MealShot

Privacy Policy

Last updated: 27 October 2026

MealShot counts calories from a photo of your meal and calculates a daily calorie target. This page says what the app sends, what it keeps on your phone, and what it does not collect.

The short version. Your profile and meal history are stored only on your iPhone. A photo of a meal (or, instead of a photo, a short description of what you ate, typed or dictated), and the hint you may type with it, are sent to our server and on to the AI provider DeepSeek to calculate the answer, only after you allow it in the app; our server does not save them. We do not collect your name, email, location or Health data. There are no third-party analytics SDKs and no tracking; the only counting we do is how many devices use MealShot per day and per month, by a hashed identifier (section 1).

1. What we collect

Photos of food. When you ask MealShot to count calories, the photo is sent to our server. It is used only to calculate the result. Our server does not store it.
A description of what you ate, instead of a photo (for example “a bowl of soup with bread”). If you say or type what you ate, this text is sent to our server instead of a photo and is used only to calculate the result. If you dictate it, only the resulting text reaches our server; see “Microphone and speech recognition” in section 5. The text is also kept with the meal on your iPhone.
The hint you type or dictate with a photo (for example “no sugar in the coffee”). It is sent together with the photo and is used only for the same purpose. If you dictate it, only the resulting text reaches our server; see “Microphone and speech recognition” in section 5.
An anonymous device identifier. MealShot generates a random identifier on first launch and keeps it in the iOS Keychain. It does not contain or point to your name, email or Apple ID. It is used to apply usage limits per device, to give every new device three free days of photo counting before a subscription is needed, to keep one subscription active on one iPhone at a time (MealShot 2.0.1 and later, see section 6), and to count how many devices use MealShot per day and per month (audience size, which Apple classifies as analytics). On the server it is stored only as a one-way keyed hash (HMAC-SHA-256 with a secret key that is not stored in the database): in request counters for up to 40 days, in the free-period record for 400 days after the last photo request, in audience counters for up to 40 days, and, for MealShot 2.0.1 and later, next to the identifier of your subscription, as a rule until 30 days after the end of the subscription's last paid period (details and exceptions in section 6). It is not stored with any photo. Settings → Delete all data does not reset this identifier, so the free period cannot be restarted by deleting data.
Your IP address is used by the server to limit requests: in a per-minute counter kept for two minutes, and as a one-way keyed hash in a daily counter of photo and voice requests per address, kept for 48 hours. It is not stored with your photos or your identifier.
Purchase data. To check that your MealShot Pro subscription is active, the app sends Apple's signed purchase record (StoreKit) to our server. We do not receive your Apple ID, name or payment details; payments are handled by Apple.

The photo or the description of the meal, the hint and the purchase record reach our server together with the anonymous device identifier, so in App Store privacy terms all four — including the identifier itself — count as “linked to you” (Apple treats a persistent device identifier as personal data). They are not linked to your name, email or Apple ID, which we never receive. None of it is used for tracking or advertising.

Subscription events from Apple. When you subscribe, renew, cancel or get a refund, Apple sends our server a notification with the transaction identifiers, the product, the App Store country, the price and the currency. We keep these records to check subscription status and to see revenue and churn totals. They contain no device identifier and no personal details, and they are kept without a time limit. Apple's signed purchase records inside these notifications are not kept; only a one-way hash of each is kept, so that a copied record cannot be used to move your subscription to another iPhone. Separately, the server keeps which iPhone (as a one-way hash of the device identifier) currently uses the subscription, so that one subscription works on one iPhone at a time. This rule applies to MealShot 2.0.1 (build 28) and later. On another iPhone the app offers “Use on This iPhone” to move the subscription there; each move is recorded. Older versions of the app keep working without this rule, and for them the server does not record which iPhone uses a subscription.

2. Photos and the AI provider

Before the first photo or description is sent, the app asks for your permission and names the provider. Without permission nothing is sent. You can withdraw it at any time in Settings → Data; after that the app sends nothing until you allow it again.

Our server passes the photo (or the description of the meal) and the hint to the third-party AI provider DeepSeek, which processes them on our behalf to calculate calories and macros and returns the result. Your device identifier, IP address and purchase record are not passed to the provider. The provider is used for this purpose only, and our server does not write the photo to disk or to a database. Technical server logs do not contain the photo, the hint or the content of purchase records. The provider's own terms apply to how it handles the data it processes.

3. What stays on your iPhone

Your profile (sex, age, height, weight, body fat percentage, goal and activity), your meals and their photos, and your settings are stored only on your iPhone. They are never sent to our server. The calorie target is calculated on the device.

4. What we do not collect

Your name, email address, phone number or address.
Your location.
Apple Health data. MealShot does not use Health.
Contacts.
Analytics, diagnostics or crash-reporting data from third-party SDKs.
Advertising identifiers. There is no advertising and no tracking, so MealShot does not show the App Tracking Transparency prompt.

MealShot has no user accounts. We do not sell your data.

5. Permissions

Camera — to photograph a meal. The camera is used only while you are taking a photo.
Photo library — only if you choose to pick an existing photo.
Microphone and speech recognition — only when you say what you ate on the voice screen or dictate a hint with the microphone button, and only while recording is on. Speech is recognized by Apple: on your iPhone when the language supports it, otherwise on Apple's servers. MealShot does not save the recording and does not send it to our server; only the recognized text is sent, as the description of the meal or as the hint.

6. Deleting your data

In the app, open Settings → Delete all data. This erases your profile, meals and photos from your iPhone. Deleting the app removes the same data. Our server does not keep your photos, profile or history, so there is nothing of those to delete there. What the server keeps: hashed request counters (up to 40 days), the hashed free-period record (400 days after the last request), a hashed per-address daily counter of photo and voice requests (48 hours), hashed audience counters (up to 40 days), the IP rate-limit counter (two minutes), Apple subscription events (no time limit), for MealShot 2.0.1 and later (see section 1): the link between your subscription and the hashed identifier of the iPhone that uses it (deleted 30 days after the end of the last paid period Apple reported for the subscription, once the link is at least 30 days old; for a refunded subscription this is also counted from the end of the paid period, not from the date of the refund; if Apple has never sent us a notification about this subscription, 400 days after it was last linked to an iPhone; if Apple has told us about the subscription but not when it ends, the link is kept until Apple reports an end date), the hashed identifiers of iPhones the subscription was linked to (30 days after each was last linked) and a record of when the subscription moved to another iPhone (30 days); one-way hashes of Apple's signed purchase records (60 days after the record expires, or 60 days after we received it if the record has no expiry date), a daily counter of AI requests per subscription or per device (72 hours), and — only if you contact support and we reset your limits manually — an audit record of that action with your device identifier (no time limit). If you want any of it removed earlier, or want to ask about anything else, write to the address below. Our web server keeps an access log without IP addresses and a standard error log that may contain an IP address when a request fails; both rotate with the system log rotation. The server database is copied nightly for disaster recovery; copies are kept for 14 days on the same server, with access restricted to the server's own account and the administrator, and are deleted after that. The developer may also keep a copy of a backup on his own computer for the same purpose.

If you used Toro 1.x. The earlier version of this app, released under the name Toro, had features that stored data on our server: the progress backup, the leaderboard profile, friends and clans. That server was shut down on 21 October 2026 and its data was deleted with it. Our current server does not hold any data from Toro 1.x, so there is nothing to delete.

7. Children

MealShot is not directed at children, and we do not knowingly collect personal data from children.

8. Changes

If this policy changes, we will update this page and the date above.

9. Contact

Questions about privacy? Email support@rvmzvz.tech.