Privacy policy

Last updated 29 September 2026

This policy explains what personal data kcal collects when you use the console and the API, why, and who else processes it. We do not sell personal data and do not use it for advertising.

What we collect

  • Account: your name, email address, password hash or passkey, and the Google or GitHub account you sign in with, if any.
  • Sessions: the IP address and browser user agent of each signed-in session, used to keep your account secure.
  • Billing: your billing name, Stripe customer ID and top-up history. Stripe handles card details; we never see or store them.
  • Usage: for every API request, the key name, endpoint, status, duration, cost and time. The console shows these on the Logs page.

What you send the API

We do not store the text or photos you send to smart search or image search. The API server's access log records request paths, which include basic search terms and barcodes. These logs are kept only for debugging and abuse prevention. Do not put personal information in queries.

Who processes data for us

  • Cloudflare hosts the console, its database and its request logs.
  • Stripe processes payments.
  • Resend sends account emails, such as verification and password resets.
  • OpenAI reads the text and photos sent to smart search and image search, and basic search terms, to identify foods. We ask it not to store them.
  • Typesafe (Jev) ranks candidate food names for a query.
  • Google and GitHub, only if you choose to sign in with them.

Some of these providers process data outside your country, including in the United States.

How long we keep it

Account, billing and usage records are kept while your account is open. Payment records may be kept longer where tax or accounting law requires.

Your choices

You can see and change your account details in the console. To get a copy of your data, correct it or delete your account, email legal@elbantli.com. You may also have the right to complain to your local data protection authority.

Cookies

The console uses only the cookies needed to keep you signed in. There are no analytics or advertising cookies.

See also the terms of service.