SayCal privacy policy

Effective November 4, 2026

SayCal is a voice food journal for iPhone. You say or type what you ate, and SayCal works out the calories and nutrients. This policy explains, in plain words, what stays on your phone, what leaves it, who handles it, and how to delete it. "SayCal", "we" and "us" mean the independent developer who makes the app.

The short version

Your food journal lives on your iPhone.
The first time you use the mic, SayCal asks whether Soniox may turn your voice into text, before anything records. Only if you choose "Use Soniox" does your voice go to Soniox, which doesn't keep it or train on it; otherwise it never leaves your iPhone. You can change your answer anytime in Profile → Voice engine. SayCal never receives a recording of your voice.
To work out the nutrition in a meal, the words of that meal go to our server and to Google Gemini. We don't keep what you said.
When you ask the coach a question, the question and a summary of your day go to our server and to Google Gemini. We don't keep those either.
You don't need an account. Signing in with Apple or Google is optional and turns on backup.
No ads. We don't sell your data, and we don't track you across other apps or websites.
SayCal counts which screens and features are used, never what you eat or say, so we can see what to make better. You can turn this off in Profile.
You can delete your account and everything tied to it on our server from the app at any time.

What stays on your phone

Your journal. Meals, foods, amounts, nutrition numbers, notes, goals, weigh-ins and settings are stored on your iPhone with Apple's SwiftData. SayCal's widgets read a short summary of your day from the same phone.
Your voice, unless you choose Soniox. If you choose "Keep it on this iPhone" (Profile → Voice engine: On this iPhone only), and until you've answered, Apple's speech recognition turns your voice into text on your iPhone, and your voice never leaves it. Only if you choose Soniox does it go there (see "Your voice" below).
The camera. When you scan a barcode, the camera image is read on your phone. Only the barcode number leaves it.
Reminders. Meal and check-in reminders are scheduled on your phone. We don't run a push notification service.
Your coach chat. Your recent questions to the coach and its answers are kept on your iPhone and are not backed up.
Exports. When you export your food log, the Excel file is made on your iPhone and goes only where you send it from the share sheet; we never receive a copy.

What we send, and why

Your voice

SayCal turns what you say into text one of two ways, and you choose which. The first time you use the mic, on any screen, SayCal asks before anything records: "Use Soniox" or "Keep it on this iPhone". It says what goes to Soniox, that Soniox keeps neither your voice nor your words (only a record that you used it), and that Soniox is in the United States. Nothing goes to Soniox unless you choose it: until you answer, and if you choose to keep it on your iPhone, Apple's speech recognition hears you on the iPhone. Your answer is kept on this iPhone, and you can change it anytime in Profile → Voice engine.

Most accurate (Soniox), only if you choose it. While you speak, the sound from the microphone streams over an encrypted connection straight from your iPhone to Soniox, a speech-to-text service in the United States, which sends the words back as you say them. It hears many languages and accents. So it spells your foods and your languages right, a short list goes with it: the languages set on your iPhone, the names of a few foods you log most, and the home cooking from Your food (when you log water or your weight, only a few words about those instead, never your foods). The stream ends when you stop, after 20 seconds with no new words, or when the recording stops by itself at one minute, the most any recording lasts.
On this iPhone only. Apple's speech recognition turns your voice into text on your iPhone, in your language when Apple can do that on the device (else US English), and your voice never leaves the iPhone. It can be a little less accurate.

About Soniox:

Soniox's terms and privacy policy say live speech is processed as it arrives and not stored: Soniox keeps neither the audio nor the text, and never uses them to train, evaluate or improve its models. Its logs hold no audio or words, only records of each use, such as how long a stream lasted, the account code described below, and request ids and times, for billing and to run its service. Soniox handles your voice for us, on our instructions, under its privacy policy.
Your iPhone connects to Soniox directly, not through our server, so Soniox also sees your iPhone's IP address, as any service you connect to does.
To open a stream, the app first asks SayCal's server for a key that opens one stream only, within a minute, for at most two minutes. The server counts it toward a daily limit and a limit per minute, and records the request like any other (see "Logs and daily limits"); your voice and the words never pass through our server on the way. Soniox's usage records note each key with a code made from your random account id that can't be turned back into it, so misuse can be traced; your account id itself never goes to Soniox.
If you chose Soniox and it can't be reached (no connection, or the daily limit), Apple's speech recognition takes over for that recording, on your iPhone where it can. When it can't do this on the device (some older devices and languages, or when the on-device speech model is missing or won't load), Apple may process the audio on its own servers under Apple's privacy policy. With "On this iPhone only", Apple's servers are never used.

Either way, SayCal never receives or keeps a recording of your voice. The words it turns into are handled as described next.

