A receipt says a lot about a household.
What we take, who else touches it, and how to make it go away.
We read the receipts from the shops you connect, and count calories with them. That is all we do with them. Your data sits in the EU, we never sell it, and deleting your account deletes it, bar four things named below.
Never sold
We do not sell, rent, trade or licence your data. Not your receipts, not your meals, not a version with your name taken off.
What we collect
Three things, all handed over on purpose.
- Your account. An email address and the sign-in links we send to it. No password. You can also use Apple or Google. Each session stores an IP address and a device name.
- Receipts from the shops you connect. The lines, quantities and prices on a purchase, plus the shop and the date. The first sync fetches your purchase history; after that we check every few hours.
- What you log, and your health figures. The food you log, any photo you send for an estimate, your weight, and the figures behind your calorie target: height, age, sex, activity level, and whether you take a GLP-1 medicine. Connect Apple Health and we read your steps, active energy and body mass, and keep them on our servers. We never write anything back to it.
Not collected
- Full card numbers, or anything that can move money.
- Your precise location. We never ask for GPS, and a receipt names the shop, not where you have been.
- Anything from a shop or an app you have not connected.
- Your contacts, your photo library, or records from a doctor. We get only the picture you pick.
Where it is stored
CaloriSpy runs on servers rented from Hetzner Online GmbH in Nuremberg, Germany. The database is a second machine in the same datacentre, on a private network with no public door. Traffic reaches us through a Cloudflare tunnel.
A receipt you forward by mail waits on Cloudflare storage in the EU until it is read, then goes after 30 days. The photos you send for an estimate sit on Cloudflare storage too, in a bucket contractually held in the EU. Your shop logins are encrypted before they are stored, under a key that lives on the server and not in the database.
Five suppliers below are American: Cloudflare, PostHog, RevenueCat, Expo and our AI provider. Cloudflare and PostHog keep the data itself in Europe, but we count all five as transfers. Four run on the EU's 2021 standard contractual clauses, and we will send you the ones you ask for. Expo is the fifth: it claims the same clauses but publishes no agreement, so we cannot show you one. It gets a device id, never a receipt, a meal or a weight. Serper, the search supplier in the table below, sits outside that count: we have not established where it is based or which clauses apply, so we claim neither. It gets a search query, never your account, a receipt or a photo.
Who else sees it
The suppliers the product is built out of. Nobody is here because they paid to be.
| Who | What they see | Why |
|---|---|---|
| Hetzner Online GmbH | Everything, as the machine it all runs on. Nuremberg, Germany. | Hosting. |
| Cloudflare | Requests on their way to us, the raw copy of a receipt you forward by mail, and the meal photos you send for an estimate. The receipt copy goes after 30 days, or at once when you delete your account; a photo goes when the entry that shows it goes. The photo store is pinned to the EU as a contractual guarantee, not a best-effort hint. | DNS, the tunnel in front of the servers, both sign-in and receipt mail, and the storage those copies and photos sit in. |
| Resend | Receipt emails arriving at your CaloriSpy inbox. | A second inbound mail route for forwarded receipts. |
| Our AI provider (outside the EU/EEA) | Receipt lines, product names, your quick-log text, and any photo you send for an estimate. Never your email address — and a receipt is passed on as the shop wrote it, so if it has a name and address printed on it, those go too. A random tag, replaced monthly, stands in for your account, so there is no lasting identifier at their end and no separate erasure for us to run there. Every request refuses a supplier who would keep your data or train on it. | The three automated parts below, under standard contractual clauses. Photos are optional. |
| Serper (web search) | Search queries only — usually a shop or product name, sometimes one site to look in. Never your account, a receipt, a photo or a name. | Looking a product up on the web when the catalogue does not know it. We have not established where Serper is based, or which clauses it works under, so we claim no safeguard for it. |
| Apple (App Store) | Your payment details and what you were charged. Apple is the seller of record, so the transaction is between you and Apple. | Taking the payment. We never see a card number. |
| RevenueCat (US) | That an account has a subscription and when it runs out, against your account id. Never a card number. | Telling the app whether the subscription is still active. Standard contractual clauses. |
| Crisp (EU) | Support chat and support mail: what you write, plus the email address and name you are signed in with, your account id and your plan. On a phone, a push token as well. Never your food log, receipts or health data. | Answering you. On this website, and in the app in a browser, nothing reaches Crisp until you press the chat button. On a phone its own code starts with the app and registers that token at every launch. French company, data in the Netherlands and Germany. |
| PostHog (EU) | Screens, actions and errors against your account id: no food names, no nutrition figures, no health data. AI debugging traces are the exception and carry the food or receipt text sent to the model and the answer back, also against your account id. Never photos, names or email addresses. Your IP address is turned into an approximate city at their end. | Knowing which parts work, hearing about crashes, debugging food matches. One switch in the app turns product analytics off; crash reports and AI traces keep running. On this website nothing runs unless you allow it. |
A few more see a narrow slice: Apple and Google if you sign in with them, and Apple Health if you connect it; Expo, which delivers app updates and push notifications.
