Summary
Lazy Calories is a food-tracking app that can estimate calories and macronutrients from food photos or text. Core meal records are stored locally on your device. Network features include hosted AI analysis, approximate location context, purchase verification, and optional integrations. Android can back up the app ID and backup settings, and app-created ZIP backups can copy meal and profile records to your chosen storage provider.
Data the app handles
Photos and food entries
With Android photo permission, the app reads photo metadata and content from the device media library. You may grant access to all photos or only selected photos, depending on your Android version and choice. The app stores references to photos, meal timestamps, calorie and macro estimates, food descriptions, stack and serving information, notes you enter, and on-device food-labeling results. It does not copy full photo files into its Room database.
ML Kit image labeling can classify likely food photos on the device. If hosted AI analysis is requested or enabled for a detected food photo, the app resizes the relevant image and sends it with useful context. A grouped meal may include several selected images, such as different angles, a menu, or a receipt. Text-only entries and food-evaluation photos are handled in the same way when you use those features.
Profile and food preferences
The app can store birth year, biological sex, height, weight, unit preference, and dietary preferences. These values are used to calculate a calorie budget and tailor food suggestions. They are stored locally and may be included in a hosted request only when needed for the feature you invoke. The app does not create a conventional user account or request your name.
Approximate location
The app may request city and country from ipapi using the device’s public IP address. It does not request precise GPS location or Android location permission for this feature. City and country are cached in encrypted app preferences for up to seven days and may be included as context in AI food analysis or suggestions. ipapi necessarily receives the network IP address and handles it under its own privacy policy.
Installation and usage information
On first use, the app creates a random installation identifier, also called an app ID. It is not an advertising ID and is not derived from your name, email address, Android ID, hardware serial number, or photo content. The app sends the identifier to TokenGate over HTTPS. TokenGate stores a secret-keyed, project-scoped fingerprint with request time, model, token counts, estimated cost, plan and quota status, and security results. AI requests can be resumed after an interrupted connection or app restart, so TokenGate temporarily keeps an encrypted copy of each request until it finishes and of its response for one hour afterwards, as described under Hosted records.
This is a pseudonymous identifier: it lets the service link hosted usage to the same app profile, apply allowances, and prevent abuse. It does not establish your real-world identity, and we do not use it to build a food-habit profile. Backups can preserve the ID after reinstalling or moving to another device. Devices restored from the same backup share its usage identity and AI allowance. Recovery is not guaranteed and does not extend how long hosted records are retained.
Optional Health Connect information
If you choose to connect Health Connect and grant permissions, the app can read total and active calories burned and the latest weight. It uses this information to adjust calorie budgets and may update your local weight setting. The app can also write nutrition records that include calories, meal time, meal type, and a food description. Health data is not used for advertising and is not sold. Lazy Calories does not send Health Connect records to TokenGate or the AI provider as health records, although locally calculated daily budget or food-summary context may be part of an AI suggestion request.
Purchases
If you buy LazyCalories Pro, Google Play handles payment details. The app receives purchase status and a purchase token. The purchase token, product identifier, and an installation binding are sent to TokenGate for verification with Google Play. TokenGate stores a keyed digest of the purchase token, not the raw token, together with subscription status, plan dates, product and base-plan identifiers, acknowledgement state, and installation binding. We do not receive your card or bank details.
Diagnostics and website use
The app can write ordinary diagnostic messages to the Android system log. Lazy Calories does not include an advertising SDK or a third-party analytics SDK. This public website does not use analytics, advertising pixels, cookies, local storage, or a contact form. Like most hosting services, its infrastructure may process basic request information such as IP address, time, requested path, and browser details for delivery and security.
How the data is used
- Show and organize a local food timeline and calculate daily progress.
- Identify likely food photos on the device.
- Provide requested AI calorie, macro, meal-grouping, food-evaluation, and suggestion features.
- Personalize calorie budgets using information you enter and optional activity data.
- Synchronize nutrition records with Health Connect when you enable that option.
- Measure hosted AI usage, enforce plan limits, prevent abuse, and verify Pro purchases.
- Maintain reliability, investigate errors, and protect the service.
We do not sell personal information and do not use food photos, health information, or meal records for targeted advertising.
Service providers
Information is disclosed only as needed to operate a feature:
- TokenGate: authenticates the app, applies plan limits, verifies purchases, and routes hosted AI requests. See the TokenGate privacy policy, terms, and trust page.
- OpenRouter and Google Gemini: TokenGate currently routes Lazy Calories AI requests through OpenRouter to a Google Gemini model. These services process request content to return a result. Their own terms and retention rules apply, including security and abuse-monitoring practices. See OpenRouter privacy and Gemini API terms.
- Google: provides Android, ML Kit, Health Connect, Google Play Billing, and purchase-verification services. On-device ML Kit labeling does not require sending your food photo to Lazy Calories’ hosted AI service.
- ipapi: converts a public IP address into approximate city and country information when that context is requested.
- Amazon Web Services: hosts this static website and its delivery network.
We may also disclose information when legally required, or when reasonably necessary to protect users, the service, or the public. We do not permit providers to use app data for advertising on our behalf.
