Last updated: 7 October 2026 · Effective: 7 October 2026
Yumcal (“we”, “us”) is operated by Baslel Workineh Ayele, a sole trader based in Dubai, United Arab Emirates. We are the data controller for the information described here.
For any privacy question or request, contact basketouae@gmail.com.
| Data | Why we need it | Legal basis |
|---|---|---|
| Account Email address, name, and — if you sign in with Google or Apple — the identifier from that provider. | To create your account, sign you in, and sync your data across devices. | Performance of a contract |
| Health & fitness profile Sex, age, height, weight, goal weight, activity level, allergies, and dietary restrictions such as no pork or vegetarian. We do not ask about religion or beliefs. | To calculate your calorie and macronutrient targets. This is the core function of the app. | Explicit consent |
| Meal logs Food names, portion sizes, nutrition values and the time you logged them. A meal photo is sent for analysis and is not stored on our servers — it stays on your phone. | To identify your food, calculate its nutrition, and show your progress over time. | Explicit consent |
| Progress data Weight entries, water intake, streaks and achievements. | To chart your progress and keep your streak. While you have a live logging streak, your first name, last initial and streak length can appear on the in-app leaderboard that other Yumcal users see. Your weight, meals and other progress data never do. | Explicit consent |
| Coach conversations Messages you send to the in-app AI coach and its replies. | To answer your questions with the context of your recent meals and targets. | Performance of a contract |
| Groups & chat Groups you join or create, messages you post in them, people you block, and reports you file. Other members see your first name and last initial (for example “Sam K.”) — never your full name or email. | To run the social features. Anything you post in a group is visible to that group’s members. Reports are reviewed by our moderators to remove content that breaks the community rules. | Performance of a contract |
| Push token A device notification token and your platform (Android/iOS). | To send meal reminders and account notices. Only stored if you enable notifications. | Consent |
| Subscription status Whether you have an active plan, which plan, and its renewal date. | To unlock paid features. Handled by RevenueCat and Google Play. | Performance of a contract |
| Server logs Standard request logs from our API, including IP address and timestamp. We do not embed any crash-reporting or analytics SDK in the app. | To keep the service secure and diagnose faults. | Legitimate interest |
The camera is used only when you choose to photograph a meal or scan a barcode. Photo library access is used only for the image you pick. Nothing is captured in the background, and nothing is uploaded except the specific meal image you submit for analysis.
Yumcal does not use your microphone. The app requests no audio permission and contains no recording feature.
We use the data above to:
We do not use your personal data or meal photos to train third-party AI models. If you explicitly correct one of our estimates, we may store that correction to improve our own accuracy.
We share data only with the processors needed to run the service:
| Processor | Purpose | Data shared |
|---|---|---|
| Clerk | Authentication | Email, name, sign-in identifiers |
| Neon | Database hosting | All account and meal data |
| Vercel | Site and API hosting | Requests in transit |
| Google (Gemini API) | Food recognition and coach replies | The meal image or text you submit, and relevant nutrition context |
| RevenueCat | Subscription management | A pseudonymous user id and purchase status |
| Google Play Billing | Payment processing | Handled entirely by Google; we never see your card details |
| Expo | Push notification delivery | Device push token and message content |
| Open Food Facts, USDA FoodData Central | Food and barcode lookup | The barcode or search term only — never your identity |
We may also disclose data where legally required, or to protect the rights and safety of our users. If Yumcal is ever acquired, your data may transfer to the acquirer under this same policy, and we will notify you beforehand.
We are based in the United Arab Emirates and our processors operate globally, so your data may be processed outside your country. Where data leaves the European Economic Area or the UK, we rely on Standard Contractual Clauses or an equivalent safeguard.
You can, at any time:
We respond to every request within 30 days, and we never charge for it.
All traffic between the app and our servers uses TLS. Data is encrypted at rest by our database provider. Access to production systems is restricted and authenticated. No system is perfectly secure, but if a breach ever affects your data we will notify you and the relevant regulator without undue delay.
Yumcal is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete it.
Yumcal estimates nutrition and offers general guidance. It is not a medical device and does not provide medical advice, diagnosis or treatment. AI estimates can be wrong. Always consult a qualified healthcare professional before making significant changes to your diet, particularly if you are pregnant, managing a medical condition, or have a history of disordered eating.
If we make a material change we will notify you in the app before it takes effect. The “last updated” date at the top always reflects the current version.
Baslel Workineh Ayele
Dubai, United Arab Emirates
basketouae@gmail.com