Cloudflare, Resend, RevenueCat, Crisp and our AI provider act only on our instructions, under a data processing agreement. With Hetzner and PostHog we are confirming ours is in place rather than telling you it is. With Serper we have none to show you at all. Apple and Google are their own controllers, for sign-in and the App Store.
AI and automated decisions
Three parts of CaloriSpy are automated, and the EU AI Act says you should be told which.
01
Matching receipt lines to food
A line reads RUGBR GROFT 950G, and something has to turn that into a product with a calorie figure. When the match is unsure the app asks you rather than guessing. A lookup can mean a web search.
02
Estimating a meal from a photo
The photo goes to our AI provider, and what comes back is marked an estimate wherever it appears. Optional: everything else works without a camera.
03
Suggesting recipes from your pantry
Ideas for what to do with what you bought. Nothing is logged until you tap it.
Nothing here makes a decision about you. No score, no profile, and no automated decision with legal or similarly significant effects under Article 22. The automation reads groceries.
And a correction wins permanently. Fix a match and the fix is stored as a human override. No later model result may write over it.
Being confirmed
We do not train anything on your photos, and we will not use a supplier who does. Every request carries that instruction and fails rather than routing to a supplier who would. What we do not have yet is their retention policy in writing, so this box stays until we do.
What allows us to
The GDPR asks us to name what permits each thing:
Your account, your receipts and your log. Article 6(1)(b), a contract. We cannot give you the service without them.
Your weight, height, age, sex, activity level, calorie target and GLP-1 answer. Article 9(2)(a), your explicit consent, with Article 6(1)(a) alongside it. You give it by entering the figure or connecting Apple Health, and take it back by clearing the field, disconnecting, or deleting the account.
Keeping the service standing up, and knowing which parts work. Article 6(1)(f), our legitimate interest in a product that can be fixed on evidence and is not abused. That covers product analytics and crash reports; the switch is under Cookies.
Our own accounts. Article 6(1)(c), Danish bookkeeping law, over the records it reaches. That is the five years below.
Withdrawing consent costs you nothing: that part stops, and what we did before stays lawful. Object to legitimate interest by writing to us, or with the switch.
How long we keep it
While your account is open we keep your receipts and your logs, because that history is the product. Close it and the data goes immediately: one transaction, everything that hangs off the account, no grace period and no undo. Cloudflare and RevenueCat are told to erase their copies. Export first if you might want any of it later.
Four things do not go. Danish bookkeeping law makes us keep accounting records for five years , so a purchase of yours that appears in our accounts stays that long. A log of anything we did to your account keeps your email address beside it for three years, and a message we sent you for one. A one-way hash of your email address stays 24 months, so the trial cannot be taken again by deleting the account and signing up afresh; it cannot be read back into an address. And PostHog is not asked to erase what it already holds: the screens, events and AI traces above, against your account id. None of the four is your receipts, your meals or your weight.
A disconnected shop stops sending immediately. Receipts already imported stay until you delete them or delete the account.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how it is used, take it elsewhere, and withdraw any consent.
They are buttons in the app: Export takes your data, Delete account ends it. For anything that is not a button yet, write to [email protected] and we will do it by hand within a month.
If we get it wrong, complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.
Children
CaloriSpy is for people aged 16 and over. Counting calories is a poor idea for a body that is still growing. If you believe a younger person has an account, write to us and we will close it.
Changes and contact
If this policy changes in a way that matters, we say so here and tell you in the app before it takes effect. This version is dated 21 September 2026.
Inside Studio I/S
Langebrogade 17, 1411 København K
CVR 46668448 · Denmark
[email protected]
Inside Studio I/S is the data controller for everything described here.
That is the whole of it. No second page, no second business.