Privacy policy

Who processes your data, and where

The data controller is Baptiste Renaud, a sole trader registered in France under SIREN 101 592 111, reachable at hello@camaleo.app. No data protection officer has been appointed: the scale of the service does not require one.

Our server — the one holding accounts and sync — is located in France, in the European Union. It is not mandatory: without an account, Camaleo runs entirely on your device and never talks to it. Were we to change hosting provider, it would be for another one in the European Union, and this page would say so.

To prevent abuse — repeated login attempts, mass account creation — the server counts requests per IP address. Those counters live in memory, from a few minutes to an hour, and are never written to any database. Technical logs keep errors only.

On what legal basis

Processing your health data — scan photos, measurements, body composition estimates — relies on your EXPLICIT CONSENT, asked for when you first open the app, before the first question. The account, sync and subscription rely on performing the contract between us. Abuse limitation relies on our legitimate interest in protecting the service.

You can withdraw your consent at any time: Settings → Reset everything wipes the device, Account → Delete my account wipes the server. Withdrawal applies going forward and does not call into question what was processed before. No decision producing legal effects is made automatically from your data: scores, estimates and advice are indicative.

The photos you take

Your photos (scans, meals, unpublished recipes) are stored in the app’s private storage on your device. If you have an account, they are also backed up to our server, linked to your account, so you can find them on another phone. They stay private: never published, never shown to other users, accessible only with your session.

When you run a scan, a resized version of the photo is sent to Anthropic PBC’s analysis model (Claude, United States), which produces the estimate. When the app is connected to our server, the image passes through it first: that relay keeps the image in memory for the duration of the call and never writes it to disk. We keep no copy of it and do not use it to train a model; its processing at Anthropic is governed by that provider’s own terms.

“Reset everything”, in the settings, erases the data on THIS DEVICE — and nothing else: if you have an account, what is backed up online, photos included, will come back at the next sign-in. To empty the account, use Account → Reset my account; to delete everything, Account → Delete my account. A photo deleted from our server may remain in its backups for up to 30 days.

What is synced if you have an account

An account is optional: without one, no data leaves your device apart from the photo of a scan or a meal sent for analysis (see above).

With an account, your log is copied to our server so you can find it on another device: your profile (height, starting weight, date of birth, sex, goal, level, preferences), your scans — estimated body fat percentage, muscle scores, overall score, entered weight, measurements, notes and texts produced by the analysis — and their photos, your workouts, training templates, custom exercises, meals and their photos, weigh-ins, activities, hydration, fridge leftovers, meal plan, recipes and shopping lists.

Two things never leave your device, with or without an account: the health information you declare (pregnancy, breastfeeding, medical follow-up, eating disorder…) and your step count read from Health Connect.

These documents are kept as they are, attached to your account, until you delete them. Deleting your account (Account → Delete my account) removes them from the server.

Profile information

Height, weight, date of birth, sex, goal and training level are entered during onboarding. They are used to calibrate estimates and personalise advice.

This information stays on your device. It is not sent to our server, even with an account: the profile is not part of the sync.

On Android, if you allow it, the app READS your step count for the day from Health Connect in order to display it. That number is stored nowhere and sent to no one: it is read at display time. The permission is withdrawn from Health Connect, without going through us.

Who your data is sent to

Anthropic PBC (United States) receives the resized photo of a scan, the text you write to describe a meal, and the text of a recipe when it is translated. It is the only recipient of that content: no analysis happens anywhere else.

Hostinger, which hosts our mailbox within the European Union, receives your address and the content of service messages — address verification, reset codes. It receives no health data.

Anthropic is the ONLY recipient located outside the European Union. That transfer relies on the standard contractual clauses adopted by the European Commission, provided for in the contract entered into with them.

No other third party receives your data: the app carries no analytics, no ad network and no tracker.

What becomes visible to others

Publishing a recipe or writing a comment makes it visible to other users, under your username. That is the ONLY part of your account that becomes public: your email address, your profile, your scans and your meals never are. A recipe can be unpublished or deleted from the app; a copy another user may have made outside the app, however, is beyond our reach.

Early-access sign-up

If you leave your address on the website to hear about the launch, it is stored with the page language and the date, and, if you arrived through a link that says so, where it came from, picked from a short fixed list (TikTok, Instagram, flyer, referral…). Nothing else — no name, no tracking of your browsing. A confirmed address gets a referral code; if a friend signs up through your link, we record who invited them, to work out your place in the queue. An email asks you to confirm it: without that click you will never receive the announcement, and an unconfirmed address is deleted after 30 days.

A confirmed address is kept until the launch email, then deleted. Every email carries an unsubscribe link that erases it immediately. This list serves that purpose alone: it is never sold, never used for advertising, and never matched against a Camaleo account.

Creator code requests

If we invited you to request a creator code, the form on the invitation page records your nickname or first name, your email address, the link to your main social media account, the two or three codes you would like, the page language, and the dates of your request and of our answer. This information is used only to review your application and, if it is accepted, to create your code. A six-digit code sent to your address confirms it; it is stored only as a hash and is valid for 30 minutes. Only we see your request; the emails (confirmation code, answer) go through our mailbox, hosted by Hostinger in the European Union.

Everything is erased automatically: after 7 days if the address was never confirmed, after 90 days if the request is still awaiting our answer, and 30 days after our decision. If your request is accepted, your address stays attached to your creator code, so we can reach you about your commissions, for as long as we work together and then as long as our accounting obligations require. This processing relies on the pre-contractual steps you ask us to take.

Subscriptions and payments

Payments are handled by the App Store or Play Store. We never see your payment details: we only receive your subscription status (active or not).

What we don’t do

We do not sell your data. We do not run targeted advertising. We do not share your photos with other users.

Your rights

You can access, export or delete your data at any time. Settings → Export my data produces a readable JSON file containing everything the app keeps on the device: profile, settings, scans, sessions, meals, meal plan, recipes and shopping lists; the photos are not embedded, but their names are listed. Local erasure is done from Settings, deletion of account data from Account → Delete my account, or by writing to us.

Our database is backed up daily and those backups are kept for 30 days. After an account deletion, your data may therefore remain in them for up to 30 days before disappearing for good. They are read again only in the event of a technical incident, never for any other purpose.

You have the right to access, rectify, erase, port, restrict and object. If you believe your data is not being handled properly, you can lodge a complaint with the data protection authority of your country — in France, the CNIL (cnil.fr).

For any question about your data: hello@camaleo.app.

Health and minors

Camaleo is not a medical device and is not intended for people under 16. The scores and percentages shown are visual estimates, never clinical measurements.