CalorAI Privacy Policy
Effective: August 12, 2026 · Version 1.0
Starforge Studio Inc. ("we", "us", or "the Company") complies with the Personal Information Protection Act of the Republic of Korea, the Act on the Protection and Use of Location Information, and other applicable laws. This policy explains how we handle the personal information of users of the mobile application CalorAI (the "Service").
Summary — CalorAI handles health-related information such as body weight, meals, and workouts. We use this information solely to provide you with calorie analysis and coaching. We do not use it for advertising or marketing, and we do not sell it to third parties. Meal photos are sent to our AI processing provider for analysis (Section 6) and are not used to train AI models.
1. Information We Collect
a. Information you provide or that is generated while using the Service
| Category | Items | When collected |
|---|
| Account | The unique identifier provided by your social login provider, email address, and nickname. We never collect the password of your social account. | Sign-up and sign-in |
Body information
(sensitive) | Sex, year of birth, height, weight, goal weight, basal metabolic rate (entered or calculated) | Onboarding and profile updates |
Meal records
(sensitive) | Meal photos, food names, portions, estimated calories and nutrients, notes you write | When you log a meal |
Workout records
(sensitive) | Activity type, duration, intensity, distance, elevation, cadence, heart rate, calories burned, and the route travelled during a workout (location data) | When you record a workout |
Weight records
(sensitive) | Recorded weight, time of measurement (morning/evening), notes | When you log your weight |
| Location | Route travelled during workouts; your current location when you request nearby restaurant suggestions | During workout tracking; when you request meal suggestions |
| Payment records | Subscription plan, payment method type, amount, date, and payment/refund history. Card and bank account numbers are handled by the payment processor or app store and are never stored by us. | When you subscribe |
| Inquiries | Conversations with the AI coach and customer support inquiries | When you submit them |
b. Information collected automatically
| Item | Purpose |
|---|
| Step count and device activity data | Estimating daily activity calories |
| IP address, access time, service usage logs | Preventing abuse, improving the Service |
| Device identifier, OS version, app version, time zone | Device optimisation and determining your local day boundary |
c. Information from health platforms (optional)
If you connect Apple Health (HealthKit) or Android Health Connect, we read the following. You may disconnect at any time in your device settings.
- Step count, active energy burned, heart rate, workout sessions
Apple HealthKit — specific commitments — We do not use information obtained through HealthKit for advertising or marketing, and we do not disclose or sell it to third parties such as data brokers or information resellers. It is used solely to provide health management features (calorie calculation, workout analysis, and coaching) to you.
2. Handling of Sensitive Information
Health-related information such as weight, meals, workouts, and heart rate constitutes sensitive information under Article 23 of the Personal Information Protection Act. We handle it as follows.
- We collect and use sensitive information only with your separate, explicit consent, obtained when you first launch the app and at the point of using each feature.
- Sensitive information is used solely to deliver the Service (calorie calculation, goal management, coaching) and never for advertising or marketing.
- You may decline to provide sensitive information, but core features of the Service (recording, analysis, and coaching) will then be unavailable.
3. Handling of Location Information
- Purpose — (i) measuring distance, route, and pace for outdoor activities such as running, walking, and cycling; (ii) finding restaurants near you.
- Method — Collected via your device's GPS only when you start a workout or request a meal suggestion.
- Background collection — While a workout is being recorded, location is collected even when the app is not on screen so that your route is not interrupted. This stops when you end the workout.
- Retention — Workout routes are stored as part of your workout records and are deleted when you delete the record or close your account. The location used for restaurant search is not stored after the results are returned.
- Disclosure — We do not provide personal location information to third parties.
- Withdrawal — You may revoke location permission at any time in your device or app settings. Distance/route measurement and nearby restaurant suggestions will then be unavailable.
4. Purposes of Processing
- Identifying members, confirming sign-up intent, and managing accounts
- Storing and displaying meal, workout, and weight records; calculating calorie balance
- Providing AI-based meal photo recognition, meal and workout suggestions, and personalised coaching
- Determining goal achievement and managing points
- Processing subscription payments and handling withdrawals and refunds
- Preventing abuse (record manipulation, duplicate point accrual, and similar)
- Statistical analysis to improve the Service, in a form that cannot identify individuals
- Delivering notices and essential service announcements
5. Retention Periods
- We delete your information without delay when you close your account. We may retain minimal identifying information for 30 days after closure to prevent abuse.
