Bilan

Bilan Privacy Policy

Last updated: October 20, 2026

Bilan (formerly CalorieSnap) is operated by Reymans Technologies LLC, New Jersey, United States. We determine how personal information is used to provide Bilan and act as its data controller where that term applies. This policy covers our app, website, messaging features, connected services, and support interactions.

Our Consumer Health Data Privacy Notice describes health-data categories, sources, disclosures, and rights. Our Terms of Service describe use of the service. Accepting the Terms or reading this policy does not replace a separate consent required by law.

What Bilan collects

How data is used

Other recipients and permitted disclosures

Hosting, database, file-storage, security, and customer-support providers process information needed to operate the service. Support correspondence includes the contact information and content you send us. Authorized personnel may access information to resolve your request, investigate a failure, or protect the service. Do not send passwords, payment-card details, or unnecessary medical records to support.

We may disclose information where legally required, to establish or defend legal claims, or to address fraud, security incidents, or threats to safety, subject to applicable law. A merger or transfer of the business does not remove applicable privacy obligations or authorize a new use of health data without any required notice and consent.

Health and nutrition notice

Bilan provides calorie and activity estimates. These estimates are approximate and are not medical advice. If you have medical nutrition needs, follow your clinician's guidance.

AI processing and your permission

In app versions that include these permissions, Bilan asks when you first use each AI feature. Before a meal or label photo is sent, the app asks whether to Analyze this photo and identifies the photo data, recipients, and purpose. Choosing Not now keeps the photo on your device and leaves manual meal logging available. Before agent replies, insights, or voice processing sends data, the app separately asks for permission to use these features and identifies the messages, audio, account context, recipients, and purposes. Choosing Not now leaves manual meal and activity logging available.

You can change either permission at any time under Profile → Privacy & data. Separate controls cover AI meal scanning and agent replies, insights, and voice processing. Turning a permission off immediately blocks that feature's AI requests from the consent-capable app. Turning off the agent and voice permission also disables pending AI-generated agent notifications. For a signed-in account, any withdrawal also revokes the older broad AI permission so an earlier app version cannot bypass the newer choice.

Version 1.4.0 was released before this permission control. During a temporary compatibility period, an untouched version 1.4.0 installation or signed-in account that has never recorded an AI-processing choice may continue using its existing AI features without the new choice. Those requests may send the same data categories to the same providers for the same purposes described below. This compatibility ends only after a consent-capable version is publicly available and adoption is verified.

When permission is on, Bilan collects AI inputs directly from what you photograph, type, or dictate in the app. For agent replies, insights, and optional agent notifications, Bilan also selects relevant information already in your account, such as calorie and macro targets, logged meals, activity, sleep, weight, and explicit agent preferences. Interactive replies can also use authorized pending messaging meal estimates, kept separate from saved diary entries. The app sends only the input and context needed for the requested feature.

Depending on provider availability, those inputs may be processed by Anthropic, OpenAI, xAI, or Google Gemini. They are used to generate meal estimates, label transcriptions, voice transcriptions, agent replies, weekly insights, or optional agent notification text. Bilan does not authorize these providers to sell the inputs, use them for advertising, or use them for an unrelated purpose. Bilan uses business or API services and remains responsible for requiring privacy protections through the applicable provider terms and data-processing commitments. Provider information is available from Anthropic, OpenAI, xAI, and Google Gemini.

Optional SMS/MMS and WhatsApp messaging

Where messaging is available, you choose a channel, accept messaging consent in the signed-in app, and send the app's linking message from your phone. This permits Bilan to answer nutrition questions using relevant diary and Agent context, and prepare meal or activity drafts that you review before saving. When you agree to connect with automatic saving, or enable it later in preferences, future meal photos and descriptions of meals you say you ate can be saved to your diary without a second confirmation. Existing drafts are unchanged. Reply UNDO within 24 hours to remove the latest automatically saved meal, provided it has not been edited. You can turn automatic meal saving off at any time. Advice and diary summaries do not themselves change your diary. Separate AI meal scanning and personal calorie agent and voice permissions still apply; linking a phone does not turn them on.

WhatsApp voice notes are sent to OpenAI for transcription when your Agent and voice permission is on. Bilan processes the audio in memory and stores the transcript as your message before applying the same meal-logging and Agent rules as typed text, including your automatic-saving choice. The transcript follows the messaging retention and deletion rules below. Bilan does not retain the raw audio; Twilio and WhatsApp may retain their copies.

Reminders and daily balance coaching stay off until you enable them separately. Optional daily coaching uses your diary and activity context at your chosen local time, subject to quiet hours and channel availability. You can pause or cancel it in the app. Reply STOP or disconnect in the app to end messaging and cancel pending work.

