Calma Privacy Policy
This policy explains what information Evolui AB ("Evolui", "we", "us") collects when you use the Calma app, how we use it, and the choices you have.
The data controller is Evolui AB, corporate identity number 559345-8705, Pildammsvägen 95F, 215 34 Malmö, Sweden. You can reach us at support@evolui.io.
The short version
Your symptom and food logs stay on your iPhone. The only things that leave it are a photo or meal description you ask us to analyse, which we do not store, and a barcode number you scan. We never sell your data and never use it for ads.
- Your symptoms, gut checks, program and meal log stay on your device unless you choose to export or share them.
- When you scan a plate or label or describe a meal, that photo or text is sent for analysis and we do not store it. A scrambled device code is sent with it only to enforce a daily scan limit, and is deleted after two days.
- We do not sell your data and we do not show ads. Analytics are pseudonymous and never include the content of your entries or any health values.
- Purchases go through Apple. We never see your card details.
What Calma stores and sends
Your gut health data
The symptoms you log (bloating, pain, gas, urgency, stool type, stress and notes), your gut check answers, your elimination and reintroduction program with its challenge results, and your meal log with its FODMAP ratings are health information. They are stored only on your iPhone. We cannot see them and they are not uploaded to us. Analytics record only that something was logged, never what. Deleting the app, or using Reset all data in Settings, deletes them.
Onboarding answers
During setup you answer questions about your age and sex, your diagnosis, your symptoms and stool type, what you eat and have tried, and any warning signs. These answers are stored on your device to set up your program. They are not sent to analytics; analytics only record that a setup step was completed, apart from non-health answers such as how many meals you eat a day.
Plate photos, label photos and meal descriptions
When you scan a plate or describe a meal, the photo you took or the text you typed is sent to our analysis function, hosted on Supabase in Stockholm, Sweden, which forwards it to OpenAI to identify the ingredients and estimate portions. When you photograph the ingredient list on a pack, the photo goes the same way so the list can be read. We do not store the photo or text on any server. To stop abuse of the service, each scan also carries your device’s app-vendor identifier and arrives with your IP address. Both are scrambled with a one-way hash before they are saved, are used only to count scans against a daily and hourly limit, are never linked to the photo, text or anything else about you, and are deleted after two days. OpenAI does not use it to train its models and may keep it for up to 30 days to detect abuse before deleting it. The FODMAP rating itself is calculated on your device. A plate photo stays on your phone with the meal entry and is deleted with it. You can always type a description instead of taking a photo.
Camera and photo library
Calma uses the camera only when you open the scanner, to photograph a plate or a label or read a barcode, and reads only the photos you pick from your library. Barcodes are decoded on your device. You can turn off either permission in iPhone Settings; the rest of the app works without them.
Barcode lookups
When you scan a packaged product, the barcode number is sent to Open Food Facts, a non-profit food database in France, to fetch the product name and ingredient list. No identifier for you is sent. The ingredient list is checked for FODMAP sources on your device.
Reports
When you export a report for your dietitian or doctor, the PDF is generated on your device and shared through the iOS share sheet to the destination you choose.
Notifications
On first launch Calma asks iOS for quiet notifications, which arrive only in Notification Center, without a banner or sound, and need no prompt. Until you subscribe, Calma uses them for a few reminders to finish setting up, including a time-limited offer on the day you first see the subscription screen. You can turn offer notifications off on the offer screen, and turn off all notifications in iPhone Settings. After you subscribe, Calma asks for full notification permission; if you allow it, meal check-ins, program day reminders and the trial reminder are shown as banners. All of these are scheduled locally on your device. We do not run a push notification server.
Information we collect
Usage analytics
We use PostHog to understand how Calma is used. This includes events such as which screens are opened and which features are used, along with device type, operating system version, app version, and a random identifier for the install. Analytics are pseudonymous: we have turned off PostHog's IP-based location lookup, and we do not send the content of your entries or any health values to analytics.
Purchases
Subscriptions and one-time purchases are processed by Apple through the App Store. We use RevenueCat to validate purchases and manage subscription status. RevenueCat receives a random app user identifier, the purchase receipt, and subscription status. Neither we nor RevenueCat receive your name, payment card, or Apple ID.
Support
If you email us, we keep the email and the information you include in it so we can help you and improve the app.
Crash reports
If the app crashes, a report containing technical details about the device and the state of the app may be sent to us or to Apple, depending on your device settings.
What we do not collect
- Calma does not require an account, name, or email.
- We do not collect precise location or track you across other apps or websites.
- We do not read your contacts, photos, or other apps' data unless a specific feature asks you for permission.
- We do not use third-party advertising SDKs.
How we use information
We use the information above to operate the app, provide purchases you make, fix bugs, understand which features are useful, and respond to support requests. Where the GDPR applies, our legal bases are performance of a contract (providing the app and your purchases), our legitimate interest in improving and securing the app (analytics and crash reports), and your consent where we ask for it, for example for location or Apple Health access.
Sharing
We share information only with the service providers named in this policy, who process it on our behalf, and with authorities where the law requires it. We do not sell personal information. The providers for Calma are:
- PostHog — usage analytics
- RevenueCat — purchase validation and subscription status
- Apple — App Store purchases and crash reports
- Supabase — hosting the analysis function that receives a scan photo or meal description and passes it to OpenAI
- OpenAI — recognising ingredients in plate photos and meal descriptions, and reading ingredient lists from label photos
- Open Food Facts — looking up packaged products by barcode
International transfers
We are based in Sweden. PostHog and RevenueCat process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses. Supabase is based in the EU (Calma’s project runs in Stockholm, Sweden). OpenAI is based in the United States, under the EU-US Data Privacy Framework and standard contractual clauses. Open Food Facts is based in France (EEA).
Retention
Data on your device stays until you delete it. Pseudonymous analytics data is kept for a limited period and then deleted or aggregated. Purchase records are kept for as long as needed to provide your subscription and meet accounting obligations.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export personal information we hold, and to object to or restrict its processing. Because your data lives on your device, the quickest way to delete it is to delete the app. For anything we hold, email support@evolui.io and we will respond within 30 days. If you are in the EU or UK you can also complain to your data protection authority. In Sweden this is the Integritetsskyddsmyndigheten (IMY).
Children
Calma is not directed at children under 13 (or 16 where that is the applicable age) and we do not knowingly collect information from them.
Security
Data on your device is protected by your device's own encryption and passcode. Data sent to our service providers is encrypted in transit.
Changes
We will post any changes here and update the date at the top. If a change is significant we will tell you in the app.