Katori is a food diary operated by Orange IQ Labs, Inc. This policy explains what the app stores and how it uses that information.
When you sign in with Google, Katori receives your Google account identifier, name and email address. You can also create an account with a verified email address and password. Passwords are stored as salted scrypt hashes, never in plain text. Cloudflare Email Service delivers verification and password-reset links. Only a hash of each single-use link is stored; links expire after one hour. Katori stores your food diary, portions, nutrition totals, saved meals, targets, appearance preference and time zone in Cloudflare D1. Your diary and saved meals are private to your account. Foods you add to the shared catalog, including their names, nutrition and portions, are available to other signed-in users. Your email address is not displayed with those foods.
If you use the goal estimator, Katori stores the age, gender, height, weight, activity level and weight-change goal you choose to provide. These details are private to your account and used to estimate editable calorie and nutrient targets. They are not included in shared food definitions, diary images or Health Connect exports. Clear body details in the profile editor and save to remove age, gender, height and weight from your profile. You can use general starting targets or enter your own without providing body details.
The Katori Android app optionally writes calories, protein, carbohydrate, fat and available fibre values from your diary to Health Connect on your phone. This includes previous entries when you enable sync. Edits and deletions are synchronized. Katori requests nutrition write permission and does not read your other health records. Manage access in Android Health Connect settings. The Android app stores the food catalog and a private diary cache locally, encrypts sign-in credentials using Android Keystore, and queues diary changes while offline. Sign-out clears the local account cache; previously exported Health Connect records remain unless you remove them there.
Cloudflare hosts Katori and processes the app data. Google provides sign-in and Android Health Connect. We do not sell your data, serve advertising, or use health information for advertising or AI training. Katori uses a secure session cookie to keep you signed in, renewed during use. Signing out removes that browser’s session. App files may be cached on your device for installation; private API responses are not cached by the service worker.
Your data is retained while you use the app. To request an export or deletion of your account and personal data, contact [email protected] from your account email address. Shared food definitions may be retained without your account attribution so other users’ saved foods continue to work. Cloudflare recovery history may retain deleted data for up to 30 days.
You may authorize an assistant such as ChatGPT to read your diary and goals, log, edit or delete diary entries, manage saved meals and goals, and add shared foods. Katori sends the requested data only after you connect your account. The assistant handles information under its own privacy policy; Katori’s statement about not using health data for AI training does not describe the policies of assistants you choose to connect.
Connections persist until revoked. We store the application name, granted permissions, connection date and last access time. Disconnect an application in Account → Connected apps to stop future access; this cannot erase data already shared in an assistant conversation. New food definitions are shared just like foods added in Katori. Your diary and saved meals remain private.
When you report a community food or contributor, we store the food as reported, your account identifier, the reason and the details you choose to provide. Reports are visible to the operator for moderation, not to other users. Blocked contributors are saved to your account so their foods can be hidden from your searches on Android and the web. You can unblock them in Foods.
You can request account deletion without reinstalling or signing in to Katori.
Katori’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Questions about privacy: [email protected].