Privacy Policy

Last Updated: October 1, 2026 Effective Date: February 1, 2025

This Privacy Policy describes the policies and procedures of Openkan LLC ("Company," "we," "us," or "our"), the publisher of Last Calorie and the controller of your personal data (2108 N ST STE N, Sacramento, CA 95816, USA), regarding the collection, use, and disclosure of your information when you use Last Calorie (the "Service"). It explains your privacy rights and how the law protects you.

BY USING THE SERVICE, YOU AGREE TO THE COLLECTION AND USE OF INFORMATION IN ACCORDANCE WITH THIS PRIVACY POLICY. If you do not agree, please do not use the Service.

1. Interpretation and Definitions

Interpretation

Words with initial capitalization have specific meanings defined below, regardless of whether they appear in singular or plural.

Definitions

• Account: A unique account created for you to access our Service.
• Affiliate: An entity that controls, is controlled by, or is under common control with us.
• Cookies: Small files stored on your device to track and enhance your experience.
• Device: Any device capable of accessing the Service, such as a computer, cellphone, or tablet.
• Personal Data: Any information that identifies or can identify an individual.
• Service Provider: Third-party companies or individuals who assist in delivering the Service.
• Usage Data: Data collected automatically, such as IP addresses and browsing behavior.
• You: The individual or legal entity accessing or using the Service.

2. Collection and Use of Your Personal Data

Types of Data Collected

Personal Data

We may collect the following types of personally identifiable information:

• Email address
• Your name, if your Apple or Google account provides it when you sign in
• A username, if you set one
• Age and date of birth
• Physical characteristics (weight, height, activity level)
• Dietary goals and preferences
• Health and wellness information you provide
• Food images uploaded for AI analysis
• Text descriptions and meal logs
• Voice recordings (if you use voice input features)
• Payment and billing information (processed by third-party payment processors)

Meal logs, meal photos and the nutrition estimates we derive from them are health-related data. Section 15 explains how we treat them.

Photos you upload are re-encoded on your device before upload, which removes embedded metadata such as GPS location.

Usage Data

This includes:

• IP address, browser type, and version
• Pages visited, time spent on pages, and diagnostic data
• Mobile device information (device ID, model, OS, browser type)
• AI chat usage counts (the number of messages you send to the in-app AI assistant — the content of your chats is not stored on our servers)
• App usage patterns, feature usage, and engagement metrics
• Crash reports and error logs

3. How We Use Your Data

We use your data for the following purposes:

3.1 Service Delivery

• Providing and Improving the Service: AI-driven calorie and macronutrient analysis
• AI assistant: Answering your questions in the in-app AI chat
• Personalizing your experience: Customizing recommendations based on your preferences
• Account Management: Managing user accounts, subscriptions, and preferences

3.2 No AI Training on Your Data

• We do not use your data to train AI models: Your uploaded images, meal logs, text and interaction data are not used to train AI models — neither ours nor those of third parties
• Quality assurance: Checking AI outputs for accuracy
• Research and development: Developing new features and improving existing ones

3.3 Business Operations

• Customer Support: Resolving inquiries and providing technical assistance
• Security & Fraud Prevention: Detecting, preventing, and investigating security threats, abuse, and fraudulent activity
• Payment Processing: Processing subscriptions and payments (handled by third-party processors)
• Analytics: Understanding usage patterns, app performance, and user engagement

3.4 Marketing and Communications

• Marketing & Promotions: Sending newsletters, promotions, product updates, or personalized recommendations. We send marketing emails only if the marketing email switch is on. During sign-up, this switch is on by default if your device region is the United States, and off by default everywhere else or when the region is unknown; skipping that step leaves it off. You can turn marketing emails on or off at any time in Settings → Privacy & data → Marketing emails, and every marketing email includes an unsubscribe link
• Surveys and feedback requests: Gathering user feedback to improve the Service

