Kalia Privacy Policy

Last updated: October 11, 2026

Kalia plans your meals for the week around your goal. It is built to process as little data as possible: no account, no sign-in, no advertising and no tracking. This policy explains which data is processed when you use the Kalia app and the Kalia pages on getdisha.app, and why.

1. Who is responsible

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Tim Heck
Neue Straße 19a
35096 Weimar
Germany

Email: kalia@getdisha.app
Phone: +49 15120241787

A data protection officer is not legally required and has not been appointed.

2. The short version

You do not need an account. We do not know who you are.
Your plans, recipes, shopping lists, check-ins and settings are stored only on your device.
Your body details (sex, year of birth, height, weight and activity level) never leave your device.
To create new dishes with AI, Kalia sends your food preferences and your planned calorie and protein targets per portion, without any identifier, through our own server to Google Gemini.
Subscriptions are handled by Apple or Google. RevenueCat checks your subscription status using an anonymous ID.
No advertising, no analytics, no tracking and no sale of data.

3. No account, your data stays on your device

Kalia works without registration, sign-in or email address. We do not run user accounts and do not create user profiles.

Everything you enter or create in Kalia is stored only in a local database on your device. This includes:

your goal and your calorie and protein targets
your body details, if you enter them
your plan settings: meals per day, days to plan, portions and cooking time
your diet style, allergies and intolerances, ingredients you do not want, food preferences and kitchen equipment
your budget, supermarket and region, if you use them
units, language and reminder settings
your weekly plans, recipes, shopping lists, check-ins, streak and pause days

We have no access to this data. There is no cloud sync and no copy on our servers. If you delete the app, this data is deleted with it. Depending on your device settings, your operating system may include app data in device backups (for example iCloud or Google backups). These backups are controlled by Apple or Google and by your settings, not by us.

Kalia contains no advertising and uses no analytics, crash reporting or advertising tools. It does not access your device's advertising ID and does not track you across apps or websites.

4. Body details and your targets

Kalia can estimate your daily calorie and protein target. For this, you enter your sex, year of birth, height, weight and activity level. The calculation runs entirely on your device. These details are not sent to us, to the AI provider or to anyone else.

Entering body details is optional. You can also enter your own targets or plan without numbers. You can change your details at any time in the app under Settings → You and your goal.

All nutrition values in Kalia are planned estimates per portion. Kalia does not record what you actually eat.

5. Creating plans with AI

Your first weekly plan is created from the recipe collection built into the app, entirely on your device. Kalia also uses this collection when you are offline or when the AI is not available.

When you create a new plan with Kalia+ or replace a dish, Kalia sends a request to an AI model (Google Gemini). The request goes through a server that we operate with our provider Cloudflare. The app does not connect to Google directly.

What is transmitted

app language and region
the days and meals to plan and the number of portions
your planned calorie and protein targets per portion for each meal (numbers only)
your diet style
your allergies and intolerances
ingredients you do not want, including anything you type in yourself
your food preferences and kitchen equipment
the supermarket used for price estimates and, if you turned it on, your weekly budget
the names of recently planned dishes, so that the new dishes are different

What is not transmitted: your name, email address, phone number, sex, age or year of birth, height, weight, activity level, check-ins, advertising ID, device identifiers or location. Please do not enter personal information in the free text field for ingredients you do not want.

Purpose and legal basis. The purpose is to provide the service you requested: creating your meal plan. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

Information about allergies, intolerances and your diet style may count as health data under Art. 9 GDPR. It is sent without any identifier, so it cannot be traced back to you. You provide it voluntarily to receive suitable dishes. As a precaution, the legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you give by entering the information. You can withdraw it at any time by removing the information in the app settings. It is then no longer transmitted.

Our server. When the app contacts our server, Cloudflare technically processes your IP address. It is used to deliver the response and to prevent abuse, and it is stored only briefly in server logs, for no longer than 7 days. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in stable operation free of abuse). Our server forwards only the content of the request to Google and does not pass on your IP address.

Google. Google processes the request to generate the response. Depending on Google's terms for the service, Google may store the content of requests for a limited period, for example to detect abuse, and may use it to improve its services. Because the request contains no identifier, this does not allow any conclusion about your identity.

6. Kalia+ subscription

Kalia+ is an auto-renewing subscription. The purchase is handled entirely by Apple (App Store) or Google (Google Play). We do not receive payment data such as card numbers or bank details.

To check whether you have an active subscription, we use the service provider RevenueCat, Inc. RevenueCat receives an anonymous ID generated by the app together with the purchase receipts from the store (for example product, purchase date and expiry date). We do not link this to your name or email address. The legal basis is Art. 6(1)(b) GDPR.

Kalia and Disha are separate apps. A purchase in one app is not shared with the other.

7. Reminders

If you turn on reminders (the daily check-in reminder or the reminder before your plan ends), Kalia schedules local notifications on your device. They are created entirely on the device. No push messages are sent from a server and no push tokens are sent to us. You can turn reminders off at any time in the app or in your device settings.

Widgets show today's dish and your shopping list on your home screen. They read the data from your device. Nothing is sent.
Sharing: you can share your shopping list as text through your device's share menu. You decide who receives it.
Ratings: Kalia may show the rating dialog of Apple or Google. We do not receive any personal data from it.
Links to this website, to email or to the app stores open in your browser or email app. The privacy policies of those services apply there.

9. Location

Kalia does not access your location. You choose your region and supermarket yourself.

10. The Kalia website

The Kalia pages on getdisha.app are purely informational. They set no cookies, use no analytics tools and do not load external fonts, maps or videos. There is no contact form and no login.

When you open a page, our hosting provider Vercel Inc. technically processes the connection data needed for operation (IP address, time, page requested, amount of data transferred, browser and operating system) in server logs. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in operating the website securely).

11. Recipients and transfers outside the EU

Data is only passed to the providers named in this policy, and only as described:

Cloudflare: our server for AI requests
Google: the AI model that creates dishes
RevenueCat: checking your subscription status
Apple and Google: purchases and the app stores
Vercel: hosting of the website

We do not sell data and do not share data for advertising.

Cloudflare, Google, RevenueCat and Vercel are based in the USA. Transfers to the USA are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Further information can be found in the privacy policies of these providers:

12. How long data is kept

On your device: until you delete it in the app or delete the app.
Server logs of our AI server: no longer than 7 days.
Google: according to Google's terms for the service.
RevenueCat: as long as needed to manage your subscription and to meet legal retention obligations.
Website server logs: briefly, according to Vercel's terms.

13. Your rights

Under the GDPR you have the right to:

access the data processed about you (Art. 15)
have inaccurate data corrected (Art. 16)
have your data erased (Art. 17)
restrict processing (Art. 18)
data portability (Art. 20)
object to processing based on legitimate interests (Art. 21)
withdraw your consent at any time with effect for the future (Art. 7(3))

Because Kalia has no accounts and your data stays on your device, we generally cannot identify you and cannot match you to any data (Art. 11 GDPR). You can manage your data yourself at any time: change your details in the app under Settings, remove your plans under Settings → Delete all plans, or delete all data at once by deleting the app.

For any questions, contact us at kalia@getdisha.app.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You can contact the authority at your place of residence or the one responsible for us: the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit).

15. Age

Kalia is intended for adults. The estimate of calorie and protein targets is designed for people aged 18 and over. We do not knowingly process data of children.

16. Changes to this policy

We update this policy when the app or the services we use change. The version published on this page applies. The date of the last change is shown at the top.