本应用是一款纯本地运行的热量与运动记录工具：手动记录饮食与运动、估算基础代谢、按周／月生成统计报告。AI 估算功能可选，需由您自行配置第三方大模型接口。开发者不运营任何服务器，不收集、不上传、不存储您的个人信息。
本应用是一款纯本地运行的个人热量与运动记录工具。开发者不运营任何服务器，不收集、不上传、不存储您的任何个人信息。
您填写的身体数据、饮食与运动记录全部保存在您自己设备的应用私有目录中。唯一会联网的动作，是把数据发送到您自己在「设置」页配置的第三方大模型（AI）接口或搜索服务——这一点在第 3 节详细说明，请务必阅读。
本应用不设账号体系，无需注册登录，也不要求您提供手机号或邮箱。以下信息由您主动填写或由您发起的 AI 估算产生，全部存储在您的设备上，开发者无法访问：
| 类别 | 具体内容 | 来源 |
|---|---|---|
| 身体数据 | 生理性别、年龄、身高、体重、日常活动描述、目标描述、基础代谢（BMR）、维持消耗，以及“额外信息”文本字段 | 您手动填写，或您点击“让 AI 估算”后由 AI 生成草稿 |
| 饮食记录 | 日期、餐次、食物名称、克数、热量、蛋白质／碳水／脂肪、您输入的原始描述文字、置信度与估算依据 | 您手动输入，或由 AI 估算后经您确认保存 |
| 运动记录 | 日期、运动名称、时长（分钟）、消耗热量、置信度与估算依据 | 同上 |
| 食物照片 | 您主动选择的食物图片（最多 4 张，单张压缩后上传） | 您从系统文件选择器主动选择。应用不申请存储权限，也不读取相册中的其他照片 |
| 报告数据 | 周／月统计结果，以及（可选的）AI 分析文本 | 程序统计生成 |
| 接口凭据 | 您配置的大模型／搜索服务的接口地址、模型名、API Key | 您手动填写 |
| 界面偏好 | 界面语言、配色主题 | 自动记录在设备本地存储中 |
本应用不收集：设备标识符（IMEI／OAID／Android ID 等）、手机号、通讯录、短信、精确或粗略地理位置、应用安装列表、剪贴板内容，也不进行任何用户行为统计、用户画像、个性化推荐或广告追踪。
本应用不包含任何第三方广告、统计、推送或崩溃上报 SDK。
/data/data/com.calorietracker.app/files/data/，其中 ct.db 为记录数据库，config.json 为配置（含明文 API Key）。其他应用无法读取该目录。电脑版保存在程序目录下的 data/ 文件夹。127.0.0.1 回环地址，端口 8787），用于界面与本地数据库通信。该端口不对局域网或互联网开放。data/ 目录或导出文件分享给他人；请为设备设置锁屏密码。这是本应用唯一的对外数据传输通道，由您主动配置并触发：
请特别注意：为保护您的健康数据，建议只填写以 https:// 开头的接口地址。使用 http:// 明文地址时，数据与 API Key 可能在传输途中被他人截获。本应用已默认禁止明文网络请求，仅在您显式填写 http:// 地址时才会放行，并会向您提示风险。
本应用为纯本地工具，未集成任何广告、统计、推送、崩溃上报、社交分享或应用市场联运 SDK。应用内仅包含以下在设备本地运行的组件，它们不收集、不上传任何个人信息，也不进行网络请求：
| 组件名称 | 提供方 | 用途 | 是否收集或上传个人信息 |
|---|---|---|---|
| Chaquopy（Python 运行时，CPython 3.14） | Chaquo Ltd. | 在设备上运行应用自带的 Python 业务代码 | 否，纯本地运行 |
| AndroidX（AppCompat / Core / Activity） | Google LLC | 安卓界面兼容与基础组件库 | 否，纯本地运行 |
| Kotlin 标准库 | JetBrains s.r.o. | 语言运行时库 | 否，纯本地运行 |
| 广告／统计／推送／崩溃上报 SDK | 无 | 未集成 | 无 |
关于您自行配置的第三方服务（不属于内置 SDK）：当您在设置中填写并主动使用时，数据会直接由您的设备发送至该服务商。常见情形包括大模型接口（如 OpenAI 兼容接口、Anthropic、Google Gemini 等）与搜索服务（如 SearXNG、Tavily、Brave Search）。这些服务商对数据的处理规则请以您所选服务商官网公布的最新隐私政策为准，本政策无法替代。
| 权限 | 用途 | 是否必需 |
|---|---|---|
INTERNET（访问网络） | 调用您自行配置的大模型接口与搜索服务；不配置接口时不产生任何网络请求 | 必需 |
ACCESS_NETWORK_STATE（查看网络状态） | 判断网络是否可用，以便在断网时给出明确提示而非长时间等待 | 可选 |
应用不申请位置、相机、麦克风、通讯录、短信、存储、电话、日历等敏感权限，也不存在后台自启动行为。选择食物照片时调用系统文件选择器，由系统仅向应用授予您选中图片的临时读取权限。
由于您的数据全部保存在您自己的设备上，开发者并不持有这些数据，因此下列权利多数可在应用内即时完成，无需向我们申请：
| 权利 | 行使方式 |
|---|---|
| 查阅 | 「每日」页查看全部饮食与运动记录；「身体数据」页查看当前身体数据与历史版本；「报告」页查看统计结果。 |
| 复制 / 数据可携带 | 「设置 → 数据管理 → 导出全部数据」，可下载 JSON 文件，包含全部记录与配置（不含 API Key 明文），您可自行留存或迁移。 |
| 更正 / 补充 | 「每日」页可逐条修改或删除记录；「身体数据」页可修改并生成新版本，历史版本随时可回溯。 |
| 删除 | 「设置 → 数据管理 → 清除全部数据」可一次性删除身体数据、饮食与运动记录、报告；卸载应用即删除全部本地数据。 |
| 撤回同意 | 「设置 → 数据管理 → 撤回隐私政策同意」，将停止使用并返回同意页。撤回后无需我们处理任何数据，因为开发者从未获取您的数据。 |
| 注销账号 | 本应用不设账号体系，不存在注册账号，因此无需也不能注销账号。您执行“清除全部数据”或卸载应用，即等同于删除全部个人信息。 |
| 投诉举报 | 发送邮件至 1242670353@qq.com，或通过下方第 9 节联系方式提出。我们将在 15 个工作日内答复。 |