3.5 Legal and Compliance

• Legal Compliance: Complying with laws, regulations, subpoenas, and law enforcement requests
• Enforcing our Terms: Investigating violations of our Terms of Service
• Protecting rights: Defending against legal claims and protecting our legal rights

4. Sharing Your Data

We may share your information under the following circumstances:

4.1 With Service Providers and Third Parties

We share data with third-party service providers who assist in operating our Service:

• Third-party AI processing: Your images, text, and other content may be processed by external AI service providers (including large language model providers and computer vision systems) to deliver AI-powered features
• Cloud hosting providers: Data is stored and processed on cloud infrastructure managed by third parties
• Analytics providers: We use third-party analytics tools to understand usage patterns and improve the Service
• Payment processors: Payment and billing information is processed by third-party payment providers
• Customer support tools: Support inquiries may be managed through third-party platforms
• Marketing and communication platforms: Email and notification services

The main service providers that process personal data on our behalf are:

• OpenAI (United States): analyzes meal, food label and grocery photos, voice recordings, and text descriptions and corrections to estimate nutrition and suggest recipes, and analyzes the one photo you choose in the optional onboarding demo. Data we send to OpenAI is processed only to provide the Service
• Anthropic (United States): powers the in-app AI chat assistant (AI Chat add-on). We send it your chat messages and the summaries of your meal, nutrition and workout data needed to answer them (for example meal names, calories and macronutrients, and workout totals such as the number of workouts, calories burned and duration). Data we send to Anthropic is processed only to provide the Service
• Supabase (United States): hosts our database, user authentication and file storage
• OpenAI Ads (United States): measures the performance of our ads shown in ChatGPT. On our website, the OpenAI Ads pixel records page views and clicks on our App Store and Google Play download buttons; it loads only when the lc_country cookie (set from the country of your IP address) shows you are outside the European Economic Area, the United Kingdom and Switzerland. If you install the app after tapping one of our ads in ChatGPT, our servers send OpenAI conversion events (app installed, registration completed, trial started, subscription started, with the plan and price) together with your email address and user ID hashed with SHA-256, your IP address, your device's user agent and the ad click reference, only to measure how our ads perform. We do not send these events for users in the European Economic Area, the United Kingdom or Switzerland, or for users who did not arrive through an OpenAI ad, and on iOS we send them only if you allow tracking through App Tracking Transparency. We show the App Tracking Transparency prompt only on iOS, and never in the European Economic Area, the United Kingdom or Switzerland

Other service providers that process personal data on our behalf: RevenueCat (United States) for subscriptions and purchases; PostHog (United States) for product analytics and, on iOS, session replay with camera and photo screens masked; Google (United States) for Firebase Analytics, Crashlytics crash reports and, on our website, Google Analytics and Google Tag Manager; Sentry (United States) for error reports; Amazon Web Services (United States) for sending emails (Amazon SES); and Vercel (United States) for hosting our website and measuring its traffic and performance.

We send our AI providers the content each feature needs, without your name or email address. In the app, sending content to our AI providers requires that you allow AI data sharing; you can turn it off at any time in Settings → Privacy & data → AI data sharing, and the AI features are then unavailable. The optional onboarding demo, which happens before you create an account, runs only after you allow AI data sharing and sends only the photo you choose to analyze; if you decline, the demo is skipped.

Under their current API policies, neither OpenAI nor Anthropic uses the data we send through their APIs to train their models. OpenAI keeps it for up to 30 days for abuse monitoring, unless longer retention is required by law. Anthropic deletes it within 30 days, unless it is flagged for a usage policy violation, in which case Anthropic may keep it for up to 2 years.

IMPORTANT: We require service providers to protect your data, but we are not responsible for their security practices, data breaches, or how they use your data beyond our direct instructions.

4.2 With Affiliates

We may share data with our affiliates and subsidiaries for:

• Internal operations and business purposes
• Security improvements and fraud prevention
• Feature development and enhancement
• Marketing and promotional purposes

4.3 For Business Transfers

In the event of a merger, acquisition, asset sale, or bankruptcy, your data may be transferred to the acquiring entity or successor.

