PhotoCal AI Privacy Policy

Effective: November 6, 2026
Last updated: November 6, 2026

Please read this Privacy Policy carefully before accessing or using the PhotoCal AI Service.

Capitalized terms have the meanings provided here. Section headings are provided for convenience in organizing this document only, and are not part of this Privacy Policy.

This Privacy Policy (the “Privacy Policy”, “The Policy”, “This Policy”) covers the PhotoCal AI app (the “App”) and the website https://photocal.ai (the “Website”), together with associated software, content and AI-powered tools (collectively, the “Service” or “Services”), made by Nuclear Cyborg Corp (“Nuclear Cyborg”, “The Company”, “We”, “Us”, “Our”). “You” means the individual using the Service or the legal entity on whose behalf the individual uses the Service. “User Content” means any images, photographs, text, metadata, or other content, including any related edits or updates, uploaded, submitted or transmitted by You through the Service. Your “Device” refers to any and all Apple iPhone, iPad, Mac, Vision Pro, Apple TV or Apple Watch devices on which You install the App or use Our Service.

Other apps, websites and services operated by Nuclear Cyborg Corp are governed by the Nuclear Cyborg Corp Privacy Policy at https://nuclearcyborg.com/privacy.

1. AGREEMENT TO POLICY AND TERMS OF USE

Your access to and use of the Service is conditioned upon Your acceptance of this Privacy Policy and the PhotoCal AI “Terms of Use”, which can be found at https://photocal.ai/terms. You acknowledge that You have read, understood, and agree to be bound by This Policy. If You do not agree, You must discontinue use of the Service.

The Service is for users 13 and older; users between 13 and 17 may use it only with the consent and supervision of a parent or legal guardian, as the Terms of Use require. It is not directed to anyone younger than 13, and We do not knowingly collect personal information from anyone under 13.

2. SUMMARY OF DATA COLLECTION AND SHARING

In short: Your food log, photos, nutrition goals and body details stay on Your Device. When You ask for an estimate, the photo or description You provided is sent to Our server and to OpenAI to process it.

PhotoCal AI has no user account or login, shows no ads, does not track You across other apps or websites, and does not use Your Device’s advertising identifier. We do not sell or share Your personal information for advertising.

3. DATA WE COLLECT

We may collect data automatically through Your use of the Service or directly from You.

3a. DATA WE COLLECT AUTOMATICALLY

We may collect usage and Device data (“Usage Data”), such as which App screens were seen and how often or each time You use a particular feature (example: “Capture Photo shutter button”). Usage Data includes:

• Anonymous account identifier, unique to Your installation of the App on a given Device
• Actions You take while using the Service, such as in-App navigation and button taps
• Frequency and duration of Your activities
• Device information, such as Device model, orientation, screen size, preferred font size
• Which subscriptions You choose or reject
• Whether or not You had a free trial and if You have used subscription-specific features
• Information about errors or crashes

3b. DATA WE COLLECT THAT YOU GIVE US DIRECTLY

• User Content You submit for analysis: food photos, nutrition label photos, and food descriptions You type or speak (sent as text). These go to Our server and to OpenAI to produce an estimate. Our server does not store them; OpenAI may keep them for up to 30 days (see WHAT IS SENT FOR AI ANALYSIS, WHAT OUR SERVER RETAINS and OPENAI PROCESSING below).
• Goals and features You pick during setup, which Firebase Analytics records after You agree (see OTHER SERVICE PROVIDERS WE USE and YOU AGREE TO ANALYTICS COLLECTION below).
• Anything You include when You email Us, such as an App runtime log or backup export (see DATA YOU PROVIDE WHEN CONTACTING US below).

Your food log, the photos saved in it, Your notes and body details stay on Your Device; We receive them only when You send a photo or description for analysis, or choose to email Us an export (see WHAT STAYS ON YOUR DEVICE below).

4. APPLE’S APP PRIVACY LABEL

The App Store listing for the App shows a summary of This Policy as PhotoCal AI’s App Privacy label: open PhotoCal AI on the App Store and scroll to App Privacy. The table below lists the same data types, in Apple’s terms, and says what each one is in PhotoCal AI.