Twilio processes your phone number, message, photo and voice-note content, replies, and delivery information to provide SMS/MMS and WhatsApp messaging. WhatsApp messaging also uses Meta's WhatsApp service; SMS/MMS uses your mobile carrier. Bilan's AI providers described above may process the inputs needed for your requested estimate or reply when the applicable AI permission is on. Messages, photos, voice notes, and replies may remain in provider records, chat history, and device notifications. We do not sell your mobile information or messaging consent, or share them with third parties for their marketing. We share them with service providers only as needed to deliver the messaging service. See Twilio's Privacy Notice and the WhatsApp Business Messaging Policy.

Third-party assistant connections

If you choose to connect Bilan to a third-party assistant, Bilan sends only the nutrition information requested through that connection. This may include meal names and types, calorie estimate ranges, available macro values, saved calorie or macro targets, frequently logged foods, recipe summaries, counts, and calendar dates. The connection is read-only and does not send meal photos, account or record identifiers, Apple Health data, activity, weight, medications, agent history, social data, authentication tokens, or billing information. The assistant provider processes the returned nutrition information under its own terms and privacy policy. You approve the connection in the signed-in Bilan app and can disconnect it at any time under Apps & Health.

Third-party services

Food photos, label photos, typed or dictated meal descriptions, agent conversations, voice activity recordings, and relevant agent context are processed either after the applicable feature permission in a consent-capable app version or, during the temporary compatibility period, through the bounded untouched version 1.4.0 path described above. Anthropic, OpenAI, xAI, or Google Gemini may receive those inputs, depending on configuration and provider availability, solely to produce the requested AI output. Food-search terms and barcode lookups may be sent to Open Food Facts, USDA FoodData Central, or Nutritionix to return matching foods. We do not sell your data.

Optional agent dictation audio and voice activity recordings are sent to OpenAI solely to produce a transcript and, for voice activity, an editable activity estimate. The Bilan server does not retain the raw recording after the request. An agent transcript remains editable and is stored as part of your agent conversation only if you choose to send it.

To keep the app stable, Bilan uses Sentry for crash and performance reporting. When the app unexpectedly crashes or runs slowly, Sentry receives technical diagnostic data such as app version, OS version, device type, a stack trace, and recent categorical product-event breadcrumbs, such as app open or account creation method, used to diagnose the failure. Those breadcrumbs exclude meal categories and other meal details. Bilan configures Sentry without default PII collection and does not intentionally send a Bilan account identifier, meal photos or descriptions, health values, email addresses, authentication tokens, receipts, or device installation identifiers to Sentry. Bilan does not use Sentry to track you across other apps or for advertising. Sentry is a subprocessor based in the United States; see its policy at sentry.io/privacy.

If you explicitly opt in, Bilan uses PostHog for product analytics. PostHog is a US analytics processor and receives categorical product events such as app open, account creation method, onboarding completion, meal scan outcome, meal logged, and subscription funnel steps, along with app version and build and SDK-generated random installation and session identifiers. Bilan does not send a Bilan account identifier, meal photos, food names, health samples, email, receipts, or device installation identifiers to PostHog. Device model, operating system, locale, timezone, screen dimensions, GeoIP enrichment, session replay, lifecycle autocapture, surveys, and error autocapture are excluded or disabled. You can withdraw consent at any time from Privacy & data in the app, including from Profile. Withdrawal stops new capture. Bilan also asks the on-device PostHog SDK to discard pending events before analytics can be enabled again. See its policy at posthog.com/privacy.

On iOS, Bilan uses RevenueCat as a subscription-validation and analytics processor. RevenueCat receives an internal Bilan account identifier and App Store purchase and subscription history, including receipt data, so it can validate purchases and report subscription diagnostics. RevenueCat does not decide whether an account has access; the Bilan server remains authoritative. Bilan does not send meal photos, food details, health samples, agent conversations, email addresses, or authentication tokens to RevenueCat. See its policy at revenuecat.com/privacy.

On Android, Google Play processes subscription payments. Bilan does not receive or store your payment card details. Bilan verifies each purchase with Google Play and stores the subscription details listed above to keep your access current. Each purchase carries an obfuscated account identifier, a one-way hash of your Bilan account identifier, so Bilan can match the subscription to your account without giving Google the identifier itself. See Google's policy at policies.google.com/privacy.

On iOS, Bilan uses Apple's AdServices attribution token to determine whether an account came from an Apple Ads campaign. The token is stored only as a cryptographic hash. Apple may return campaign, ad group, keyword, placement, and impression or click details, which Bilan links to the account for campaign analytics. Bilan does not use this data for cross-app tracking and does not serve third-party ads.

