Aklti Privacy Policy
Version 1.0 · Effective date: 19 October 2026
1. Who we are
1.1. The Aklti (أكلتي) mobile app for iOS and Android (the "App") is provided by KALM L.L.C-FZ, a company registered in Dubai, United Arab Emirates, trade licence no. 2314694.01 (Meydan Free Zone, Dubai), registered address Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. ("Aklti", "we", "us").
1.2. Aklti is the controller of the personal data described in this policy.
1.3. Contact for privacy questions and requests, including data protection matters: privacy@aklti.app.
2. Summary
2.1. Aklti helps adults (18+) log what they eat and estimate its nutritional values. To do this we process health data, which is sensitive personal data. We only do so with your explicit consent.
2.2. In short:
- We collect the account, body, health, food and exercise data you enter, and the meals you log.
- Meal photos are sent once for analysis and are not stored by Aklti.
- Meal photos and descriptions go to an outside AI provider (Claude, by Anthropic) only after a separate, optional consent. The AI only names foods and amounts; the nutritional values come from Aklti's food database.
- We do not sell your data, show ads, or use advertising or analytics trackers.
- You can see, correct and delete your data, delete your account in the App, and withdraw your consent.
3. The data we collect
3.1. Account data
- Your email address, used to sign in. Sign-in works with a one-time code sent to your email; there is no password.
- A user identifier issued by our sign-in provider, and the account's status and creation date.
- Session tokens (see 3.12; they stay on your device).
3.2. Profile data (health data)
- Date of birth (used to compute age and to confirm you are 18 or older), sex (female/male), height, weight, activity level, goal (lose weight, maintain, build muscle) and, if you chose to lose weight, the weekly rate you picked.
- From these we calculate daily targets (calories, protein, carbohydrates, fat). Targets are calculated when you ask for them and are not stored separately.
3.3. Health screening answers (sensitive health data)
- Before any plan, the App asks whether any of the following applies to you: pregnancy; breastfeeding; type 1 diabetes or taking insulin or a medicine that can lower blood sugar; type 2 diabetes; kidney disease (including dialysis); an eating disorder now or in the past. You can answer "none of these".
- We store only the conditions you tick. We use them to protect you: for example, with pregnancy, breastfeeding, insulin-treated diabetes, kidney disease or an eating disorder the App does not create calorie targets or a weight-loss plan; with an eating disorder badges are turned off; with some conditions therapeutic diet checks are paused.
3.4. Food profile (health data)
- Your diet (for example none, high-protein, low-carb, keto, vegetarian, vegan, pescatarian), the food groups you avoid and how strictly (for example gluten, dairy, egg, peanut, tree nuts, sesame, soy, fish, shellfish, pork, alcohol), and for keto, your daily net-carbohydrate limit.
- These may reveal allergies, intolerances, or religious or ethical choices.
3.5. Food diary
- Each meal you log: the day, the meal type (breakfast, lunch, dinner, snack), how it was logged (manually, photo, text), each food, the amount (portion or grams, with a low/expected/high range), the nutritional values calculated at that time, the catalog source and version, and any values you entered yourself.
3.6. Exercise log
- The activity (for example walking, running, swimming), the minutes, the day, and, to estimate calories burned, the activity's MET value and your weight at that time.
3.7. "My dishes"
- Dishes you save yourself: the name you give them and their ingredients with grams. Only you can see them.
3.8. Meal analysis (optional AI features)
- Text: the meal description you type (up to 500 characters).
- Photo: the meal photo you take or pick. The App resizes and re-compresses it on your phone (to about 1024 pixels) before sending. An optional note you add to the photo (up to 200 characters).
- Dish breakdown: when a dish is not in our database, only the dish's name is sent to the AI to suggest its ingredients.
- Draft: the result you review before saving.
- Technical record of each analysis, kept after the draft ends: type (text/photo), status, the meal's day and type, which recogniser/model and prompt version were used, processing time, number of tokens, estimated cost, and any error code. This record does not contain your text, your photo, your note or the draft.
3.9. Consent records
- Each time you accept or withdraw a policy (terms, privacy, health data, AI processing): which policy, which version, accepted or withdrawn, and when. We keep every record, so we can show which version you accepted.
3.10. Usage counters
- How many analyses you used each day, to apply your plan's daily limits.
3.11. Technical and log data
- When the App talks to our servers, our servers log technical request data such as the time, the address requested, the response, a request identifier and technical headers, which may include your IP address and device/app information. Sign-in tokens are removed from these logs.
