LucaPrivacy Policy
This policy explains what the Luca app for iPhone does with your data. Luca is published by Ege Beşe, an individual developer ("we", "us"). You can reach us at support@ege.md.
The short version
- There is no account. You never give us your name, email address or phone number.
- The app uses an anonymous identifier so our servers can tell one installation from another.
- Meal photos, meal text and voice recordings are sent to our servers to be processed and are not stored there.
- Processing runs on servers we operate, not at a third-party AI provider.
- Your meals are stored on your device, and in your own iCloud if you have it enabled.
- Friends see only your display name, avatar, streak, whether you logged today, whether you reached your goal today, and your badges.
- Apple Health data stays in your own Health store on your device.
- You can delete everything at any time.
Who is responsible
Luca is published by Ege Beşe, an individual developer, who decides how the data described here is used. For any privacy question or request, write to support@ege.md.
No account, an anonymous identifier
When you first open Luca, it signs in anonymously in the background using Firebase Anonymous Authentication. This creates a random identifier for your installation. It is not connected to your name, email address or Apple Account. We use it to know which daily scan allowance, which subscription and which friends profile belong to which installation.
Meal photos, voice and text
- Photos. When you scan a meal, the photo is sent over an encrypted connection to our servers, analysed on servers we operate, and the estimate is returned to your device. The photo is not stored on our servers.
- Text. When you type a description of a meal, the text is sent, analysed in the same way and not stored on our servers.
- Voice. When you log a meal by voice, Luca records up to 20 seconds of audio and sends it to our server to be turned into text. The recording is linked to your anonymous user ID only for the duration of that request; it is not stored on our servers or on your device after the text is produced, and it is never used for advertising or shared with third parties. The text is then handled like typed text.
- Fixes in words. When you correct a result by typing a sentence, the sentence and the current result are sent, analysed and not stored.
- Nutrition labels. When a barcode is not found and you photograph the nutrition label, that photo is sent, read on our servers and not stored.
- No third-party AI provider. We do not send your photos, voice recordings or meal text to an outside AI service.
- Where the numbers come from. Our servers work out what the food is and how much. Calories and macros are then calculated from a nutrition database that we hold on our own servers, where the food is recognised. When a food is not recognised in the database, Luca uses its own estimate for that item and treats the result as less certain. Your meals are not sent to any outside nutrition service for this.
- No training. Because photos, recordings and meal text are not stored, we do not use them to train AI.
What is worked out on your device and never sent
- The camera hint. The camera gently tells you when no meal is in view. That check runs on your device; nothing is sent for it.
- Your usual portions. Luca learns your usual portions from your corrections. This is kept on your device and is not sent to our servers.
What is stored on your device
Your meals (their items and numbers), your recent and favorite meals, your targets, your streaks and your achievements are stored on your iPhone. If iCloud is enabled for Luca on your device, this data is also stored in your own iCloud, which is run by Apple under your Apple Account. We cannot read your iCloud.
Barcode lookups
When you scan a barcode, the barcode number is sent to our servers, which look the product up in Open Food Facts, an open food database. The product's name and nutrition data are returned to your device. A barcode number says which product was looked up; it carries no personal information.
Friends and challenges
Friends are optional. If you use them, our servers store, under your anonymous identifier:
- the display name you choose and the avatar you pick (one of twelve built-in pictures of Luca and Mino);
- your 4-character friend code;
- your streak;
- two flags for the day: whether you logged, and whether you reached your goal;
- the badges you have earned;
- who your friends are, and the challenges you take part in with the number of days counted for each member.
Your friends can see your display name, avatar, streak, the two day flags and your badges. They cannot see your calories, macros, meals, photos or targets, because that information is never sent to our servers for sharing.
Apple Health
Luca works with Apple Health only if you allow it, and you choose what it may read or write. Apple Health data never leaves your device through Luca: it is read from and written to your own HealthKit store on the device. We do not send it to our servers, use it for advertising or share it with anyone.
Other data
- Scan counter. Our servers count your AI scans for the day to apply the free plan's limit. The counter holds a number, not the content of a scan.
- Subscription status. If you subscribe to Luca Pro, Apple handles the payment. RevenueCat tells the app and our servers whether a subscription is active for your anonymous identifier. We never receive your card details.
- Notifications. If you allow notifications, a notification token for your device is stored so that notifications can be delivered through Apple's push service.
- Usage statistics. Anonymous usage statistics are collected through TelemetryDeck, for example which screens and features are used. They contain no meal content, photos or names, and are not linked to your identity.
- Technical logs. Our servers keep short-lived technical logs (time, the anonymous identifier, the kind of request, whether it succeeded) to run the service and stop abuse. They do not contain photos or meal text.
We do not sell your data and we do not use it for advertising.
Who processes data for us
| Processor | What for |
|---|---|
| Apple | The App Store, payments and subscriptions, iCloud (if you enable it), HealthKit on your device, push notifications. |
| Google Firebase | Anonymous authentication and the server functions the app talks to, including the friends data described above. |
| RevenueCat | Subscription status for your anonymous identifier. |
| TelemetryDeck | Anonymous usage statistics. |
| Open Food Facts | Barcode lookups: the barcode number is looked up in its database. |
The processing of photos, voice recordings and text runs on servers we operate ourselves. Nutrition values for everyday foods come from a database we hold on our own servers.
Why we may process it
We process the data above to provide the service you ask for (analysing a meal, looking up a barcode, showing you to your friends, keeping your subscription working) and, for usage statistics and technical logs, on the basis of our legitimate interest in running and improving the app without identifying you. Apple Health access rests on the permission you give in iOS.
How long data is kept
- Meal photos, voice recordings and meal text: not stored on our servers. A voice recording is also not kept on your device after the text is produced.
- Friends profile, friend links, challenges, scan counter, notification token: until you delete your data, or remove the friend or leave the challenge.
- Data on your device and in your iCloud: until you delete it.
- Subscription records: as kept by Apple and RevenueCat under their policies.
Deleting everything
Use Delete all data in the app. It removes what our servers hold under your anonymous identifier and the data on your device. You can also write to support@ege.md. The delete-your-data page gives every step, including the copies in your own iCloud and Apple Health.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict its use, and to complain to your data protection authority. Write to support@ege.md. Because we hold no name or email for you, we will ask for your friend code or anonymous identifier to find your records.
Children
Luca is not directed at children under 13, and we do not knowingly collect data from them.
Not a medical service
Luca gives estimates for general information. It is not a medical device and we do not process your data to diagnose, treat or advise on any health condition.
This website
The website luca.ege.md sets no cookies, runs no analytics and loads nothing from third parties. As with any website, the server that hosts it and Cloudflare, which carries its traffic, process your IP address and the page you request in order to deliver the page and keep the service secure.
Changes
If this policy changes in a way that matters, the date at the top changes.