Calories & Reps — Privacy Policy

Version 1.6 · Effective Date: 16 July 2026

1. Who We Are

This Privacy Policy explains how Calories & Reps ("the App," "we," "us") collects, uses, shares, and protects your personal data. Calories & Reps is operated by شركة مشاري الزهراني لتقنية المعلومات (Mashari Alzahrani Information Technology Company), a Saudi Limited Liability Company registered under Commercial Registration No. 7054242719, with registered address at Al Kawthar District, Makkah Al-Mukarramah, Kingdom of Saudi Arabia.

This Policy is designed to comply with the Saudi Personal Data Protection Law (Royal Decree No. M/19 dated 9/2/1443H, as amended), together with its Implementing Regulations (the "PDPL"), as enforced by the Saudi Data & AI Authority (SDAIA).

Data Protection Contact: privacy@hakimai.app

2. Calories & Reps Is a Wellness App, Not a Medical Service

Calories & Reps is a nutrition and fitness tracking aid for general wellness. It is not a medical device and does not provide medical advice, diagnosis, or treatment. Calorie targets, macro estimates, and coaching suggestions are informational estimates only. Always consult a qualified healthcare professional before changing your diet or exercise, especially if you have a medical condition, are pregnant, or have a history of disordered eating.

3. Data We Collect

3.1 Account Data

Name, email address, hashed password (we never see your plain-text password) or a Sign in with Apple identifier, app preferences you configure (units, goals, calorie and macro targets), optional height and gender profile fields, and an append-only record of each legal-document version you accept. Gender, when provided, is limited to male or female. Height and gender are optional: you may leave either unset or clear it later. An unset gender is not sent to AI as gender context. The acceptance record contains your account identifier, the accepted version, the server timestamp, your three affirmative assertions (adult confirmation, Terms agreement, and Privacy acknowledgement), and the neutral recording method authenticated clickwrap; it does not contain your IP address or user agent.

3.2 Nutrition and Fitness Content

Meals and foods you log and their estimated calories and macros; meal photos you choose to submit for AI food recognition; your messages to the AI coach (text and voice recordings); coach-draft text submitted for optional AI polishing; and private notes exchanged through coach/client features, including delivery or read state. When you use a voice feature, the recording's audio is sent to Google for transcription and AI processing; the resulting transcript may then be used for the requested feature, and the temporary audio is automatically deleted from our servers. We also process workout logs (exercises, sets, weights), body data you enter (current and historical weight, height, body-fat percentage, measurements, optional gender, and notes), a BMI ratio derived only when current weight and height are available, and progress photos you choose to take. BMI is a rough general-wellness screening ratio, not a diagnosis. Progress photos are separate from meal photos and are not sent to an AI provider.

3.3 Apple Health Data (with your permission)

If you connect Apple Health on iPhone, we read daily step counts, active energy, resting energy, and exercise minutes to power your daily energy balance and adaptive calorie target. If you explicitly start workout mode on Apple Watch, the Watch app reads live heart rate and active energy and saves the completed strength workout to Apple Health. We never use Health data for advertising and never sell it. Daily activity totals may be included in the context given to our AI coaching features so the coach can answer questions about your day accurately.

3.4 Usage and Device Data

App actions; device and network information (operating system, app version, and signup IP address used for short-lived abuse prevention); food-product search terms; short-lived pseudonymous authentication and media-upload rate-limit events; and sanitized operational error or diagnostic events. A media-upload rate event contains only an event category, a secret-keyed HMAC bucket derived from the account, and a timestamp. It contains no photo, audio, health content, raw account identifier, raw upload/request identifier, IP address, or user agent. Food-search terms are not stored in the Calories & Reps application database, but may appear in unlinked infrastructure or Open Food Facts request logs. Sentry receives neither request bodies nor URL query strings, and tracing/performance monitoring is disabled.

3.5 Subscription Data

Your subscription status and transaction identifiers from Apple In-App Purchase. Payment is processed by Apple; we do not receive or store your card details. If you delete your account, we may retain a minimal pseudonymous link to purchase or transaction identifiers and a keyed, non-reversible proof of your Sign in with Apple identity or normalized account email. This allows an active Apple subscription to be restored only after the later account proves the same Apple identity or control of the same verified email, together with Apple's signed transaction proof, and supports fraud prevention and legal or accounting obligations.

We do not use advertising trackers and we do not sell your data.

