Privacy Policy

English

Calrdit ("we", "the app") is a calorie-tracking iOS app that frames eating as "spending calories." We take a minimalist approach to data — almost everything you log lives on your device.

What stays on your device

• Your profile (age, height, weight, goal, created date)
• Every transaction you log (food name, kcal, emoji, photo note, timestamp, source)
• Settings and preferences (reminder times, API key if you choose to provide one)
• Face ID authentication state

All of the above is stored locally via Apple's SwiftData and Keychain. We have no server database that holds any of it. Your SwiftData records can optionally sync to your private iCloud container; that sync is entirely inside your Apple ID, not visible to us.

What is sent off-device, and what isn't

The only thing Calrdit ever transmits is the meal you explicitly submit for AI calorie estimation — and only when you tap "Accept" on the in-app consent prompt that appears the first time you use AI.

What we never transmit: your name, email, Apple ID, profile (height/weight/goal), location, device identifier (other than the anonymous counter above), past meal logs, photo metadata (we strip EXIF before transmission), or any health/biometric data.

OpenAI's role: OpenAI processes the single request to estimate calories and returns the result. OpenAI may retain API traffic per their policy — see openai.com/policies/privacy-policy. By accepting Calrdit's AI consent prompt you agree to OpenAI's processing of your submitted meal data.

Our retention: the Cloudflare Workers proxy does not persist request bodies or AI responses. The KV-stored daily counter is keyed by the anonymous identifier and auto-expires after 48 hours.

Consent

The first time you tap "+" and choose AI text or photo entry, the app shows a full-screen consent sheet stating exactly what will be sent and to whom. AI requests do not leave your device until you tap "Accept and continue." If you decline, you can still log meals manually with no network request. You can revoke consent and erase all local data anytime via Settings → Account → Delete account.

Subscription and payment

Calrdit Plus is an auto-renewing subscription handled entirely by Apple's StoreKit. Payment, receipts, renewals, and refunds are managed by Apple — we do not see your payment method or Apple ID. The only subscription-related data our server handles is the anonymous transaction signature you present alongside an AI request, which we verify then discard.

Device permissions

• Camera — only when you tap to take a photo of your meal. Photos are used only for the one-shot recognition request, not stored or uploaded anywhere else.
• Photo Library — only when you pick an existing photo. Same handling as camera.
• Face ID — local biometric check to confirm the "payment." The result (yes / no) never leaves your device.
• Notifications — optional meal-time nudges; scheduled locally via UNUserNotificationCenter.
• Apple Health (read-only) — if you grant access, Calrdit reads only HKWorkout samples (workout type, duration, calories burned, UUID) to deposit them as exercise transactions. We never write to Apple Health, never upload health data to our servers, and never link it to an account. You can revoke this anytime in iOS Settings → Privacy & Security → Health → Calrdit.

Weight tracking (1.1)

Each weight entry you log lives only on your device via SwiftData, optionally syncing through your private iCloud container (invisible to us). Weight is used to compute BMR (Mifflin-St Jeor) and to scale exercise calorie estimates (MET formula). We never transmit weight to any server. Settings → Account → Delete account erases the full history.

Tracking & analytics

None. No third-party analytics, no advertising SDKs, no tracking pixels.

Account deletion

Calrdit offers Sign in with Apple as a cosmetic identifier (we have no server-side accounts). To delete your "account":

1. In the app: Settings → Account → Delete account. This signs you out of Apple, clears every meal log, profile field, goal, reminder, AI-consent flag, and free-quota counter on this device.
2. To fully revoke Apple's sign-in token: open iOS Settings → your Apple ID → Sign in with Apple → Calrdit → Stop Using. (Apple does not let third-party apps revoke this on your behalf.)
3. Server-side data: none exists, so there is nothing further to delete.

Deleting the app from your device also removes everything stored locally. There is no cloud backup outside your own private iCloud container.

Children

Calrdit is not directed at children under 13.

Contact

Questions? jzhe614@gmail.com

简体中文

Calrdit 是一款把吃饭记为"支付热量"的 iOS 应用。我们的数据哲学是"能不收就不收"——你记的几乎所有内容都只存在你手机上。

只存在你手机上的数据

• 个人资料（年龄、身高、体重、目标、创建时间）
• 每一笔饮食记录（食物名、热量、emoji、备注、时间、来源）
• 偏好（提醒时间、如果你填了 API key 也只在本机）
• Face ID 认证状态

以上都走 Apple 的 SwiftData 和钥匙串，我们这边没有任何服务器数据库保存它们。SwiftData 记录可以选择同步到你个人的 iCloud 容器；那份同步完全发生在你的 Apple ID 内，我们看不到。

会离开你手机的数据

为了从文字或照片估算热量，Calrdit 会通过我们部署在 Cloudflare Workers（美国节点出口）上的代理把请求转发给 OpenAI 的 Chat Completions API。代理会带一个匿名的设备标识（identifierForVendor，重装即重置）用于每日配额计数。如果你订阅了 Calrdit Plus，客户端会在请求里附带 StoreKit 2 的交易签名以便代理抬高免费额度——我们既不保存这个签名，也不保存请求内容。OpenAI 自身会按其政策保留 API 流量，详见 openai.com/policies/privacy-policy。

订阅与支付

Calrdit Plus 是一个自动续期订阅，完全由 Apple 的 StoreKit 处理——付款、收据、续期、退款全部走 Apple 账户，我们看不到你的支付方式或 Apple ID。我们服务器只会临时用到一个匿名的交易签名（验一下是否有效），验完就丢。

设备权限

• 相机——仅在你主动拍照时使用。照片只用于这一次识别请求，不保存、不上传到任何其他地方。
• 相册——仅在你主动选图时使用。处理方式同相机。
• Face ID——本地生物验证来确认"支付"。结果（通过 / 不通过）从不离开你的手机。
• 通知——可选的餐时提醒；通过 UNUserNotificationCenter 在本地排程。

追踪与分析

无。没有第三方分析、没有广告 SDK、没有跟踪像素。

删除数据

在手机上删除 Calrdit 即删除全部本地数据。除了你自己的 iCloud 外没有云端备份，也没有账号要注销。

儿童

Calrdit 不面向 13 岁以下用户。

联系

有问题请发邮件：jzhe614@gmail.com