How does Kairo handle my data, and how do I delete my account?

Kairo's database and sign-in run on Supabase in an EU region. Row-level security policies make sure every account can only access its own data. Data processing agreements under Art. 28 GDPR are in place with all processors. Analytics (PostHog) and error monitoring (Sentry) are both used with EU hosting.

Some services are located outside the EU. The complete list with provider, purpose, legal basis and transfer mechanism is in the privacy policy.

For the analysis, a photo is sent through Kairo's server to the Google Gemini API (Google LLC, USA). Kairo uses the paid API: Google does not use the data to train AI models, keeps it for a maximum of 30 days for abuse and security monitoring, and then deletes it automatically. Google is certified under the EU-US Data Privacy Framework.

For nutrition look-ups on branded products and restaurant dishes, only the recognised product or dish name is sent to a web search service, with no image and no user identifier. For a barcode scan, only the barcode number goes to Open Food Facts. Voice input is converted to text on your device; no audio leaves the iPhone.

Account data (email address, name, display name, optionally a profile picture), the body and goal details from setup, and your meals including photos. Body data is health data under Art. 9 GDPR and is only processed with your explicit consent.

Account data is kept until you delete your account, meal data until you delete it or delete the account. Analytics and error data are kept for 90 days, billing data for as long as the law requires (up to 10 years). Kairo processes Apple Health data locally on the device.

Open your profile, tap "Legal", and in the "My Data" section tap "Export Data". Kairo creates a JSON file with your data and opens the iOS share sheet so you can save it or pass it on.

You have the rights granted by the GDPR: access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. Email support@kairocalories.com; we reply within 30 days. If you no longer have access to the app, you can also request deletion of your account this way.

The competent supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information. Provider details are in the imprint.