Privacy policy
1. Who is responsible
Your personal data is processed by Licora Studio as the data controller (Turkish Personal Data Protection Law No. 6698, "KVKK", and the EU GDPR where it applies). Contact: licorahelp@gmail.com.
2. Data that stays on your phone
The following lives in the app's own storage on your phone; it is not sent to us and we can't access it:
- Profile and targets: sex, birth year, height, weight, activity level, your goal and pace, daily calorie and macro targets, language and time zone.
- Meal logs: the text in which you describe what you ate, food names, amounts, weights, calories, macro- and micronutrients, meal type, date and time.
- Consent: the version and date of the consent you gave.
If device backup is on, Android may include this data in your device backup in your Google account (end-to-end encrypted with your screen lock on Android 9 and later). Google keeps that backup for you; we can't access it.
3. Data that passes through our server
- Meal analysis: the text in which you describe or correct a meal, the app's language and your phone's local time; for corrections, the draft table on screen (food names, amounts, nutrient values).
- Micronutrient estimates: the name, weight, calories and macros of the items you saved.
- Install ID: a random number made on your phone when the app first opens. It is not your name, e-mail, phone number or advertising ID; it is used only for the request limits that prevent abuse, and "Delete all my data" replaces it.
- IP address: reaches our server as with any internet connection; used only for the request limits.
Your profile, measurements, targets and meal history are not sent to the server. Our server has no database: it answers requests and doesn't keep their content. Its logs contain only technical details such as the type of request, its duration, its result and the AI cost; not the text, the install ID or the IP address.
Voice: when you speak, your phone's own speech recognition service (Google on Android) turns it into text. We never receive or store audio; only the resulting text is used. The speech service is subject to Google's privacy terms.
Food, body measurements and targets may count as health data (special category data).
4. Why
- To split the meals you describe into items and estimate their calories, macro- and micronutrients;
- to protect the service against abuse (request limits) and run it securely.
Your daily targets, summaries and history are calculated on your phone.
5. Legal bases
- Processing meal descriptions for analysis (may be health data): your explicit consent (KVKK Art. 6; GDPR Art. 9(2)(a)), given when you first open the app.
- Install ID and IP address: legitimate interest in operating the service securely (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
- Transfers abroad (below): your explicit consent and the safeguards of KVKK Art. 9.
6. Who receives it
- Hosting: our server runs in Hetzner Online GmbH's data centre in the European Union; requests are processed there and not stored.
- AI analysis: the analysis and estimate content described above is sent to Google LLC's Gemini API. Under the paid API terms Google does not use this content to improve its products; it may keep it for a limited time only to detect abuse and meet legal obligations. Your install ID and IP address are not sent to Google.
These providers are outside Turkey; data is transferred only for the purposes above and only as far as needed. We don't sell your data, use it for advertising or marketing, or share it with anyone else, except where the law requires it.
7. How long it is kept
- Data on your phone: until you delete it (Profile and settings → Delete all my data) or uninstall the app.
- On our server: request content is not stored. Request counters (by install ID and IP address) are held only in the server's memory and are gone within 25 hours.
- Google: for the limited abuse-detection period described above.
8. Security
All traffic between the app and the server is encrypted (HTTPS). No user data is kept on our server; the AI access key lives only on the server, never in the app. To protect the data on your phone, we recommend using a screen lock.
9. Your rights
You can ask whether and how your data is processed, and have it corrected or deleted; you can object to or restrict processing and withdraw your consent at any time. The data on your phone can be viewed, corrected and deleted in the app; there are no records about you on our server. To withdraw consent, stop using the app and delete your data. Questions: licorahelp@gmail.com; we reply within 30 days. You may also complain to the Turkish Personal Data Protection Authority or, in the EU, to your data protection authority.
10. Deleting your data
In the app, Profile and settings → Delete all my data deletes all of your data on the phone right away. Uninstalling the app deletes it too. More: Data deletion.
11. Age
VOXACAL is for people aged 18 and over; we don't knowingly process data of anyone younger.
12. Medical disclaimer
The values shown are estimates, not medical advice. Talk to a doctor or dietitian about your health.
13. Changes
When we update this policy we change the effective date above, and we announce important changes in the app.