KAITA Privacy Policy

KAITA is operated by Mihin Wickramaratne, an individual developer based in Sri Lanka ("KAITA", "we", "us"), who provides the KAITA fitness and nutrition application for iOS and Android and the website at https://kaita.app and is the controller responsible for the personal information described in this policy.

You can contact us about anything in this policy at support@kaita.app.

This policy explains what information KAITA processes, why, who it is shared with, how long it is kept and the choices you have. It applies to the KAITA app and website.

When you create an account we process your email address, your display name, an encrypted password credential (we never see your password in readable form), a profile image if you upload one, and the account identifiers our authentication provider issues.

We also collect your date of birth. We use it to verify that you are 16 or older and to personalise your calorie, macro and training recommendations, which depend on your current age. Your date of birth is never shown to other users, is included in your data export, and is deleted with your account.

If you sign in with Google or Apple, we receive only the information those services share with your permission — typically your name, email address and a stable account identifier. KAITA never receives or has access to your Google or Apple password.

We also process email verification and password-reset events so we can confirm your address and keep the account secure.

During onboarding and in Settings you can provide: age or date of birth, gender, height, weight, fitness goal, experience level, gym or home training preference, available equipment, training days and session length, injuries or physical limitations, and your diet preferences including dietary requirements, allergies and foods you want to avoid.

You also select your country or nationality during onboarding, and you can change it later in Settings. We store that country code and use it to select the appropriate regional experience — for example the Sri Lankan or international recipe, food and coaching content — and to present the subscription offering and store pricing that applies to your region.

This information is used only to build and adjust your workout and nutrition plans, and to deliver the regional experience described above. Some of it (for example injuries, allergies and body measurements) is health-related, so we treat it as sensitive and never use it for advertising.

Health-related and Apple Health information is processed only with your separate, explicit consent, which you give in the app and can withdraw at any time. It is never bundled into your acceptance of the Terms.

KAITA stores the workout plans and templates assigned to or created for you, scheduled and completed workouts, exercises, sets, repetitions and weights, session duration, training history, progress and personal records, and any exercises or templates you create yourself.

Steps, walking or running distance, sleep and recovery information are processed only when you explicitly connect a supported health service and grant permission at the operating-system level, or when you enter them yourself in the app.

KAITA stores your meal logs, custom meals, recipe favourites, calorie and macronutrient totals and targets, hydration logs, fasting activity, sleep logs, and body weight and weight goals.

KAITA's scanner has three modes: meal photographs, packaged-food nutrition-label photographs and barcode/product scans. In every mode the photograph you capture or select is sent to our AI provider for recognition. KAITA's servers pass the image through and do not save it to the database or to file storage; the provider may retain it briefly for abuse monitoring under its own policy. For barcode scans, the digits read from the image may also be sent to the public Open Food Facts product database to look up the product.

What is stored is the resulting text: the food or product name, barcode digits where read, portion or serving size, calorie and macronutrient values, and any note or ingredient list produced by the scan, saved to your log if you accept it. Corrections you type are stored so recognition accuracy can be reviewed and improved.

AI Coach conversations (your messages and the assistant's replies) are saved to your account so you can continue them later. A small AI memory store keeps a few long-term preferences you have shared, which you can view and delete individually.

When you ask the AI Coach a question, relevant profile and training context is included in the request so answers are personalised. When you generate a plan, your onboarding answers are used as input. When you scan a meal, a nutrition label or a barcode, that image is included in the request.

Scan images (meal photographs, label photographs and barcode photographs) are sent to the AI provider for analysis and are not written to KAITA's database or file storage; the provider may retain them briefly for abuse monitoring under its own policy. Only the resulting text (food or product name, barcode digits, portion, macros, notes) and any correction you type are stored. Corrections are kept in the food_recognition_feedback table linked to your account.

KAITA records AI usage events (timestamp, feature, token counts and estimated cost) so fair-use limits and costs can be enforced. These records contain no message content.

AI requests are processed by OpenAI (AI Coach chat) and by Google Gemini models accessed through the Lovable AI Gateway (food recognition and plan generation). These are business/API tiers, under which the providers do not use submitted content to train their models. Providers may retain content briefly for abuse monitoring in line with their own policies.

