Privacy Policy

1. Who operates Koolo

Koolo is operated by Andrii Soboliev, an individual based in Ukraine ("Koolo", "I", or "me"). I am the controller responsible for the personal data described in this notice. Koolo is the app name, not a separate legal entity.

Website: https://koolo.space. Contact email: koloooapp@gmail.com. Correspondence address: Rozhalina St., 22, Romny, Romenskyi District, Sumy Region, Ukraine.

This notice covers the Koolo iOS application and the Koolo website, including account, community, food logging, habit, sleep, and recovery features.

2. Data used by Koolo

Account information: email address, account identifier, authentication information supplied by Google Sign-In, your date of birth (used to confirm that you are 18 or older), and profile information you choose to provide, such as name, username, and avatar. Koolo does not receive your Google password.

Community content: posts, comments, avatars, and media you upload to the community. This content is visible to other members, and avatars and media are available through public links.

Nutrition and habits: food photographs you submit for analysis, food names, ingredients, quantities, calorie and nutrient estimates, your corrections, food diary entries, goals, and habit completion records. Your food diary is stored locally on your device.

Apple Health data: with your permission through the iOS system prompt, Koolo reads steps, activity, sleep, heart rate, heart rate variability, respiratory rate, blood oxygen, and wrist temperature. Koolo only reads this data and does not write anything to Apple Health. To calculate your sleep and recovery scores, the app sends the following to Koolo's server (Supabase): sleep intervals and stages (in bed, awake, core, deep, REM) with start and end times, time zone, and source device (for example, Apple Watch); overnight heart rate, heart rate variability, respiratory rate, blood oxygen saturation, and wrist temperature with measurement times and source; and your baseline values. A server function calculates your sleep score, recovery score, and their components, and the results are stored with your account. Roughly the last 29 days of nights are synchronized. Steps and activity data are processed only on your device and are not sent to the server.

Technical information: service requests and operational logs maintained by the infrastructure providers may contain IP addresses, timestamps, account identifiers, and error information needed to run and troubleshoot the service. Koolo does not use analytics or crash-reporting tools.

Support: messages and contact details you send when requesting help. Please avoid sending health information that is not necessary to resolve your request.

3. How the data is used

Koolo uses account information to provide access, community content to operate the community, your food and habit records to maintain your diary and progress, and Apple Health measurements to calculate personal sleep and recovery indicators. Information is also used to resolve support requests, maintain security, and investigate faults.

Food identification and portion estimates can be inaccurate. Sleep and recovery indicators are automated wellness estimates. They are not diagnoses or clinical decisions. You can correct food entries; to ask for correction of other stored information, contact the email above.

Koolo does not use these results to make decisions with legal or similarly significant effects on you, such as decisions about employment, credit, or insurance.

4. Legal basis and your choices

Where data-protection law such as the GDPR or Ukraine's Law on Personal Data Protection applies, necessary account and requested-service processing relies on performance of the contract; security and reliability operations rely on legitimate interests; legal obligations rely on legal obligation. Optional processing relies on your consent.

For health data and for sending food photographs to AI, Koolo relies on your explicit consent. Health data is requested through the iOS system prompt, and a separate consent is requested the first time you scan a food photograph. Accepting the Terms and this Policy at sign-in does not by itself constitute that consent.

You may withdraw consent at any time. You can change Apple Health permissions in your iPhone Health settings, and you can stop using AI analysis and enter food manually. Withdrawal affects future processing and does not make previous lawful processing unlawful. Features that require that information will no longer work.

5. Apple Health and optional wearable connections

Koolo reads only the Apple Health categories you authorize. You can change permissions in your iPhone Health settings. Sleep-related measurements are sent to Koolo's server as described in section 2; steps and activity data stay on your device.

If an Oura connection is made available and you choose to connect it, Oura supplies the health and activity categories shown on the connection screen under your authorization. Koolo uses authorization tokens to retrieve permitted data and does not receive your Oura password. The same applies to Garmin if that integration is made available and you connect it. Oura and Garmin handle your data in their own accounts under their own privacy notices.

Disconnecting a provider stops future access. It does not delete information held in the provider's own account.

6. Photo analysis and Google Gemini

When you choose AI food analysis and give the separate consent, your food photograph and the analysis instructions are sent through Koolo's backend function to Google Gemini (Gemini API) to identify food and estimate ingredients and quantities. Food descriptions you enter for analysis are sent in the same way.

Koolo does not store the photograph on its servers after the analysis response is returned. A copy remains only on your device. Google processes the request under its Gemini API terms and may retain requests for a limited time for abuse and safety purposes.

The analysis result is used to prepare an editable food entry. Avoid including faces, documents, or unrelated personal information in the photograph. AI analysis is optional; you can enter food manually.

7. Service providers and disclosures

Supabase provides the backend, database, authentication, and storage for community media used by Koolo.

Google Gemini processes food-analysis requests as described above. Google provides sign-in when you choose Google Sign-In.

FatSecret, Open Food Facts, and USDA FoodData Central are used to search for food products and barcodes; search terms or barcodes you enter are sent to them for that purpose. Giphy and Unsplash are used to search for GIFs and images in the community; your search terms are sent to them. Those services operate under their own privacy notices.

I do not sell your personal data, do not use health data for advertising, and do not use it to train general-purpose AI models.

Information may also be disclosed when legally required, or when necessary and proportionate to protect the service or establish, exercise, or defend legal claims.

8. International processing

Koolo's database and backend are hosted by Supabase in London, United Kingdom (AWS region eu-west-2). Your data is therefore transferred from where you live to the United Kingdom. Other providers, including Google, may process data in other countries, including outside the European Economic Area and Ukraine. Where required, transfers rely on the safeguards offered by those providers, such as Standard Contractual Clauses or an applicable adequacy decision. You can contact me to ask for information about the safeguards.

9. Retention and deletion

Account, profile, community content, and synchronized sleep and health data (sleep intervals, overnight measurements, and calculated scores) are kept until you delete your account. Your food diary stays on your device until you delete it or remove the app. Food photographs are not retained on Koolo's servers after analysis. Technical logs are kept by the infrastructure providers for the limited periods they apply.

You can delete your account in the app: Profile → edit → "Delete account". Deletion removes your account, profile, posts, comments, uploaded media, and synchronized sleep and health data, and is irreversible. Copies may remain in provider backups for a limited period before they are overwritten. You can also request deletion by emailing koloooapp@gmail.com; I may ask for information needed to verify that the account is yours.

Deleting your Koolo account does not delete your Apple Health, Oura, Garmin, or Google account.

10. Your rights

Where applicable, you may request access, correction, erasure, restriction, or portability of personal data, object to processing based on legitimate interests, and withdraw consent. Contact koloooapp@gmail.com. Requests are handled within the periods required by applicable law.

You can complain to your data-protection authority. In Ukraine, this is the Ukrainian Parliament Commissioner for Human Rights (Ombudsman). If you live in the EEA, you may also contact the authority in your country.

11. Security, age, and website

Data is transmitted over encrypted connections, access to the backend is restricted, and authorization tokens are kept out of public content. No method of transmission or storage is completely secure.

Koolo is for adults aged 18 or older and is not intended for children. Age is confirmed by your date of birth at first launch. If you believe a child has supplied information, contact me so I can investigate and take appropriate action.

The Koolo website uses only the cookies and local storage necessary to keep you signed in. It does not use analytics or advertising trackers.

12. Changes and contact

This notice may be updated as Koolo develops. The effective date identifies the applicable version. Material changes will be communicated, and new consent will be requested where required before a new use of data begins.

For privacy questions or requests: koloooapp@gmail.com.