foodakl
The short version
What leaves this phone is what a feature needs, at the moment you use it: a reduced copy of a meal photo when it is read, with the short list of your own foods the app has learned; your own record when you ask it a question, and a summary of it when the coach writes your week; the report behind a share link you make; and, if you choose to make an account, your email address, a backup encrypted with a key we never have, and anything you post to the suggestion board. Our server never stores a photo, and the original never moves. Progress photos never travel at all. Nothing read from your phone’s health store reaches our server in a form anyone can read. We do not sell anything, we do not advertise, and nothing you log is used to train anything. Everything you record lives in this app on this device, and you can take all of it with you at any time.
What is stored on your phone
Every meal photo, every set of numbers read from those photos, your weigh-ins, any progress photos, your water and fasting logs, your supplement schedule, your targets and your preferences. All of it sits in this app’s own private storage, which no other app on your phone can read. Deleting the app deletes all of it permanently, which is why the export exists.
What leaves your phone, and when
A meal photo, when it is read. The app makes a reduced copy of that one photo — resized to at most 1024 pixels on its long edge and re-encoded — and sends that copy to our server, which passes it to the analysis service and returns the food it read. The original photo, at full resolution, never moves. Nothing else about the picture travels with it: not where it was taken, not when, not which phone took it. Location data is never read by this app at all. What does go with the copy is small, and is there so the reading makes sense: the date and the hour you logged the meal, your language so the names come back in it, and — when the reading asked you a question — the answers you gave about that meal. Once the app has learned something about how you eat, a short list goes with the copy too: your own foods — each one’s name, the names a reading has given it before, what is in it, and your usual serving’s figures, at most twelve of them — and the notes you wrote for the app about how you eat. It is what lets a photo of your own shake come back as your shake. No meal, no date and no correction goes with it, and you can see, change or delete every item on it in More → What Foodakl knows about you. Everything else that travels has its own article below, and each one says exactly what it carries: a meal you describe instead of photographing, the written read of your week, Ask your record, share links, the optional account and its backup, the suggestion board, invitations and subscriptions. One thing comes before all of them: the first time the app opens, it introduces itself to our server, so that a free week is given once per phone. What the server keeps, next, says with what.
What the server keeps
Of a photo: nothing. It is held in memory for the seconds the reading takes and is never written to disk, never logged, and never stored in any database. Of a meal you describe: nothing either, in exactly the same way — and the same of the list of your own foods and notes that rides with either. For each installation the server keeps a small record, not linked to your name or email unless you sign in: a random identifier the server gives the app, whether the phone is trialling or subscribed and until when, and a count per day of the readings, questions and written reads it has asked for — which is how a daily allowance works. It also notes whether the phone is an Android phone or an iPhone, and the last day the app was in touch with the server — only the last one, never a history — which is how we count how many people use Foodakl without knowing who they are. On Android the app also sends the identifier the operating system gives this app on this phone; the server keeps only a one-way hash of it, so that reinstalling cannot restart a free week. That record stays after an account is deleted, for the same reason. Beyond that, the server holds only what you choose to put there, each described in its own article: the report behind a share link until the link dies; and, with an account, your email address, your encrypted backups, what you post to the suggestion board, and a record of any invitation you use.
Progress photos are different again
Body photos are never sent to us or to any service, under any circumstances. They are not analysed, they are not uploaded, and they are deliberately excluded from the export file — because an exported image is the thing most likely to end up somewhere you did not intend. A backup you make yourself does carry them, to the folder or file you choose, so a new phone can have them back. Deleting the weigh-in they belong to deletes the photo with it.
Uninstalling, and what that costs
Everything Foodakl holds about you is on your phone, which is the point of the design and also its one sharp edge: uninstalling the app, or clearing its data from your phone's settings, deletes every meal, photo, weigh-in and workout immediately and permanently. There is no copy on our server to restore from, because we never made one. Reinstalling gives you an empty app. A backup or an optional account both survive that, and both are described below. Neither is required. We would rather say this plainly than have you discover it.
Backups you make
More → Your record → Back up writes a complete copy of your record — photographs included, because a food diary without its photographs is a spreadsheet — into storage you own. It never touches our server, we cannot see it, and we could not restore it for you if we wanted to. It happens only when you press the button, and where the copy lands is entirely your choice. The shape differs by phone; the contents do not. On Android it is a folder you choose — Google Drive counts, which is the point. On iPhone it is a single zip file you save or send wherever you like. Unzip that file on a computer and you are looking at the same folder Android writes, holding the same record and the same photographs.