4.4 For Legal Reasons

We may disclose your information when required by law or when we believe disclosure is necessary to:

• Comply with law enforcement requests, subpoenas, court orders, or legal proceedings
• Investigate or prevent fraud, security threats, or illegal activity
• Enforce our Terms of Service
• Protect the rights, property, or safety of Openkan LLC, our users, or the public

4.5 With Your Consent

We may share your data for purposes not described in this policy if we obtain your explicit consent.

4.6 Aggregated and Anonymized Data

We may share aggregated or anonymized data that cannot identify you personally for research, marketing, or business purposes.

5. Data Retention Policy

We retain your data for different periods depending on the type of data and its purpose:

5.1 Account Data

• Personal account information is retained as long as your account is active
• After account deletion, most personal data is deleted within 30-90 days, except where retention is required by law

5.2 Content and User-Generated Data

• Uploaded images and text: Retained as long as your account is active and deleted when you delete your account (subject to Section 5.4)
• AI chat: Conversations with the in-app AI assistant are kept only in memory on your device and are not stored on our servers; we store only the number of messages you send
• AI meal analysis: The calorie and macronutrient estimates for a meal are stored with the meal and kept until you delete the meal or your account
• Meal logs and nutrition data: Retained as long as your account is active; deleted within 90 days of account deletion
• Contributions to a discontinued feature: Photos, ratings, comments and dish names you shared through a community feature that has since been discontinued are kept, but are not visible to anyone and are not used. They are deleted when you delete your account, or earlier if you ask us at contact@lastcalorie.com

5.3 Usage Data

• Analytics and diagnostic data: Retained for up to 2 years for performance monitoring and improvement
• Security and fraud logs: Retained for up to 5 years for security purposes and legal compliance

5.4 Legal and Compliance

• Data may be retained longer if required by law, regulation, legal proceedings, or to defend against legal claims

6. Security Measures

🔐 How We Protect Your Data:

We implement reasonable security measures to protect your data, including:

• Encryption: AES-256 encryption for sensitive data at rest
• Secure connections: HTTPS (TLS 1.2/1.3) for all data transmissions
• Access controls: Role-based access restrictions limiting who can access user data
• Regular security assessments: Periodic security reviews and vulnerability testing
• Monitoring: Continuous monitoring for suspicious activity and security threats

🚨 IMPORTANT SECURITY DISCLAIMER

NO SYSTEM IS 100% SECURE. While we implement industry-standard security measures, we cannot guarantee absolute protection against:

• Data breaches, hacking, or unauthorized access
• Security vulnerabilities in third-party services or AI providers
• Transmission interception or man-in-the-middle attacks
• Social engineering or phishing attacks targeting users
• Loss, theft, or misuse of your login credentials

YOU ACKNOWLEDGE THAT YOU USE THE SERVICE AT YOUR OWN RISK and that we SHALL NOT BE LIABLE for any security breaches, data loss, or unauthorized access to your information, whether caused by us, third-party service providers, or other parties.

Your Responsibility

You are responsible for:

• Maintaining the confidentiality of your login credentials
• Using strong, unique passwords
• Notifying us immediately if you suspect unauthorized access to your account

7. Your Privacy Rights

You have the right to:

• Access, Correct, or Delete Data: Request a copy of your stored data, correct inaccuracies, or delete your account.
• Restrict Processing: Limit the ways your data is used.
• Withdraw Consent: Opt-out of AI processing, marketing communications, or third-party data sharing.

To exercise these rights, contact us at contact@lastcalorie.com. Additional rights for residents of Brazil, Japan and certain US states are described in Section 16.

8. Do Not Sell or Share My Data (CCPA, GDPR & Privacy Rights)

8.1 We Do Not "Sell" Personal Data

We do NOT sell your personal data for monetary consideration. However, under certain privacy laws (such as CCPA), sharing data with third parties for certain purposes may be considered a "sale" or "sharing."