KAITA does not record, upload or transcribe voice or audio. No audio is captured by any released feature.

To operate and secure the service we process technical information such as device type, operating system, app version, IP address and standard server request logs, together with error and diagnostic messages generated by the app.

If remote notifications are enabled for your platform, a device notification token and the associated platform and app version are stored so reminders can be delivered. Local reminders scheduled on your device do not leave your device.

Camera access is requested only when you open the food scanner. Photo-library access is requested only when you pick a food photo or save a workout summary image. On iOS, Health access is requested only when you choose to connect Apple Health.

KAITA does not collect precise location, your contacts, advertising identifiers, browsing history outside the app, or unrelated device data. KAITA contains no advertising SDKs and does not run third-party analytics or crash-reporting SDKs.

Some information stays only on your device, including your theme and language choice, favourites cache, the local copy of your current Coach chat, fasting timer state and offline log queues.

KAITA offers auto-renewing subscriptions through Apple's App Store in the iOS app and through Google Play Billing in the Android app. Apple or Google processes your payment credentials and all billing; neither KAITA nor RevenueCat ever receives your complete payment-card details. No purchases are processed on the web.

KAITA uses RevenueCat as its subscription infrastructure provider to retrieve the available offerings and prices, to start and validate purchases with the App Store, to restore previous purchases and to manage your subscription entitlement.

For this purpose KAITA and RevenueCat may process: your KAITA account identifier, the RevenueCat app-user identifier linked to it, the product identifier, the offering and package you selected, transaction and original transaction identifiers, purchase and expiry dates, subscription status and renewal status, free-trial or introductory-offer status, the store and store country associated with the purchase, the sandbox or production environment, and your entitlement status.

Your subscription status is synchronised to KAITA's backend through RevenueCat and its authenticated webhook, so premium access can be granted, renewed or ended on your account. KAITA stores this as a mirror of the store's verified entitlement; it is never used to grant access that the store has not confirmed.

If you voluntarily enter a KAITA partner or offer code associated with a gym partner, influencer, promotional partner, campaign or other approved offer, KAITA may associate information about that redemption with your account. This may include the partner or campaign, the entered code or an appropriately protected code identifier, redemption status, relevant platform and store information, timestamps, and a store transaction or subscription reference where needed to confirm attribution. We use this information to validate codes, prevent abuse and fraud, attribute qualifying subscriptions or redemptions to the appropriate partner or campaign, administer partner and promotional programmes, resolve redemption issues and maintain accurate records. Attempt and security logs use masked or otherwise protected code information for rate limiting, security and abuse prevention rather than unnecessarily storing raw attempted codes.

Entering a partner or offer code does not itself activate Premium access, independently change an App Store or Google Play price or guarantee a discount. On iOS, eligible offers are redeemed through Apple's official offer-code or redemption process, and KAITA grants subscription access only after the resulting entitlement has been received and verified through its subscription infrastructure.

You can manage, change or cancel your subscription at any time in your Apple ID subscription settings on iOS or your Google Play subscription settings on Android. Cancelling stops future renewals; access continues until the end of the period you have already paid for.

Deleting your KAITA account does not by itself cancel your App Store or Google Play subscription. You must cancel it through Apple or Google, otherwise the store will keep charging you.

Restore Purchases is available in the app (on the subscription screen and in Settings) so an existing subscription can be re-linked to your KAITA account on the same or a new device.

Creating, authenticating and securing your account; personalising workouts, nutrition targets and recommendations; recording your progress and synchronising it across your devices; providing the AI Coach, food recognition and plan generation; delivering reminders and notifications you have enabled; applying fair-use limits to AI features; responding to support requests; detecting and preventing abuse, fraud and security incidents; diagnosing technical problems and improving reliability; and meeting our legal obligations.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you (providing the app), your consent (health-service connections, camera, photo, notification access and optional AI features), our legitimate interests (security, abuse prevention, reliability) and legal obligations. Health-related data is processed on the basis of your explicit consent, which you can withdraw at any time.