The optional account backup
If you create an account, the app can also keep an automatic copy of your numbers — meals, weights, workouts, notes, settings, and what your phone’s health store has shared with the app; never photographs — on our storage. That copy is encrypted on your phone before it leaves, with a key that is shown to you once as a recovery code and is never sent to us. What our storage holds is ciphertext we cannot open: lose your phone and your recovery code together and nobody can read that backup — not you, and not us either. That sentence is the price of the promise, and we would rather say it here than have you assume otherwise. Deleting the account deletes every backup with it, immediately.
Invitations
If you use a friend’s invitation or one of our codes, we record which account invited you (as an id, never a name or address), the server’s identifier for the phone that used it, and a one-way hash of your email address. The hash and that identifier exist so an invitation cannot be used twice by one person or on one phone; the hash cannot be turned back into your address, it is joined to nothing you wrote, and both stay after you delete your account. The person who invited you is told how many friends joined, never who.
Share links you create
When you share your record with someone helping you, the app publishes a read-only page at a private link: the name you gave the report, if you set one, and your numbers, charts, food names, meal notes, supplements, water, fasting and the weigh-ins you typed — never weigh-ins your phone’s health store supplied, and never your photos, which have no way into it. The link is a long random address nobody can guess, it expires by itself within thirty days at most, and More → Account and sharing → Switch off every live link removes everything you have shared, immediately. While a link is live its content sits on our server; the moment it dies, that content dies with it. Deleting your account does not switch a link off, so do that first if you want it gone sooner.
Describing a meal
When you have already eaten, you can describe a meal instead of photographing it. Sending it carries the words you typed, where you said it was made if you said, the date and the hour of the meal, your language, and the same short list of your own foods and notes that goes with a photo. Nothing else from your record goes with them: no photograph, because there is none; no meal note; nothing from your health store; nothing that identifies you. If the reading asks you a question, your answer travels the same way, together with the description it is about. While you are typing, nothing is sent at all. The suggestions under the field come from the food library stored on your phone, and the words leave once — when you press Read it. We keep none of it. The description is held in memory for the seconds the reading takes and is never written to disk, never logged, and never stored in any database. The service that reads it keeps the request for up to fifty-five days only to detect abuse, never to train anything. On your phone the words stay with the meal, because they are what the reading was made from: they are in your backup and your export, and they go when you delete the meal.
The written read of your week
The coach card on Insight is mostly your own phone talking: the verdict, the evidence, where you stand and the check are all worked out here, and they are there whether you are paying or not. What travels is what turns them into three sentences. That summary carries more than numbers, and it should say so plainly. It carries the days you logged and their totals, the meals in the window WITH THE NAMES of what you ate, roughly when you ate them, the foods you log most often, the weigh-ins you typed and how far they are from your target, your workouts, your supplements and your fasting window — for the period you are looking at and the one before it, so the read can say what changed. The foods you told the app about or kept as yours, and the notes you wrote for it, go too, so the read calls your food by your name for it. Your language rides with it so the answer comes back in it. What it does not carry: no photograph, ever; nothing you typed into a meal note; nothing from your phone's health store, and no figure worked out from it — a weigh-in your scale sent through it stays out of the weight change too; no email address, no account, nothing that says which installation asked. We store none of it. The service that writes the sentences keeps each request for up to fifty-five days, only to detect abuse of its service, and never uses it to train anything. It is also not always something you press. Once a week has closed, the app writes that week's read the next time it wakes up, so it is ready when you look. If you would rather none of this travelled, turn the coach card off in Your cards: every figure on it except the three sentences is computed on your phone and stays there.
