Aklti Privacy Policy

Version 1.2 · Effective date: 22 October 2026

1. Who we are

1.1. The Aklti (أكلتي) mobile app for iOS and Android (the "App") is provided by KALM L.L.C-FZ, a company registered in Dubai, United Arab Emirates, trade licence no. 2314694.01 (Meydan Free Zone, Dubai), registered address Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. ("Aklti", "we", "us").

1.2. Aklti is the controller of the personal data described in this policy.

1.3. Contact for privacy questions and requests, including data protection matters: privacy@aklti.app.

2. Summary

2.1. Aklti helps adults (18+) log what they eat and estimate its nutritional values. To do this we process health data, which is sensitive personal data. We only do so with your explicit consent.

2.2. In short:

• We collect the account, body, health, food, exercise, weight and water data you enter, and the meals you log.
• Meal photos are sent once for analysis and are not stored by Aklti.
• Meal photos and descriptions go to an outside AI provider (Claude, by Anthropic) only after a separate, optional consent. The AI only names foods and amounts; the nutritional values come from Aklti's food database.
• We do not sell your data, show ads, or use advertising trackers.
• Privacy-respecting usage analytics are off until you agree to them, on a screen of their own in the App. They never include your food, photos or health data, are not linked to your account, and you can switch them off at any time (see 3.15).
• You can see, correct and delete your data, delete your account in the App, and withdraw your consent.

3. The data we collect

3.1. Account data

• Your email address, used to sign in. Sign-in works with a one-time code sent to your email; there is no password.
• A user identifier issued by our sign-in provider, and the account's status and creation date.
• Session tokens (see 3.12; they stay on your device).
• If you start without an email (as a guest), your account has no email until you add one; everything else in this policy applies in the same way.

3.2. Profile data (health data)

• Date of birth (used to compute age and to confirm you are 18 or older), sex (female/male), height, weight, activity level, goal (lose weight, maintain, build muscle) and, if you chose to lose weight, the weekly rate you picked.
• From these we calculate daily targets (calories, protein, carbohydrates, fat). Targets are calculated when you ask for them and are not stored separately.

3.3. Health screening answers (sensitive health data)

• Before any plan, the App asks whether any of the following applies to you: pregnancy; breastfeeding; type 1 diabetes or taking insulin or a medicine that can lower blood sugar; type 2 diabetes; kidney disease (including dialysis); an eating disorder now or in the past. You can answer "none of these".
• We store only the conditions you tick. We use them to protect you: for example, with pregnancy, breastfeeding, insulin-treated diabetes, kidney disease or an eating disorder the App does not create calorie targets or a weight-loss plan; with an eating disorder badges are turned off; with some conditions therapeutic diet checks are paused.

3.4. Food profile (health data)

• Your diet (for example none, high-protein, low-carb, keto, vegetarian, vegan, pescatarian), the food groups you avoid and how strictly (for example gluten, dairy, egg, peanut, tree nuts, sesame, soy, fish, shellfish, pork, alcohol), and for keto, your daily net-carbohydrate limit.
• These may reveal allergies, intolerances, or religious or ethical choices.

3.5. Food diary

• Each meal you log: the day, the meal type (breakfast, lunch, dinner, snack), how it was logged (manually, photo, text), each food, the amount (portion or grams, with a low/expected/high range), the nutritional values calculated at that time, the catalog source and version, and any values you entered yourself.

3.6. Exercise, weight and water logs

• The activity (for example walking, running, swimming), the minutes, the day, and, to estimate calories burned, the activity's MET value and your weight at that time.
• The weights you log on the Progress screen (one per day). The latest one becomes your profile weight.
• The glasses of water you log: the day and the amount.

3.7. "My dishes"

• Dishes you save yourself: the name you give them and their ingredients with grams. Only you can see them.

3.8. Meal analysis (optional AI features)

• Text: the meal description you type (up to 500 characters).
• Photo: the meal photo you take or pick. The App resizes and re-compresses it on your phone (to about 1024 pixels) before sending. An optional note you add to the photo (up to 200 characters). When you log the meal, the App keeps a small copy of the photo on your phone only, to show it with the meal in your diary; it is not sent again, and it is removed when you delete the meal, sign out or delete your account.
• Dish breakdown: when a dish is not in our database, only the dish's name is sent to the AI to suggest its ingredients.
• Package labels: a photo of a food's nutrition label, read by the AI in the same way as a meal photo and not stored. The food you confirm from it is saved under its generic name (never a brand) and may become available to other users, without anything about you.
• Draft: the result you review before saving.
• Technical record of each analysis, kept after the draft ends: type (text/photo), status, the meal's day and type, which recogniser/model and prompt version were used, processing time, number of tokens, estimated cost, and any error code. This record does not contain your text, your photo, your note or the draft.

3.9. Consent records

• Each time you accept or withdraw a policy (terms, privacy, health data, AI processing) or answer the usage analytics question (3.15): which policy, which version, accepted or withdrawn, and when. We keep every record, so we can show which version you accepted.

