Privacy Policy

When you use Kilo we collect the information you provide directly and some information generated automatically:

• Account information — your email address and the password hash used to authenticate you.
• Profile & goals — age, height, weight, activity level, calorie target, and macro targets you enter during onboarding or in Settings.
• Food diary — meals you log, including food names, quantities, macronutrients, meal times, and any photos you attach.
• Workout data — workout plans you create, exercises, sets, reps, weights, and the dates you log sessions.
• Health & cycle data — body weight check-ins and menstrual cycle dates you choose to track.
• AI chat history — messages and responses in Kilo Brain (our AI assistant). Kilo encrypts these stored records.
• Device & usage data — app version, device type, operating system, and crash logs collected to help us fix bugs.

We do not collect your precise GPS location, contacts, microphone input, or camera roll unless you explicitly grant permission for a specific in-app feature (e.g. scanning a barcode or uploading a food photo).

We use the data we collect exclusively to provide and improve the Kilo app:

• Displaying your nutrition totals, macro progress, and weekly budget.
• Generating personalised meal plans, workout schedules, and AI coaching responses.
• Sending optional push notifications for meal reminders and nudges you configure.
• Diagnosing crashes and fixing bugs based on anonymised error reports.
• Improving our AI models using aggregated, de-identified patterns — never raw personal records.

We will never sell your personal information, use it for targeted advertising, or share it with data brokers.

Kilo Brain responses are AI-generated. To generate a response, we send the messages you submit to OpenAI. Messages are encrypted in transit and Kilo encrypts chat and feedback records when they are stored. This is not end-to-end encryption: authorized Kilo administrators may decrypt and review stored Kilo Brain conversations for support and product improvement.

Each Kilo Brain response has a feedback option. When you submit feedback, we store the question, the AI response, and the concern you describe for review. Feedback is anonymous by default, which means we do not include account identity with that report. If you choose to share your identity, we include the relevant account contact details so the Kilo team can follow up.

Kilo uses a small number of carefully selected third-party services to operate:

• OpenAI — powers the Kilo Brain AI assistant. Messages you send to Brain are processed by OpenAI's API in accordance with OpenAI's Privacy Policy. We do not send your name or email to OpenAI.
• Resend — used to deliver transactional emails (password reset, account confirmation). Your email address is shared only to the extent necessary to deliver these messages.
• Replit — our cloud infrastructure provider. Your data is stored on Replit's servers in encrypted form.

No third-party analytics SDKs (e.g. Mixpanel, Amplitude, Firebase Analytics) are embedded in the app.

Health Context report processing is currently unavailable while required privacy, vendor, and legal release checks are completed. Existing Health Context data can still be reviewed or deleted in the app.

Health report screens and requests are excluded from Kilo’s analytics, session replay, diagnostic payloads, advertising use, and unrelated AI features. Health Context is not sent to Kilo Brain unless you separately turn on sharing in the Health Context screen; that revocable choice sends only your current reviewed signals and lab values, never report files, document text, report IDs, encrypted records, or account identifiers. You can review and correct retained signals and lab values in Health Context, delete an individual value, delete a report or date range, or permanently delete all Health Context data.

We retain your data for as long as your account is active. If you request account deletion, we will permanently delete your account and all associated personal data within 7 days.

Anonymised, aggregated statistics (e.g. "X% of users log breakfast") may be retained indefinitely as they cannot be linked back to any individual.

Crash logs and diagnostic data are automatically purged after 90 days.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate information directly in the app's Settings screen.
• Deletion — permanently delete your account and all associated data.
• Portability — request an export of your meal and workout history in a machine-readable format.
• Objection — opt out of any future use of your data for model improvement.

To exercise any of these rights, email us at info@noodlworks.ai with the subject line matching your request (e.g. "Delete my account" or "Data export request") and include the email address associated with your account. We will respond within 7 days.

If you have any questions about this Privacy Policy or how we handle your data, please reach out:

Email: info@noodlworks.ai

We take privacy seriously and will respond to all enquiries within one business day.