多少卡路里 隐私政策
1. 适用范围
本政策说明 多少卡路里 在提供餐食记录、营养估算、体重与身体指标趋势以及账号同步功能时如何处理个人数据。多少卡路里 不是受监管的医疗器械，AI 营养结果仅供一般健康与生活方式参考，不构成诊断、治疗或医疗建议。
2. 我们处理的数据
- 账号与同步数据：登录后的结构化个人档案（如年龄、性别和目标）、餐食记录及用户保存的压缩餐食照片、用户手动输入或从 Apple 健康导入到 App 的身高、体重、体脂及其他身体测量，以及用户手动记录的标准化运动摘要（运动类型、时间、时长、活动能量、距离和来源）。
- AI 输入：仅在用户主动同意并提交时处理所选餐食照片、食物名称与重量等餐食文字、用于文字估算的近期餐食名称、用于生成卡通形象的自拍、主动选择的身体数据截图（每批最多 20 张，包含截图上的日期与测量值）、随机安装标识、请求编号和不含内容的运行元数据。
- 运行与安全数据：任务状态、请求次数、版本、稳定错误码、耗时及供应商用量等，用于交付服务、防滥用和排障。网络服务提供商也会在传输过程中处理 IP 地址、粗略网络位置、请求时间和设备网络元数据。
多少卡路里 不会读取或上传完整的 HealthKit 数据库；仅处理用户明确授权的数据类型。登录后，用户手动记录的运动摘要，以及导入到 App 的身高、体重和体脂记录，可能作为账号同步数据上传，但不会自动发送给 AI 服务。从 HealthKit 读取的锻炼、步数和活动能量记录只在设备内处理，不作为账号同步数据上传。App 不会自动把个人档案或从 HealthKit 读取的记录加入 AI 请求。只有用户主动选择并同意识别的身体截图会发送给 Cloudflare 和火山方舟，用于提取日期与测量值；识别后由用户选择保存哪些值。一批截图识别计为 1 次 AI 调用。手动填写食物名称与重量后保存会调用 AI 估算热量；直接记录身体数值、本地体态评分和本地快速估算不调用 AI。
3. 使用目的
我们仅为提供账号登录与恢复、跨设备同步、用户主动请求的 AI 分析、配额与防滥用控制、服务安全、故障排查以及履行法律义务而处理数据。多少卡路里 不出售个人数据，不投放基于跨 App 或网站行为的广告，也不跟踪用户。
4. 存储与账号隔离
账号同步数据通过 HTTPS 传输；结构化记录存储在私有 Cloudflare D1，用户保存的压缩餐食照片存储在私有 Cloudflare R2，并按服务端用户 ID 隔离。不同登录身份默认是不同账号，不会仅凭邮箱自动合并。退出登录会清除当前设备上的该账号副本；重新登录后可从云端恢复。卸载 App 只删除设备副本，不会自动删除云端账号。
5. AI 与临时对象
异步 AI 分析会将用户主动提交的图片或文字临时存入私有 Cloudflare R2。输入对象会在成功、最终失败或取消后删除，结果会在 App 获取并确认后删除；未正常清理的对象在 1 天后到期，由云存储异步删除；到期不代表已完成删除。对象使用随机键且没有公开访问地址。
6. 服务提供商
- 腾讯云（香港中继）：通过 HTTPS 接收 App 请求并转发至 Cloudflare，包括请求中的账号凭据、同步数据或用户主动提交的 AI 输入；中继代码不保存请求正文。
- Cloudflare Workers、D1、R2 与 Queues：请求校验、设备授权、配额、账号同步、临时对象存储及异步投递。
- 火山引擎方舟：执行用户主动请求的 AI 分析。根据其公开平台条款，未经另行授权不会存储并使用客户数据训练或优化模型；法律义务与内容安全审查所需的处理除外。
- Apple：提供 Apple 登录、HealthKit、MetricKit、通知及 App 分发。
- Google 与微信：仅在用户主动选择对应方式时，验证登录身份并返回账号标识；不会取得用户密码。微信还可能返回昵称。昵称只随本次登录响应回到设备并存入设备钥匙串，多少卡路里 服务端不保留昵称。
7. 保留期限
账号同步数据（包括用户保存的餐食照片）保留至用户删除、替换相应记录或删除账号，或不再需要提供服务。AI 临时对象按第 5 节删除。多少卡路里 主动记录的脱敏运行事件不包含照片、餐食文字、AI 输出、令牌、Cookie、邮箱或电话，最长保留 7 天。服务提供商可能按其适用条款与法律义务处理必要的安全或合规记录。
8. HealthKit
多少卡路里 仅在用户通过 iOS 授权后读取或写入相应 HealthKit 数据。原始记录保留在 Apple HealthKit 中。从 HealthKit 读取的锻炼、步数和活动能量只在设备内处理，不作为账号同步数据上传；导入到 App 的身高、体重和体脂记录，以及用户手动记录的运动摘要，可能按第 2 节同步。健康与运动数据不用于广告，也不出售给数据经纪商。从 HealthKit 直接读取的记录不会自动发送给 AI；用户主动选择的截图识别按第 2 节处理。
9. 用户选择与权利
用户可拒绝 AI 数据使用同意并继续直接记录身体数值、使用本地快速估算或编辑已保存的食物重量与热量。App 提供数据导出、退出登录和删除账号。删除账号会撤销账号会话并删除结构化云端记录、服务端任务状态及仍关联的私有 R2 对象；服务端确认成功后，App 再删除设备副本。有关访问、更正、删除或隐私问题，可通过本政策所列邮箱联系。
10. 儿童隐私
多少卡路里 不以儿童为目标用户，也不会明知故意收集未达到所在地数字同意年龄儿童的数据。如监护人认为儿童向 多少卡路里 提供了个人数据，请联系我们处理。
11. 安全
我们采用传输加密、私有存储、账号隔离、最小化日志和访问控制等措施。任何网络服务都无法保证绝对安全；若发生影响个人数据的安全事件，我们将评估影响并依适用法律和平台规则采取通知等措施。
12. 跨境处理
腾讯云、Cloudflare、Apple、Google、微信和火山引擎可能依其基础设施及适用条款在用户所在国家或地区以外处理数据。我们仅为本政策所述目的使用这些服务，并采取合理措施保护数据。
13. 政策变更与联系
