EatCam 卡路里相机 · 隐私政策

生效日期与适用范围

生效日期：2026 年 8 月 1 日。本政策适用于 EatCam（卡路里相机）移动应用及其关联服务。首次使用前请阅读本政策。继续使用即表示你已知悉并同意本政策所述的处理方式。

数据控制者

EatCam 由个人开发者运营（以下称「我们」），Whaloom（忽然鲸）为本应用的发布品牌。就本政策项下个人信息处理相关的任何问题、请求或投诉，可通过 support@whaloom.com 与我们联系。

我们处理哪些信息，为什么

• 餐食照片：为完成 AI 菜品识别而上传至服务器，识别完成后立即删除，不用于模型训练。仅当你主动开启「照片云备份」（可选，默认关闭）时，照片才会加密存储于云端，详见下节。处理依据：履行服务所必需 / 你的同意。
• 匿名设备标识符：首次启动时随机生成的 UUID，仅用于统计每日免费识别次数与防滥用，无法关联你的真实身份。处理依据：正当利益（服务运营与防滥用）。
• 身体档案与饮食记录：身高、体重、目标及每餐记录默认仅存储在你的设备本地。仅当你开启「历史记录保存」（可选，Pro 权益）后，这些记录会保存到我们的服务器，供你在新设备上取回；关闭即停止保存。处理依据：你的同意。
• 订阅标识：本应用不设账号。开启「历史记录保存」时，我们以 Apple App Store / Google Play 签发的匿名订阅交易标识作为你保存数据的主键——它不含姓名、邮箱或任何可识别你身份的信息，仅用于把同一订阅下的设备对应到同一份数据。处理依据：履行服务所必需。
• 健康数据（Apple 健康 / Health Connect）：仅在你明确授权后，我们读取你的运动消耗（活动能量）用于在首页展示净热量收支，并写入你记录的餐食营养（热量、蛋白质、碳水、脂肪）和体重。健康数据只在你的设备与系统健康应用之间流转，不会上传至我们的服务器，不用于广告或任何其他目的。你可随时在系统设置（iOS：设置 → 健康 → 数据访问与设备；Android：Health Connect → 应用权限）撤销授权。处理依据：你的同意。
• 条码扫描：扫描包装食品条码时，条码号经我们的服务器向开放食品数据库 Open Food Facts 查询营养信息，不附带任何个人信息。若你为未收录的商品拍摄营养成分表或手动填写整包量，识别出的营养数值与整包量会以匿名形式汇入商品库供其他用户查询（不含照片、不含任何身份信息）。处理依据：正当利益（完善公共商品数据）。
• 订阅信息：付款由 Apple App Store / Google Play 处理，我们不接触你的支付方式或平台账号，仅收到用于解锁功能的匿名交易凭据。
• 我们不集成任何第三方广告或跨应用追踪 SDK，不收集姓名、电话、通讯录或精确位置。

照片的完整生命周期

默认情况：照片经 TLS 加密传输至我们的服务器，仅在内存中用于本次识别，不写入持久存储。识别产生的文字结果（菜名与营养估算）返回你的设备后，服务器侧的照片数据即被丢弃。

开启「历史记录保存」后（可选，默认关闭，Pro 权益）：餐食照片会加密传输并存储于阿里云对象存储（OSS），仅用于在你的设备间恢复照片，不用于识别之外的任何目的、不用于模型训练。你可以随时关闭备份。在 App 内删除某条记录会同步删除对应的云端照片；在设置中「清除已保存的记录」会删除全部云端照片。保存在你手机相册或 App 内的照片副本始终由你自己控制。

存储、保留与删除

饮食记录与身体档案保存在设备本地数据库中：你可以在 App 内逐条删除，卸载 App 将清除全部本地数据（如启用系统云备份——iOS 的 iCloud 或 Android 的 Google 备份——备份副本受相应平台条款约束）。若你开启了「历史记录保存」，云端保存你的记录快照与照片，用于在新设备上取回。在 App 内删除记录会同步更新云端；你可以在 App 内直接清除（设置 → 历史记录保存 → 清除已保存的记录），全部云端数据将即时删除，关闭开关则停止保存。也可联系 support@whaloom.com 申请，我们将在 30 天内完成。服务器侧另保留以「匿名设备标识 + 日期」聚合的用量计数，保留期不超过 12 个月。

第三方处理者

为提供服务，我们使用以下处理者：阿里云（AI 视觉模型推理，以及云同步与照片备份的服务器与对象存储，均依其数据处理协议处理），Open Food Facts（条码商品营养数据的公开查询），以及你下载本应用的分发平台（Apple App Store / Google Play，负责应用分发与订阅支付）。我们不出售个人信息，也不与任何第三方共享个人信息用于广告目的。

你的权利

你可随时在 App 内查看、更正或删除自己的数据。依据你所在地法律（包括欧盟/英国 GDPR、加州 CCPA/CPRA 等），你可能还享有访问、可携带、限制处理、反对处理及投诉监管机构的权利。行使权利请联系 support@whaloom.com，我们将在法定期限内响应。由于我们不持有可识别你身份的数据，部分请求可能仅能对设备本地数据由你自行完成。

未成年人

本服务不面向 13 周岁以下（或你所在地规定的同等最低年龄）的儿童。我们不会有意收集儿童个人信息。如你认为儿童在未经监护同意的情况下使用了本服务，请联系我们处理。

政策变更与联系方式

本政策可能不时更新：重大变更将在 App 内显著提示，继续使用即视为接受更新后的版本。历史版本与完整文本见 whaloom.com/eatcam/privacy。联系方式：support@whaloom.com（Whaloom / 忽然鲸）。本政策以英文版本为准，中文文本为方便阅读提供。

EatCam · Privacy Policy

Effective date & scope

Effective 1 August 2026. This Policy applies to the EatCam mobile application and related services. Please read it before first use; continued use signifies that you understand and accept the practices described here.