4. How and Why We Use Your Data

4.1 Your Choice About Third-Party AI

Before the App sends personal content to a third-party AI provider, it presents a separate disclosure naming the providers and data categories—including meal photos sent for food recognition, coach-draft text sent for AI polishing, standing notes or instructions from a linked human coach when relevant to AI coaching, voice-recording audio sent to Google for transcription, and relevant optional profile context such as height, current weight, derived BMI, and gender if selected—and asks you to choose whether to allow that sharing. Profile fields are included only when you entered them and they are relevant to your request; an unset gender is not sent as gender context, missing values are never invented, and AI is instructed not to use gender stereotypes. The current decision and disclosure version are stored with your account on our backend, so the same choice applies across iPhone, Apple Watch voice uploads, and the web app. Every AI chat, meal-photo analysis, coach-draft polish, voice-transcription, workout-coach, and AI activity-estimate request is checked by the backend before content is sent to a provider. If you decline, manual meal, workout and body tracking, food search, account controls, coach tools that do not use AI, and subscription management remain available, while those AI features remain off.

You may withdraw that consent at any time from Me/Settings → AI Data Sharing. Withdrawal updates the account record and blocks new AI requests at the server, including direct Apple Watch uploads. It does not undo processing that was completed while consent was active or remove data that must temporarily remain under the retention rules below. You can also contact privacy@hakimai.app for help.

4.2 Sharing With a Human Coach

Linking a human coach does not automatically expose your whole account. You choose separate sharing scopes for weight history, nutrition summaries, workouts, progress photos, and a detailed body profile. The legacy Weight history choice shares only current and recent logged weight; it never automatically expands to newly introduced fields. Detailed body profile is a separate, versioned consent that shares current weight, height, body-fat percentage, body measurements, derived BMI, and gender if you chose to provide it. Existing coach links must affirmatively enable that new choice before a coach can receive those expanded fields. You can review or change each choice while linked, leave profile fields unset, and unlink the coach to stop future access. A bounded recent history of coach reads remains visible in the App after you unlink or switch coaches; this history shows the shared-data category and time without revealing coach identities. Coaches are expected to use shared data only for the coaching service and not to make assumptions or apply gender stereotypes.

5. Who We Share Data With (Sub-Processors)

AI sub-processors receive only the content needed to answer your request (for example your message, a meal photo you deliberately submit for recognition, coach-draft text you deliberately submit for polishing, logged meals, relevant optional height/current-weight/derived-BMI/gender context, standing notes or instructions from your linked human coach when relevant, and daily totals). Calories & Reps uses paid/business API configurations and does not opt in to model training; under those terms, providers do not use submitted prompts or responses to improve or train their models. Provider terms may permit limited security, abuse-monitoring, and legally required retention. Progress photos are stored in-Kingdom and are never sent to AI providers.

6. Cross-Border Transfers

Primary application hosting, account data, logs, and progress-photo storage use Google Cloud's Saudi Arabia region (me-central2, Dammam). Automated database backups may be stored in an EU multi-region. Transactional email addresses and message contents are processed in the United States by Resend, and sanitized operational error data may be processed there by Sentry. If you consent to AI features, the minimum content needed for inference or audio processing is transferred outside Saudi Arabia, including to the United States and other countries where OpenAI, Google, or their approved service providers operate. Cleaned food-name search terms may be sent to the Open Food Facts association in France; no Calories & Reps account identifier or profile context is included. We use contractual data-processing safeguards and transfer controls as required by the PDPL.

7. Retention

8. Security

We use TLS encryption in transit, encryption at rest, salted one-way password hashing, account-bound access controls, security logging, and rate limiting. No system is perfectly secure, but we apply measures appropriate to the sensitivity of the data.

9. Your Rights (PDPL)

You have the right to be informed, to access, to rectify, to erase, to object to or restrict processing, to withdraw consent, and to data portability. You may withdraw AI consent from Me → AI Data Sharing, delete your account and data from within the App, or contact privacy@hakimai.app. We respond within 30 days. You may also lodge a complaint with SDAIA (sdaia.gov.sa).

10. Data Breach

If a breach likely to risk your rights occurs, we will notify SDAIA within 72 hours of becoming aware and notify affected users without undue delay, consistent with PDPL Article 20.

11. Children

The App is intended for users 18 and older and is not directed to children. We do not knowingly collect data from anyone under 18.

12. Changes and Contact

We may update this Policy from time to time. A material Terms or Privacy change requires a new authenticated legal acceptance before using the App, while account deletion and Apple subscription management remain reachable if you decline. A material change to AI sharing also requires a new, separate in-app AI consent version before further AI use. Questions or requests: privacy@hakimai.app. Product support: fitness.hakimai.app/support.