Privacy Policy

1. Who is responsible for your data

welKaly is operated by Beni RAFA et l'equipe welKaly, Boulevard eugène reguillion 69100. We are the data controller for the personal data described in this policy.

For any privacy question or request, contactprivacy@welkaly.com.

2. What we collect

Account data

• Your email address, and a securely hashed password (or, if you sign in with Google, the account identifier and email Google returns to us).
• The name you choose to be called in the app.
• Sign-in timestamps and email-confirmation status, kept by our authentication provider so we can secure your account.

Health and fitness data

This is the sensitive category, so we are explicit about it. During setup and ongoing use, you may provide:

• Sex, date of birth, height, weight and target weight.
• Your goal, the pace you want to reach it at, and what motivates you, including anything you type into the “other” box on those questions.
• Activity level, exercise types, sleep duration and daily walking.
• Diet type, meals per day, food allergies and health conditions you choose to record.
• The calorie, macronutrient and water targets we calculate from all of the above.
• Meals you log, with their foods, quantities, calories, macronutrients, any barcode scanned and any note you add.
• Activities you log, with duration, intensity, sets, reps, weight and calories burned, plus any custom exercise you create.
• Water intake.
• Body measurements over time: weight, height, body fat, waist, chest, arm, hips and thighs.

You decide what to enter. But the app cannot calculate targets without the basics (age, sex, height, weight and activity level), so skipping those limits what it can do for you.

Meal photos

When you use the photo analysis feature, the app takes a picture with your camera and sends it to OpenAI, our AI provider, which identifies the foods and estimates their nutrition. Any note you add to guide the analysis is sent with the photo, along with your app language.

We never store the photo. It is not saved to your welKaly account and it is not written to our servers. Only the resulting numbers are. OpenAI does keep a copy for up to 30 days in its own logs, for security and abuse monitoring. OpenAI's API terms state that data sent through the API is not used to train its models.

The app only ever opens the camera for this. It does not read your photo library.

Settings and preferences

• Units (metric or imperial), app language, light or dark theme, and your time zone.
• Your reminder toggles. These are stored as preferences; the app does not currently send push notifications.

Technical data

• Authentication tokens, stored in your device's secure keystore to keep you signed in.
• Server-side logs from our infrastructure providers, which include your IP address, used for security and debugging.
• A per-account counter of AI analyses, used to enforce the daily limit of 30 analyses.
• When the app starts, it asks our update service whether a newer version is available. That request tells the service your platform, app version and IP address. It carries nothing about you or your entries.

What stays on your device

While you are going through the setup questions, your answers are saved on your phone so you can close the app and pick up where you left off. They are sent to us only when you finish setup. Signing out clears your session from the device.

3. Why we use it, and on what legal basis

Several of these purposes are necessary in order to provide the service you signed up for, so our legal basis for them is performance of a contract. This covers using your account data to create and secure your account; using your email address to send you the account emails that go with it, meaning confirmation and password reset; using the meals, activities and measurements you logged to show you your own history and progress charts; and using a barcode or search term you gave us to look up a packaged product.

Health and fitness data is a special category under the GDPR, so our legal basis for it is your explicit consent. We use that data to calculate your calorie, macronutrient and water targets, and we use a meal photo, together with any note you attach to it, to estimate the nutrition of that meal.

A small amount of processing rests on our legitimate interestin keeping the service working and safe. That means using technical data to check whether a newer version of the app is available, and using technical data and per-account usage counters to prevent abuse and protect the service against misuse.

Health data is a special category under the GDPR, so we rely on your explicit consent for it. You give that consent by choosing to enter the information during setup, and again each time you send a photo for analysis. You can withdraw it at any time: see section 8. Withdrawing does not affect anything we did while the consent was valid.

4. Who else processes your data

We do not sell your data, and no advertising company receives anything about you today (see section 10 if that changes). We rely on a small number of service providers to run welKaly, and each of them receives only what it needs to do its job.

Your account, your profile and everything you log are held by ourcloud hosting and database provider, which operates the database, the authentication system, the server logs and the server functions behind the app from within the European Union. This is the only provider that holds your data as a whole; every other recipient below sees a single fragment of it, for as long as it takes to do one job.

