Last updated 10 October 2026
Rylia is an AI calorie scanner: you photograph a meal, or describe it, and the app estimates its calories and macronutrients. This policy explains exactly what we collect, where it goes, and how to get rid of it. It describes what the app does today, not what it might do one day.
Rylia is operated by Om Prakash Kumar, an individual developer based in Jamshedpur, Jharkhand, India. For anything in this policy, write to support@rylia.app.
During setup the app asks for your sex, age, height, weight, activity level and goal, and optionally a target weight and dietary preferences. This information is used only to calculate your daily calorie and macronutrient targets, to estimate how long reaching a target weight might take, and to show it back to you in the app. Your dietary preferences are kept with your profile but do not affect anything the app calculates or estimates at present. Some of it is health-related information, and we treat it accordingly.
When you scan a meal, the photo is resized on your device and sent over an encrypted connection to our server, which forwards it to Google's Gemini API for analysis. When you type a description instead, the text takes the same path.
The photo is not kept. Our server does not write it to any database or file store. For 24 hours we cache the analysis result against a one-way cryptographic hash of the image, so that scanning the same plate twice does not produce two different answers. The hash cannot be turned back into your photo. The photo file itself stays on your phone, in the app's own storage. Deleting a meal removes it from your log but does not delete that file; your phone may clear it to free up space, and it is removed when you delete the app.
Meals you save — names, calories, macronutrients, portion sizes, timestamps — are stored on your device and backed up to Google Firebase under your account identifier, whether or not you sign in. Signing in — with Google on Android, or with Apple on iPhone — is what lets you recover them on a new phone.
You can use Rylia without an account; the app creates an anonymous identifier so your data can be saved. If you sign in with Google (Android), Google passes us your account identifier, your email address and the display name on your Google account. If you sign in with Apple (iPhone), Apple passes us an account identifier and an email address — which is a private relay address if you choose "Hide My Email" — and we do not ask Apple for your name. These are held by Google Firebase as part of your sign-in record. The app itself never reads your name or email, and neither is shown in Rylia, attached to a diagnostic report, or used to contact you.
If you subscribe, the purchase is handled by Google Play on Android or the Apple App Store on iPhone. We never see your card, UPI or bank details. Through RevenueCat we receive the details of your subscription — which plan, when it started, renews or ends, and the store's transaction identifiers — so that the right features are unlocked, and our usage events may record which plan you chose.
We may collect crash reports and usage events to find bugs and understand which features are used. These are linked to your account identifier — the same anonymous or signed-in identifier your data is saved under — so that a single person's path through a problem can be followed. They are not linked to your name or your email address. They never include your photos, your meal contents, or anything you typed.
Our server also keeps short-lived request logs, so that a failure can be investigated after the fact rather than only while someone happens to be watching. They record what a request did and whether it succeeded, and a one-way hash of the network address it came from. We deliberately do not log the address itself, the contents of your photo or description, or the analysis returned for it.
Each time the app starts, it asks Expo's update service (EAS Update) whether a newer version of its code is available, and downloads it if there is one. That request names our app and carries your platform (iOS or Android), the app's version and update identifiers, a random ID the app creates for update checks, and, if the app failed while starting last time, a short technical description of the failure. The random ID is not derived from your device, your account or anything you entered, and we do not link it to your account. As with any request to a server, Expo also sees your device's network address.
We do not sell your data or share it for advertising. We use these service providers, each handling only what its job requires:
| Provider | What it receives | Why |
|---|---|---|
| Google (Gemini API) | Your meal photo or description | To identify the food and estimate nutrition |
| Google Firebase | Account identifier, profile, meal log | Sign-in and cloud backup |
| Open Food Facts | The barcode number only, sent by our server — never your account identifier and never your device's network address | To look up a packaged product's nutrition label |
| Cloudflare | Requests in transit; cached results | Runs our server and protects it from abuse |
| Google Play, Apple App Store | Purchases and subscription status | Billing |
| Apple (Sign in with Apple) | Your Apple sign-in identifier and email, only if you choose to sign in with Apple | Sign-in on iPhone |
| RevenueCat | Subscription status, account identifier | Manages subscription entitlements |
| Sentry, PostHog | Crash reports and usage events, linked to your account identifier | Diagnostics |
| Expo (EAS Update) | Your platform, the app's version and update identifiers, a random ID used only for update checks, a description of a failed start if there was one, and your device's network address — never your account identifier | To check for and deliver app updates |
We may also disclose information where the law requires it.
These providers operate globally, so your data may be processed outside India, including in the United States and the European Union. All transfers happen over encrypted connections.
| Data | Kept for |
|---|---|
| Meal photos | Not retained by us. Cached analysis results expire after 24 hours |
| Barcode lookups | Not linked to you. The product's nutrition is cached on our server by barcode alone for up to 7 days, so the same product does not have to be looked up twice |
| Profile and meal log | Until you delete them or delete your account |
| Account record | Until you delete your account |
| Diagnostics | Up to 90 days |
| Server request logs | A few days. Outcome and a hashed network address only — never your photo, your meal text, or the analysis |
| App update checks | Not kept by us. Expo keeps them under its own privacy policy, which we do not control |
Under India's Digital Personal Data Protection Act 2023, and under the GDPR if you are in the European Economic Area or the UK, you have the right to access your data, correct it, delete it, withdraw consent, and complain to a regulator.
You can exercise most of these in the app itself: Settings → Delete account removes your account, your cloud backup, and the profile and meal log on your device, and cannot be undone. Meal photo files stay in the app's storage until your phone clears them or you delete the app. For anything else, email support@rylia.app and we will respond within 30 days.
Rylia is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, write to us and we will delete it.
Traffic is encrypted in transit. Access to your cloud data is restricted to your own account by server-side rules, and our AI endpoint requires an authenticated request. No system is perfectly secure, and we do not claim otherwise.
If this policy changes materially we will update the date above and notify you in the app. Please check back occasionally.
Om Prakash Kumar, Jamshedpur, Jharkhand 831012, India
support@rylia.app