Privacy Policy

MinimalistKalori mobile app

Last updated: September 7, 2026

This policy explains which personal data is processed when you use the MinimalistKalori app, where it is stored, who it is shared with, and your rights under Turkey's Law on the Protection of Personal Data No. 6698 (KVKK).

1. Quick summary

• Almost all of the data you enter and the data the app generates is kept only on your device (the app's local storage).
• We do not have a user-account server; we do not collect your data into a cloud profile.
• A request is sent to a server only when you use an AI feature (AI Coach and photo food recognition). That request is forwarded to Google's Gemini service to generate a reply.
• When you scan a barcode, only the barcode number is sent to Open Food Facts.
• The app contains no ad network or third-party analytics/tracking software.
• The app is for users aged 18 and over.

2. Data processed

The app does not collect location, contacts, search history, or ad-tracking data via device identifiers or similar means.

3. Where data is stored

3.1. On your device (local)

All of the data above is kept in the app's on-device storage. This data does not leave the app to be sent to our servers, except for the exceptions listed in Section 4, which are sent to the relevant third parties.

3.2. On a server

We use a relay server (proxy) to forward AI requests. This server:

• Does not permanently store request content; it receives the request, forwards it to Google, and returns the response to you.
• Keeps only a short-lived, in-memory counter for rate limiting (requests per minute).
• Runs on Cloudflare's infrastructure. Cloudflare may keep connection metadata (e.g. IP address) in its own short-term system logs.

Other than this, we do not maintain a user database on our side.

3.3. Account and sign-in

The app does not create a membership account. The sign-in screen only stores a "signed in" flag on the device. Your email address or Apple ID is not collected by us and is not sent to a server.

4. Data shared with third parties

4.1. AI Coach — Google Gemini (via our relay server)

When you send a message to the AI Coach, the following is sent to our relay server and from there to Google's Gemini API so it can generate a reply:

• The message you wrote and a portion of previous messages in that session,
• Your age, height, current weight, target weight,
• Your daily calorie target and protein/carbohydrate/fat targets,
• Your total calories and macros for that day,
• The name and calories of the meals you added that day,
• Your average daily calories over the last 7 days.

Your name, gender, weight history, water records, full meal history, and Apple Health data are not sent in the AI Coach request.

4.2. Photo food recognition — Google Gemini

When you take a photo of a plate and tap "analyze," the photo is sent at low resolution through our relay server to the Google Gemini service, and estimated nutrition values are returned. The photo is used only for that request; it is not stored by the app or processed for any other purpose.

4.3. Barcode scanning — Open Food Facts

When you scan a packaged product's barcode, only the barcode number is sent as a query to the Open Food Facts open database (world.openfoodfacts.org). This request contains no personal data. If you save the returned product info, it is kept on your device.

4.4. Apple Health

The Apple Health integration is optional and works only with your explicit permission. Data exchange happens on your device through Apple's HealthKit framework; this data is not sent to our servers. Storage and syncing of Apple Health data is subject to Apple's own privacy terms.

4.5. Apple — subscription and payment

Premium subscription purchase, renewal, and restoration are handled through the Apple App Store. Your payment and billing information is processed by Apple; the app does not see or store your card details.

4.6. Notifications

Meal, water, and trial-period reminders are scheduled locally on your device. Since no remote (push) notification infrastructure is used, no device token is sent to a server for notifications.

4.7. About third-party service providers

Google (Gemini), Cloudflare (relay server infrastructure), Apple (app distribution, payment, Health), and Open Food Facts are independent service providers and process data that reaches them under their own privacy/terms of use. Google may log AI request and response content for a limited time for service security and abuse-prevention purposes.

5. Legal basis for processing

Nutrition, weight, height, and similar health-related data may be considered special category personal data under KVKK. This data, along with other profile and usage data, is processed based on the explicit consent you give by accepting the notice shown the first time you open the app. You can withdraw your consent at any time by deleting the app or using the "Delete Account" function; processing stops accordingly.

6. Retention period and deletion

• Data on your device: kept until you delete it. Uninstalling the app deletes all app data on the device.
• Deletion within the app: Settings → "Delete Account" permanently deletes your profile, meal, water, and weight records, AI Coach chat history, saved products, preferences, and subscription status flag from the device, and cancels scheduled reminders.
• Export: Settings → "Export My Data" lets you get your meal, water, and weight records as a CSV file and save it wherever you like via the share sheet. What happens to that file afterward is under your control.
• Relay server: does not permanently store request content. Cloudflare and Google may keep short-term technical/security logs in their own systems.

For deletion or access requests, you can write to sahinsamet881@gmail.com; your request will be resolved within 30 days at the latest.

7. Your rights under KVKK

Under Article 11 of KVKK, you can exercise the following rights by applying to Samet Şahin:

• Learn whether your personal data is being processed, and request related information,
• Learn the purpose of processing and whether it is used in line with that purpose,
• Know the third parties to whom data is transferred, domestically or abroad,
• Request correction if it has been processed incompletely or incorrectly,
• Request its deletion or destruction,
• Request that correction, deletion, and destruction be notified to third parties to whom the data was transferred,
• Object to a result that is against you arising solely from automated analysis,
• Request compensation for damages arising from unlawful processing.

You can submit requests via sahinsamet881@gmail.com. We may request reasonable information to verify your identity.

8. Age limit of 18

The app is for users aged 18 and over. Birth year is asked during setup, and users found to be under 18 are not allowed to enter. We do not knowingly collect personal data from anyone under 18; if we become aware such data was processed, we delete it.

9. Data security

Data on your device is protected by the operating system's app sandboxing. AI requests are transmitted over an encrypted connection (HTTPS). Despite this, no transmission over the internet or electronic storage can be guaranteed to be 100% secure.

10. Changes

We may update this policy from time to time. We will provide notice within the app or on this page for significant changes. The current version is always published at this address.

11. Contact

Data controller: Samet Şahin
Email: sahinsamet881@gmail.com