This policy explains how Genio Group, Inc. handles personal information when you use calsa.app, the web app at app.calsa.app and the Calsa apps for iPhone and Android. Health information gets extra protection, described here and in our separate Consumer Health Data Policy.
The short version
- You decide. We ask for your consent before we collect anything about your body, food or health, and again before anything goes to an AI provider. You can withdraw consent in Settings.
- We don’t sell your data, don’t use it for advertising, and don’t send health information or conversion events to advertisers or data brokers. Optional install attribution is described below. The apps and website have no ad trackers. PostHog is our selected product analytics provider; optional analytics only start after your choice.
- AI providers are named. Photos, phrases and chat messages go to OpenAI or Anthropic only to answer you. They may not train on them and delete them within 30 days, with narrow exceptions explained in our AI Policy.
- Voice stays on your phone. In the Calsa apps, speech is turned into text on your device, and the recording is never sent to us.
- Export and delete. Export everything in your account at any time for free. Delete your account in the app or at calsa.app/delete-account. Backup copies expire within 35 days.
- Ending a subscription deletes nothing. Your diary stays readable, exportable and deletable.
Who we are
Calsa is operated by Genio Group, Inc., a Delaware corporation, 1470 Civic Ct Ste 309, Concord, CA 94520-5230, United States. We are the controller of your personal information. We have no establishment in the United Kingdom or the European Union. Questions and requests go to our privacy contact at [email protected].
Calsa is for adults. We don’t knowingly collect information from anyone under 18.
What we collect and why
Information you give us
| What | Why we use it | Legal basis (UK and EU) | How long we keep it |
|---|---|---|---|
| Email and sign-in method (Apple, Google, passkey or email link) | Your account and service emails | Contract | While your account exists |
| Date of birth, sex used for the calorie formula (or “prefer not to say”), height, activity level | Calculating your calorie and nutrient goals and checking you are 18+ | Explicit consent | While your account exists |
| Weight, weight history and trend, goals and pace | Your goal, progress and trend | Explicit consent | While your account exists |
| Food diary: foods, grams, times, meals, nutrients, water | Your diary and daily totals | Explicit consent | While your account exists |
| Meal photos | Recognising the food and showing you what you ate | Explicit consent | Until you delete the photo or the entry |
| Photos of labels, recipes, menus or your fridge | Answering that one request | Explicit consent | 24 hours |
| Text of logging phrases (typed, or spoken and turned into text on your device) | Recognising the food | Explicit consent | While the entry exists |
| Your own foods, meals and recipes, and foods you choose instead of a suggestion | Faster logging | Explicit consent | While your account exists |
| Allergies, “Don’t eat” and “Watch” lists | Warnings and better suggestions | Explicit consent | While your account exists |
| AI chat messages and chat memory | Answering you, and remembering facts you allow | Explicit consent | While your account exists, or until you delete the chat or the fact |
| Support requests | Helping you | Explicit consent (health details) or legitimate interests | 2 years after closing. Text and link to you deleted at once with your account. |
| Reports about AI answers | Reviewing and fixing answers | Explicit consent | 12 months after review. Text and link to you deleted at once with your account. |
| Product error reports and new product suggestions | A correct food database | Legitimate interests | Until reviewed and 12 months after |
| Payment and subscription details (store or Stripe IDs, card brand and last four digits, billing country, your agreement to renew) | Selling and renewing your subscription, tax and accounting | Contract and legal obligation | 7 years for tax records, and at least 1 year after the subscription ends |
| Settings, notification preferences and consents | Running the app as you set it, and proving what you agreed to | Contract and legal obligation | While your account exists |
| Invite codes and reward status | The invite-a-friend program | Contract | While the inviting account exists |
| Feature requests and votes | Deciding what to build | Legitimate interests | 12 months after a decision. Unlinked from you at once if you delete your account. |
We don’t ask about diagnoses, medicines or pregnancy, and the chat is designed not to save them to memory. Allergies and foods you avoid are lists you choose to fill in.
Information from Apple Health and Health Connect
If you connect Apple Health or Health Connect, Calsa reads weight, body fat, steps and active energy, and once, to fill your profile, height and date of birth. It writes the food and water you log. We use this data only to show your progress and calculate your energy balance. It goes to the AI chat only if you allow that separately. We never use it for advertising, never sell it, and never share it with anyone except the service providers below. When you disconnect, you choose whether to keep or delete what was imported. You can also manage access in your phone’s settings.
Before your first account is created, a checkout attempt may keep the agreed payment terms, amount, currency, payment-provider references and a protected reference to your verified email address so that an interrupted checkout does not charge you twice. We do not store your questionnaire answers or sign-in pass in that attempt. A definitively unsuccessful attempt with no charge is deleted within 13 months after the final outcome; an uncertain charge is reconciled first. Successful payment records follow the billing retention period below.
