Privacy Policy

Effective Date: August 26, 2026

Welcome to KaloCam, provided by FUNCONNECT PTE. LTD., a company incorporated in Singapore ("we", "us", or "our").

This Privacy Policy ("Policy") is to clearly explain how we collect, use, disclose, and protect your personal information, as well as the rights you have and to help you make appropriate choices. Your privacy matters to us, please do take the time to get to know and familiarize yourself with the policy and practices. We have used bold font to distinguish the terms in this policy that are (possibly) significantly related to your rights and interests. Please read them carefully.

In particular, we would like to draw the attention of underage users (especially children under the age of 13) and their guardians. We have specified Section 7. Children on the protection of underage users, please read it carefully.

It is important to note that this Policy does not apply to any products, services, websites, or content that are offered by third parties ("Third Party Services"), which are governed by their respective privacy policies. We encourage you to read and review the privacy statements of each Third-Party Service that you may choose to use.

1. Personal Information We Collect

1.1 Overviews

We will follow the principles of what is rightful, legal and necessary to collect and use the personal information that you voluntarily provide to us, obtained by us from third parties and automatically collected during your use of our Platform and Services. If we want to process your personal information for other purposes not specified in this policy, or use the information we have collected for other purposes based on a particular purpose, we will notify you in a reasonable manner and seek your consent (when required by applicable data protection laws) again before using it.

1.2 Personal Information You Provide

Account Information: The information you provide when registering for and using an account, such as username, profile picture. This information is used to create and manage your account, ensuring that you can access and use our services smoothly.
Email address and password (email sign-in): If you choose email sign-in, we collect the email address you enter and a password you create as account credentials. Your password is stored only in salted, one-way hashed form; we cannot see or recover the original password. We do not verify ownership of the email address and do not offer email-based password recovery. If you forget the password, you may use the single-use recovery code shown when you register or regenerate it (stored by us only as a keyed, one-way hash), or complete a fresh sign-in with an Apple or Google account you previously linked in Settings. Email sign-in is optional; you may instead use Apple or Google. Keep the password and recovery code safe.
Health, Nutrition, and Medication-Status Data: Information you choose to record in the app, such as food logs, calorie intake, body measurements (such as weight and height), activity data, health or nutrition goals, whether you currently use or plan to use a GLP-1 medication, your GLP-1 personalization preference, consent version, and related update times. We use this information to provide nutrition tracking, progress monitoring, and, when you explicitly enable it, personalized nutrition targets, reminders, and coaching. We do not use your status to diagnose a condition or provide medication advice.
AI Interactions: Questions, messages, and other content you submit when using our AI features, as well as food photos you upload for analysis or recognition. We use this information to generate responses, provide nutrition-related suggestions, and improve your experience with our service.
User Content: The prompts and other content that you input and generate while using our products and services. This information helps us understand your needs and preferences, so that we can provide you with more accurate services and support. If you use the voice input function, we process the audio recording and resulting transcription to provide transcription and AI analysis. We do not use voice input to identify you by voiceprint.
Communication Information: If you communicate with us, such as via email or feedback pages or our pages on social media sites, we may collect personal information like your name, contact information, and the contents of the messages you send.
Surveys, Research, and Promotions: We collect information you provide if you choose to participate in a survey, research, promotion, contest, marketing campaign, or event conducted or sponsored by us.

1.3 Information We Receive from Your Use of the Services

Log Data: We collect information that your browser or device automatically sends when you use the services.
Usage Data: When you use our Services, we will collect details of your use of our Services and retain them as Usage Data, which may include your IP address, provider information, Internet connection environment, Wi-Fi status information, and other Usage Data generated when you use KaloCam.
Advertising Attribution and Device Identifiers: If you grant tracking permission, we may collect and process advertising identifiers such as IDFA, AppsFlyer ID, install attribution information, campaign/source information, app launch events, registration/login events, and subscription-related events. We use this information to measure advertising performance, understand campaign effectiveness, attribute installs and conversions, detect fraud, and improve our marketing. If you deny tracking permission, we may still receive limited attribution or analytics information that does not use IDFA where permitted by Apple and applicable law.
Product Analytics: We record certain in-app choices and events to understand onboarding and feature use. This includes the GLP-1 status value you select during onboarding, even if you choose not to enable GLP-1 personalization. We use this sensitive health-related event for product and population-level usage analysis; it is not used for advertising.
Microphone Permission: When you use the voice recognition feature, we will request your authorization for microphone-related permissions. If you refuse to grant authorization, you will not be able to use this feature, but it will not affect your normal use of other features.
Camera and Gallery Access Permissions: When you take a photo or upload an image, we'll ask you to grant access to the camera and gallery. If you deny authorization, you won't be able to take or upload photos, but this won't affect your ability to use other features.
Location Permission: When you choose to attach meal location and grant location permission, we may add approximate or precise location context to meal records. If you refuse authorization, you can still record meals without location information.
Other Information: We will also collect other information during your use of KaloCam, to help us provide a better user experience for you. We may request you to grant storage, notification, and other permissions based on different devices and the services you require. If you refuse authorization, you will not be able to use the relevant services, but this will not affect your use of other functions.