KAITA does not sell personal or sensitive user data. KAITA does not use health or fitness data for advertising, and does not share it with data brokers.

We disclose information only to the providers listed below, to deliver a feature you requested, to comply with law or legal process, or to protect the rights, safety and security of users and the service. If Kaita is ever involved in a merger or acquisition, we will notify users before their information becomes subject to a different policy.

Supabase — authentication, database and file storage (account, profile, training, nutrition, AI conversation and usage records, profile images). https://supabase.com/privacy

OpenAI — AI Coach chat completions (your messages and the profile context included in the request). https://openai.com/policies/privacy-policy

Google (Gemini models, accessed through the Lovable AI Gateway) — food recognition and workout plan generation (food photographs, onboarding answers). https://policies.google.com/privacy and https://lovable.dev/privacy

Google Sign-In — optional sign-in (name, email, account identifier you agree to share). https://policies.google.com/privacy

Application hosting and email delivery are provided by Lovable, including transactional authentication emails such as verification and password reset (your email address). https://lovable.dev/privacy

RevenueCat — subscription offering retrieval, purchase validation, restoration and entitlement management. RevenueCat receives subscription and purchase identifiers, store and product information, entitlement status, an app-user identifier linked to your KAITA account, and limited device and app technical information needed to provide the subscription service. https://www.revenuecat.com/privacy

For partner and promotional programmes, limited attribution and redemption information may be used to determine that a qualifying redemption occurred for a particular partner or campaign. Partners do not receive your full KAITA account information, health or fitness information, nutrition data, workout history, AI conversations, payment credentials or other unrelated personal data through this feature. Apple, Google and RevenueCat may independently process information needed to complete and verify a purchase under their respective privacy practices.

Apple and Google operate the App Store and Google Play distribution and the device push infrastructure used for notifications where enabled. Apple and Google additionally operate App Store and Google Play billing for KAITA subscriptions and may process your payment, transaction and subscription information under their own privacy policies. https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy

Open Food Facts — public product lookup for barcode scans (the barcode digits read from your scan). https://world.openfoodfacts.org/privacy

KAITA uses no advertising networks, no analytics SDK and no third-party crash-reporting service.

KAITA is a fitness and nutrition application. KAITA is not a medical device and provides no medical service.

KAITA does not diagnose, treat, cure or prevent any medical condition. AI responses, nutrition estimates, calorie and macronutrient figures and fitness recommendations may be incomplete, inaccurate or unsuitable for you.

Consult a qualified healthcare professional before starting or changing a training or nutrition programme, and about any medical condition, injury, allergy, pregnancy, medication, diagnosis or treatment. Never rely on KAITA in an emergency — contact your local emergency services.

Health-service connections are optional. On iOS, KAITA can read step count and walking or running distance from Apple Health only after you grant HealthKit permission; KAITA does not write data to Apple Health. The current Android release includes no health-service integration and requests no Android health permissions. The web app connects to no health service.

You can revoke health permissions at any time in your device settings (iOS: Settings › Health › Data Access & Devices › KAITA).

Health and activity data is used only to power the fitness, nutrition and activity features you see in the app. It is never used for advertising and is never sold.

Your data is stored both on your device (caches, offline queues and preferences) and on KAITA's servers, operated on our behalf by Supabase.

All traffic between the app and our servers uses HTTPS/TLS. Supabase encrypts stored data at rest. Server-side records are scoped to your account and enforced with row-level security policies, so one account cannot read another account's data. Profile images live in a private storage bucket accessible only through short-lived signed URLs. Passwords are stored only as salted hashes by our authentication provider.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our providers may process data in countries other than yours, including the United States. Where the GDPR applies, such transfers rely on the European Commission's Standard Contractual Clauses or an equivalent approved safeguard included in our agreements with those providers.

Account, profile and personalisation data is kept while your account exists, and is deleted when you delete your account.

Workout history, nutrition, hydration, sleep, step and body-weight logs are kept while your account exists so you can see long-term progress, and are deleted with your account.