Storage, backup, and retention
On the device
Meal metadata, profile information, food preferences, cached fitness totals, and app settings are stored in the app’s local Room database or preferences. Versions supporting app ID recovery store the identifier in private preferences without additional app-level encryption, so Android can back it up. The approximate-location cache remains in encrypted preferences. While an AI request is in progress, the app keeps an encrypted copy of the request, and then of its answer, in private storage that Android does not back up. It deletes them once the answer is applied or the request can no longer be recovered. Clearing the app’s storage or uninstalling it removes the local copy, subject to Android and storage-provider behavior, but does not delete backups or hosted records.
Versions supporting app ID recovery allow Android automatic cloud backup and device-to-device transfer to preserve the identifier and backup settings. Android controls backup availability, timing, encryption, and restoration according to your device and settings. The Room database, encrypted preferences, and cached AI usage are excluded. Recovering the ID does not itself recover meal records; use an app-created ZIP backup for those. Without an available ID backup, a new installation may create a new ID.
User-created backups
If you configure backups, Lazy Calories writes an unencrypted ZIP file to Downloads/LazyCalories or to a folder you choose through Android’s storage picker. A backup contains meal and profile records, photo references, food preferences, and cached fitness totals. Backup format 5 also includes the app ID. It does not include photo files, TokenGate access keys, or purchase tokens. Restoring replaces current local records and restores the saved ID; older backups retain the current ID. Restoring an ID reuses its existing service usage state when that state is still retained, rather than granting a new allowance or proving ownership of a subscription. Google Play purchases still require verification.
Keep ZIP backups private. Anyone with a copy can read their contents and restore the saved usage identity. Automatic backup housekeeping keeps daily backups for up to seven days and one weekly backup for the following three weeks, for a retention window of up to 28 days. A storage provider you choose may sync or retain those files under its own policy. Delete unwanted backup files from that provider. During a restore, the app temporarily keeps a private copy of the snapshot outside Android backup to finish interrupted writes. It removes that copy after the restore completes.
Hosted records
The app sends AI requests so that they can be resumed after an interrupted connection or app restart. TokenGate keeps each request’s content, including any resized images, encrypted until the request finishes, and the encrypted response for one hour after it completes, then deletes them from its live database. Encrypted copies can remain in the database change log and daily server snapshots, usually for 30 to 37 days after they were written. A content-free record of each request ID is kept for 90 days so that a repeated request cannot run or be charged twice. Detailed usage records tied to an installation fingerprint are normally retained for 90 days. Fingerprint-free monthly usage totals are retained for up to 24 months. An inactive installation fingerprint is normally removed after 90 days, except where a security block or custom quota must remain. Short-lived infrastructure security logs may be kept for up to seven days during an incident and are configured to exclude content and credentials. Purchase records are kept while needed to provide, transfer, reconcile, or defend the subscription and to meet legal obligations.
AI providers, Google Play, Health Connect, ipapi, your chosen backup provider, and website hosting providers maintain information under their own retention rules.
Your choices and deletion controls
- Limit photo access to selected images, revoke photo permission in Android settings, disable background food detection, or stop using AI features.
- Edit calorie values and meal context, exclude photo entries from calorie totals, and delete text-only entries in the app.
- Clear app storage or uninstall the app to remove the local database and preferences. Android may restore the app ID and backup settings on reinstall. Review Android’s backup controls separately; uninstalling does not erase Android cloud backups or hosted usage records.
- Delete user-created ZIP backups from the folder or cloud-storage provider you selected.
- Revoke Health Connect permissions and separately review or delete records written by Lazy Calories in Health Connect. Clearing or uninstalling Lazy Calories does not necessarily delete records already written to Health Connect.
- Manage or cancel a Pro subscription through Google Play. Cancellation does not itself delete local or server usage records.
- Email us to request deletion of TokenGate records linked to the current installation. We may need a non-secret installation reference shown by the app or other reasonable information to identify the record.
Deleting a source photo in another app may make it unavailable to Lazy Calories, but it is not a substitute for clearing the app’s local records or deleting a user-created backup.
Security
Network requests use HTTPS. The app ID is a recoverable usage reference, not an authentication secret or proof of a unique physical device. Sensitive preferences such as cached location use Android encrypted storage. App-created ZIP backups are unencrypted and exclude TokenGate access keys and purchase tokens. Purchase tokens are stored server-side only as keyed digests. TokenGate requests use app and device-integrity checks where available. No system can guarantee absolute security or recovery. Keep your device and any chosen backup location protected, and do not place information in meal notes that you do not want processed.
Children
Lazy Calories is not directed to children under 13, or a higher minimum age where local law requires it. We do not knowingly collect personal information from a child through an account system. A parent or guardian who believes a child has provided information through the app can contact us to request review and deletion.
International processing and policy changes
Service providers may process information in countries other than your own. Their laws may differ from those where you live. We may update this policy when the app, providers, or legal requirements change. The effective date and the policy available at this stable URL will be updated.
Contact
Questions, privacy requests, and deletion requests can be sent to lazycalories@inbox.aceves.mx. Please do not email food photos, health details, purchase tokens, or other sensitive information.