All of them are “linked to You” in Apple’s sense: they are tied to random identifiers that the Service creates for Your installation of the App, never to Your name, email address or Apple Account. None of them is used to track You.

5. WHAT STAYS ON YOUR DEVICE

PhotoCal AI keeps Your food log, food photos, nutrition goals, notes, and the body details You choose to enter for goal suggestions (such as weight, height, birth year, sex and activity level) in the App’s storage area on Your Device. Uninstalling the App permanently deletes these items from Your Device.

• Widgets, Siri and Shortcuts read Your figures on Your Device. When You speak to Siri, Apple processes Your request under Apple’s privacy policy.
• Spotlight: Your food log entries and all related information, such as trends, comparisons with prior time periods, and progress toward goals, are indexed on Your Device by Apple’s Spotlight, for use with Search and Siri.
• Backups You export: When You use the App’s feature to export a backup of all data, the data is exported into a machine-readable, unencrypted “JSON” format. The export stays on Your Device unless You choose to share it or otherwise copy or move it off-device.
• Your Device’s own backups (iCloud or computer) include the App’s data under Apple’s terms, as they do for any app.

6. APP PERMISSIONS

• Camera: to take photos of Your food or food nutrition labels in the App or from the Lock Screen.
• Photos: PhotoCal AI receives only the photos You pick in the system photo picker or share to it from another app, such as Photos. It does not request general access to Your photo library.
• Microphone and speech recognition: to describe food by voice. Speech is transcribed on Your Device. The audio data never leaves Your Device and is discarded immediately as soon as the transcription is finished.
• Notifications: the reminders and summaries You turn on are scheduled on Your Device.

PhotoCal AI does not ask for Your location or Your contacts, and it does not read or access Apple Health.

7. WHAT IS SENT FOR AI ANALYSIS

7.1. PRE-PROCESSING

When You ask PhotoCal AI to analyze a food photo or a nutrition label photo, the App first pre-processes the photo by removing location information and certain other metadata from the image, for Your privacy protection.

When You ask PhotoCal AI to transcribe Your voice to describe Your food, speech is transcribed into text on Your Device, then the audio is immediately discarded.

When You ask PhotoCal AI to analyze a written description of Your food, no pre-processing is done.

7.2. AI PROCESSING

The pre-processed image (in the case of photo analysis) or the food description text (in the case of transcribed audio or typed text), taken together with Your Device’s language and region, and Your App installation’s anonymous Firebase identifier, is sent over an encrypted connection to Our server, which runs on Google Cloud Functions for Firebase. Our server sends it to OpenAI for AI processing and returns the nutrition estimate to the App.

We do not use User Content to train AI models.

8. WHAT OUR SERVER RETAINS

Our server does not store Your photos or food descriptions. For each request it records the time, the originating Device’s IP address, a random identifier that Firebase Authentication creates and associates with the specific App installation on Your Device, the kind of analysis performed, its outcome, the amount of processing used, and information about any errors or failures that may have occurred. These request records are kept in Our server logs for 30 days. We also keep counts of requests and sign-ins for each identifier, to enforce daily usage limits and detect abuse. We use these records only to operate the Service, to enforce those limits, and to investigate problems. The identifier is not linked to Your name, email address or Apple Account.

9. OPENAI PROCESSING

We send OpenAI the photo or text only to produce the nutrition estimate. With each request We send OpenAI a one-way hash of the random Firebase Authentication identifier, never the identifier itself, so that OpenAI can detect abuse. OpenAI states that data sent to the OpenAI API is not used to train or improve OpenAI models, and that it may retain API data in abuse monitoring logs for up to 30 days. OpenAI’s privacy policy: openai.com/policies/privacy-policy.

