CalCast — Privacy Policy

Last updated: 30 September 2026

CalCast is a food and calorie journal. It is built so that your diary stays on your phone. There are no accounts, no logins, and no ads inside the app. We do advertise CalCast on TikTok and on Meta's apps (Facebook and Instagram), and we use their measurement tools to learn which of those ads lead to installs and subscriptions — with your device's advertising identifier only if you allow tracking. Your diary and your health data are never part of that.

This page explains exactly what leaves your device, where it goes, and why.

Who we are. CalCast is provided by Bimsara Withanage Perera, a sole trader based in the United Kingdom, who is the data controller for the limited personal data described below. You can reach us at bimsui@icloud.com.

What stays on your device

All of this is stored in CalCast's own database on your phone and is never sent to us:

• Meals, portions, calories and macronutrients
• Weight entries, your goal weight and your forecast
• Events (birthdays, dinners, drinks) and workout routines
• Water intake
• Profile details — age, height, weight, activity level, goal mode
• Settings, units, and reminder preferences

Deleting the app deletes all of it. We cannot recover it, because we never had a copy.

What leaves your device

1. Meal descriptions, for interpretation

When you log food in plain words — typed or dictated — CalCast may send that text to its parsing service to turn it into calories and macronutrients. This happens only when the app's on-device interpretation isn't confident enough.

The service runs on Cloudflare Workers, and the text is interpreted by a language model — currently Google Gemini, reached either through Cloudflare Workers AI or directly through Google's Gemini API, with Mistral (through Cloudflare Workers AI) as a fallback.

Sent alongside the text is a random identifier created on your device the first time you open the app. Its only purpose is to enforce a daily request limit and prevent abuse of the service. It is not your Apple ID, not your device serial number, and it is not connected to your identity — we do not hold one for you.

We do not send your name, email address, weight, goal, Apple Health data, or diary history with these requests.

Retention. Our parsing service does not store the text you send, and does not write it to any log. It is held in memory only for as long as the request takes, then discarded. We keep a counter of how many requests your random identifier has made that day, which expires automatically within 26 hours. Cloudflare, Google and the model providers process the text under their own terms and retention policies — see the Cloudflare Privacy Policy and the Google Privacy Policy. Requests sent directly to Google use its paid API tier, under which Google does not use your text to improve its products.

2. Barcodes you scan

If you scan a packaged product, CalCast sends the barcode number to Open Food Facts, a public food database, to retrieve that product's nutrition information. Only the number is sent — no photograph, no identifier, and nothing about you. The camera image is processed on your device and is never stored or transmitted.

See the Open Food Facts privacy policy.

3. Speech you dictate

If you use hold-to-talk dictation, your speech is converted to text on your device using Apple's speech recognition. The audio never reaches our servers. Once it becomes text, it is treated exactly like text you typed — including the interpretation step described above.

4. Subscription status

Purchases are processed by Apple. We never see your card details, billing address, or Apple ID.

We use RevenueCat to tell us whether your subscription is currently active. RevenueCat receives an anonymous subscriber identifier and basic device information such as your device model and country. See RevenueCat's privacy policy.

If you installed CalCast from an Apple Ads campaign, Apple's attribution service tells RevenueCat which campaign that was, so we can compare what a campaign cost against the trials it produced. This uses no advertising identifier and is held against the same anonymous subscriber identifier.

5. Advertising measurement (TikTok and Meta)

CalCast includes the TikTok Business SDK, provided by TikTok, and the Meta SDK (app events only), provided by Meta Platforms, so we can measure which of our ads on TikTok, Facebook and Instagram lead people to install CalCast and start a subscription, and so those platforms can show our ads to people more likely to find the app useful.

Each SDK sends its own platform:

• that the app was installed and opened
• App Store purchases — starting a trial or a subscription, the product

and its price

• basic device information — such as device model, operating system

version, language, time zone and IP address

• your device's advertising identifier (IDFA), **only if you allow

tracking** when iOS asks

They do not send your meals, food descriptions, weight, goals, Apple Health data, or anything else from your diary. We do not give TikTok or Meta your name or email address, because we don't have them.

If you don't allow tracking, the advertising identifier is never shared. TikTok and Meta still receive the install, open and purchase events described above without it, and Apple's privacy-preserving SKAdNetwork system reports ad results to them in aggregate. You can change your answer at any time in Settings → Privacy & Security → Tracking.

TikTok and Meta process this data under their own terms — see the TikTok Privacy Policy, TikTok's Business Products (Data) Terms, the Meta Privacy Policy and Meta's Business Tools Terms.

Apple Health

If you grant permission, CalCast reads dietary energy logged by other apps and your daily step count, and writes the meals you log back to Health as dietary energy.

This exchange happens entirely on your device, directly between CalCast and Apple Health. We never receive your Health data, and it is never sent to our servers or to any third party.

We do not use Health data for advertising, marketing, or any purpose beyond showing you your own figures inside the app. You can review or revoke access at any time in the Health app under Sharing → Apps.

Notifications

All reminders are optional and off unless you turn them on. They are scheduled locally by your phone. No push server is involved, and we have no way of knowing which reminders you have enabled.

Diagnostics

CalCast keeps a small local record of how well its interpretation is working — which method produced an estimate, how confident it was, and whether you edited the result. It never contains your food, your words, or any figure from your diary. It stays on your device and is only ever shared if you choose to export it yourself from Settings and send it to us.

Tracking and advertising

CalCast shows no ads, and nothing from your diary or Apple Health is ever used for advertising.

The one exception to "no tracking" is the advertising measurement described in section 5 of "What leaves your device". Apple counts sharing your advertising identifier with TikTok or Meta as tracking, which is why iOS asks your permission first, and why nothing is shared that way unless you say yes.

• No third-party analytics SDKs
• Nothing sold, and nothing shared with data brokers
• Your meals, weight and health data are never shared with any advertiser

Children

CalCast is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us with information, contact us and we will delete it.

Your rights

Because your diary never reaches our servers, the fastest and most complete way to erase it is to delete the app from your device.

If you are in the UK or the EU, you have rights under data protection law to access, correct, delete, or restrict the processing of personal data we hold about you, and to object to that processing. In practice we hold very little: a short-lived request counter tied to a random identifier we cannot connect to you, your subscription status held by RevenueCat, and the advertising measurement data TikTok and Meta hold, described above.

Our lawful basis for processing the text you send for interpretation is performance of a contract — it is the service you asked us to provide. Our basis for the request counter is legitimate interests, specifically keeping the service available and affordable to run. Sharing your advertising identifier with TikTok or Meta relies on your consent, given through the iOS tracking prompt and withdrawable at any time in Settings. Our basis for the remaining advertising measurement is legitimate interests — understanding which of our ads work, so we can keep CalCast affordable to run.

To exercise any right, contact bimsui@icloud.com. If you are unhappy with our response, you may complain to your national supervisory authority — in the UK, the Information Commissioner's Office.

International transfers

Our parsing service runs on Cloudflare's global network, and may pass your text to Google's Gemini API, so your request may be processed in a country outside the UK or EEA. Cloudflare and Google each provide appropriate safeguards for these transfers under their own data protection terms. Advertising measurement data sent to TikTok or Meta may likewise be processed outside the UK or EEA, including in the United States, under each company's data transfer safeguards.

Changes to this policy

If we change this policy in a way that materially affects you, we will update this page and the date at the top.

Contact

Bimsara Withanage Perera United Kingdom bimsui@icloud.com

If you need a postal address for a formal request, ask by email and we will provide one.