Privacy Policy

In short: Kitty works without an email address or password. Your profile, meals and weight are stored on servers in Frankfurt, Germany. Photos and voice recordings are only used to analyze your meal and aren't stored by us. No ads, no selling of data, no tracking. You can delete everything in the app at any time.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Portionscore UG (haftungsbeschränkt)
Hornbühlstraße 5
79117 Freiburg im Breisgau
Germany
Managing directors: Jonathan Schäfer, Paul Hummel
Email: kontakt@portionscore.de

For any question about your data, write to us at the email address above.

2. Data in the Kitty app

Your account

Kitty doesn't ask for your email address or a password. When you open the app for the first time, we create an account with a random ID. It links your data to your app and to your subscription. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Your profile and plan

During setup you tell Kitty your name or nickname, your age, height, weight, goal weight, activity level, preferred pace, your experience with tracking and how Kitty should talk to you. You can also give Kitty a name. From this, Kitty calculates your daily goals for calories and macronutrients. We store these details so the app can show your plan. Details about your body and weight are health data (see section 3).

Food diary and weight

When you log a meal, we store what you ate, the amount, the date and time, the meal, the nutrition values, how you logged it (photo, barcode, chat or manually) and, if you scanned one, the barcode. We also store the weights you enter. This is your diary, which we need to show your day, your history and your progress.

Photo analysis

When you take or choose a photo of a meal, the app sends it to our server, which forwards it to OpenAI to recognize the foods and estimate the amounts. On iPhone models with a LiDAR sensor, the app measures the depth of the scene on your device and only sends a size estimate along with the photo. We don't store the photo after the analysis. The camera and your photos are only used when you choose to scan a meal.

Voice input

When you tell Kitty what you ate, the recording is sent through our server to OpenAI and turned into text. We don't store the recording. The microphone is only used while you're recording.

Chat with Kitty

When you write to Kitty, we send your message to OpenAI together with the context Kitty needs for a helpful answer: your name and Kitty's name, your chosen tone, your daily goals and what's left of them today, today's meals, the time of day, your current weight, goal weight and expected goal date, your average of the last 7 days and foods you often log. Your chat history is only stored on your device.

Barcodes, food search and recipes

When you scan a barcode or search for a food, the app sends the barcode or search term to our server, which looks it up in our food database. The values come from Open Food Facts, the German Federal Food Code (BLS) and the USDA. Product photos are loaded directly from the servers of Open Food Facts, so your IP address is transmitted to Open Food Facts.

When Kitty suggests a dish, our server looks for matching recipes on the web through the Brave Search API. Only the name of the dish is sent, no personal data. The preview images are loaded through Brave's image service, so your IP address is transmitted to Brave. When you open a recipe, the linked website's own privacy policy applies. When you import a recipe, our server reads the recipe page and keeps the result, without any personal data, so it loads faster next time.

Subscription

Kitty is sold as a subscription through Apple's App Store. Apple handles the payment; we never see your payment details. To know whether your subscription is active, we use RevenueCat, which receives your account ID, your purchases and the purchase receipts from Apple. Legal basis: Art. 6(1)(b) GDPR.

Fair use and security

To protect the AI features from misuse, we record when your account uses an AI feature (account ID, type of request, time). Our server provider also keeps short-lived technical logs, such as IP addresses and error messages, to keep the service secure and running. Legal basis: our legitimate interest in a secure and stable service (Art. 6(1)(f) GDPR).

App updates

The app checks for updates through Expo (EAS Update). For this, your device sends technical information such as its IP address, the app version and the platform. Legal basis: Art. 6(1)(f) GDPR.

We don't use advertising, analytics or tracking tools in the app, and we don't use your data to train AI models.

3. Health data and your consent

Your weight, height, goal weight and food diary can reveal information about your health. We therefore only process them with your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you give during setup. You can withdraw your consent at any time with effect for the future by deleting your account in the app (Profile, then Delete account) or by writing to us. Without this consent, Kitty can't calculate a plan or keep your diary.

4. Service providers

We work with the following providers. Unless marked as their own responsibility, they process data only on our behalf under a data processing agreement (Art. 28 GDPR).

5. Transfers outside the EU

Some providers are based in the USA or may process data there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise we use the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of these safeguards.

6. How long we keep data

• Profile, diary and weights: as long as your account exists. When you delete your account in the app, we delete them immediately and permanently, together with your subscription record at RevenueCat.
• Photos and voice recordings: not stored by us after the analysis.
• Chat history: on your device until you delete the app.
• Records of AI use: as long as your account exists.
• Technical logs: a few days, depending on the provider.

Deleting the app alone doesn't delete your account. Please delete your account in the app first (Profile, then Delete account). If you've already removed the app, write to us and we'll help.

Apple keeps records of your purchases under its own rules and legal obligations.

7. This website

This website is hosted by Vercel Inc. When you visit it, Vercel processes technical data such as your IP address, the time of the request, the page you open and your browser, to deliver the site and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR. The website doesn't set cookies, doesn't use analytics or tracking and loads its fonts from our own server.

When you email us, we only use your message and your address to answer you and delete them once they're no longer needed, unless the law requires us to keep them.

8. Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data deleted (Art. 17 GDPR),
• restrict the processing (Art. 18 GDPR),
• receive your data in a common, machine-readable format (Art. 20 GDPR),
• object to processing based on our legitimate interests (Art. 21 GDPR),
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

Just write to kontakt@portionscore.de. Because Kitty doesn't know your email address, we may need some details from you to find your account.

You also have the right to lodge a complaint with a data protection authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

9. Children, security and changes

Kitty is not intended for children under 16.

All connections are encrypted. In our database, your data can only be accessed with your account.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). Your calorie goal is a calculated suggestion that you can change at any time.

We update this policy when Kitty changes. The current version is always available on this page.