此外：本应用不进行自动化决策——AI 估算结果仅作为草稿展示，必须经您确认后才会保存；本应用不进行个性化推送与用户画像。
若您通过邮箱提出与个人信息相关的请求，为保障安全，我们可能需要您提供必要信息以核验身份；若您对我们的答复不满意，您还可以向网信、电信、公安、市场监管等主管部门投诉或举报。
本应用不面向未满 14 周岁的儿童，也不主动收集其个人信息。若您是未成年人，请在监护人陪同下阅读本政策，并在取得监护人同意后使用本应用。监护人如发现未成年人未经同意使用本应用，可通过第 9 节联系方式与我们联系。
当本政策发生重大变更（例如新增数据用途、新增对外提供对象）时，我们会在应用启动时再次弹窗提示，由您重新确认同意后方可继续使用。历史版本可通过第 9 节联系方式索取。
如对本政策或您的个人信息有任何疑问、意见或投诉，请联系个人信息保护相关负责人：
我们将在收到您的问题后 15 个工作日内答复。
Calorie Tracker is a fully local calorie and exercise logging tool: log food and workouts manually, estimate your BMR, and generate weekly/monthly reports. The optional AI estimate features require you to configure your own third-party LLM endpoint. The developer operates no server and does not collect, upload or store your personal information.
Calorie Tracker is a fully local personal calorie and exercise logging tool. The developer operates no server and does not collect, upload, or store any of your personal information.
The body data and food/exercise records you enter stay in your own device's private app storage. The only network activity is sending data to the third-party AI (LLM) endpoint or search service that you configure yourself in Settings. Please read Section 3 carefully.
The app has no account system and requires no sign-up, phone number or email address. The following is entered by you or produced by an AI estimate you trigger, and is stored on your device only — the developer cannot access it:
| Category | Details | Source |
|---|---|---|
| Body data | Sex, age, height, weight, daily-activity description, goal description, BMR, maintenance burn, and a free-text "extra" field | Entered by you, or drafted by AI when you tap "estimate" |
| Food records | Date, meal, food name, grams, calories, protein/carbs/fat, your original description text, confidence and basis | Entered by you, or AI-estimated and confirmed by you |
| Exercise records | Date, activity name, minutes, calories burned, confidence and basis | As above |
| Food photos | Photos you actively pick (up to 4, compressed before sending) | Chosen by you via the system picker. The app requests no storage permission and cannot read other photos |
| Reports | Weekly/monthly statistics and optional AI analysis text | Computed by the app |
| Credentials | Endpoint URL, model name and API key for the LLM/search service you configure | Entered by you |
| Preferences | Interface language and colour theme | Stored in local device storage |
The app does NOT collect: device identifiers (IMEI / OAID / Android ID), phone number, contacts, SMS, precise or coarse location, installed-app list, or clipboard content. It performs no behavioural analytics, profiling, personalised recommendation or ad tracking.