Who we are

EatCam is operated by an individual developer ("we", "us"); Whaloom is the brand under which the app is published. For any question, request or complaint regarding the processing of personal data under this Policy, contact support@whaloom.com.

What we process, and why

• Meal photos: uploaded to our server to perform AI dish recognition and deleted immediately afterwards — never used for model training. Only if you actively enable "Photo cloud backup" (optional, off by default) are photos stored encrypted in the cloud, as described below. Basis: necessity to perform the service / your consent.
• Anonymous device identifier: a random UUID generated at first launch, used only to meter the daily free quota and prevent abuse; it cannot identify you. Basis: legitimate interest (operations and abuse prevention).
• Body profile & food diary: height, weight, goals and meal records are stored on your device by default. Only if you turn on "Save history" (optional, a Pro feature) are they stored on our servers so you can restore them on a new device; turning it off stops saving. Basis: your consent.
• Subscription identifier: the app has no accounts. When "Save history" is on, we use the anonymous subscription transaction identifier issued by the Apple App Store / Google Play as the key for your saved data — it contains no name, email or anything that identifies you, and serves only to map devices under the same subscription to the same data. Basis: necessity to perform the service.
• Health data (Apple Health / Health Connect): only after your explicit authorization, we read your active energy burned to show a net calorie balance on the home screen, and write the nutrition of meals you log (calories, protein, carbs, fat) and your body weight. Health data moves only between your device and the system health app; it is never uploaded to our servers and never used for advertising or any other purpose. You can revoke access at any time in system settings (iOS: Settings → Health → Data Access & Devices; Android: Health Connect → App permissions). Basis: your consent.
• Barcode scanning: when you scan a packaged food, the barcode number is looked up through our server in the open database Open Food Facts, with no personal information attached. If you photograph the nutrition label of an unlisted product or enter its package size manually, the recognized nutrition values and package size are added anonymously to the product library for other users (no photo, no identifying information). Basis: legitimate interest (improving public product data).
• Subscriptions: payment is handled by Apple App Store / Google Play. We never see your payment details or platform account — only an anonymous transaction receipt used to unlock features.
• We integrate no advertising or cross-app tracking SDKs, and collect no name, phone number, contacts or precise location.

Photo lifecycle

By default: photos travel over TLS, are processed in memory for the single recognition request, and are never written to persistent storage. Once the textual result (dish names and nutrition estimates) is returned to your device, the server-side photo data is discarded.

With "Save history" enabled (optional, off by default, a Pro feature): meal photos are transferred encrypted and stored in Alibaba Cloud Object Storage (OSS), used solely to restore your photos across your devices — never for anything else, never for model training. You can turn backup off at any time; deleting an entry in-app also deletes its cloud photo, and "Clear saved history" in Settings erases all cloud photos. Copies in your camera roll or inside the app remain under your control.

Storage, retention & deletion

Diary and profile data live in a local database on your device: you may delete entries individually in-app, and uninstalling the app removes all local data (system cloud backups, if enabled — iCloud on iOS or Google Backup on Android — are governed by the respective platform's terms). If "Save history" is on, the cloud holds your diary snapshot and photos so you can restore them on a new device; deleting entries in-app updates the cloud accordingly, and you can clear everything directly in-app (Settings → Save history → Clear saved history) — all cloud data is erased immediately; turning the switch off stops saving. You may also email support@whaloom.com and we complete deletion within 30 days. Server-side we additionally retain usage counters aggregated by anonymous device ID and day, for no longer than 12 months.

Third-party processors

We rely on: Alibaba Cloud (AI vision model inference, plus the servers and object storage behind cloud sync and photo backup, all under its data-processing agreement), Open Food Facts (public lookup of barcode nutrition data), and the distribution platform you obtained the app from (Apple App Store / Google Play — app distribution and subscription billing). We do not sell personal information, nor share it with any third party for advertising purposes.

Your rights

You can view, correct or delete your data in-app at any time. Depending on where you live (including under EU/UK GDPR and California CCPA/CPRA), you may also have rights of access, portability, restriction, objection, and to lodge a complaint with a supervisory authority. To exercise them, contact support@whaloom.com; we will respond within statutory deadlines. Because we hold no data that identifies you, some requests may only be completable by you on your own device.

Children

The service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect children's personal information; if you believe a child has used the service without guardian consent, please contact us.

Changes & contact

We may update this Policy from time to time; material changes will be prominently announced in-app, and continued use constitutes acceptance. The full and historical text is available at whaloom.com/eatcam/privacy. Contact: support@whaloom.com (Whaloom). The English version of this Policy is authoritative.