3.10. Usage counters

• How many analyses you used each day, to apply your plan's daily limits.
• Which subscription offers you have been shown, so that an offer meant to be shown once is shown once.

3.11. Technical and log data

• When the App talks to our servers, our servers log technical request data such as the time, the address requested, the response, a request identifier and technical headers, which may include your IP address and device/app information. Sign-in tokens are removed from these logs.
• Our sign-in provider and update service may also process your IP address and device information (see section 7).

3.12. Data kept only on your phone

• Your session tokens, in the phone's secure keychain/keystore. Signing out removes them.
• Your display preferences (language, numeral style, appearance).
• Your meal reminder settings (which meals and times). Reminders are local notifications scheduled on your phone; we do not send push notifications and do not collect a push token.
• Which badges you have already seen, and whether you turned badge celebrations off.
• Your answer to the usage analytics question (3.15), and when you gave it.
• This data does not leave your phone.

3.13. Badges

• Badges (for example "3 days in a row") are calculated from your diary, exercise and dishes when you open them; they are not stored separately. If you share a badge, the App creates the badge image on your phone and opens your phone's share sheet; what you share and with whom is your choice, and Aklti does not receive it.

3.14. Data we do not collect

• We do not collect your location, contacts, microphone or voice, files, or advertising identifier, and the App contains no advertising SDKs. Its only analytics tool is the one in 3.15, which stays off until you agree. On Android the App blocks microphone and storage permissions.

3.15. Privacy-respecting usage analytics (optional)

• Off until you agree. Usage analytics are off by default for everyone. The App asks you once, on a screen of its own that is separate from the Terms of Use and from the other consents, with two equal choices: "I agree" and "No, thanks". Until you agree, the App does not start the analytics tool at all and sends no analytics event, not even that the App was installed or opened. Your answer is kept on your phone and, when you are signed in, in our consent records (3.9) with the version of this policy. Saying no changes nothing else in the App.
• Who processes it: PostHog, Inc., which processes the events on our behalf as our processor. The data is hosted in PostHog's EU cloud in Frankfurt, Germany (European Union).
• What is collected, only if you agree:
• General events in the App: the App was installed, opened or updated; onboarding was started or completed; an account was created; a meal was logged, with only the way it was logged (photo, text, manually, or from the food database); the subscription screen was shown; a purchase was started or completed, with only the store product identifier; the App language was changed, with only the language code.
• The name of the screen you open (for example "Today" or "Settings"), without anything you searched for or opened on it.
• Technical information about the device and the App: device type and model, operating system and version, App version, the device's language and time zone, and the approximate country, which PostHog derives from the IP address at the time of the event.
• A random identifier that the App creates on your phone for analytics.
• The random identifier is not linked to your account. No name, email or account number is sent with the events, and we never link the events to your Aklti account. The identifier is replaced with a new one when you sign out or switch analytics off. Because it is still an identifier kept on your device, this policy covers it like any other data.
• What is not collected: the foods you log or search for, their names or amounts, calories or nutrients, your meal photos, your body or health data (such as weight, height, goals or health answers), your food profile, and any text you type. Touches, typed input and screen recordings (session replay) are not captured. We configure PostHog to discard the IP address after the approximate country is derived; it is not stored with the events.
• No sale and no advertising: analytics data is not sold, rented or shared with advertisers or data brokers, and is not used for advertising, profiling for marketing, or tracking across other companies' apps or websites.
• Retention: analytics events are kept for at most 12 months and are then deleted automatically. Because they are not linked to your account, deleting your account does not change them, and they cannot be linked to you afterwards.
• Changing your mind: you can switch analytics on or off at any time in the App, under Settings → Privacy & data → "Privacy-respecting usage analytics". When you switch it off, the App stops the analytics tool, sends no further events from that phone, and replaces the random identifier. Switching it off does not affect any other feature of the App.

4. Why we use your data, and on what legal basis

4.1. We do not use your data for advertising, profiling for marketing, or automated decisions with legal or similarly significant effects. The App's safety rules (for example not creating a plan with certain conditions) are automatic; you can change your answers at any time and they never lock you out of the App.

4.2. We do not use your health data, photos or descriptions to train AI models, and we do not allow our AI provider to do so.

4.3. If you do not give the health-data consent, you cannot use the App, because tracking food requires health data. If you do not give the AI consent, you can still use the App: you can search the food database and describe meals in words, read by a free text parser that runs on our servers without any outside AI. Photo analysis needs the AI consent. If you do not agree to usage analytics, nothing changes in the App.

5. AI meal analysis

5.1. What is sent: the meal photo and its optional note, or the meal description you type, or a dish name to be broken into ingredients. They are sent from our servers to Anthropic, PBC (the "Claude" service), which is located in the United States.

5.2. What is not sent: your name, email, user identifier, profile, weight, health answers or food profile are never sent to the AI provider.

5.3. What the AI does: it names the foods and drinks and estimates amounts. It never provides calories or nutrients; those come from Aklti's food database. Its output is an estimate and can be wrong; you review the draft and nothing is saved to your diary until you confirm it.

