Personal data processing policy
Version: 19 October 2026.
1. Data controller and contact
The controller is Kuprin Mikhail Valeryevich, a registered payer of professional income tax (self-employed), taxpayer identification number (INN) 503220684394. Contact for data processing and user requests: support@caloriesdiary.com. This policy applies to caloriesdiary.com, its PWA, Telegram bot and Mini App.
2. Data we process
Account and sign-in data: email, password hash, session identifiers and, when signing in through Telegram, Telegram ID and available profile details. Passwords are not stored in plain text. A guest diary is linked to its session.
Food diary data: descriptions and names of meals, ingredients, estimated or user-entered weights, nutrients, meal dates, favourites, custom foods, analysis results and edits. Images and text sent for AI analysis are processed as described below. Language, time zone, technical events, source tags and known referrer domains may also be processed.
Payment data: selected plan, order identifier, amount, currency, payment status, provider payment identifier and subscription period. Full bank card details are processed by the payment service; the diary does not store them. Support requests may include your email and the information you send us.
3. Purposes and grounds for processing
Data is used to provide and perform the service: sign-in, food diary, AI calculations, reports, saving and repeating meals, subscription access, payment confirmation and support. Technical data is used to protect accounts, prevent duplicate charges, enforce allowances, resolve errors and assess functionality to the extent necessary for those purposes.
Where consent is the legal basis, it is requested separately for the relevant purpose and may be withdrawn. Optional external analytics is enabled after a separate user choice. Accepting the public offer does not replace separate consent where the law requires it.
4. Images and AI providers
Meal and ingredient names may also be sent to the AI service for Russian and English translation. Translations are stored with the diary and do not change weights or nutrients. When you request analysis, the image or description is sent to the configured AI service for calculation. Current API host: api.aitunnel.ru. With AI Tunnel, requests may be forwarded to the selected model provider. Account emails, passwords and payment details are not included in analysis requests, but personal information may appear inside your photo or text.
An external provider may process data outside the Russian Federation. Its processing and retention terms are governed by its documentation; information about services used and grounds for transfer is available by contacting the controller. Local diary storage does not mean the AI request is processed only on our server.
To recover an analysis in progress, the image or description is temporarily stored in a server job. Its source payload is removed after the job finishes. An unfinished job expires within 24 hours; completed jobs are cleaned up after seven days when the worker runs. A diary entry you save is stored separately. Telegram determines its own message and file retention rules.
5. Other recipients
To the extent necessary, data may be processed by Beget Cloud hosting, Robokassa and Telegram Stars payment services, Telegram when using its bot or Mini App, and an email service when you contact support. Payment data is transferred only when the relevant payment method is used.
If you enable external analytics, Google Analytics receives usage events, page information and technical identifiers. Meal contents, images and Telegram sign-in credentials are not included in these events. Information required by law is supplied to authorised authorities through the prescribed procedure. Sharing data with a service contractor does not publish your diary.
6. Cookies and browser storage
A session cookie is needed for sign-in and diary access. Browser local storage may contain language, an unfinished analysis identifier and your analytics choice; session storage may contain traffic source tags. Disabling or clearing cookies may sign you out or remove access to a guest session. The PWA caches a general offline screen, not a copy of your private diary.
External analytics does not run before you enable it. You can change your choice using the analytics control on the website or by clearing the relevant browser settings.
7. Retention and protection
Diary entries and account data are retained as needed to provide the service, until you delete them or processing ends following a justified request. Certain payment documents and information needed to comply with law or resolve disputes may be retained to the minimum necessary extent for the applicable period. Once the processing purposes are fulfilled, data is deleted or anonymised unless another lawful retention basis exists.
We use HTTPS, password hashing, record ownership checks, access controls, server verification of payment confirmations and restricted access to application settings. The controller does not promise absolute security but must apply protection appropriate to the data and legal requirements.
8. Your rights and requests
You may request information about processing and recipients, correction, restriction or deletion where grounds exist, withdraw previously given consent and complain to Roskomnadzor or a court. Withdrawal does not stop processing that has an independent lawful basis.
Email support@caloriesdiary.com with your account and request details. To prevent deletion of another person’s data, we may need to verify account ownership. Do not send passwords, sign-in codes or full card details. Requests are handled within the time limits established by law.
9. Publication and changes
The current English version is available at caloriesdiary.com/en/privacy, with the Russian version at caloriesdiary.com/privacy. Changes are published with a new version date. New processing purposes and recipients require checking the corresponding lawful grounds; updating this policy does not itself create user consent.