Kaora is a pregnancy food-safety app made by one person. It asks for as little as it can, keeps it in one place and sells none of it. This page says exactly what is collected, why, where it goes and how to get rid of it.
Who is responsible
Mehmet Ozay, an individual developer, is the data controller for Kaora. Contact: mehmetozay94@gmail.com.
What we collect
Account identifier, and email address and name if you sign in with Apple or Google — so your data follows you to a new device. Performance of a contract.
Pregnancy profile: due date, height, pre-pregnancy weight, allergies, country and language — the features themselves. Explicit consent for health-related data; withdraw it by deleting your account.
Tracking entries: weight, water, caffeine, symptoms, kicks, contractions, appointments, questions for your doctor, hospital bag, saved foods, scan history — the features themselves. Performance of a contract.
Plate and menu photos and the answer we gave — so you can look them up later in "Plate history", and so we can show what we said if a question about a verdict ever arises. Performance of a contract and legitimate interest.
Barcode numbers — looked up on Open Food Facts to identify the product. Camera frames never leave your phone. Performance of a contract.
Daily usage counters tied to your account and to a one-way hash of your IP address — to apply the free limits fairly and stop abuse. Legitimate interest.
Subscription status and renewal date — to know whether to unlock Pro. Performance of a contract.
App version, device model, OS version, last sign-in and launch count — for support and debugging. Legitimate interest in a working app.
Crash reports (Firebase Crashlytics): what the app was doing when it crashed, device model and OS version — to find what broke. Legitimate interest.
Usage analytics (Firebase Analytics): which screens and features are used, in aggregate, without advertising identifiers — to see what helps and what confuses. Legitimate interest; you can withdraw by deleting your account.
What we do not collect
No advertising identifiers, no ad networks, no tracking across other apps or websites.
No location, contacts or microphone. Photos only when you choose one for analysis.
Apple Health: if you allow it, the app reads your steps, active energy and walking distance to show them in Statistics. This data is read on your phone only; it is never uploaded, stored on our servers or shared. You can revoke access in Settings → Health at any time.
No payment details. Apple processes payments; we receive only whether a subscription is active and when it ends.
No push tokens: reminders are scheduled on your phone.
Nothing is sold, rented or shared for anyone else's marketing. Ever.
Artificial intelligence
Plate and menu recognition, product notes and on-demand translation use the OpenAI API. What is sent: the photo, the product name and ingredients, the text to translate, your language and country code. Your name, email and identity are never sent. OpenAI does not use API data to train its models. AI answers can be wrong; they never replace official guidance or your doctor.
Who processes data for us
Google Firebase (sign-in, database, file storage, functions, Crashlytics crash reports, Analytics usage statistics) — European Union, region europe-west1; Analytics and Crashlytics are processed by Google globally.
OpenAI (AI analysis) — United States.
RevenueCat (subscription state) — United States.
Apple (payment, Sign in with Apple) — global.
Open Food Facts (product lookup by barcode number only) — France.
Each acts on our instructions. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses.
How long we keep it
Account, profile and tracking data — until you delete your account.
Plate and menu photos with their answers — until you delete your account, at most three years.
Daily usage counters — ninety days.
Crash reports — ninety days.
Subscription records — as long as tax law requires them; they contain only an anonymous account identifier.
Your rights
If you are in the European Economic Area, the United Kingdom or Türkiye you have the right to access your data, correct it, delete it, restrict or object to its processing, withdraw consent and receive it in a portable form. Under California law you have the right to know what is collected and to ask for deletion, and the right to opt out of sale — not needed here, because nothing is sold.
Deleting your account inside the app (Profile → Delete account) removes everything on the server: profile, tracking data, photos, counters and the sign-in identity. For anything else write to mehmetozay94@gmail.com from the address on the account. We answer within thirty days, free of charge. If you are unhappy with the answer you may complain to your national data protection authority.
Children
Kaora is not directed at children under sixteen and we do not knowingly collect their data. If you believe a child has created an account, write to us and it will be removed.
Security
Traffic is encrypted in transit. Database and storage rules allow an account to read only its own records; usage counters, the subscription field and the photo archive can be written only by the server, not by the app on your phone. No API keys ship inside the app.
Changes
If this policy changes in a way that affects you, the date at the top changes and the app shows a notice on next launch.