8.2 Data Sharing That May Constitute a "Sale" or "Share"

We may share your data with third parties in ways that could be considered a "sale" or "share" under privacy laws:

• Third-party AI service providers for AI-powered features
• Analytics and advertising partners for personalized recommendations and marketing
• Marketing platforms for promotional communications

8.3 Your Right to Opt-Out

You have the right to opt out of data "sales" or "sharing" by:

📩 Emailing us at: contact@lastcalorie.com with "Do Not Sell/Share My Information" in the subject line ⚙ Adjusting settings in your account dashboard (if available)

Note: Opting out may limit certain features or personalization capabilities.

Google Analytics: Our website uses Google Analytics to measure traffic. In the European Economic Area (EEA), the United Kingdom and Switzerland, analytics and advertising storage is off by default. To stop Google Analytics from collecting your browsing data, install Google's opt-out browser add-on: Google Analytics Opt-out Browser Add-on

8.4 Rights for California Residents (CCPA)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal data is collected, used, disclosed, or sold
• Request deletion of personal data (with certain exceptions)
• Opt-out of the sale or sharing of personal data
• Non-discrimination for exercising privacy rights

8.5 Rights for European Residents (GDPR)

Under the General Data Protection Regulation (GDPR), European residents have the right to:

• Access your personal data and obtain a copy
• Rectification of inaccurate or incomplete data
• Erasure ("right to be forgotten") under certain circumstances
• Restriction of processing in certain situations
• Data portability to receive data in a structured format
• Object to processing based on legitimate interests or for direct marketing
• Withdraw consent at any time (where processing is based on consent)

8.6 How to Exercise Your Rights

To exercise any of these rights, contact us at: 📧 Email: contact@lastcalorie.com 📝 Subject Line: "Privacy Rights Request"

We will respond to your request within 30 days (or as required by applicable law). We may require verification of your identity before processing your request.

8.7 Limitations

Some privacy rights may be limited by law. For example:

• We may retain data required for legal compliance or to defend against legal claims
• We may deny requests that are manifestly unfounded, excessive, or repetitive

9. Children's Privacy

🚸 Age Restriction: Our Service is NOT intended for individuals under 18 years of age.

• You must be at least 18 years old to use this Service.
• We do not knowingly collect personal data from individuals under 18.
• If you are under 18, you are PROHIBITED from using the Service.
• If you believe we have unintentionally collected data from someone under 18, contact us immediately at contact@lastcalorie.com so we can delete it.

Parents and guardians: If you discover that your child under 18 has provided us with personal information, please contact us immediately.

10. Cookies and Tracking Technologies

We use cookies for:

🍪 Types of Cookies We Use

• Necessary: Authentication, fraud prevention, session management.
• Preferences: Remembering user choices and settings.
• Analytics: Tracking usage patterns, performance optimization.

You can manage or disable cookies in your browser settings.

11. International Data Transfers

11.1 Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States and other jurisdictions where our service providers operate. Our database, user authentication and file storage (Supabase) and our AI providers (OpenAI and Anthropic) are located in the United States.

IMPORTANT: Different countries have different data protection laws, and some may provide less protection than your home country.

11.2 Legal Basis for Transfers

We transfer data internationally based on:

• Your consent (by using the Service)
• Contractual necessity to provide the Service
• Standard contractual clauses approved by relevant authorities
• Adequacy decisions where applicable
• Legitimate business interests

11.3 Third-Party Service Providers

Our third-party service providers (including AI providers, cloud hosting, and analytics services) may be located in various countries, including:

• United States
• European Union
• Other countries where data protection laws may differ

We are not responsible for the data protection practices of these third-party providers or the laws of the countries where they operate.

11.4 Your Consent

BY USING THE SERVICE, YOU EXPLICITLY CONSENT TO THE TRANSFER OF YOUR DATA TO OTHER COUNTRIES, including countries that may not offer the same level of data protection as your home country.