AI Coach conversations and AI memory are kept until you clear them or delete your account. You can clear them at any time from this page or from the Coach screen.

Scan images (meal, nutrition-label and barcode photographs) are not written to KAITA's database or file storage: they are passed to the AI provider for analysis and discarded, and the provider may hold them briefly for abuse monitoring under its own policy. Only the resulting text and any correction you typed are stored by KAITA, and both are deleted with your account.

AI usage records (timestamps, token counts, cost) are retained for fair-use and cost accounting and are deleted with your account.

Server request and security logs are retained by our hosting and database providers for a short period under their standard configuration, typically a few days to a small number of weeks, and are not linked to your profile beyond an account identifier and IP address.

Backups: our database provider takes routine encrypted backups. Deleted data can persist in those backups until they expire on the provider's rolling schedule, after which they are overwritten.

Aggregated or anonymised information that can no longer identify you (for example counts of feature usage) may be retained indefinitely.

Subscription and entitlement records (product, transaction identifiers, purchase and expiry dates, status and store events) are retained while they are needed to provide premium access, allow purchases to be restored, prevent fraud and abuse, resolve disputes and meet accounting and legal obligations.

Partner-code attribution and redemption records follow the same retention and deletion principles: they are kept only while needed to validate and administer the offer or partner programme, confirm attribution, prevent abuse or fraud, resolve redemption issues and maintain legally required records. They are deleted with your account unless a limited record must be retained for one of those purposes or a legal obligation, in which case only the minimum necessary is kept until that purpose ends.

After you delete your KAITA account, Apple, Google and RevenueCat may keep their own transaction records under their legal and accounting obligations. Deleting your KAITA account does not cancel your App Store or Google Play subscription — you must cancel that through Apple or Google.

Where the law requires us to keep limited records — for example to prevent fraud or abuse, resolve disputes or meet accounting obligations — we retain only the minimum necessary and delete it once that purpose ends.

Export: Settings › Privacy & Data › Export My Data downloads a JSON copy of your account, profile, workouts, meals, hydration, sleep, steps and reminder settings.

AI history: Privacy & Data › AI usage lets you clear all AI Coach conversations and remove individual AI memory entries.

On-device data: Clear On-Device Data removes KAITA's local caches, favourites, local Coach chat copy and timer state from that device.

Delete account: Privacy & Data › Delete My Account permanently deletes your account, all of the data above and your stored profile image after an in-app confirmation. Deletion is immediate and cannot be undone.

If you cannot use the app, see https://kaita.app/delete-account for how to request deletion.

Depending on where you live, you may have the right to access your personal information, correct it, receive a portable copy, request deletion, restrict or object to certain processing, and withdraw consent at any time (including consent for health-service, camera, photo or notification access, which you can also revoke in your device settings).

You can exercise access, portability and deletion directly in the app, or contact us at support@kaita.app. We verify requests using the email address registered to the account and respond within 30 days.

Withdrawing consent does not affect processing carried out before withdrawal. If you believe we have handled your information improperly, you may lodge a complaint with your local data-protection authority.

KAITA is intended for people aged 16 and over. We do not knowingly collect personal information from anyone under 16.

A sign-in account can exist before onboarding is finished, so an email or Google/Apple account may be created before we have a date of birth. Onboarding asks for your date of birth, and access to the service is blocked when the date you submit shows you are under 16. Until an eligible date of birth is confirmed, no personalised feature is available.

For eligible users aged 16 and 17, KAITA processes health, fitness, nutrition and AI-related information only with clear, separate consent, and calorie and weight-goal recommendations are kept conservative (no automatic calorie deficit or surplus).

If we learn that someone under 16 has provided us with personal information, we will delete the account and its data. You can also contact support@kaita.app and we will delete it.

We may update this policy when the app, our providers or legal requirements change. The last-updated date at the top of this page always reflects the current version.

If we make a material change — for example a new category of data, a new provider or a new purpose — we will notify you in the app or by email before the change takes effect, and where required we will ask for your consent again.

Mihin Wickramaratne (Kaita) — support@kaita.app — https://kaita.app

Privacy questions, data requests and complaints are all handled at this address.