At a glance.
- You give us your email, a password, and photos or descriptions of your meals. We use them to give you AI feedback and a daily score.
- If you join The Aliqa Programme, we also store your weight, your walks, which audios you finished, and your enrolment. A waitlist stores a name and an email. Same rules: not sold, not used to train a model, deleted with the account.
- Photos and descriptions are stored in Singapore on AWS, encrypted in transit and at rest, and analysed by OpenAI under its API business terms. They are not used to train OpenAI's models.
- We do not sell your personal data, we do not share it with advertisers, and we do not use it to train any AI model.
- Export your data from Profile → Export. Delete your account from Profile → Delete account. Privacy contact: privacy@aliqa.app.
- Your health data belongs to you.
- The score is AI-generated and approximate. Edit any meal and the score updates. That is how you get a fresh result, and how you ask for a human review.
This Policy covers the Aliqa iOS and Android apps, The Aliqa Programme at program.aliqa.app, the link host at app.aliqa.app, the login site at login.aliqa.app, and the site at www.aliqa.app. It is written to meet the Apple App Store privacy rules, the Google Play User Data policy, UK data-protection law, EU data-protection law (including what the French CNIL expects), Singapore's personal-data law, California privacy law, and the UK and EU rules on cookies and electronic communications.
The data controller is Agile Projects Pte. Ltd. (UEN 202119053N), trading as Aliqa, registered in Singapore. Our registered office is 9 Raffles Place, #18-21, Republic Plaza, Singapore 048619.
If you are in the United Kingdom, our UK representative is Agile Projects Ltd, Langley House, 53 Theobald Street, Borehamwood, England, WD6 4RT, United Kingdom. If you are in the EEA, you can write to that address or to privacy@aliqa.app. Agile Projects Ltd is our UK representative. It is not an EU representative.
Write to privacy@aliqa.app for privacy questions, rights requests, and complaints. That address reaches our privacy team, our Data Protection Officer (appointed because we process health-related data), and our California privacy contact. Address the email to "Aliqa DPO" when you want the officer specifically. General support is support@aliqa.app.
Some data is needed to run the Service. Some we hold only if you choose to give it.
| Data | Why | Lawful basis |
|---|---|---|
| Email address | Your account, login, service email, password reset | Contract |
| Password (stored as a bcrypt hash, never in plain text) | To sign you in | Contract |
| Time zone, language | The right day boundary, and the language of the app | Contract |
| What you accepted at sign-up (the disclaimer text, the Terms, Privacy, and disclaimer versions, and when you confirmed your age) | A record that you agreed | Legal obligation; legitimate interests |
| Sign-up code, if you used one | Controlled access | Contract |
| Admin scopes (staff only) | Staff access | Legitimate interests |
Meals, photos, and scores reveal your diet and eating habits, and the daily score can suggest something about your health. We treat that combination as health data. We process it only with your explicit consent, which you give at sign-up.
| Data | Why | Lawful basis |
|---|---|---|
| Meal photos | Input to the AI, and your meal history | Contract and explicit consent |
| Meal descriptions and your corrections | Input to the AI, and your record | Contract and explicit consent |
| AI food items, tags, and portion labels | The core result. You can edit any of these. The day score updates when you do. That is how you challenge an automated result. | Contract and explicit consent |
| Daily scores, weekly reviews, suggestions | To provide the Service | Contract and explicit consent |
| Clarification questions and your answers | A more accurate read of that meal | Contract and explicit consent |
| Foods you log often, and meal-guide preferences | To personalise the app | Contract |
| Streaks, badges, score history | Features of the Service | Contract |
You can withdraw this consent at any time by deleting the content, or your account, from Profile → Delete account. Withdrawal does not make earlier processing unlawful.
If you opt in, we store a push token. We also store your email preferences. Service email (verification, password reset, the weekly review, and billing reminders) is part of the contract. Turn optional messages off in Profile → Notifications and Profile → Emails.
| Data | Why | Lawful basis |
|---|---|---|
| Push token | Notifications you opted into | Consent |
| Marketing email opt-in | Product news, if you asked for it | Consent |
| Service email (verification, password reset, billing reminders) | To perform the contract, and to send reminders the law requires | Contract; legal obligation |
If you subscribe through the App Store or Google Play, Apple or Google takes the payment. We do not receive your card number. The store tells us whether the subscription is active, in trial, expired, or cancelled, plus a transaction identifier and events such as renewal, cancellation, refund, and billing problems. We keep those so we know whether to let you in. Lawful basis: contract, and legal obligation for tax and accounting records.
| Data | Why | Lawful basis |
|---|---|---|
| IP address and approximate region, kept briefly at our API gateway | Security, abuse prevention, routing | Legitimate interests |
| App version, OS version, device model | Support and crash diagnosis | Legitimate interests |
| Endpoint, latency, and AI cost figures, with no meal content | To run the Service | Legitimate interests |
We keep a short record of data exports and account deletions, so we can show that we did what you asked.
A phone photo can contain location, the time it was taken, and the device model. The App removes GPS coordinates before the photo leaves your device. We keep the capture time, because we need it to put the meal on the right day. If a photo is not food or drink, we may delete it without notice, as described in the Terms of Use.