Information collected automatically
| What | Why | Legal basis (UK and EU) | How long |
|---|---|---|---|
| Sessions and devices you sign in from | Keeping you signed in and secure | Contract | 180 days after last use |
| Push notification token and device time zone | Sending notifications you allowed | Contract | 180 days after last use |
| Country and region of a request | Prices, units and tax. Only the billing and units country is stored. | Legitimate interests (correct prices, tax and units) | Region is not stored |
| Usage events without any health information, such as “entry saved” but never what was eaten | Understanding which features work | Consent (optional product analytics) | 13 months |
| Delivery records for our emails and an unsubscribe list | Sending email reliably and honouring unsubscribes | Legitimate interests | 13 months; unsubscribes until you ask us to email you again |
| Request IDs when something fails | Retrying without duplicates | Contract | 24 hours |
| Searches and barcodes that found nothing, without account IDs | Adding missing foods | Legitimate interests | 90 days |
| Staff actions on your account | Security and accountability | Legitimate interests | 3 years |
When optional product analytics are enabled, we use PostHog for: understanding paths through the website and apps, conversion, retention and marketing channels. It receives a random analytics ID, permitted activity events and general campaign tags, never your email, diary content, weight, food details, chat, Health data or raw IP address. We do not send conversion events to advertisers. Analytics is off until you allow it, everywhere; you can decline without losing access to Calsa. This choice is separate from install attribution. Withdrawing it stops collection and starts deletion of your analytics events and profile; account deletion also includes PostHog. We do not record your screens or what you type. Browser storage is described in our Cookie Policy.
Optional install attribution is off unless you choose to allow it. On iOS, our server sends Apple a temporary AdServices token to ask whether an Apple Ads campaign led to the installation. On Android, the app reads the campaign reference from Google Play. We do not send your Calsa account, health information or purchase and usage events for this purpose. We keep only the minimal campaign reference and attribution status for up to 13 months after the last visit, and remove that attribution and its link to your account if you withdraw the choice or delete your account. The raw Apple token is not stored. Declining does not affect Calsa or its prices.
Information we create
| What | Why | Legal basis (UK and EU) | How long |
|---|---|---|---|
| Safety signs: which signs are active and when the last support card was shown, without weight or calorie values | Offering support when tracking may be causing harm | Explicit consent | 28 days after the last sign |
| Safety case after a phrase that suggests a crisis or an eating disorder: the message and the facts used for the answer | Checking that the support response worked | Explicit consent | The message, 90 days after the case is closed, or at once if you delete your account. A record without any link to you, 3 years. |
| Your data export file | Letting you download it | Explicit consent | 7 days |
If you joined the Calsa waiting list on our website before launch, we keep your email, the prices we showed and the time, with your consent to hear about the launch, until you subscribe or for 90 days after the launch email.
Information kept only on your device
Drafts, entries waiting for a connection, recent foods and the last 7 days of your diary stay on your device until they are sent or you sign out. A file you import never leaves your device: only the rows you confirm are sent, and the file is cleared when you close the preview. In the iPhone and Android apps, these also stay out of iCloud and Google backups. The apps also keep your sign-in key in the phone’s secure storage and today’s totals for the Calsa widget, and delete them when you sign out or delete your account. Images you create with “share” stay on your device unless you share them yourself.
How we use automated suggestions
Calsa makes three kinds of automated suggestions: a calorie and nutrient goal calculated from your answers, the foods and portions recognised in a photo or phrase, and AI chat answers. You can change or ignore all of them, and nothing from AI is saved without your tap. None of them produces a legal or similarly significant effect on you. Calsa also automatically watches for a few signs that tracking may be harming you and offers support, as described in our Health & Wellness Notice. These signs never limit your account or trigger contact with anyone.
Who we share it with
We share personal information only with the service providers below, who process it for us under contract, and only the part each one needs. We don’t sell personal information or share it for cross-context behavioural advertising, and we don’t send health information or conversion events to advertisers, data brokers or social networks. The only optional install-attribution exchange is described above.
| Provider | What it does for Calsa | Where |
|---|---|---|
| OVH US | Hosting our servers and database | United States |
| Cloudflare | Network delivery and security, storage of meal photos and export files, encrypted backups | United States and its global network |
| OpenAI | Recognising food in photos and phrases, safety checks on chat answers, and backup chat answers | United States |
| Anthropic | AI chat answers | United States |
| Stripe | Web payments and tax calculation | United States |
| Apple and Google | App store purchases, Sign in with Apple or Google, push notifications; optional install attribution as described above | United States |
| Resend | Sending service emails | United States |
| Google Workspace | Receiving and answering support emails | United States |
| PostHog | Optional product analytics using permitted activity events and random IDs, without health data | Selected EU cloud storage in Frankfurt, Germany |
AI providers may not train on Calsa data and delete it within 30 days, unless the law requires them to keep it longer or they need it to investigate a specific breach of their usage rules. Details are in our AI Policy. When you suggest a correction to a product, we may send the corrected values and barcode to the public food databases we use, such as Open Food Facts, without your photo or anything about you.