The app contains no third-party advertising, analytics, push, or crash-reporting SDK.
/data/data/com.calorietracker.app/files/data/, where ct.db holds records and config.json holds settings (including the API key in plain text). Other apps cannot read this directory. On desktop it is the data/ folder next to the program.127.0.0.1:8787 only, for communication between the UI and the local database. It is not exposed to the LAN or the internet.data/ folder or export files, and set a device lock screen.This is the app's only outbound data channel, and it is configured and triggered by you:
Important: to protect your health data, prefer endpoints beginning with https://. With a plain http:// endpoint, your data and API key may be intercepted in transit. The app blocks cleartext traffic by default and only allows it when you explicitly enter an http:// address, after warning you of the risk.
The app is a fully local tool and integrates no advertising, analytics, push, crash-reporting, social-sharing or app-store distribution SDK. It contains only the following components that run locally on the device and collect nothing, upload nothing and make no network requests:
| Component | Provider | Purpose | Collects/uploads personal data |
|---|---|---|---|
| Chaquopy (Python runtime, CPython 3.14) | Chaquo Ltd. | Runs the app's bundled Python business logic on device | No, runs locally |
| AndroidX (AppCompat / Core / Activity) | Google LLC | Android UI compatibility and base libraries | No, runs locally |
| Kotlin standard library | JetBrains s.r.o. | Language runtime | No, runs locally |
| Ad / analytics / push / crash SDKs | None | Not integrated | None |
Third-party services you configure yourself (not bundled SDKs): when you enter and actively use them, data is sent directly from your device to that provider. Typical cases include LLM endpoints (e.g. OpenAI-compatible, Anthropic, Google Gemini) and search services (e.g. SearXNG, Tavily, Brave Search). Please refer to the latest privacy policy published by the provider you choose; this policy does not replace it.
| Permission | Purpose | Required |
|---|---|---|
INTERNET | Call the LLM and search endpoints you configure; no request is made unless you configure an endpoint | Yes |
ACCESS_NETWORK_STATE | Detect connectivity so an offline state produces a clear message instead of a long wait | Optional |
The app requests no location, camera, microphone, contacts, SMS, storage, phone or calendar permissions, and does not auto-start in the background. Picking a food photo uses the system file picker, which grants temporary read access to the selected image only.
Because all data lives on your own device and the developer holds none of it, most rights can be exercised immediately inside the app, without contacting us:
| Right | How to exercise it |
|---|---|
| Access | The Daily page lists all food and exercise entries; the Body data page shows current data and version history; the Report page shows statistics. |
| Copy / portability | Settings → Data management → Export all data downloads a JSON file with all records and settings (without API key secrets) that you can keep or migrate. |
| Rectification | The Daily page lets you edit or delete any entry; the Body data page lets you revise your data and keeps previous versions reviewable. |
| Erasure | Settings → Data management → Clear all data deletes body data, food/exercise records and reports in one step; uninstalling removes all local data. |
| Withdraw consent | Settings → Data management → Withdraw privacy consent stops use and returns to the consent screen. Nothing needs deleting on our side, because the developer never received your data. |
| Account deletion | The app has no account system and no registered account, so there is no account to delete. Clearing all data or uninstalling is equivalent to erasing all personal information. |
| Complaints | Email 1242670353@qq.com or use the contact details in Section 9. We reply within 15 working days. |
In addition: the app performs no automated decision-making — AI estimates are shown as drafts and are saved only after you confirm them. There is no personalised push or profiling.
If you contact us by email about personal information, we may ask for the minimum information needed to verify your identity. If you are not satisfied with our response, you may also complain to the competent internet, telecommunications, public security or market-regulation authorities.
The app is not directed at children under 14 and does not knowingly collect their personal information. If you are a minor, please read this policy with a guardian and use the app only with their consent. Guardians may contact us using the details in Section 9.
If this policy changes materially (for example, a new data use or a new recipient), the app will show the consent dialog again at launch and require your renewed consent before you continue. Previous versions are available on request via Section 9.
We will respond within 15 working days.