Please note that some of the above-mentioned information alone cannot be used to identify a specific natural person, thus cannot be considered as Personal Information. Only when such non-personal information is used in combination with other information to identify a specific natural person, or when it is used in combination with Personal Information, will this information be regarded as Personal Information during such combination. In this case, we will anonymize and de-identify this type of information, unless with your consent or otherwise according to laws and regulations. The above-mentioned information is essential to the provision of the Service. If you choose not to provide them, we may not be able to provide you with our related services.

1.4 Personal Information We Collect from Third Parties

Third-Party Login or Authentication Providers: If you choose to log in using a third-party service, we may collect certain information from that provider with your authorization. This may include your access tokens, profile photo, username, email address, or other public profile information. We use this information to create and link your account, streamline authentication, and personalize your experience.
Security Information: We may receive information from our trusted partners, such as security partners, to protect against fraud, abuse, and other security threats to our services.
Public Information: We may obtain publicly available information from Internet sources to improve the accuracy of the responses provided by our services.

1.5 Apple Health and HealthKit Data

Apple Health and HealthKit data are optional. KaloCam may read steps, walking and running distance, active energy, workouts, and weight records from Apple Health only after you grant permission.

In this review build, Apple Health data is used only for activity history, weight trends, logged workouts, and the Today, Activities, and Weight views. Apple Health activity energy does not increase today's eating target. Weight records you choose to sync may update profile weight and may be used to recalculate BMR, TDEE, daily target, and macro targets.

KaloCam does not use Apple Health data for advertising, marketing, sale, use-based data mining, or training KaloCam or third-party AI models. Raw Apple Health records and samples are not included in third-party AI prompts in this review build.

You can manage Apple Health permissions in Apple Health or iOS privacy settings. If a future version uses raw Apple Health records or samples inside AI features, we will update this policy, consent copy, review notes, and code-level data filters to match that behavior before doing so.

2. How We Store and Protect Your Information

We store your information as long as necessary to provide the services, fulfill the purposes outlined in this policy and other legitimate business purposes (such as service improvement, resolving disputes, safety or security), comply with legal obligations.

Retention periods vary based on factors such as information type, sensitivity, and legal requirements. For example, account, input, and payment information are retained while your account is active. Violation-related information is retained until the violation is resolved. Also, in some cases, the length of time we retain data depends on your settings.

Anti-abuse records. To prevent abuse of the sign-up service, such as automated bulk registrations, we retain a keyed, pseudonymized identifier derived from the network address used at registration for up to 30 days. This security record remains until that period ends even if you delete your account and does not directly identify you.

GLP-1 records. Structured GLP-1 settings, personalization markers, and the onboarding analytics event are generally retained while your account is active, until you change or delete them. Short-lived deletion receipts and hashed settings-mutation records are retained for up to 30 days to make deletion and settings requests idempotent and auditable. Account deletion removes these first-party GLP-1 records and ledgers.

Your personal information may be transferred to and stored on servers located outside your country of residence. We store the information we collect in secure servers. By accepting this Privacy Policy, you consent to the transfer of your personal information to third parties (if any), which may include the cross-border transfer of your information to any country where we have databases or affiliates.

When cross-border transfers are necessary, we will implement appropriate safeguards, consistent with applicable data protection laws, to ensure your information is protected for the purposes outlined in this policy.

