Privacy Policy
Effective date: October 30, 2026 · Last updated: October 30, 2026
Thaali ("Thaali", "we", "us") is operated by Boota Singh Sidhu (operating as Thaali), a sole proprietor based in Surrey, British Columbia, Canada. This policy explains what personal information the Thaali mobile app collects, why, who we share it with, and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).
In short: we collect only what the app needs to estimate your meals' nutrition and personalise guidance. Your meal photos are private to you. We never sell your information and we do not use advertising or tracking. Health details are collected only after you give explicit consent, and you can withdraw that consent, export your data or delete your account at any time in Settings.
1. Information we collect
| Information | Why we use it |
|---|---|
| Account details: your email address and password (stored securely by our authentication provider as a one-way hash), and one-time sign-in codes we email you. | To create your account, sign you in and keep your data tied to you. |
| Profile: name, year of birth, sex, height, weight and preferred units, activity level, city and country, phone number (optional), and your preferred language. | To calculate your BMI and daily calorie target and to show the app in your language. Name, phone, email and location are never sent to the AI service. |
| Health information (only with your consent): health conditions you select (for example diabetes or high blood pressure), optional health notes, dietary pattern (for example vegetarian), health goals, weight-loss pace and calorie goal. We record the date and version of your consent, and the date if you withdraw it. | To personalise nutrition notes and suggestions. |
| Meal photos and meal log: photos you take or choose, any text hint you add (for example "made with ghee"), the meal occasion you choose (everyday, langar or special occasion), the foods detected, portions and nutrition values, meal times, and any edits you make. We also keep the AI's original answer to check and improve accuracy. | To analyse your meal and keep your meal history. Photos are resized on your phone before upload, which also removes location (GPS) and other camera metadata. |
| Usage needed to run the service: number of scans per day, your device time zone (to reset the daily free limit at your midnight), and subscription status. | To apply the free-plan limits and unlock Premium. |
| Purchases: if you subscribe or start a free trial, Apple or Google processes your payment. We receive the subscription product, status, trial and renewal/expiry dates, linked to an account ID. We never see your card details. | To give you Premium access and restore purchases. |
We do not collect your contacts, precise location, microphone audio, or advertising identifiers, and we do not use third-party analytics, advertising or crash-reporting SDKs. If we add crash reporting in the future, we will update this policy first; health information and meal photos will not be included in crash reports.
2. Camera and photo library
Thaali asks for camera access so you can photograph a meal, and photo-library access so you can choose an existing photo. We only use the photos you take or pick for analysis. You can withdraw these permissions at any time in your phone's settings.
3. How meal analysis works (AI)
When you scan a meal, the photo is uploaded to your private storage folder. Our server then sends the photo, your optional text hint, and only the minimum profile details needed (health conditions, health notes, dietary pattern, health goals and calorie goal) to Anthropic, the provider of the Claude AI model, in the United States, which returns an estimate of the foods and nutrition. Your name, email, phone number, age and location are not sent. Anthropic processes this information on our behalf to provide the service; under its commercial terms it does not use it to train its models. Results are estimates only and not medical advice.
4. Who we share information with
We never sell or rent your personal information. We share it only with service providers that help us run Thaali, under contracts that require them to protect it and use it only to provide their services to us:
- Supabase – hosts our database, sign-in, file storage (including meal photos) and server functions. Our project is hosted in Supabase's Canada (Central) region. Sign-in code emails are sent through Supabase's authentication service using an email delivery provider.
- Anthropic – AI meal-photo analysis (United States). Receives meal photos, your text hint and the minimum health details described above.
- RevenueCat – manages subscriptions (United States). Receives an account ID and purchase records, not your health information or photos.
- Apple (App Store) and Google (Google Play) – app distribution and payment processing, under their own privacy policies.
We may also disclose information if required by law, or to protect the rights and safety of our users or others.
5. Where your information is stored (cross-border transfers)
Our main database and photo storage are hosted in Canada. Some of our providers store or process information outside Canada, in particular in the United States (Anthropic for meal analysis, RevenueCat for subscriptions, and Apple and Google for purchases). When this happens your information is subject to the laws of that country, and courts, law enforcement and national security authorities there may be able to access it. We use contracts and security measures to protect it wherever it is processed. By using Thaali you acknowledge these transfers; you can contact our privacy officer with any questions about them.
6. How we protect your information
- All connections use encryption (HTTPS).
- Database security rules ensure each user can read and change only their own records.
- Meal photos are kept in a private storage bucket and are shown only through links that expire within one hour (or 7 days for links in a data export you request).
- Our AI service key and other secrets are kept on our servers, never in the app.
- Health details and photos are not written to logs or error reports.
7. How long we keep it
- We keep your account, profile, meals and photos while your account is active.
- On the free plan, meals older than the free history period are hidden from view but kept, so they reappear if you subscribe and are included if you export your data.
- When you delete a meal, its photo is deleted too.
- Unused meal photos are deleted automatically. A clean-up runs every night and deletes any meal photo that is not attached to a saved meal (for example, a scan you abandoned or an interrupted upload) once it is more than 24 hours old.
- When you delete your account in the app, your account, profile, health information, meals, photos and usage records are deleted straight away. Requests by email are completed within 30 days.
- Limited purchase records may be kept where the law requires (for example, records held by Apple, Google or RevenueCat for tax and accounting).
8. Your choices and rights
Under PIPEDA and BC PIPA you have the right to access the personal information we hold about you, to ask us to correct it, and to withdraw your consent, subject to legal and contractual limits. You can do most of this yourself in the app:
- Access and correction: you can view and edit your profile and meals in the app at any time.
- Copy of your data (export): in the app, go to Settings → Your data → Export my data to download a file with your account details, profile and health information, consent record, every meal (including meals hidden by the free plan), scan usage and subscription status, with links to your meal photos that work for 7 days. The file includes your health information, so keep it somewhere safe. You can also email us at ask@thaali.ai.
- Withdraw consent: in the app, go to Settings → Your health information → Withdraw consent. This clears the health information your consent covered (age, sex, height, weight, activity level, health conditions, notes, dietary pattern, goals and calorie goal). You can also choose to delete all your meals and photos at the same time. Meal scanning needs your consent, so it stays off until you consent again.
- Delete your account: in the app, go to Settings → Delete account; your account is deleted straight away. You can also request deletion by emailing ask@thaali.ai from the email address on your account with the subject "Delete my Thaali account". See our account deletion page. Deleting your account permanently removes your profile, health information, meal log and photos.
- Subscriptions: deleting your account does not cancel an App Store or Google Play subscription. Cancel it in your Apple ID or Google Play account settings.
To make a request or ask a question, contact our privacy officer (details below). We will respond within 30 days, as the law requires. If you have a concern, please contact us first. You also have the right to complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.
9. Age requirement
Thaali is intended for people aged 16 and over, and you must be at least 16 to create an account. We do not knowingly collect information from anyone under 16. If you believe someone under 16 has given us information, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. If we do, we will update the date at the top of this page, and if we make important changes we will tell you in the app. If a change affects how we use health information, we will ask for your consent again.
11. Contact us
Privacy officer: Boota Singh Sidhu
Email: ask@thaali.ai
Mail: Boota Singh Sidhu (operating as Thaali), Unit 201, 6610 152 Street, Surrey, BC V3S 3L1, Canada