Privacy Policy

Last updated: June 1, 2026

1. Data Controller

Data Controller: Serkan Berk Bilgiç (Sole Proprietorship)

This Privacy Policy describes how Calquate ("App", "we", "us", "our") collects, uses, stores, and protects your personal data when you use our mobile application. This policy is prepared in accordance with Turkey's Personal Data Protection Law No. 6698 ("KVKK"), the General Data Protection Regulation ("GDPR") where applicable, and the Apple App Store and Google Play review guidelines.

By downloading, installing, or using Calquate, you acknowledge that you have read and understood this Privacy Policy.

2. Categories of Personal Data and Processing

We process personal data under specific lawful bases as outlined below. We follow the principles of data minimization and purpose limitation.

Data Category	Data Types	Purpose	Legal Basis (KVKK)
Identity	Anonymous user ID (Firebase Auth)	Link your meals and profile to your device, manage your account	Performance of a contract (Art. 5/2-c)
Health / Profile	Self-entered age, sex, height, weight, activity level, calorie/macro goals	Calculate your personalized daily nutrition targets	Explicit consent (Art. 5/1); Performance of a contract (Art. 5/2-c)
Meal Data	Meal names, descriptions, photos you provide, and the calories/macros logged	Log your meals and analyze nutrition. Photos and descriptions you submit for AI analysis are sent to OpenAI solely to estimate the nutrition of that meal	Explicit consent (Art. 5/1); Performance of a contract (Art. 5/2-c)
Transaction	Subscription status, tier, purchase history	Manage your subscription and deliver premium features	Performance of a contract (Art. 5/2-c)
Technical	Device type, OS version, app version	App stability and debugging	Legitimate interest (Art. 5/2-f)

3. Data We Do NOT Collect

We do not require your name, email address, phone number, or physical address to use the App.
We do not collect location data (GPS, IP-based geolocation).
We do not collect contacts or address book data.
We do not use cookies or web tracking technologies.
We do not collect advertising identifiers (IDFA/GAID).
We do not use your meal photos or data for AI model training.

4. How Your Meal Photos & Descriptions Are Processed

Transparency about how the AI food analysis works is important to us:

What you provide: To get an automatic nutrition estimate, you may take/select a meal photo or type a short description.
AI processing: The photo or description is sent through our secure server (a Google Cloud Function) to a third-party AI service (OpenAI) which returns an estimate of the food items, calories, and macronutrients. The data is used solely for that single analysis request.
Storage: Meal photos you choose to save are stored in Firebase Storage, and your logged meals are stored in Cloud Firestore, associated with your anonymous user ID.
No training: Your photos and meal data are never used for training AI models, advertising, or profiling.
No sharing: Your data is never sold, shared with third parties, or made publicly accessible, except the service providers below that are necessary to run the App.
Manual entry: You can always log meals manually without using the AI feature.

5. Third-Party Services

We use the following third-party services that may process your data in the course of providing the App:

Service	Provider	Purpose	Data Processed	Privacy Policy
Firebase Auth, Firestore, Storage, Cloud Functions	Google LLC (USA)	Authentication, database, file storage, server logic	Anonymous ID, profile, meals, photos	Link
OpenAI API	OpenAI, L.L.C. (USA)	AI nutrition analysis of meal photos/descriptions	Submitted meal photo or text description	Link
RevenueCat	RevenueCat Inc. (USA)	Subscription and payment management	Anonymous ID, subscription status, purchase events	Link

We do not sell, trade, or otherwise transfer your personal data to any third parties except the service providers listed above, which are necessary for the operation of the App.

6. International Data Transfers

Your data may be transferred to and processed in:

European Union: Firebase services (region: europe-west3, Frankfurt, Germany) — primary data storage and server logic.
United States: AI processing (OpenAI) and RevenueCat.

These transfers are conducted in compliance with KVKK Article 9 and, where applicable, GDPR Chapter V. The third-party providers listed above maintain appropriate safeguards (Standard Contractual Clauses, data processing agreements) for international data transfers.

7. Data Security

All data transmission uses HTTPS/TLS encryption.
Firestore and Firebase Storage are secured with server-side rules — users can only access their own data.
The OpenAI API key is held only on the server (Google Secret Manager) and never ships inside the app.
Server-side operations use the Firebase Admin SDK with restricted permissions (principle of least privilege).
No payment card data ever touches our servers — all payments are processed by the Apple App Store and Google Play.

8. Data Retention and Deletion

Active accounts: Data is retained as long as you actively use the App.
Account deletion: You may request deletion of your account and all associated data at any time by contacting us at sberk.bilgic@gmail.com. We will process your request within 30 days.
Transaction records: Subscription transaction records are retained as required by applicable tax and commercial law.

9. Your Rights Under KVKK (Article 11)

As a data subject, you have the right to: learn whether your personal data is processed; request information about the processing; learn its purpose; know the third parties to whom data is transferred; request rectification of incomplete/inaccurate data; request deletion or destruction; request notification of these to third parties; object to results arising solely from automated analysis; and claim compensation for damages from unlawful processing.

To exercise any of these rights, contact us at sberk.bilgic@gmail.com. We will respond within 30 days, free of charge.

10. Your Rights Under GDPR (Where Applicable)

If you are located in the European Economic Area (EEA), you additionally have the right to access a copy of your personal data; request data portability; withdraw consent at any time; and lodge a complaint with a supervisory authority.

11. Children's Privacy

Calquate is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from children under these ages. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last updated" date at the top of this page. Continued use of the App after changes constitutes acceptance of the updated policy.

13. Contact Us

Data Controller: Serkan Berk Bilgiç

Email: sberk.bilgic@gmail.com