However, we need to remind you that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

3. How We Use Personal Information

We use your information to provide, maintain, improve and develop the services, including for the following purposes:

To Provide the Services: We use your information to create and manage your account, authenticate your login, and enable you to interact with the features of our Services, such as chat, content generation, and personalization.
To Improve and Develop Our Services: We analyze how you use the services to identify areas for improvement, develop new features, and enhance the overall user experience.
To Communicate with You: We may contact you to provide service-related updates (such as changes to features or terms), respond to your inquiries or feedback, send administrative notifications, or resolve technical issues. We may also provide customer support and handle complaints or user requests.
To Ensure the Safety and Security of Our Services: We use your information to detect and prevent fraudulent activities, abuse, and other security threats. This helps us maintain the integrity and stability of our platform.
To Measure Advertising and Attribution: With your permission where required, we use advertising identifiers, attribution data, app events, and subscription conversion events to measure campaign performance, optimize acquisition channels, and understand whether ads lead to installs, account creation, app usage, or subscriptions.
To Comply with Legal Obligations and Rules: We process your information to comply with applicable laws and regulations and rules, respond to valid legal requests, enforce our terms, and protect the rights, property, or safety of our users, us, or third parties.
To Promote Our Services: We may use your information to promote our services or third-party services through marketing communications, contests, or promotions, with your consent where required.
To Personalize Nutrition and Provide AI Features: When you explicitly enable GLP-1 personalization, we use your GLP-1 status with profile and nutrition data to adjust nutrition targets and support relevant reminders. Your current status and the context needed for coaching may also be processed through secure, encrypted connections by third-party AI service providers. These providers may include Anthropic Claude, Google Gemini, OpenAI, and related AI routing or infrastructure providers, depending on the feature and model availability. This also covers food photo analysis, voice transcription, nutrition coaching conversations, memory processing, and personalized dietary suggestions. We send only the information needed to provide the enabled or requested feature. Turning off GLP-1 personalization stops future GLP-1 context from being sent.

4. How We Share Personal Information

When sharing, transferring, and disclosing your Personal Information, we uphold the principles and requirements of minimization, necessity, and legality. We do not sell any personal information to third parties. Under normal circumstances, we do not share, transfer or disclose your Personal Information externally. However, to the extent permitted by applicable laws and regulations, we may share, transfer and disclose your Personal Information in the following situations:

Obtain Your Explicit Consent: With your authorization, necessary information will be shared with third parties.
AI Service Providers: When you use AI-powered features, we share the submitted photos, text, audio, profile context, meal context, and, only after you explicitly enable GLP-1 personalization, current GLP-1 status needed for that feature with third-party AI service providers, which may include Anthropic Claude, Google Gemini, OpenAI, and related AI routing or infrastructure providers. These providers process the information solely to provide the enabled or requested app functionality.
Attribution and Analytics Service Providers: We use AppsFlyer and may use related attribution or analytics service providers to process advertising identifiers, attribution data, device or app information, and app events such as app launches, registrations, logins, and subscription conversions. These providers help us measure campaign effectiveness, prevent fraud, and analyze service usage in accordance with this Privacy Policy.
Service Providers (Processors): We engage service providers that help us provide, support, and develop the services and understand how they are used. We share your information with these service providers as necessary to enable them to provide their services. These providers will access, process, or store personal information only in the course of performing their duties to us.
Affiliates: We may share your information with our affiliates, ensuring that they handle your information in a manner consistent with this Privacy Policy.
Corporate Transactions: In the event of a corporate transaction, such as a merger, sale of assets or shares, reorganization, financing, change of control, or acquisition of all or a portion of our business, your information may be shared with third parties. If such a transaction involves the transfer of your personal information, we will require the new holder of your personal information to continue to be bound by this policy.
Legal Requirements and Compliance: We may share your information with government authorities or other third parties if we have good faith belief that it is necessary to: (i) comply with applicable law, legal process or government requests; (ii) protect and defend the rights, property, and safety of us, users and public; (iii) detect or prevent fraud or other illegal activity; (iv) protect against legal liability.

5. Your Rights and Choices

You have the rights to access, rectify or update, transfer, delete your personal information as well as restrict how we process, withdraw your consent, lodge complaints before the competent authorities and potentially others.

You can exercise some of these rights directly through settings or through your account if you have logged in. Additionally, your device may offer settings that allow you to manage the information we collect.

GLP-1 choices. In Settings, you can update your GLP-1 status, stop GLP-1 personalization without deleting your status, or use the separate “Delete GLP-1 Data” action. Stopping personalization stops new target adjustments and new GLP-1 context sharing but retains your status and existing records. Deleting GLP-1 data removes the five structured GLP-1 account fields, GLP-1 fields from the frozen onboarding draft, the GLP-1 onboarding analytics event, GLP-1 adjustment markers in daily target snapshots, and GLP-1 alert records. It does not mean that every related historical trace is erased.