- Our sign-in provider and update service may also process your IP address and device information (see section 7).
3.12. Data kept only on your phone
- Your session tokens, in the phone's secure keychain/keystore. Signing out removes them.
- Your display preferences (language, numeral style, appearance).
- Your meal reminder settings (which meals and times). Reminders are local notifications scheduled on your phone; we do not send push notifications and do not collect a push token.
- Which badges you have already seen, and whether you turned badge celebrations off.
- This data does not leave your phone.
3.13. Badges
- Badges (for example "3 days in a row") are calculated from your diary, exercise and dishes when you open them; they are not stored separately. If you share a badge, the App creates the badge image on your phone and opens your phone's share sheet; what you share and with whom is your choice, and Aklti does not receive it.
3.14. Data we do not collect
- We do not collect your location, contacts, microphone or voice, files, or advertising identifier, and the App contains no advertising or analytics SDKs. On Android the App blocks microphone and storage permissions.
4. Why we use your data, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, sign you in | 3.1, 3.12 | Performance of the contract (Terms of Use) |
| Calculate targets, log meals and exercise, check meals against your food profile | 3.2–3.7 | Your explicit consent to processing health data (UAE PDPL; Egypt PDPL; GDPR Art. 9(2)(a)) |
| Protect you: withhold plans or features where a specialist is needed | 3.3 | Your explicit consent |
| Analyse meals with AI (optional) | 3.8 | Separate explicit consent to AI processing |
| Apply daily limits, prevent abuse, keep the service secure, control AI costs | 3.8 (technical record), 3.10, 3.11 | Legitimate interest / performance of the contract |
| Keep proof of your consents | 3.9 | Legal obligation / defence of legal claims |
| Comply with the law and respond to authorities | as needed | Legal obligation |
4.1. We do not use your data for advertising, profiling for marketing, or automated decisions with legal or similarly significant effects. The App's safety rules (for example not creating a plan with certain conditions) are automatic; you can change your answers at any time and they never lock you out of the App.
4.2. We do not use your health data, photos or descriptions to train AI models, and we do not allow our AI provider to do so.
4.3. If you do not give the health-data consent, you cannot use the App, because tracking food requires health data. If you do not give the AI consent, you can still use the App: you can search the food database and describe meals in words, read by a free text parser that runs on our servers without any outside AI. Photo analysis needs the AI consent.
5. AI meal analysis
5.1. What is sent: the meal photo and its optional note, or the meal description you type, or a dish name to be broken into ingredients. They are sent from our servers to Anthropic, PBC (the "Claude" service), which is located in the United States.
5.2. What is not sent: your name, email, user identifier, profile, weight, health answers or food profile are never sent to the AI provider.
5.3. What the AI does: it names the foods and drinks and estimates amounts. It never provides calories or nutrients; those come from Aklti's food database. Its output is an estimate and can be wrong; you review the draft and nothing is saved to your diary until you confirm it.
5.4. What Aklti keeps: we do not store the photo. The text, note, AI output and draft are deleted when you confirm or discard the draft, or after 24 hours at most. Only the technical record in 3.8 remains.
5.5. What the provider keeps: under its terms the AI provider may keep inputs and outputs for a limited period, for example for safety and abuse monitoring, and does not use them to train its models.
5.6. Withdrawal: you can withdraw your AI consent at any time in the App, under Settings → Privacy & data. After that nothing is sent to the AI provider, and text descriptions are read by the free parser. Withdrawal does not affect analyses already made.
5.7. When the monthly AI budget is reached, photo analysis may pause and text descriptions are read by the free parser.
6. The shared dish library
6.1. When the AI breaks a well-known dish (for example "koshari" or "kabsa") into ingredients for one user, we keep the dish's usual name, other common names, its cuisine and the AI's ingredients with grams for one serving in a shared library, so that later users get the dish without another AI call.
6.2. The library contains no information about you: no user identifier, no email, none of the amounts you changed. The words you typed are kept as a name for the dish only when every word is already one of the dish's names (for example "kabsa chicken" for "chicken kabsa"); personal names such as "my mother's dish" are never kept.