Ask your record
Asking a question sends three things: the question you typed, the conversation so far, and your record — your daily totals for up to three years, the meals of the last 120 days with their foods and figures, how often you have had each food, the weigh-ins you typed, your workouts, supplements and fasts, your targets and the profile you gave the app (your goal, and the sex, age, height and activity it works your targets out from), and what the app has learned about you, including the notes you wrote for it. It is the whole record because a question can be about any of it, and the answer works its numbers out exactly from it rather than guessing. The same limits as the written read, for the same reason: no photograph, no meal notes, nothing from your health store or worked out from it, nothing that identifies you. Your meals travel under short labels made for that one question, and only your phone knows which meal each one is. We keep none of it: your record is held only while the answer is written, and nothing from it is logged. The service that writes the answer keeps the request for up to fifty-five days only to detect abuse, never to train anything. What comes back is checked on your phone before it is drawn. Every figure is summed again from your own record, a meal it points at must be one you have, and anything it offers to do — remember a note, log one of your foods, set a target, add water — happens only if you tap it, with Undo straight after. Its guidance is general guidance, not medical advice: it will not diagnose anything, advise on medication, or plan fewer than 1,200 kcal a day.
Notes you write
A note you add to a meal is never sent for analysis, never part of the written read, and never part of an answer on Ask your record — there is nowhere in any of those messages for it to go. It does appear in your export, and on a share link’s page if you make one, because it is your writing and both are meant to be complete. What you tell the app on What Foodakl knows about you is different, and is meant to travel: those notes go with each reading, with the written read and with your questions on Ask your record, because helping them understand how you eat is what they are for. Each one can be kept off readings, changed or deleted there.
The account is optional, and why
You never have to make one — the app works without it, forever; only the suggestion board and invitations need one. If you choose to, an account is one email address and nothing else: no password, no social sign-in, no profile. It exists so your encrypted numbers backup can find you on a new phone, so a subscription or days of Premium can follow you there, and so the board counts one person’s vote once. The email is the one piece of personal information the account adds; it is used to send sign-in codes and for nothing else — no newsletters, no marketing, nothing sold. Delete the account and the email, every backup and everything you posted to the board go with it, while everything on your phone stays yours.
The suggestion board
The suggestion board, in More, is where people with an account post ideas for the app and vote on them. What you post — a title and a line or two — is shown to everyone else who opens the board, without your name, your email or anything else that says it was you. We keep it with your account so you can take it back, so a vote counts once, and so a report can be acted on; the same goes for your votes and anything you report. Before an idea is posted, the analysis service reads it to keep abuse, repeats and personal details — an email, a phone number, an address — off the board. Anyone who opens the board can report an idea or hide it from their own view, and we remove what breaks the terms. If we edit or remove an idea, our record of that action keeps the words we changed. Taking an idea back, or deleting your account, removes it from the board and from our database. When an idea you posted is planned, built, shipped or turned down, or we leave you a note about it, the app tells you — on the board, and with a short notice the next time you open it. A note is shown only to you, and it goes when the idea goes. If you voted for an idea that ships, you hear that too. We can pause an account from posting, or block it from the board altogether: its ideas come off the board, its votes stop counting, and the app tells that account so rather than leaving it to guess. On an idea someone else posted, “Hide their ideas” takes every idea by the same person off your board. That choice is kept on your phone: it tells neither us nor them, and nobody is ever shown who it was.
Subscriptions and purchases
Premium is bought through Google Play or the App Store, and paid for there: we never see a card, a billing address or your store account. A subscription service checks each purchase with the store for us and tells our server which plan is live and until when. That service knows this installation only by a random purchase identifier our server makes up for it — never your email, and nothing from your record. We keep a record of each purchase event the store reports (which plan, when, and what changed), because it is the only way to answer somebody who writes in to say they paid. Cancelling happens in the store that billed you.
Analytics
There is no third-party analytics library in this app. No advertising identifier is read. No behavioural profile is assembled. The counters on the server meter the readings a subscription pays for, and in total — never per person — tell us whether readings are working. One library does report on itself: on Android, the scanner that reads a recovery code’s QR when you set up a new phone is a Google library, and it sends Google basic diagnostics about the scan when it runs.
The website
foodakl.com counts its own visits and the taps on its store buttons, on our own server, with no cookie and no third-party script. What it keeps is the page, the name of the site you came from (never the link), the campaign words on a link you followed, which kind of phone, and which store. To count visitors without naming them, the server writes down a code made from your address and your browser with a secret that changes every day and is never stored, so the code cannot be turned back into you and cannot follow you from one day to the next. Your address itself is never kept. If your browser sends Global Privacy Control or Do Not Track, the website does not count you at all. Nothing about the website reaches the app or your record.