如数据处理方式发生重大变化，我们会更新本政策并在适用时通过 App 或产品页面通知。隐私请求请发送至 the.fake.architect.studio@gmail.com。
本政策是 多少卡路里 当前公开隐私说明。版本：2026-09-15。
CalorieBite Privacy Policy
1. Scope
This policy explains how CalorieBite handles personal data while providing meal logging, nutrition estimates, weight and body-metric trends, and account sync. CalorieBite is not a regulated medical device. AI nutrition results are for general wellness and lifestyle use only and are not diagnosis, treatment, or medical advice.
2. Data we process
- Account and sync data: after sign-in, structured profile details such as age, sex, and goals; meal records and compressed meal photos the user saves; height, weight, body fat, and other body measurements entered manually or imported into the app from Apple Health; and standardized summaries of exercises the user records manually, including type, time, duration, active energy, distance, and source.
- AI input: only when the user expressly agrees and submits a request, selected meal photos or text such as food names and weights, recent meal names used for a text estimate, selfies for cartoon generation, body screenshots expressly selected for import (up to 20 per batch, including visible dates and measurements), a random installation identifier, a request identifier, and content-free operational metadata.
- Operations and security data: job status, request counts, app version, stable error codes, latency, and provider usage for delivery, abuse prevention, and troubleshooting. Network providers also process IP address, approximate network location, request time, and device network metadata while transmitting requests.
CalorieBite does not read or upload the complete HealthKit database and processes only data types the user authorizes. After sign-in, manually entered exercise summaries and height, weight, and body-fat records imported into the app may sync with the account but are not automatically sent to AI services. Workouts, steps, and active-energy records read from HealthKit are processed only on the device and are not uploaded as account-sync data. The app does not automatically add profile data or records read from HealthKit to AI requests. Only body screenshots the user selects and agrees to have recognized are sent to Cloudflare and Volcengine Ark to extract dates and measurements. The user then chooses which values to save. One screenshot batch counts as 1 AI call. Saving a manually entered food name and weight calls AI to estimate calories. Direct body-value entry, local body scoring, and local quick estimates do not call AI.
