Privacy
What WhispCal knows about you
This describes what the app actually stores, taken from its data model rather than from a template. Where something is a choice you make, it says so.
By Thomas MoriceBuilds WhispCal, and writes everything here
What is collected
An account, and the numbers you put into it. Nothing else is gathered in the background.
- Your account. An email address, or an Apple or Google sign-in, depending on how you created the account.
- Your profile. Age, sex, height, weight, activity level, goal, diet style, units and language. These are the inputs a calorie target is built from.
- What you log. Meals, the foods in them, and when you logged them.
- Weigh-ins and steps. Weight and daily step count. Steps and weight can come from Apple Health or Health Connect if you connect them, and nothing is read from either until you do.
- Autopilot state. Your current phase, your calorie target, your measured Peak Maintenance, and the history of how they changed.
- Feature counters. A daily count of how many AI logs you used, which is what enforces the free tier limits.
Where it goes
The app talks to a small number of services, and each one gets only what it needs to do its job.
- Supabase hosts the database and handles sign-in. This is where your account and everything above lives.
- Google Gemini parses food from text, voice and photos. A request contains what you wrote, said or photographed, and the app asks for your consent before the first one and records when you gave it.
- RevenueCat handles subscriptions, and sees a purchase identifier rather than your food or weight.
- PostHog records product events, such as a meal being logged, so we can see which parts of the app are used. Sentry records crashes.
- Apple and Google take the payment. We never see a card number.
This website
The site uses Vercel Web Analytics and Speed Insights. Both are cookieless and store no identifier, which is why there is no consent banner asking you to accept something.
If someone shares a meal with you, the link carries that meal and expires after 7 days.
Deleting everything
There is a delete account option in the app. It is a hard delete, not a flag: it removes the account and cascades through every table that references it, in one transaction. Nothing is retained for a grace period and there is no undo, which is the point.
If you would rather ask a person, write to whispcal@gmail.com from the address on the account.
Your rights
If you are in the EU or the UK, the GDPR gives you the right to see what is held about you, to correct it, to take it elsewhere, and to have it erased. The app covers erasure directly. For the rest, write to whispcal@gmail.com and you will get an answer.