10. OTHER SERVICE PROVIDERS WE USE

• Google Firebase: Firebase Authentication provides anonymous sign-in without an account (the random identifier above). Anonymous accounts are retained indefinitely. Firebase App Check token helps confirm that requests come from the genuine App installed on a real Device. Firebase Analytics describes how the App is used and how it performs, along with Device details such as model, iOS version and approximate region (such as Your city). Analytics also records the goals and features You pick during setup (for example, weight or protein), details on how You use the Service, the length and frequency of Your use of the Service, Service performance metrics, and other App and Service usage details. Google Analytics is never sent Your photos, food descriptions, or calorie and nutrition information about the foods You eat. Firebase Crashlytics reports App crashes with information as to what was recently happening in the App, to help Us resolve such issues, and may also report non-fatal errors. Google keeps Analytics data for up to 14 months and crash reports for 90 days. Google’s privacy policy: policies.google.com/privacy.
• Apple’s App Store: subscriptions and refunds are processed by Apple, through the App Store. The App Store will receive an appAccountToken UUID, a persistent random identifier unique to Your installation of the App on Your Device. If You request a refund from Apple, We will send Apple “Consumption Information” including:
  • Whether or not You were provided, prior to Your purchase, a free sample or trial of the Service, or information about its functionality
  • Whether or not the App successfully delivered the subscribed content and features associated with the subscription
  • That You consented to the sharing of this information
• RevenueCat: We have contracted with RevenueCat to help Us track and manage the App’s subscriptions. We send RevenueCat Your App Store purchase history (for Our App only), an anonymous random identifier which identifies Your App installation on Your specific Device, an Apple Search Ads attribution token, and basic information about Your Device. RevenueCat also receives updated information, fetched from Apple and from Your Device, every time You launch the App. RevenueCat holds this data on Our behalf as long as We use its service, under its Data Processing Addendum. RevenueCat’s privacy policy: revenuecat.com/privacy.
• Apple Search Ads attribution: if the App was installed as a result of an Apple Search Ads ad, Apple tells the App which campaign, ad group and keyword led to it. We deliver this data to both Google Firebase and RevenueCat.

We use these providers to help Us operate the App and fulfill its Services.

11. LEGAL / LAW ENFORCEMENT REQUESTS

We may disclose information when required to comply with a law or legal process, such as from a court order or subpoena. We may also provide additional information as required by Our platform providers, such as Apple.

We may voluntarily disclose information, including contents of communications and customer records, to a federal, state, or local governmental entity if We believe in good faith that an emergency involving imminent danger of death or serious physical injury to any person requires such disclosure without delay.

12. WHEN DATA COLLECTION BEGINS

Firebase Crashlytics starts as soon as the App starts. Any App crash reports are collected automatically, from the moment of the App’s launch, so that We can detect and understand crashes that happen before You agree.

Firebase Analytics data collection, including the Apple Search Ads attribution details sent to it, and RevenueCat’s Apple Search Ads attribution system start only after You agree to the Terms of Use and This Policy on the App’s welcome screen. After You have agreed, on subsequent App launches, these systems start automatically and without delay.

13. HOW TO STOP DATA COLLECTION

To stop all collection, delete the App.
Data previously collected will be kept for the standard retention periods detailed above, and is not linked to Your name.

14. DATA DELETION REQUESTS

To delete Your data from Your Device, delete the App. Uninstalling the App deletes all of Your data from Your Device, such as food pictures, nutrition label images, food descriptions, calorie and nutrition records, trends, time period comparisons, goals, goal history, and other such detail. Deleting the App may also delete the on-device unique anonymous identifiers which are associated with Your App installation on Your specific Device.

Our server’s request logs are only linked to You via the unique anonymous identifiers. Therefore, We cannot look up information related to You and Your use of the Service by Your name or email address.

Analytics and subscription data will be retained by Us or Our service providers according to the retention policies detailed above.

15. DATA YOU PROVIDE WHEN CONTACTING US

If You email Us, We receive Your email address and whatever You choose to include, such as an App runtime log or App backup data export. We will handle Your correspondence with Us with due care, but because email is inherently insecure, sharing information this way is at Your own risk. Customer service communications may be retained indefinitely, at Our discretion, and in support of Our general business record keeping needs.

16. THE WEBSITE

The Website is served by Cloudflare, which processes each visit’s request data (such as Your IP address) to deliver and protect the Website. Request logs are retained up to 30 days. If You choose a language, a cookie remembers it for one year. The Website has no analytics, advertising or tracking.