12. Third-Party Links and Services

The Service may contain links to third-party websites, services, or integrations that are not owned or controlled by us.

WE ARE NOT RESPONSIBLE FOR:

• The privacy practices of third-party websites or services
• The content, accuracy, or policies of third-party sites
• Data collected by third-party services when you leave our Service

We encourage you to review the privacy policies of any third-party services you visit or use.

13. Changes to This Privacy Policy

13.1 Right to Modify

We reserve the right to update or modify this Privacy Policy at any time in our sole discretion.

13.2 Notification of Changes

We will make reasonable efforts to notify you of material changes by:

• Updating the "Last Updated" date at the top of this policy
• Sending email notifications (if you provided an email address)
• Displaying in-app notifications
• Posting prominent notices on the Service

13.3 Acceptance of Changes

Continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy.

If you do not agree with the changes, your sole remedy is to stop using the Service and delete your account.

13.4 Your Responsibility

It is your responsibility to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your data.

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, OPENKAN LLC SHALL NOT BE LIABLE FOR:

• Any unauthorized access to or disclosure of your personal data
• Any data breaches, security incidents, or loss of data
• Any misuse of your data by third-party service providers
• Any damages resulting from data collection, use, or sharing practices described in this policy
• Any harm caused by third-party AI models or external services

YOU ACKNOWLEDGE THAT YOU USE THE SERVICE AT YOUR OWN RISK and that we make no guarantees regarding the security or privacy of your data.

15. Health-Related Data

15.1 What We Treat as Health-Related Data

Your meal logs, meal photos, the calorie and nutrition estimates we derive from them, and the physical characteristics and goals you enter (weight, height, activity level, dietary goals) can reveal information about your health. We treat all of them as:

• sensitive personal data concerning health under Brazil's General Data Protection Law (LGPD, art. 5, II and art. 11)
• consumer health data under the Washington My Health My Data Act (RCW 19.373)
• sensitive personal information under the California Consumer Privacy Act as amended by the CPRA, and "sensitive data" under other US state privacy laws, where those laws apply

15.2 Why We Use It

We use health-related data only to:

• Estimate the calories and nutrients of your meals and show you your history and progress
• Provide the features you ask for
• Keep the Service secure and working, and comply with the law

We do not sell health-related data, and we do not use it for advertising or to train AI models.

15.3 Consent

We process health-related data on the basis of your consent, which you give when you create your account and start logging meals. You can withdraw your consent at any time by deleting your meal logs or your account, or by contacting us (Section 17). Withdrawing consent does not affect processing that took place before.

16. Additional Rights by Region

16.1 Brazil (LGPD — Lei nº 13.709/2018)

If you are in Brazil, Openkan LLC is the controller of your personal data, and you have the rights set out in LGPD art. 18, including to:

• Confirm whether we process your data, and access it
• Correct incomplete, inaccurate or outdated data
• Have unnecessary or excessive data, or data processed in breach of the LGPD, anonymized, blocked or deleted
• Data portability to another provider
• Deletion of data processed on the basis of your consent
• Information about the public and private entities with which we share your data
• Information about the possibility of not giving consent, and its consequences
• Withdraw your consent
• Request review of decisions taken solely on automated processing (art. 20)
• Petition the National Data Protection Authority (ANPD)

Data Protection Officer (Encarregado): Ricardo Naoki Horiguchi, Openkan LLC, 2108 N ST STE N, Sacramento, CA 95816, USA — contact@lastcalorie.com. This is also our communication channel with data subjects and the ANPD.

International transfer (LGPD art. 33): your data is transferred to and processed in the United States (Section 11), through the service providers listed in Section 4.1. We carry out these transfers when they are necessary to perform the contract you enter into with us, at your request (art. 33, IX, together with art. 7, V) — for example, to analyze the meals you log or answer your questions in the AI chat — and, where the provider offers them, under the standard contractual clauses approved by the ANPD (Resolution CD/ANPD nº 19/2024), as Google does for Firebase and Google Analytics. You can ask us for more information about these safeguards at contact@lastcalorie.com.