After “Delete GLP-1 Data,” six categories remain: (1) a deletion receipt containing the request identifier and time for up to 30 days; (2) a general settings-mutation record containing a hash and version, but not the setting value, for up to 30 days; (3) the general monotonically increasing settings-state version; (4) free text in Coach memories or conversation history that cannot be reliably identified as medication-related—you can delete Coach memories separately or delete your account; (5) historical daily protein, fat, and carbohydrate target numbers, while their GLP-1 adjustment markers are removed, because those numbers form part of your nutrition history; and (6) historical processing or inferences already completed by a third-party AI provider, which cannot be recalled. Non-GLP fields in your frozen onboarding snapshot also remain. Use account deletion if you want the broader deletion available for your account.

If you choose to cancel your account, this action is permanent and irreversible. You will lose access to any associated content or services, and we may not be able to restore data after deletion. We recommend exporting or saving any personal data or content before initiating account deletion.

When you delete your account, your email address and hashed password are deleted with your other account data, except for the hashed anti-abuse record described in Section 2, which is retained for up to 30 days for security purposes.

Please note that the services generate responses by analyzing a user's request and predicting the words that are most likely to follow. However, the most probable words may not always be factually accurate. As a result, you should not assume that the output from our services is factually correct. If you find that the output contains inaccurate information about you and you wish to request a correction or removal of that information, please contact us.

6. Information Security

We are fully aware that the security and confidentiality of your personal information are of utmost importance to you. We will endeavor to avoid collecting irrelevant user information and will take reasonable technical and organizational measures to protect your personal information from unauthorized access, public disclosure, use, modification, damage, or loss, including but not limited to:

Data Encryption: We use industry-leading encryption algorithms to encrypt users' personal information.
System Security Protection: We regularly conduct security checks and vulnerability patches on servers and systems to prevent hacker attacks and virus intrusions.
Institutional Safeguards: We have established a dedicated data protection department and appointed a person in charge to be responsible for the protection of users' personal information.
Data Backup: We regularly back up users' personal information data and store the backup data in different physical locations to reduce the risk of data loss.
Data Breach Alert: We have set up a monitoring system to monitor abnormal data access and leakage situations. Once signs of data leakage are detected, we will immediately take measures to stop the leakage.

Please note that due to the limitations of technical and management means, we cannot guarantee absolute security. We strongly recommend that you take proactive security measures, such as refusing to lend accounts, disclose verification codes, or upload sensitive information.

We have developed a cybersecurity incident emergency response plan. In the unfortunate event of a personal information leak or other security incidents, we will immediately activate the emergency response plan and promptly inform you of the basic situation of the security incident, the potential impact, and the remedial measures we have taken.

7. Children

Our Services are not directed to, or intended for, children under the age of 13 (or the minimum age required in your jurisdiction to provide valid consent to data processing). We do not knowingly collect personal information from children under this age. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at wangwei01@funconnectsg.com. We will promptly review and, where appropriate, delete such information in accordance with applicable laws.

If you are at least 13 but under 18 years of age (or the age of majority in your jurisdiction), you must review this Privacy Policy with your parent or legal guardian. Your parent or guardian must consent to your use of the Services before you may use them.

We encourage parents and guardians to take an active role in their children's online activities and to help enforce this policy by instructing minors never to provide personal information without their permission.

8. Special Terms for Jurisdictions

We do our best to comply with data protection laws and regulations worldwide to protect users' personal data. At the same time, we are constantly updating our data protection work to ensure compliance with legislative requirements in various jurisdictions. Please give us feedback if there is any need for improvement or adaptation regarding our data protection you find in your daily use.

9. Privacy Policy Updates

We may update this policy from time to time as required. When we do, we will publish an updated version and effective date on this page, or by providing any other notice required by applicable law. We recommend that you review the updated policy each time you access the services to stay informed of our privacy practices.

10. Contact Us

If you have any questions, suggestions, or concerns about this Privacy Policy or our data practices, or if you wish to exercise your rights regarding your personal information, you can contact us through the following methods:

For general suggestions or feedback: You may use the built-in feedback features within our products and services.
For privacy-related inquiries, complaints, or data subject rights requests: Please send a detailed request or complaint to wangwei01@funconnectsg.com

We will review and respond to all requests or complaints in accordance with applicable data protection laws. Please note that for security and verification purposes, we may request additional information to confirm your identity before processing your request.

11. Language

This Privacy Policy may be provided in multiple languages. In the event of any conflict, where permitted under local law, the English language version of this Privacy Policy shall prevail.