17. YOUR RIGHTS

Depending on where You live, You may have the right to ask what personal information We hold about You, and to have it corrected or deleted. Because We hold no user account and nothing tied to Your name or email address, other than email communications You may have sent Us, there is usually nothing on Our side to look up. See above for information regarding DATA DELETION REQUESTS.

18. CONSUMER HEALTH DATA

Some US state laws, such as Washington’s My Health My Data Act and Nevada’s consumer health data law, treat information about what You eat and Your nutrition or weight goals as consumer health data. In PhotoCal AI that is:

• Your food log, food photos, nutrition goals and body details, which stay on Your Device
• the photo or description You submit into the App for a nutrition estimate
• the goals You pick during setup, which Firebase Analytics records after You agree

We collect these items only as needed to deliver the App’s functionality. We do not sell them, use them for advertising, or share them with anyone except the providers named in This Policy, who process them on Our behalf as described above. See above for HOW TO STOP DATA COLLECTION and DATA DELETION REQUESTS information.

For anything else, including a request to access or delete Your consumer health data, contact Us at the address below. We may be unable to identify data linked to You, because it is tied only to random identifiers, or because it has already been deleted at the end of its retention period. If We decline a request, You can appeal by replying to Our answer, and We will respond within 45 days.

19. CALIFORNIA

In the past 12 months We have collected these categories of personal information, from the App and from the providers above:

• identifiers (random App identifiers and IP addresses)
• commercial information (Your App Store subscription)
• Internet or other electronic activity (how the App is used and how it performs)
• approximate location (such as Your city), derived from Your Device’s public IP address
• the photos and descriptions You send for analysis

We use this information only for the purposes This Policy describes and disclose it only to the providers named here, who act on Our behalf.

We do not sell or share Your personal information, as the California Consumer Privacy Act defines those terms, and We have not done so.

We use sensitive personal information, such as Your food photos and nutrition goals, only to provide the Service.

You have the right to know, correct and delete the personal information We hold about You, and We will not treat You differently for using these rights.

You can make a request Yourself, or through an authorized agent, by emailing Us.

Do Not Track: neither the App nor the Website tracks You across other apps or websites, so Do Not Track and Global Privacy Control signals change nothing and do not apply.

20. EUROPEAN ECONOMIC AREA, UNITED KINGDOM, AND SWITZERLAND

If You are in the European Economic Area, the United Kingdom, or Switzerland, Nuclear Cyborg Corp is the controller of Your personal data. We rely on these legal bases:

• To perform Our contract with You: analyzing the photos and descriptions You send, providing the Service and Your subscription, enforcing daily usage limits
• Your consent: Firebase Analytics, including the Apple Search Ads attribution details sent to it, and the Apple Search Ads attribution token RevenueCat receives, all of which start only after You agree on the welcome screen.
• Our legitimate interests in keeping the App working and secure: crash reports, App Check and server request records.

You have the right to access, correct or delete Your personal data, to restrict or object to its use, to receive it in a portable form, and to withdraw Your consent at any time by deleting the App; withdrawing does not affect what was done prior to withdrawal. Contact Us to use these rights. You also have the right to complain to Your local data protection authority.

Your data is processed mainly in the United States of America (see WHERE DATA IS PROCESSED below). Our providers protect it with the safeguards the law provides for such transfers, such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

21. WHERE DATA IS PROCESSED

Our server, Google Firebase and RevenueCat process data in the United States of America (RevenueCat lists its sub-processors and their locations in its Data Processing Addendum). Other providers named in This Policy, such as OpenAI and Cloudflare, may also process it in other countries where they operate.

22. DATA TRANSMISSION SECURITY

Everything the Service sends over the Internet travels over encrypted connections (TLS).

23. CHANGES TO THIS POLICY

We may change This Policy. When We do, We will post the new version here and update the date at the top. You should check back frequently for any such updates. The Service will attempt to inform You and ask You to consent to the updated Privacy Policy and/or Terms of Use.

If You do not agree with This Policy or the Terms of Use, or any subsequent updates to either, You must stop using the Service immediately.

24. CONTACT

support@photocal.ai
Nuclear Cyborg Corp
3760 Rosewood Ln N, Plymouth, MN 55441, USA