6.3. A dietitian reviews the dishes in the library. Library dishes are always shown as estimates.
7. Who we share data with
7.1. We share personal data only with service providers that process it on our behalf and under our instructions:
| Provider | What it does | Data | Location |
|---|---|---|---|
| Supabase, Inc. | Sign-in by email code, sending the code email, and hosting our database | Email, sign-in records, IP address; all data in the database | Frankfurt, Germany (EU) |
| Render Services, Inc. | Hosting our API server | All data passing through the API; server logs | Frankfurt, Germany (EU) |
| Anthropic, PBC | AI recognition of meals (only with AI consent) | Photo, note, description or dish name (see 5) | United States |
| Expo (650 Industries, Inc.) | Delivering App updates | Technical device and app information, IP address | United States |
| Apple, Google | App distribution through their stores | Under their own privacy policies | — |
7.2. We may also disclose data when required by law, a court order or a competent authority, or to protect the rights and safety of users and Aklti.
7.3. If Aklti is merged, acquired or sells its assets, data may pass to the successor, which will be bound by this policy.
7.4. We do not sell, rent or trade your personal data, and we do not share it with advertisers or data brokers.
8. Transfers outside the UAE and Egypt
8.1. Our providers process data outside the UAE and Egypt, including in the European Union (Germany) and the United States.
8.2. We transfer data only with the safeguards the law requires.
9. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, health answers, food profile, diary, exercise, my dishes | While your account exists; deleted when you delete your account |
| Meal photos | Not stored by Aklti |
| Analysis text, note, AI output and draft | Until you confirm or discard the draft, at most 24 hours |
| Technical record of each analysis (3.8) | Deleted with the account, and anonymised after 12 months |
| Usage counters | 90 days, and deleted with the account |
| Consent records | Deleted with the account |
| Server logs | 30 days |
| Shared dish library | Kept indefinitely; contains no personal data |
| Data on your phone | Until you sign out or delete the App |
9.1. When your account is deleted, all your rows in our database are deleted together, and so is your sign-in account at our sign-in provider. Deleted data may remain in our hosting providers' backups for a limited time, until those backups are overwritten.
10. Security
10.1. We protect your data with measures including: encrypted connections (HTTPS/TLS) between the App and our servers and between our servers and the database (with certificate verification); the database rejects any direct access with the App's public key, so only our API server can read data; every request is limited to the signed-in user's own data, and this is tested automatically; sign-in tokens are kept in the phone's secure storage and removed from server logs; no secret keys are stored in the App; rate limits on requests.
10.2. No system is completely secure. If a breach affects your personal data, we will notify you and the competent authorities as the law requires.
11. Your rights
11.1. Subject to applicable law, you have the right to:
- Access your data and receive a copy. The App has no export feature; to request a copy, write to privacy@aklti.app.
- Correct it: you can edit your profile, health answers, food profile, diary items, exercise and dishes in the App at any time.
- Delete it: you can delete diary items, exercise entries and dishes in the App, and delete your whole account in the App under Settings → Privacy & data → "Delete my account and data", or by email to privacy@aklti.app.
- Withdraw consent at any time, without affecting processing before withdrawal. You can withdraw the AI consent in the App (see 5.6), and any other consent by email. Withdrawing the health-data consent means you can no longer use the App; you can delete your account and data in the App at any time.
- Object to or restrict certain processing, and data portability where the law provides it.
- Complain to a supervisory authority: in the UAE, the UAE Data Office; in Egypt, the Personal Data Protection Center; in the EU, your local data protection authority.
11.2. To use your rights, write to privacy@aklti.app from your account's email. We may ask you to confirm your identity. We will answer within 30 days.
12. Adults only
12.1. Aklti is for adults aged 18 or over. Our server refuses to create a profile with a date of birth under 18. If we learn that a person under 18 has given us data, we will delete it.
13. Aklti is not a medical service
13.1. Aklti is a nutrition-tracking tool. It does not diagnose, treat or give medical advice, and the data you give is not used for medical care. See the Terms of Use.
14. Phone permissions
14.1. Camera: to photograph a meal. Photos: to pick a meal photo through the system picker. Notifications: only if you turn on meal reminders. You can turn each permission off in your phone's settings; the related feature will then not work.
15. Changes to this policy
15.1. We may update this policy. Each version has a number and a date. When a change is material, the App will show the new version and ask for your consent again before you continue, and we record the version you accepted.
16. Contact
16.1. KALM L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E., trade licence no. 2314694.01 (Meydan Free Zone, Dubai). Privacy: privacy@aklti.app. Help with the App: support@aklti.app.
16.2. This policy is governed by the federal laws of the United Arab Emirates, without prejudice to the mandatory data protection rights you have under the law of your country of residence (including Egypt PDPL and, for EU residents, the GDPR).