- Meal photos are deleted when you delete the corresponding record or close your account.
- Detailed usage logs are retained for 90 days from collection and then deleted; thereafter only non-identifiable statistics are kept.
- Where retention is required by law:
- Records of contracts, withdrawal of subscription, payment, and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
- Records of consumer complaints and dispute resolution: 3 years (same Act)
- Access logs (login IP and time): 3 months (Protection of Communications Secrets Act)
6. Processors and Cross-Border Transfers
We entrust the following processors to deliver the Service. Some are located outside the Republic of Korea.
| Processor | Purpose | Items transferred | Country · timing · method | Retention |
|---|
| Anthropic PBC |
Meal photo recognition, meal and workout suggestions, generation of AI coaching text |
Meal photos; summaries of records such as food names and calories; body information (sex, age, height, weight, goal); messages you send to the AI coach |
United States · at the moment you use the feature · encrypted transmission (HTTPS) |
Deleted once the purpose is fulfilled. The processor does not use transferred information to train AI models. |
| Amazon Web Services, Inc. |
Cloud infrastructure: servers, databases, and image storage |
All information stored in the course of using the Service |
Republic of Korea (Seoul region) · while using the Service · network transmission |
Until the processing agreement ends or you close your account |
| Kakao Corp. |
Searching for nearby restaurants (Kakao Local API) |
Coordinates (latitude and longitude) at the time of search, search keywords |
Republic of Korea · when you request meal suggestions · encrypted transmission |
Not stored by us after results are returned |
Payment processors and app stores
(Apple Inc., Google LLC and others) |
Subscription payment, payment authentication, refunds |
Payment method information, amount, and date |
Countries designated by each provider · at the time of payment · each provider's payment system |
As determined by each provider's policy and applicable law |
You may refuse cross-border transfer. However, AI analysis and coaching features are provided only through the overseas processor, so those features will be unavailable if you refuse. Please contact us at the address in Section 12 to exercise this right.
7. Disclosure to Third Parties
We do not disclose your personal information to third parties, except:
- where you have given prior consent; or
- where a lawful request is made by an investigative authority under applicable law.
A future community ("Crew") feature may allow you to share information such as weight or meals with other users at your own choosing. In that case you control the scope of sharing, and anything you do not set to be shared remains private.
8. Destruction of Personal Information
Information whose retention period has expired or whose purpose has been fulfilled is destroyed without delay. Electronic files are deleted by irrecoverable means, and image files such as photos are permanently removed from storage.
9. Your Rights
- You may at any time request access, correction, deletion, or suspension of processing of your personal information.
- In the app's My tab you can edit your body information directly, delete records, and close your account to request deletion of your account and all associated data.
- You can export your data to a file using the export feature.
- Children under 14 may not use the Service. If we learn that such an account exists, we delete it and its data without delay.
10. Security Measures
- Encryption in transit (HTTPS/TLS)
- Token-based access control — the server verifies that you may access only your own records
- Meal photos are held in private storage and served only to authenticated requests from the owner
- Rate limiting on login attempts; minimisation of internal access privileges
- Minimising the number of staff who handle personal information and logging their access
11. Automatic Collection Devices
The Service stores a minimal authentication token on your device to keep you signed in. If we introduce advertising or analytics tools, we will amend this policy at that time and disclose what is collected, why, and how to opt out.
12. Data Protection Officer and Contact
- Data Protection Officer: Seokjun Choi (Chief Executive Officer)
- Contact: support@starforge.work
You may also report concerns to the Korea Internet & Security Agency Privacy Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972).
13. Changes to This Policy
If this policy is amended, we will give notice in the app or on our website at least 7 days before the change takes effect, or at least 30 days in advance where the change materially affects your rights.
Starforge Studio Inc. · CEO Seokjun Choi · 50 Dongsan 1-ro, Deogyang-gu, Goyang-si, Gyeonggi-do, Republic of Korea · Business Registration No. 338-86-03911 · support@starforge.work