Meals you log

When you say or type a meal, its text goes over an encrypted connection to SayCal's server, which runs on Supabase in the United States (US East, Virginia). The server sends that text to the Google Gemini API, which splits it into foods and estimates amounts and nutrition. Your phone's region setting (such as India) and local time go with the text, so portions and drinks match where you are (tea in India comes with milk and sugar) and a whole day's meals can be placed at the right times; we don't store them either. The country, home cooking, diet and foods to avoid from Your food go with the text too, so a dish you don't describe is read the way you eat (a vegetarian's curry is a vegetable curry), but the note you can add there never leaves your phone with a meal. For a restaurant or packaged food, Gemini may search Google for the brand's published nutrition, using only the product name (for example "Starbucks Caffe Latte Grande").

We don't store the text of your meals on our server, and our logs never contain it.
We use Google's paid Gemini API. Under Google's terms for paid services, Google does not use this content to improve its products; it may keep it for a short time to detect abuse.
Nutrition found for restaurant and brand items is saved in a shared cache with no link to you, so the next lookup is faster.

Questions to your coach

When you type or say a question to the coach, it goes over an encrypted connection to SayCal's server and on to the Google Gemini API, which writes the answer. So the answer can use your numbers, a summary of your day goes with it: your goal, today's calories and nutrients against your targets, whether you add workout calories to your budget, the names and calories of the foods you logged today, your local time, and the country, home cooking, diet and foods to avoid from Your food (never the note). Nothing from Apple Health goes with it. Your last few questions and answers from today go too, so a follow-up makes sense. The suggested questions above the ask field are answered on your phone and send nothing.

We don't store your questions, the coach's answers or the day summary on our server, and our logs never contain them. We count how many questions you ask each day, for the daily limit.
Gemini handles them under the same paid-service terms as meals.

Barcodes

The barcode number goes to our server, which looks it up in our food database and, when needed, in USDA FoodData Central and Open Food Facts. Our server makes those lookups, so those services never see your phone. A barcode nobody could find is kept for 7 days, with no link to you, so we know which products to add. If our research later adds that product's published numbers (see the next section), its barcode stays with them in SayCal's shared food data.

Foods you type in yourself

When you enter a food and its numbers by hand, we store that food (name, brand, barcode if any, amount and nutrition numbers) with your account id and your phone's language and region setting. We use it to check your numbers against published sources and show you what we found, and for research to improve SayCal's food data. To check it, the food's name and numbers go to Google Gemini as described above, which searches Google for the product's published nutrition.

If you signed in with Apple or Google, the published numbers that search found may be added to SayCal's shared food data, so the next person who logs the product gets them right away. That happens only for numbers on the brand's own website, or in a nutrition database (USDA FoodData Central, Nutritionix or CalorieKing), for a brand you named, when the search shows it found that site; only when the product's published name has the same words you typed; and only once someone else who signed in has typed the same product and their check agrees. The numbers are stored under the product words you typed and, for a package, the barcode you scanned (never a store's own code, a coupon or a loyalty card). We never share the numbers you typed, your account id or anything else about you. The food you typed and its check are deleted when you delete your account. Published numbers added to the shared food data aren't linked to you, so they stay (see "How long we keep data").

Sources you report

If you tap "Report this source", we mark that food's source, with the reason you picked and your account id, so it is checked again. The report is not shown to anyone else.

If you sign in with Apple or Google, SayCal backs up your journal to our server so you can restore it on a new phone. Without signing in, nothing is backed up. The backup is stored on Supabase, tied to your account, and encrypted in transit and at rest. It holds what your journal holds, including weigh-ins and workouts shown in your journal.

Your profile photo, if you add one

Signed in: SayCal makes the photo a small square on your iPhone, without its location or camera details, and stores it privately with your account on Supabase. Only your account can see it, through links that stop working within a minute. It's deleted when you remove the photo or delete your account. If you sign out before a new photo (or its removal) has reached your account, that change waits on your iPhone, out of sight, until you sign in to the same account again; deleting the account drops it.
Not signed in: the photo stays on your iPhone until you sign in.

Logs and daily limits

To keep the service fast and fair, the server records each request: which feature was used, when, how long it took, how many foods it returned and whether it worked, with your random account id. It never records what you said or typed. We also count how many requests each account makes per day (and, for voice keys, in the last minute) to enforce fair-use limits.

Usage counts

So we can see where people get stuck, SayCal sends PostHog, an analytics service in the United States, a short note when something happens: an onboarding step was shown, SayCal was opened, a meal was logged. Each note holds only the event's name, a few plain facts chosen in the app (for a meal: whether it was said or typed, and how many foods it had), SayCal's version and your iPhone's iOS version, and a random id made on this iPhone.

That id isn't your account id, and nothing else ties it to you: deleting the app starts a new one. PostHog builds no profile of you from it.
The notes never hold what you said or typed, food names, your voice, your name, email, journal, weight or anything from Apple Health.
Nothing is recorded on screen, nothing is collected on its own, and nothing tracks you across other apps or websites.
Turn it off in Profile → Share usage counts; SayCal then sends none. Debug and test builds send none either.