5.4. What Aklti keeps: we do not store the photo (the copy shown in your diary stays on your phone only, see 3.8). The text, note and draft are deleted when you confirm or discard the draft, or after 24 hours at most. For a photo, what the AI read in it (the foods and amounts it named, never the photo) is kept with a fingerprint of the photo (a SHA-256 hash, from which the photo cannot be rebuilt) for 30 days at most, so that the same photo sent again gets the same answer without being sent to the AI provider again. It is deleted after 30 days and when you delete your account. Only the technical record in 3.8 remains after that.

5.5. What the provider keeps: under its terms the AI provider may keep inputs and outputs for a limited period, for example for safety and abuse monitoring, and does not use them to train its models.

5.6. Withdrawal: you can withdraw your AI consent at any time in the App, under Settings → Privacy & data. After that nothing is sent to the AI provider, and text descriptions are read by the free parser. Withdrawal does not affect analyses already made.

5.7. When the monthly AI budget is reached, photo analysis may pause and text descriptions are read by the free parser.

6. The shared dish library

6.1. When the AI breaks a well-known dish (for example "koshari" or "kabsa") into ingredients for one user, we keep the dish's usual name, other common names, its cuisine and the AI's ingredients with grams for one serving in a shared library, so that later users get the dish without another AI call.

6.2. The library contains no information about you: no user identifier, no email, none of the amounts you changed. The words you typed are kept as a name for the dish only when every word is already one of the dish's names (for example "kabsa chicken" for "chicken kabsa"); personal names such as "my mother's dish" are never kept.

6.3. A dietitian reviews the dishes in the library. Library dishes are always shown as estimates.

7. Who we share data with

7.1. We share personal data only with service providers that process it on our behalf and under our instructions:

7.2. We may also disclose data when required by law, a court order or a competent authority, or to protect the rights and safety of users and Aklti.

7.3. If Aklti is merged, acquired or sells its assets, data may pass to the successor, which will be bound by this policy.

7.4. We do not sell, rent or trade your personal data, and we do not share it with advertisers or data brokers.

8. Transfers outside the UAE and Egypt

8.1. Our providers process data outside the UAE and Egypt, including in the European Union (Germany) and the United States.

8.2. We transfer data only with the safeguards the law requires.

9. How long we keep data

9.1. When your account is deleted, all your rows in our database are deleted together, and so is your sign-in account at our sign-in provider. Deleted data may remain in our hosting providers' backups for a limited time, until those backups are overwritten.

10. Security

10.1. We protect your data with measures including: encrypted connections (HTTPS/TLS) between the App and our servers and between our servers and the database (with certificate verification); the database rejects any direct access with the App's public key, so only our API server can read data; every request is limited to the signed-in user's own data, and this is tested automatically; sign-in tokens are kept in the phone's secure storage and removed from server logs; no secret keys are stored in the App; rate limits on requests.

10.2. No system is completely secure. If a breach affects your personal data, we will notify you and the competent authorities as the law requires.

11. Your rights

11.1. Subject to applicable law, you have the right to:

• Access your data and receive a copy. The App has no export feature; to request a copy, write to privacy@aklti.app.
• Correct it: you can edit your profile, health answers, food profile, diary items, exercise and dishes in the App at any time.
• Delete it: you can delete diary items, exercise entries and dishes in the App, and delete your whole account in the App under Settings → Privacy & data → "Delete my account and data", or by email to privacy@aklti.app.
• Withdraw consent at any time, without affecting processing before withdrawal. You can withdraw the AI consent (see 5.6) and the usage analytics consent (see 3.15) in the App, and any other consent by email. Withdrawing the health-data consent means you can no longer use the App; you can delete your account and data in the App at any time.
• Object to or restrict certain processing, and data portability where the law provides it.
• Complain to a supervisory authority: in the UAE, the UAE Data Office; in Egypt, the Personal Data Protection Center; in the EU, your local data protection authority.

11.2. To use your rights, write to privacy@aklti.app from your account's email. We may ask you to confirm your identity. We will answer within 30 days.

12. Adults only

12.1. Aklti is for adults aged 18 or over. Our server refuses to create a profile with a date of birth under 18. If we learn that a person under 18 has given us data, we will delete it.

13. Aklti is not a medical service

13.1. Aklti is a nutrition-tracking tool. It does not diagnose, treat or give medical advice, and the data you give is not used for medical care. See the Terms of Use.

14. Phone permissions

14.1. Camera: to photograph a meal. Photos: to pick a meal photo through the system picker. Notifications: only if you turn on meal reminders. You can turn each permission off in your phone's settings; the related feature will then not work.

15. Changes to this policy

15.1. We may update this policy. Each version has a number and a date. When a change is material, the App will show the new version and ask for your consent again before you continue, and we record the version you accepted.

16. Contact

16.1. KALM L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E., trade licence no. 2314694.01 (Meydan Free Zone, Dubai). Privacy: privacy@aklti.app. Help with the App: support@aklti.app.

16.2. This policy is governed by the federal laws of the United Arab Emirates, without prejudice to the mandatory data protection rights you have under the law of your country of residence (including Egypt PDPL and, for EU residents, the GDPR).