When you enable remote reminders, Bilan uses the Expo push service to deliver notifications through Apple Push Notification service on iOS or Firebase Cloud Messaging on Android. Expo, and Apple or Google for delivery, receive the device-scoped push token and the notification content, which can include figures from the reminders you enable, such as tonight's estimated calorie balance or today's step count.

Website analytics

Public pages on mycaloriesnap.com use Plausible to measure visits without cookies. We send the public page path and referring website origin, excluding URL query strings, fragments, referral codes, account pages, and private previews. We do not send app account or health data to Plausible. This website measurement is separate from the optional in-app analytics described above.

Browser Do Not Track signals do not change the cookie-free public-page measurement described above. Do Not Track and Global Privacy Control are different signals. We do not serve third-party ads or use this website measurement for cross-context behavioral advertising. Where an applicable law requires us to honor an opt-out preference signal, that requirement applies regardless of the browser setting's name.

Optional model-training contributions

When saving a corrected photo meal, you may choose to share that one meal photo, corrected food name, and calorie value for training Bilan's food-recognition model. Saving a meal, allowing AI processing, or enabling usage analytics does not grant this permission. Future meals are not shared automatically. Contributions retain an account link so you can export or remove them in Privacy & data. They do not include your profile or connected health data.

Removing contributions excludes them from future training and leaves your diary unchanged. Deleting the source meal or your account also removes its contributions. Removal cannot reverse training already completed. Bilan does not sell contributions.

Children and younger users

Bilan is not intended for children under 16, or anyone below a higher minimum age required by local law. Users who have not reached the legal age to enter this agreement must have a parent or guardian's permission and acceptance of the Terms where required. Contact support if you believe a child below the permitted age has supplied information, so we can investigate and arrange deletion as required. A store age rating is not permission to create an account.

Data retention

Account-linked data is retained while your account is active so Bilan can provide your history and requested features. Bilan does not set a separate fixed expiration period for active account records. Raw agent dictation audio is processed in memory and is not retained by Bilan. Account deletion removes the Bilan records listed below.

Account-linked messaging records follow the same active-account retention rule. STOP, disconnecting, or cancelling a draft stops the relevant work but does not erase existing records. Temporary photo files used for a messaging estimate are removed from the Bilan server after that request; the current service does not automatically delete Twilio's original photos, voice notes or provider message records. Limited anti-abuse receipts retain provider message identifiers, keyed sender hashes, and timestamps, without raw phone numbers or message content. Those receipts have no fixed expiration and are not removed by account deletion.

A fixed retention period for installation-linked product analytics has not yet been confirmed. Apple classifies these events as linked through a random installation identifier, not through a Bilan account identifier. When available, the app includes its analytics installation identifier with your deletion request so we can arrange provider-side erasure. Older installations, other devices, or cleared app storage may require additional investigation. Account deletion alone is not confirmation that analytics events have been erased.

RevenueCat retains purchase and subscription records under its privacy and legal-retention terms. In-app account deletion detaches the app from the former RevenueCat customer identity but does not delete Apple's purchase history. Account deletion creates a follow-up task for the associated RevenueCat customer record, subject to applicable retention requirements. Contact support@mycaloriesnap.com about its status.

Historical website waitlist records are retained only until launch communications conclude or you request removal, whichever comes first. The public website no longer accepts waitlist signups. Email support@mycaloriesnap.com from the address originally submitted to have that record removed.

Historical Friends & Challenges database rows from builds that predated removal remain only for profile export and account deletion. The current app does not add new friend or challenge activity.

Retention must remain necessary for the stated purpose. An account that has not been deleted is not a reason to retain every category indefinitely. Privacy requests also cover records outside the self-service deletion flow. Any retention exception must have a specific purpose and applicable legal basis; a hashed or random identifier is not necessarily anonymous information.

Backups, infrastructure logs, and processor records may have separate deletion cycles. Contact us for a request covering these records. Where applicable law requires deletion from backups or notification to recipients, we handle the request under those requirements rather than treating the self-service result as proof that every copy is gone.

When a meal photo or profile photo is removed or replaced, its storage path is held in a restricted deletion queue until cleanup succeeds. Failed cleanup is retried. These temporary records are used only to finish deletion, not to restore your account or train a model.

Account deletion also creates a restricted request record containing the identifiers needed to complete provider follow-up, such as account and contact identifiers, message references, delivery tokens, and photo paths. These identifiers are removed when all follow-up tasks are resolved. Minimal completion records are retained to document how the request was handled. They are not used for advertising, model training, or restoring your account.

