Caaals

Legal

Privacy Policy

Last updated: September 25, 2026

1. Introduction

Caaals (“we,” “us,” or “our”) operates the Caaals mobile and web applications (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We may collect the following categories of information:

  • Account information. Such as your name, email address, and authentication identifiers when you register or sign in (for example via email, Apple, or Google).
  • Profile and health-related information. Such as height, weight, body fat, body measurements (for example your waist), age, sex, activity level, dietary goals, and the food and nutrition entries you choose to log or plan.
  • Content you provide. Such as meal descriptions, photos you submit for logging, favorites, and other data you enter into the Service.
  • Progress photos (optional). Photos of your body (front, side and back) that you choose to take to follow your progress, with the day and pose they belong to. We only collect them after you turn progress photos on; the feature is off by default. See section 4 for how we handle them.
  • Usage and device data. Such as app version, device type, operating system, approximate location derived from IP address (if applicable), crash reports, and how you interact with features.
  • Cookies and similar technologies. On the web, we may use cookies, local storage, and similar technologies for authentication, preferences, and analytics as described below.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service;
  • Personalize your experience, including nutrition estimates and goals;
  • Process transactions and send related communications;
  • Send service-related notices, security alerts, and support messages;
  • Monitor and analyze usage and trends to improve performance and develop new features;
  • Detect, prevent, and address technical issues and abuse; and
  • Comply with legal obligations and enforce our terms.

Progress photos are used for one purpose only: to show them back to you, for example side by side to compare two dates. We do not analyze them, we never send them to an artificial intelligence model or use them to train one, and we do not use them for any other purpose.

If you are in the European Economic Area or United Kingdom, we process your personal data where necessary to perform our contract with you, based on our legitimate interests (such as improving and securing the Service, provided those interests are not overridden by your rights), or based on your consent where required (for example, certain optional communications or analytics). You may withdraw consent at any time where processing is consent-based.

Progress photos. Photos of your body may reveal information about your health, which the GDPR treats as a special category of personal data. We process them only on the basis of your explicit consent, which you give by turning progress photos on in the app. You can withdraw that consent at any time in Settings: withdrawing stops any new progress photos from being stored. Photos you have already taken stay available to you until you delete them, which you can do for a single check-in or for all of them at once, at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

5. Sharing and Disclosure

We do not sell your personal information. We may share information with:

  • Service providers who assist us with hosting, analytics, customer support, email delivery, payment processing, and similar functions, subject to confidentiality obligations;
  • Professional advisers where required by law or to protect our rights;
  • Authorities when required to comply with applicable law, regulation, legal process, or governmental request; and
  • Business transfers in connection with a merger, acquisition, or sale of assets, with notice as required by law.

Progress photos are not shared with anyone. They are stored in the European Union by our cloud storage provider, which processes them only on our behalf, and they are never sent to the providers that power our AI features.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service, resolve disputes, enforce our agreements, and comply with legal obligations. When retention is no longer necessary, we delete or anonymize data in accordance with our internal policies, subject to applicable law.

Progress photos are kept until you delete them. Deleting a check-in, deleting all your progress photos, or deleting your account removes the photos from our storage. Links to them are included in the data export you can request from the app.

7. Security

We implement appropriate technical and organizational measures designed to protect your information. No method of transmission over the Internet or electronic storage is completely secure; we cannot guarantee absolute security.

Photos are stored privately and can only be opened through short-lived links issued to your account. Before a photo is stored, we re-encode it, which removes embedded metadata such as the location where it was taken. In the app, progress photos are shown blurred until you choose to reveal them.

8. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal data; object to or restrict certain processing; and withdraw consent where processing is based on consent. California residents may have additional rights under the CCPA/CPRA, including the right to know what personal information is collected and the right to opt out of certain sharing (we do not sell personal information). To exercise these rights, contact us using the information below. You may also uninstall the app and request account deletion where available in the Service.

9. Children's Privacy

The Service is not directed to children under 13 (or the age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected such information, please contact us and we will take steps to delete it.

10. International Transfers

Your information may be processed in countries other than your country of residence. Where required, we use appropriate safeguards (such as standard contractual clauses) for transfers of personal data from the EEA, UK, or Switzerland.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last updated” date. For material changes, we may provide additional notice (such as in-app notification or email) where required by law. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at hello@caaals.com.