16.2 Japan (Act on the Protection of Personal Information — APPI)

If you are in Japan:

• Provision to third parties: We do not provide your personal data to third parties without your consent, except where permitted by law. Processing by our service providers (such as OpenAI, Anthropic and Supabase) on our behalf is an entrustment of handling, not a provision to third parties.
• Transfer to foreign countries: We entrust the handling of your personal data to service providers in the United States (Section 4.1). The United States has no comprehensive federal law on the protection of personal information equivalent to the APPI; protection comes from sector-specific federal laws, enforcement by the Federal Trade Commission, and state laws such as the California Consumer Privacy Act, so the level of protection may differ from that in Japan. The Personal Information Protection Commission publishes information about the US system (ppc.go.jp). Our providers handle your data under contracts that limit its use to providing services to us and require them to protect it.
• Business operator and representative: Openkan LLC, 2108 N ST STE N, Sacramento, CA 95816, USA. Representative: Ricardo Naoki Horiguchi, Openkan LLC. Contact: contact@lastcalorie.com.
• Security control measures: We take the following measures to protect your personal data:
  • Organizational: our representative is responsible for the handling of personal data and for responding to requests and incidents.
  • Technical: all communication between the app, our website and our servers is encrypted (HTTPS/TLS); database access rules (row-level security) let each user read and change only their own records; stored photos are kept in private storage and opened only through time-limited signed links; server credentials are kept on our servers and are never shipped in the app; on your device, the login session is stored encrypted with a key held in the device's secure storage; photos are re-encoded on your device before upload, which removes location metadata; and the analytics data we send includes health information only as ranges (for example an age or BMI range), never exact measurements.
  • Access control: administrative access to user data is limited to authorized personnel.
  • Physical: we do not run our own servers; your data is held in the data centers of our cloud providers.
  • Understanding the external environment: we hand data to providers in the United States after reviewing the protection system described above.
• Your requests: You may ask us to disclose, correct, add to, delete, stop using, or stop providing to third parties your retained personal data, and to disclose records of provision to third parties, by contacting contact@lastcalorie.com.

16.3 United States — Additional State Privacy Rights

California (CCPA/CPRA). In addition to the rights in Section 8.4, California residents have the right to correct inaccurate personal information and to limit the use and disclosure of sensitive personal information. The sensitive personal information we process includes health-related data (Section 15). We use sensitive personal information only for purposes permitted without offering a right to limit.

Other states. Residents of other states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia, Texas and Oregon) may have similar rights to access, correct, delete and port their data, and to opt out of targeted advertising, sale and profiling. We process sensitive data such as health data only with consent. To appeal a decision on your request, reply to our response with the subject "Privacy Appeal".

Washington — Consumer Health Data (My Health My Data Act). Our Consumer Health Data Privacy Policy describes in full the consumer health data we collect, share and why, and how to exercise your rights. In summary: we collect consumer health data (Section 15.1) to provide the Service's nutrition features (Section 15.2). We collect it from you directly and from the photos and text you submit. We share it only with the service providers listed in Section 4.1 that process it on our behalf. We do not sell consumer health data. You have the right to confirm whether we collect, share or sell your consumer health data, to access it (including a list of the third parties and affiliates with which we shared it), to withdraw consent, and to have it deleted. Contact contact@lastcalorie.com with the subject "Consumer Health Data". You may appeal a refusal by replying to our response; if the appeal is denied you may contact the Washington State Attorney General.

17. Contact Us

For any privacy concerns, questions, or to exercise your privacy rights, contact us at:

📧 Email: contact@lastcalorie.com 📝 Subject: "Privacy Inquiry" or "Privacy Rights Request"

🏢 Mailing Address: Openkan LLC 2108 N ST STE N, Sacramento, CA 95816, USA

By using Last Calorie, you acknowledge that you have read, understood, and agree to this Privacy Policy.