3. Purposes
We process data only to provide account sign-in and recovery, cross-device sync, AI analysis requested by the user, quota and abuse controls, service security, troubleshooting, and legal compliance. CalorieBite does not sell personal data, run ads based on activity across apps or websites, or track users.
4. Storage and account separation
Account-sync data is sent over HTTPS. Structured records are stored in private Cloudflare D1, and compressed meal photos the user saves are stored in private Cloudflare R2. Both are separated by a server-side user ID. Different sign-in identities are separate accounts by default and are not merged only because they share an email address. Signing out removes that account's copy from the current device; signing in again can restore it from the cloud. Uninstalling the app removes only the device copy and does not automatically delete the cloud account.
5. AI and temporary objects
Asynchronous AI analysis temporarily stores the photo or text submitted by the user in private Cloudflare R2 storage. Input objects are deleted after success, final failure, or cancellation. Results are deleted after the app retrieves and acknowledges them. Objects not cleaned up normally expire after one day. Cloud storage deletes expired objects asynchronously; expiration does not mean deletion is complete. Objects use random keys and have no public URL.
6. Service providers
- Tencent Cloud (Hong Kong relay): receives app requests over HTTPS and forwards them to Cloudflare, including account credentials, sync data, or AI input the user submits. The relay code does not retain request bodies.
- Cloudflare Workers, D1, R2, and Queues: request validation, device authorization, quotas, account sync, temporary object storage, and asynchronous delivery.
- Volcengine Ark: AI analysis expressly requested by the user. Under its published platform terms, customer data is not stored and used to train or improve models without separate authorization, except for processing required by law or content-safety review.
- Apple: Sign in with Apple, HealthKit, MetricKit, notifications, and app distribution.
- Google and WeChat: only when the user chooses the corresponding sign-in method, they verify identity and return an account identifier. CalorieBite does not receive the user's password. WeChat may also return a nickname. It is returned in the sign-in response and stored only in the device Keychain; CalorieBite's server does not retain it.
7. Retention
Account-sync data, including saved meal photos, is kept until the user deletes or replaces the related record, deletes the account, or the data is no longer needed to provide the service. AI temporary objects follow section 5. Redacted operational events created by CalorieBite exclude photos, meal text, AI output, tokens, cookies, email addresses, and phone numbers and are kept for no more than seven days. Service providers may process necessary security or compliance records under their applicable terms and legal duties.
8. HealthKit
CalorieBite reads or writes HealthKit data only after the user grants the corresponding iOS permission. Original records remain in Apple HealthKit. Workouts, steps, and active energy read from HealthKit are processed only on the device and are not uploaded as account-sync data. Height, weight, and body-fat records imported into the app, and exercise summaries entered manually by the user, may sync as described in section 2. Health and fitness data is not used for advertising or sold to data brokers. Records read directly from HealthKit are not automatically sent to AI. Recognition of screenshots expressly selected by the user follows section 2.
9. User choices and rights
Users may decline AI consent and still enter body values directly, use local quick estimates, or edit the weight and calories of saved foods. The app provides data export, sign-out, and account deletion. Account deletion revokes account sessions and deletes structured cloud records, server job state, and associated private R2 objects that remain. After the server confirms deletion, the app deletes the device copy. For access, correction, deletion, or privacy questions, contact the email address in this policy.
10. Children's privacy
CalorieBite is not directed to children and does not knowingly collect data from a child below the age of digital consent where the child lives. A parent or guardian who believes a child provided personal data may contact us to request appropriate action.
11. Security
We use encrypted transport, private storage, account separation, minimized logs, and access controls. No network service can guarantee absolute security. If a security incident affects personal data, we will assess it and provide notice or take other action required by applicable law and platform rules.
12. International processing
Tencent Cloud, Cloudflare, Apple, Google, WeChat, and Volcengine may process data outside the user's country or region under their infrastructure and applicable terms. We use these services only for the purposes described in this policy and take reasonable measures to protect data.
13. Changes and contact
If our data practices change materially, we will update this policy and, where appropriate, notify users in the app or on its product page. Send privacy requests to the.fake.architect.studio@gmail.com.
This is CalorieBite's current public privacy notice. Version: 2026-09-15.