If you join The Aliqa Programme, or you ask to join the waitlist, we also hold the data below. The controller is the same company as the rest of this Policy. We do not sell it, and we do not use it to train a model.
| Data | Why | Lawful basis |
|---|---|---|
| Weight you enter | Your own weigh-in record | Contract |
| Walk distance and minutes | Your own walk record | Contract |
| Which audios you finished | To show you what you have completed | Contract |
| Enrolment (which programme, start date, invite code used) | To give you access | Contract |
| Waitlist name and email, if you ask to be contacted | To tell you when a place opens | Consent |
Programme records are deleted with your account, on the timetable in §5. A waitlist entry from someone with no account is deleted when you ask, or when we no longer need it to contact you about a cohort. Email privacy@aliqa.app. You do not need the food-log app. See how account deletion works.
A small number of suppliers process data for us. Each is bound by a written data-processing contract.
| Supplier | Where they are based | What they do | Which data | Safeguard |
|---|---|---|---|---|
| Amazon Web Services | Singapore | Hosting, database, meal-image storage, API logs | Account data, meal data, photos, technical logs | Stored in Singapore. Encrypted in transit and at rest. |
| OpenAI Ireland Limited (and OpenAI OpCo, LLC, for API processing) | Ireland / United States | Photo analysis, tagging, scoring, and weekly-review text. API only. OpenAI does not train its models on API inputs or outputs by default. | Photos and meal descriptions, the prompt and the response, and an internal user ID (not your email) | EU-US Data Privacy Framework, standard contractual clauses, and the UK addendum |
| Apple Distribution International Limited | Ireland (App Store in the EU); USA (push) | App Store delivery, billing, Sign in with Apple if you use it, push notifications | Apple transaction identifier, push token | Apple holds this data under Apple's own privacy policy |
| Google LLC | United States / global | Google Play delivery, Play Billing, push notifications | Play purchase token, device push token | Google holds this data under Google's own privacy policy |
| Amazon SES | Singapore | Verification, password reset, weekly review, trial-end and renewal reminders | Email address, message content, delivery data | Sent from Singapore. Encrypted in transit. |
A change to this list is a material change. We will tell you in advance (§10).
We may also share limited information with professional advisers (lawyers, accountants, auditors) under confidentiality; with public authorities when the law requires it or to protect rights, property, or safety; and with a successor if we merge, are bought, or become insolvent. Your rights will not be materially reduced. We do not share personal data with advertisers, data brokers, or anyone else for their own marketing.
| Category | How long |
|---|---|
| Account record (email, preferences) | Until you delete the account, then 30 days for disaster recovery |
| Meal photos and food entries | Until you delete them, or within 30 days of account deletion |
| AI analyses, day scores, weekly reviews | As long as the meal they belong to |
| Clarification tasks and reprocess jobs | Until they finish or are abandoned, then 90 days |
| Service-email delivery logs | 30 days |
| API access logs | 30 to 90 days (security) |
| Marketing email preferences, if you opted in | Until you opt out, then 30 days |
| Push token | Until Apple or Google invalidates it, or you opt out |
| Programme weight, walks, completed audios, and enrolment | Until you delete the account, then within 30 days |
| Programme waitlist | Until you ask us to delete it, or we no longer need it to contact you |
| Billing records from Apple or Google | 7 years (tax and accounting) |
| Export and deletion records | 2 years |
| Inactive accounts | If an account has had no activity for 10 years, we delete it or fully anonymise it |
Fully anonymised statistics, which cannot be linked back to you even with other data we hold, may be kept indefinitely to improve the Service. Data that is still tied to an internal user ID is personal data, and the table above applies to it.
Wherever you live, you can ask us for the following, and we will honour the request as far as we reasonably can:
We reply within 30 days. For a complex request we may take up to two further months, and we will tell you. We may need to confirm who you are. If we refuse or limit a request, we will say why and how to complain.
You can also complain to a regulator:
The Service is not for anyone under 18. We do not knowingly collect their data. Sign-up asks you to confirm you are at least 18. If you believe a child has an account, email privacy@aliqa.app and we will remove it.
No internet service can be guaranteed completely secure. We use reasonable, industry-standard measures to protect your data.
www.aliqa.app uses Google Analytics 4 for aggregate traffic measurement only after you opt in. The default is reject all. The login and product sites use local storage and a cookie on .aliqa.app to keep you signed in. Those are strictly necessary. The apps do not set browser cookies. Auth tokens stay in the iOS Keychain or the Android Keystore. The Cookies notice has the full list.
Our main systems are on Amazon Web Services in Singapore, encrypted in transit and at rest. Limited transfers to the United States happen when OpenAI analyses a meal, when Apple or Google deliver the app, take payment, or send a push, and for some support tools.
When you upload a meal photo or description, we send it to OpenAI through the OpenAI API:
To have a person look at a result, edit the meal in the App or email privacy@aliqa.app.
We post the new version at /legal/privacy.html and update the Effective date. For a material change (a new supplier that changes where your data goes, a new reason for processing, a new retention period, a change to your rights, or any use of your data to train AI), we will give at least 30 days' notice in the App and by email, say what changed, ask you to accept again where the law requires it, and let you delete your account before the change takes effect.
We change the version string whenever the wording changes, so the record of what you accepted stays clear.
Privacy questions and rights requests: privacy@aliqa.app. General support: support@aliqa.app. Post: Agile Projects Pte. Ltd. (Aliqa DPO), 9 Raffles Place, #18-21, Republic Plaza, Singapore 048619. If you are in the United Kingdom, you may also write to our UK representative, Agile Projects Ltd, Langley House, 53 Theobald Street, Borehamwood, England, WD6 4RT, United Kingdom. If you are in the EEA, you may write to either address.
If you are not satisfied, complain to the regulator for your country, listed in §6.