We may also disclose information when the law requires it, to protect people from serious harm, or as part of a merger or sale of our business, in which case this policy continues to apply. If you dispute a charge, we give your bank only billing records, never your diary, weight, photos or messages.
When we add a provider or send a new kind of data, we update this policy first, and for AI providers we ask for your consent again.
International transfers
We process information in the United States and use selected EU storage for PostHog analytics. Where the law of your country requires a transfer safeguard, we use the European Commission’s Standard Contractual Clauses with the UK Addendum, or the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework where the provider is certified. You can ask us for a copy.
Security and breaches
We encrypt data in transit and in backups. Staff get access only to what their role needs, and we keep a log of staff actions. Health data stays out of logs, analytics and crash reports. No system is perfectly secure. When breach notification is required, we will notify affected people and the relevant regulators without undue delay and within the applicable legal deadlines, including those under the U.S. FTC Health Breach Notification Rule and UK and EU data protection law. If we no longer have usable contact details, we use the alternative notice methods required by law; we do not recover deleted contact details from backups to send a notice.
How long we keep it
We keep your account data while your account exists. Ending a subscription or not using Calsa doesn’t delete it. The retention periods for each kind of data are in the tables above.
When you delete your account: live data is removed when deletion completes, and we send deletion requests to our service providers the same day. Backup copies expire within 35 days, and restoring a backup never brings back a deleted account. We keep only what the law requires or what no longer identifies you: payment records and your agreement to renew for 7 years; product error reports, usage events without health data, email delivery records and staff action logs for the periods listed above; and, if an account was closed because its owner was under 18, a scrambled code of the sign-in method for 2 years so the account can’t be reopened. Support requests, AI reports and safety cases lose their text and any link to you at once.
Your rights and choices
Wherever you live, you can:
- see and export everything in your account, in the app, for free;
- correct your information in the app;
- delete single entries, photos, chats, memory facts or your whole account, in the app, or without the app at calsa.app/delete-account;
- withdraw consent in Settings. Withdrawing consent to health data stops new tracking. If you subscribed on our website, we also stop your renewal. If you subscribed in the App Store or Google Play, cancel there too, or the store will keep charging you. You can still export and delete what is saved;
- turn off AI with one switch and keep logging without it;
- opt out of marketing emails with one click. We send them only if you agree;
- object to or restrict processing based on legitimate interests;
- ask for a list of the companies that received your information.
You can also email [email protected] with the subject “Privacy request”. We confirm within 10 business days and complete the request within 28 days. We may need to confirm it’s your account. We don’t charge for requests. If we refuse a request, you can appeal by replying with the subject “Appeal”, and we will answer within 45 days.
Complaints
Please tell us first. Email [email protected] with the subject “Privacy complaint”. We acknowledge complaints within 30 days and answer without undue delay. You can also complain to a regulator: the UK Information Commissioner’s Office (ico.org.uk), your EU data protection authority, the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information, the Office of the Australian Information Commissioner (oaic.gov.au), or your U.S. state attorney general.
Do Not Track
We don’t track you across other companies’ sites or apps. We treat browser Do Not Track and Global Privacy Control signals as a no to optional cookies and visit measurement.
Notices for specific places
United States. We don’t sell or share personal information as California and other state laws define those terms, and we honour Global Privacy Control signals. Residents of California and other states with privacy laws have the rights listed above. Health data of residents of Washington, Nevada and Connecticut is covered by our Consumer Health Data Policy. Nevada residents: we don’t sell covered information, and you can still send a sale opt-out request to [email protected] with the subject “Nevada opt-out”. Rhode Island residents: we collect the categories of personal information listed above, and we do not sell personal information to third parties.
United Kingdom and European Union. The legal bases for each use are listed in the tables above. Health information is processed with your explicit consent.
Canada. The person responsible for personal information at Calsa is our Privacy Officer, Genio Group, Inc., reachable at [email protected] and at the address above. You can ask how your information is used, correct it, and withdraw consent.
Australia. We handle personal information under the Australian Privacy Principles. Information is stored and processed in the United States by the providers listed above.
Changes to this policy
When we change this policy, we update the date at the top. We tell you about material changes by email and in the app at least 30 days before they take effect. We never start using health data for a new purpose without asking for your consent first.
Contact
Genio Group, Inc., a Delaware corporation 1470 Civic Ct Ste 309, Concord, CA 94520-5230, United States