Privacy Policy

Effective: April 11, 2026

Kufu ("the app") is built by Akos Komuves. This policy explains how the app handles your data.

Data Storage

All your training logs, meal data, progress photos, and health information are stored locally on your device and optionally synced to your personal iCloud account. We do not operate servers that store your personal data.

AI Food Analysis

When you use the AI food scanner (photo or text), your food image or description is sent to Google's Gemini API via a Firebase Cloud Function for analysis. This data is:

Processed only to estimate nutritional content
Not stored on our servers after processing
Subject to Google's Privacy Policy

Apple Health

If you enable Apple Health integration, the app reads weight, sleep, and step data, and writes workout data (type, duration, heart rate, active energy). This data stays on your device and in Apple Health. We never access your Apple Health data remotely.

Camera and Photo Library

Kufu asks for camera access to scan food barcodes (processed locally on your device) and to take photos of meals for AI analysis (see above). It asks for photo library access so you can select existing photos to analyze or to save and view progress photos. Progress photos remain on your device (and in your iCloud, if enabled) and are never transmitted to our servers or any third party.

Third-Party Services

Kufu uses a small number of external services to deliver its functionality. We do not use analytics SDKs, advertising SDKs, behavioral tracking, or any service that builds a profile of you. The full list of services Kufu communicates with is:

Firebase Cloud Functions (Google) — used as a server-side proxy for AI requests so that API keys are not shipped inside the app. No user account or identifier is attached to these requests.
Google Gemini 2.5 Flash — receives food photos or text descriptions via the Cloud Functions proxy to estimate nutrition and to analyze digestive-health patterns. Subject to Google's Privacy Policy.
Firebase Crashlytics (Google) — collects anonymous crash reports if the app crashes. Reports include device model, operating system version, and stack trace. Crashlytics is used solely to diagnose crashes so they can be fixed; Firebase Analytics is explicitly disabled.
OpenFoodFacts — receives barcode numbers when you scan a packaged food, and returns nutrition data from their public, open-license food database. No personal data is included in these lookups.
Apple App Store / StoreKit — handles Kufu Pro subscription purchases. Payment information is managed entirely by Apple; we do not see or store it.

Subscriptions

Kufu Pro subscriptions are managed entirely through Apple's App Store. We do not process or store payment information. See Apple's Privacy Policy for subscription billing details.

Data Sharing

We do not sell, share, or transfer your personal data to third parties. The only external data transmission is the AI food analysis described above.

Data Deletion

You can delete all your data at any time by deleting the app. If you use iCloud sync, also delete the data from iCloud via Settings > Apple ID > iCloud > Manage Storage.

Children

Kufu is not directed at children under 13. We do not knowingly collect data from children.

Changes

If this policy changes, we will update this page with a new effective date.

Contact

Questions? Email komuvesakos@icloud.com