Data deletion

You can delete your account from the app (Profile → Privacy & data). Self-service deletion removes the account, profile, meals, activity records, steps, synced Apple Health and Health Connect summaries, weight entries, hydration logs, journal entries, medication logs, connected-device records, daily reports, agent conversations, agent memory, historical Friends & Challenges records, feedback reports, messaging links, linking records, messages, replies and drafts, push devices, refresh tokens, subscription state, Apple Ads attribution records, and Google Play install referrer records from Bilan. Associated stored meal and profile photos are queued for deletion as described above; account deletion is not confirmation that every storage or backup copy has already been erased. App Store server-notification audit rows are retained only without any link to the deleted account. Apple manages subscription billing and purchase history separately. Deleting a Bilan account does not cancel an Apple subscription or remove Apple's transaction records.

Google Play subscription notification rows are retained only without any link to the deleted account. Google manages Google Play billing and purchase history separately. Deleting a Bilan account does not cancel a Google Play subscription.

Deleting a Bilan account does not automatically erase messages, photos or voice notes held by Twilio, WhatsApp, your carrier, or your devices. Some recipients keep independent records; others process records on our behalf. Contact the privacy support address below about provider-held records or the status of your request. Account deletion creates provider follow-up tasks; it does not itself confirm provider erasure. We remain responsible for instructing our processors and notifying other recipients where applicable law requires it. A provider's own policy does not waive your rights or our obligations. We explain any lawful retention exception in our response.

Removal of a historical waitlist record is separate from in-app account deletion. Send the request from the email address originally submitted to support@mycaloriesnap.com.

Your privacy rights and requests

You can request access to your information, correction, deletion, or a portable copy by emailing support@mycaloriesnap.com. The app also provides account export and deletion under Privacy & data. You do not need to create a new account to make a request. If an export is marked incomplete, contact support for the remainder.

Depending on the law that applies, you may also have rights to restrict processing, object to processing based on legitimate interests, withdraw consent, limit certain uses of sensitive information, opt out of sale, sharing or targeted advertising, and appeal a refusal. We do not sell your data. Disclosures to service providers and user-directed connections are described above; these are not a blanket permission for other uses.

We may request information reasonably needed to verify your identity or an authorized agent's authority. Do not send identification documents unless requested through an appropriate secure method. We respond within the deadline under the applicable law and explain any permitted extension, refusal, or fee. Exercising a privacy right does not result in unlawful discrimination. A feature may stop working when the information or consent necessary to provide it is withdrawn.

To appeal, reply to our decision or email support with the subject "Privacy appeal". You may also complain to your local data-protection authority or attorney general without first completing our internal process. Withdrawal does not affect processing that was lawful before withdrawal, and does not waive any right concerning an earlier unlawful use.

International users and legal grounds

Bilan is operated from the United States. Information may be processed in the United States and other countries where the providers described above operate. Those countries may have different privacy laws. Using the app does not waive mandatory protections in your country or, by itself, constitute consent to a restricted international transfer.

Where European or UK data-protection law applies, the legal grounds must match the activity: performance of a contract for requested account and service functions; consent for optional processing where required; legal obligations for required records and responses; and legitimate interests, balanced against your rights, for proportionate security, fraud prevention, and service administration. Health information requires an additional legal condition, such as explicit consent where applicable. Contractual necessity alone does not authorize processing special-category health data.

You may object to processing based on legitimate interests and to direct marketing. You may ask us for information about the transfer mechanism and safeguards applicable to your data, and a copy where required. A transfer requiring safeguards or local authorization must have those protections; this policy is not itself a transfer agreement, certification, or regulatory approval. Local rights and restrictions also apply where relevant in Africa, the United Arab Emirates, and other countries. Availability of a website is not a statement that every feature is offered in every country.

Calorie estimates and suggestions are generated automatically and can be corrected by you. They are not decisions about eligibility for employment, insurance, credit, or medical treatment.

Security and changes to this policy

We use safeguards appropriate to the information and service, including access controls and protection of account credentials. No system or transmission is completely secure. SMS/MMS, shared devices, notification previews, and exported files can expose information to others. WhatsApp transport encryption does not mean that the complete path through Bilan and its processors is end-to-end encrypted. Contact support promptly about a suspected privacy or security incident. We provide notifications required by applicable breach-notification law.

We update the date above when this policy changes. Material changes will be communicated through an appropriate in-app notice or other direct notice before a new use begins where required. A policy update does not override an existing consent choice; we obtain additional consent when required.

Contact

Reymans Technologies LLC handles Bilan privacy requests. Questions, access requests, or deletion help: support@mycaloriesnap.com