No account needed. When you first use a feature that needs our server, SayCal creates an anonymous account: a random id with no name, email or phone number.
Sign in with Apple or Google (optional). Signing in links that provider to the same account, so nothing you've logged is lost. We receive your email address (with Apple, this can be a private relay address if you choose "Hide My Email"), the account id the provider gives us, and, from Google, the name and profile picture link Google shares. We use these only to sign you in, greet you by name and restore your backup. We don't send marketing email.

Purchases

SayCal Pro is sold through the App Store. Apple handles payment; we never see your card or billing details. We use RevenueCat to know whether your subscription is active. RevenueCat receives your purchase records from Apple, your SayCal account id, and basic technical details such as app version, iOS version and country. Our server keeps only your plan (free or Pro) and when your free week started. The app also keeps that date in your iPhone's Keychain, which stays on the iPhone (it isn't synced to iCloud), so reinstalling the app doesn't start another free week.

Apple Health

If you allow it, SayCal reads your workouts, steps, walking and running distance, active energy and weight from Apple Health to show them in your day and your progress. SayCal does not write to Apple Health.

Health data stays on your phone. It is never sent to our server, except your workouts and weigh-ins as part of your journal backup, which happens only if you sign in.
Your steps, distance and the day's active energy are only shown. SayCal doesn't save them or back them up, and they never change your calorie budget.
Health data is never used for advertising, never sold and never shared with anyone else.
You can turn access off any time in the Settings app → Privacy & Security → Health → SayCal.

What we don't do

We don't show ads and don't include advertising code.
We don't sell or rent your data, and we don't share it for advertising.
We don't track you across other companies' apps or websites, and we don't use the advertising identifier.
We don't use your journal to train AI models.

Who handles data for us

Supabase runs our database, sign-in and server functions (United States).
Soniox turns your voice into text (United States), only if you chose it in the app.
Google runs the Gemini API and Google Search lookups, and Google Sign-In if you choose it.
Apple runs Sign in with Apple, App Store payments, speech recognition and Apple Health.
RevenueCat keeps track of subscriptions.
PostHog counts which screens and features are used (United States), unless you turn it off.
USDA FoodData Central and Open Food Facts receive barcode numbers or food names from our server only.

Each of these handles data under its own privacy policy and only to provide its part of SayCal.

How long we keep data

Journal on your phone: until you delete it or the app.
Your voice: never kept, by us or by Soniox.
Backup: until you delete it or your account.
Profile photo: until you remove it or delete your account.
Foods you typed and their checks: until you delete your account.
Request logs: 30 days, then deleted automatically.
Usage counts: up to a year at PostHog, then deleted.
Daily usage counters: 90 days, then deleted automatically. The per-minute count for voice keys keeps only the times of your last few keys, and goes with your account.
Barcodes nobody could find: 7 days, with no link to you.
Shared nutrition cache: kept and refreshed over time; it holds product names and numbers, not people.
Published numbers our research added to the shared food data: kept, with no link to you, under the product words and barcode they were found for. Numbers for a brand's item are refreshed like the rest of the cache. A product added under a barcode is checked against USDA FoodData Central and Open Food Facts, replaced as soon as either lists it, and removed when someone reports it. Deleting your account doesn't remove them, since nothing ties them to it.

Deleting your data

In the app: Profile → Account → Delete account. This deletes your account and the data tied to it on our server: backups, your profile photo, foods you typed and their checks, your plan and your usage counters. Request logs that hold your random account id expire within 30 days, and a source you reported keeps your random account id with the report until that source is refreshed with new numbers. Published numbers our research added to the shared food data aren't tied to your account, so they stay.
On your phone: deleting the app deletes the journal stored on it.
Subscriptions: deleting your account does not cancel a subscription. Cancel it in the Settings app → your name → Subscriptions. Apple and RevenueCat keep purchase records as the law requires for tax and accounting.
By email: you can also ask us at mubarisfly@gmail.com to delete your data or send you a copy of it.

Your privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia or another US state with a privacy law), you may have the right to know what personal information we have about you, get a copy, correct it, and delete it. Email us and we'll answer as soon as we can, and within 45 days. We'll never treat you differently for asking. We don't sell or share personal information as those laws define it, and we don't use it for targeted advertising.

Security

Everything SayCal sends travels over encrypted connections (HTTPS). On the server, each account can reach only its own rows. Access to the server is limited to the developer, and we look at stored data only to fix a problem or when you ask us to. No system is perfectly secure, so we keep as little as we can.

Children

SayCal is not meant for children under 13, and we don't knowingly collect personal information from them. If you think a child under 13 has used SayCal, email us and we'll delete the data.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how your data is used in a meaningful way, we'll tell you in the app before it takes effect.

Contact

Questions or requests: mubarisfly@gmail.com