Who else is involved
A few services do work for us, on our instructions, and each receives only what its job needs. The analysis service reads the reduced meal photos, writes the answers on Ask your record and the coach’s three sentences from the summaries described above, and screens suggestion board posts. It never receives your device identifier, your email or anything that would connect one request to another. Under our agreement it may not use what we send to train or improve its models; it keeps requests for up to fifty-five days only to detect abuse of its service, where authorised staff can review them for that purpose alone. A subscription service checks purchases with Google Play and the App Store (see Subscriptions and purchases). A mail service delivers sign-in codes, so it receives the email address you typed and the code. Our own server runs on rented infrastructure, and the company that rents it to us has no access to what is stored on it.
Your phone’s health store
If you switch the health sync on, Foodakl reads and writes through your phone's own health store — Health Connect on Android, Apple Health on iPhone — and only what you permitted: meals, water and weigh-ins go out to it; steps, active energy and weigh-ins come back in. That data is used to show and keep your record on this phone, and for nothing else. It is never used for advertising and never sold. The app sends nothing read from it — and no figure worked out from it — to our server or to anyone else in a form anyone can read: it is left out of the written read, out of Ask your record, and out of every share link. The one place it reaches our server is inside the optional account backup, encrypted on your phone with a key we never have. The backups and exports you make yourself include it, because they are your whole record and they go only where you send them. You can see and revoke every permission in your phone's own health settings at any moment, and the sync simply stops.
Children
Foodakl is for adults — eighteen and over. It is not designed for or directed at children, and calorie targets computed for adults are not appropriate for a growing body. We do not knowingly collect anything from anyone younger; if you are under eighteen, please use something built for you, ideally with a professional involved.
Your rights over your data
You can read everything the app holds, because it is all shown to you in the app itself, and More → What the server holds lists what is on our side. You can take a complete copy at any time from More → Your record → Export as. You can delete any individual item, or all of it at once, from More → Your record → Delete everything, which clears the record from this phone and cannot be undone. If you have never signed in, your log has only ever existed on this phone. If you have linked an account, the server also holds your email address, whatever backups you have made, what you have posted or voted on the suggestion board, and a record of any invitation you used — and clearing the phone does not remove those. More → Account and sharing → Your account → Delete account removes them; so does https://api.foodakl.com/delete without the app, or writing to support@foodakl.com. Deleting an account does not remove what exists to stop a free week or an invitation being claimed twice: the phone’s record described in What the server keeps, and the one-way hash and identifier described in Invitations. Nor does it remove the record of purchase events, or a share link before it expires. How long everything else lasts is in How long things are kept.
How long things are kept
A photo, a question, a summary for the written read: not kept by us at all. The service that reads them keeps each request for up to fifty-five days, only to detect abuse. A share link’s page: until the link expires — thirty days at most — or you switch it off. Your account, email address, backups and board posts: until you delete them or the account; only your three newest backups are ever kept. A sign-in code: ten minutes. The server’s logs, which record the internet address each request came from, the address it asked for, the app or browser that asked and when, so that abuse can be spotted and slowed — never what you logged: seven days for the app server’s log, fourteen for the web server’s. Copies of the database made each night in case of a failure: fourteen days, so something deleted can survive in one for up to two weeks. Kept for as long as the service runs, because each exists to stop the same thing happening twice: the phone’s record (What the server keeps), the invitation hash and identifier (Invitations), the record of purchase events (Subscriptions and purchases), and our record of moderation actions on the board.
Security
Everything sent to the server travels over an encrypted connection, and account backups are encrypted on your phone before they leave it. On your phone, the app’s storage is sandboxed by the operating system and protected by your device lock. Our database accepts connections only from our own server, under an account that can do no more than the app needs. The analysis key that lets the server talk to the engine lives only on the server; it is not in the app, and the app has no way to reach the engine directly.
This is not medical advice
Foodakl estimates. A photograph cannot see oil absorbed into a fried potato or sugar dissolved in a sauce, and the numbers here are approximations offered to show you patterns over weeks — not measurements to make clinical decisions from. If you are pregnant, managing diabetes or an eating disorder, recovering from illness, or taking medication affected by food, talk to a professional. Nothing this app says should displace that conversation.
Changes to this policy
If what the app does with your data changes, this page changes with it, and the date below moves. A change that made your photos leave the device, or that started storing them, would be announced plainly and would not be switched on quietly.