Meal photos are analysed by OpenAI, in the United States, purely so the foods in them can be identified and their nutrition estimated. Section 2 explains what happens to a photo, and section 5 explains the transfer.

When you scan a barcode or search for a packaged product, that barcode or search term, along with your IP address, goes toOpen Food Facts, a community food database based in France. It never receives your account, your profile or anything you have logged.

Account emails, meaning confirmation and password reset, are delivered byResendfrom within the European Union, which receives your email address for that purpose alone.

Googleis involved only if you choose to sign in with Google, and only for the sign-in itself. Using an email address and password instead avoids it entirely.

Our app update provider answers the app when it asks whether a newer version is available. It receives your platform, your app version and your IP address, and nothing else about you. This provider operates in the United States and globally.

This website is served byCloudflarefrom its global edge network, which also manages the welkaly.com domain.

If you install the app from the App Store or Google Play, Apple or Google also holds its own record of that download under its own privacy policy. We do not control that and we do not receive your data from it.

We may also disclose data where we are legally required to do so, or to protect our rights or the safety of others.

5. Where your data is stored

Our database, authentication and server functions run on servers in theEuropean Union. Everything we hold about you long-term (your account, your profile, your health data, your meals, activities and measurements) stays there. Account emails are sent from within the EU too, and the packaged product lookup service is based in France.

Three things do leave the EU, and we would rather name them than bury them:

• Meal photos. A photo you send for analysis is processed by OpenAI in the United States. It is not stored by us at any point, and OpenAI's copy rotates out within 30 days (see section 2). If this matters to you, simply do not use the photo feature. Barcode scanning and manual entry stay entirely within the EU.
• Signing in with Google, if you choose it. Google handles that sign-in on its own global infrastructure. Using an email address and password instead avoids it.
• App update checks. When the app starts it asks our update service whether a new version exists. That request carries your platform, app version and IP address, nothing about you or your entries.

6. How your data is protected

• All traffic between the app and our servers is encrypted with HTTPS, and data is encrypted at rest by our hosting provider.
• Every table holding your data is protected by row-level security in the database, so a request can only ever return rows belonging to the signed-in account. This is enforced by the database itself, not only by the app.
• Passwords are hashed; we never see them in plain text. We require at least 8 characters with upper case, lower case and a digit, and we reject passwords known to have appeared in a public data breach.
• New accounts must confirm their email address before they can be used.
• Authentication tokens are held in your device's secure keystore, not in ordinary app storage.
• Rate limits cap how often an account can trigger AI analysis or request account emails, which limits the damage a compromised account can do.

7. How long we keep it

Your account data, logs and entries are kept for as long as your account exists. When you delete your account, your profile, meals, activities, custom exercises, measurements and targets are deleted with it: see ouraccount deletion page for the full list and how to do it.

• Backups. Encrypted database backups are retained for 7 days, then rotate out. We do not restore deleted accounts from them.
• Server logs. Kept for a short period (typically up to 7 days on our current plan) for security and debugging.
• Meal photos. Never stored by us. OpenAI's copy rotates out within 30 days.

8. Your rights

Under the GDPR and comparable laws, you can:

• Access the personal data we hold about you.
• Correct anything inaccurate: most of it is directly editable in the app.
• Delete your account and data.
• Export a copy of your data in a portable format. There is no self-service export button yet, so email us and we will send you one.
• Withdraw your consent for health-data processing. The simplest way is to delete your account; if you would rather keep the account and have us erase the health fields, ask us and we will.
• Object to processing based on legitimate interest, and ask us to restrict processing while a dispute is resolved.

9. Children

welKaly is not intended for anyone under 13. The app will not accept a date of birth that puts you below that age, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Advertising

welKaly shows no ads today. There is no advertising SDK in the app, nothing on this website is an ad, and no advertising company receives anything about you.

We may introduce advertising in the future. We would rather tell you that here than change the rules quietly later. If it happens, these commitments hold:

• We will not sell your personal data.
• We will never use your health and fitness data (your weight, allergies, health conditions, meals, activities or measurements) to decide which ads you see, and we will never hand that data to an advertising company.
• On iOS, personalised advertising also needs the system tracking permission. Declining it will not stop you using welKaly.

11. Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. Significant changes will also be announced in the app, and where the law requires it we will ask for your consent again rather than assume it.