Legal
Privacy Policy
Last updated: 29 October 2026
PicMyCals is made by Axamattic Limited, a company registered in England and Wales (company number 15570389), at 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London, W1T 6EB. We are the “controller” of your personal data. If you have questions, email harry@axamattic.com.
The short version
- You take photos of your meals. We estimate their calories and nutrients and keep your food diary.
- We only use your data to run PicMyCals. We never sell it, and we don’t use it for advertising.
- You can delete a meal, or your whole account, from inside the app at any time.
What we collect
- Account details
- Your email address, or the ID Apple or Google gives us when you sign in with them. If you use Sign in with Apple and choose “Hide My Email”, we only see the relay address. You can also give us your name.
- Profile details
- Your age, sex, height, weight, activity level and goal. We use these to work out your daily calorie and macro targets.
- Meal photos and diary
- The photos you take or upload, any descriptions you type, and the calories, nutrients and meal times we record.
- Subscription details
- Whether you subscribe, which plan you’re on and when it renews. Apple or Google handle the payment itself. We never see your card details.
- Technical and usage data
- Your device type, OS and app version, error logs, and how the app’s features are used. This helps us fix bugs and improve the app.
- Messages you send us
- If you contact support, we keep the conversation.
Health information
Your weight, body measurements and food intake can reveal things about your health. We only process them because you choose to give them to us for this purpose (your explicit consent). We use them only to provide the service. You can withdraw consent at any time by deleting the data or your account.
How we use your data
- To analyse your meal photos and estimate their nutrition.
- To work out your targets and keep your diary in sync across devices.
- To manage your account and subscription.
- To send emails you need, such as sign-in links, verification and password resets, and to answer support requests.
- To keep the service secure, prevent abuse (including fair-use limits on photo analysis), and fix and improve the app.
Our legal bases under UK GDPR are:
- Contract: to provide the service you signed up for.
- Consent: for health data and reminders.
- Legitimate interests: for security, fraud prevention and product improvement.
- Legal obligation: for example, tax records.
Your meal photos
Photos are sent over an encrypted connection and stored privately against your account. To analyse a photo, we send it to an AI model hosted on Amazon Web Services (Amazon Bedrock). The model provider does not use your photos to train its models. Only you can see your photos. When you delete a meal, its photo is deleted too.
The nutrition figures in the app are estimates made by AI. Jools, the character who talks to you in the app, is an AI assistant, not a person.
Who we share it with
We use a small number of trusted providers, who process data only on our instructions:
| Provider | What for |
|---|---|
| Amazon Web Services | Hosting, photo storage and AI analysis (UK/EU regions) |
| Supabase | Database (UK/EU/US regions) |
| Apple / Google | Sign-in, payments, and push notification delivery |
| RevenueCat | Managing subscriptions |
| Resend | Sending account emails |
| PostHog | Product analytics and error tracking (EU region) |
We may also disclose data if the law requires it, or to a buyer if the business is sold. In that case this policy will still apply to your data. We never sell your personal data.
International transfers
We keep your data in the UK and EU where we can. Where a provider handles data outside the UK, we rely on adequacy decisions, the UK International Data Transfer Addendum, or Standard Contractual Clauses.
How long we keep it
We keep your data while you have an account. When you delete your account, we delete your profile, diary and photos within 30 days. Backups expire within a further 30 days. We may keep limited records longer where the law requires it, such as transaction records for tax.
Your rights
You can ask to access, correct, delete or export your data. You can also object to or restrict how we use it, or withdraw consent.
Many of these you can do yourself in the app: edit your details in Profile, delete meals, or delete your account. For anything else, email harry@axamattic.com and we’ll reply within one month.
You can also complain to the Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to help first.
Notifications
Meal reminders are optional. You can turn them off in Profile or in your device settings at any time.
Children
PicMyCals is for people aged 18 and over. We don’t knowingly collect data from anyone younger. If you believe a child has given us data, contact us and we’ll delete it.
Security
We use encryption in transit, private storage, access controls and signed, short-lived links to photos. No system is perfectly secure, but we take reasonable steps to protect your data.
Changes
If we make significant changes to this policy, we’ll tell you in the app or by email. The date at the top shows when it last changed.
See also our Terms of Service.