Privacy Policy — Kestrel
1. Who we are
Kestrel is a calorie and nutrition tracking application operated by Amir Muradov, an independent developer based in Bishkek, Kyrgyzstan.
For any privacy question, or to exercise the rights described in section 9, contact sohmuradov47@gmail.com.
This policy explains what Kestrel collects, where that data goes, how long it is kept, and how to delete it. If you do not agree with it, please do not use the application.
2. Summary
Kestrel works on your device and, when you sign in, syncs your data to our servers so it survives a reinstall or a change of phone.
- You can use Kestrel without an account. If you do, your data stays on your device and is not synced.
- Meal photographs and your messages to the AI coach are processed by Google's Gemini API on our behalf.
- We do not sell, rent, or trade your personal data, and we do not share it for advertising.
- Kestrel contains no advertising, analytics, crash reporting, or attribution software of any kind.
3. What we collect
3.1 Account information
When you sign in with Google, we receive and store your email address, your display name, and your profile picture URL. Signing in is optional; you can use the app without an account, with the limits described in section 2.
We also generate and store a user identifier that links your records together and identifies you to our subscription provider.
3.2 Health and fitness information
When you are signed in, the following is stored on our servers:
| What | Detail |
|---|---|
| Body metrics and goals | Gender, age, height, weight, target weight, BMI, goal, activity level, workout frequency, weight-loss pace |
| Dietary restrictions | Food allergies you enter |
| Weight history | Every weigh-in you record, with its date |
| Meal logs | Meal name, calories, protein, carbohydrates, fat, servings, time logged, and a reference to the meal photograph |
| Activity logs | Exercise type, label, duration, and calories burned |
| Daily balances | Rollover calories per day |
| Logging streaks | Your streak count and last activity date |
Water intake and your calculated daily calorie and macro targets are held only on your device and are never sent to our servers.
3.3 Photographs
- Meal photographs. Taken with the camera or chosen from your gallery, then sent to our servers for AI analysis and stored so your history displays correctly.
- Progress photographs. Stored on your device, and additionally uploaded to our private storage when you are signed in.
Photographs are stored in a private bucket. Access is restricted to your own account, and images are served through short-lived links that expire after seven days.
3.4 AI coach conversations
If you use the AI coach, the full text of your conversation is stored on our servers — both your messages and the coach's replies — along with the session title and a preview of your most recent message. Because you may discuss your health with the coach, please treat these messages as health information.
3.5 Subscription information
If you subscribe, we store your plan, store of purchase, status, trial status, expiry date, product identifier, cancellation date, and the purchase token. We never see or store your card details. Payment is handled entirely by Google Play.
3.6 What we do not collect
Kestrel does not collect or access: your location, your contacts, your calendar, your files, your browsing history, your advertising identifier, audio or video recordings, or any device identifier transmitted off your phone. The app requests only the camera permission, and only for meal scanning and progress photographs.
4. Where your data goes
We use the following providers. Each processes data solely on our instructions and only to deliver the service.
| Provider | What it receives | Purpose |
|---|---|---|
| Supabase | Account details, all health and fitness records, chat history, subscription records, photographs | Authentication, database, and file storage |
| Our backend service (Render) | Meal photographs; your messages, recent conversation history, and user identifier | Routes requests to the AI models |
| Google Gemini API | Meal photographs; AI coach message text and recent conversation history | Food recognition and coach replies |
| RevenueCat | Your user identifier and subscription status | Subscription management |
| Google Play Billing | Payment details, which we never receive | Payment processing |
We may also disclose information where we are legally required to do so, or where it is necessary to establish or defend a legal claim.
5. Data we handle without an account
Two things happen before you sign in, and you should know about them:
- The app contacts our server once at launch to wake it up. No personal data is sent, but this discloses your IP address and the time you opened the app.
- Meal scanning works without an account. Your photograph is sent for analysis with no identifier attached and is not linked to any user.
6. How long we keep it
Your records are kept for as long as your account exists. If you delete your account, they are erased as described in section 7.
AI coach conversations are retained indefinitely while your account exists, so your history remains readable.
If you use Kestrel without an account, nothing is retained on our servers beyond the anonymous scan described in section 5.
7. Deleting your data
In the app: open Account settings and choose Delete account. You will be asked to confirm twice. This permanently erases your profile, meal logs, weight history, activity logs, rollover balances, streaks, progress photograph records, all AI coach conversations, your subscription record, and every image stored under your account. Your local data is cleared at the same time. This cannot be undone.
On the web: if you cannot access the app, you can request deletion at https://amirmuradov.github.io/velora-ai-privacy-policy/delete-account.html, or by emailing sohmuradov47@gmail.com from the address on your account. We will action it within 30 days.
8. Security
Data is encrypted in transit using HTTPS on every connection. Our database enforces row-level security so that records can only ever be read by the account that owns them, and our storage bucket applies the same rule to files. Access to production systems is limited to the operator named in section 1.
No system is perfectly secure, and we cannot guarantee absolute security.
9. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent at any time.
To exercise any of these, email sohmuradov47@gmail.com. We will respond within 30 days.
If you are in the EEA or the UK and believe we have handled your data improperly, you may complain to your national data protection authority.
10. Children
Kestrel is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18. Calorie and weight tracking is not appropriate for children without medical supervision.
If we learn that we hold data from someone under 18, we will delete it promptly. If you believe a child has provided us with data, contact sohmuradov47@gmail.com.
11. Changes to this policy
We may update this policy. Any change will be posted on this page with an updated effective date. Your continued use of Kestrel after a change takes effect constitutes acceptance of the updated policy.
12. Contact
This document was drafted from a technical audit of the application's actual data flows. It is not legal advice, and it has not been reviewed by a lawyer. If you take on users at scale in the EEA, have it checked by someone qualified.