Privacy Policy
CarbLuma by ClinicalTools ("CarbLuma", "we", "us") is a carbohydrate tracking app for iPhone and iPad. We designed it to collect as little as possible. This policy explains what data the app handles, where it goes, and the choices you have.
1. Your food log stays with you
The foods you log, carbohydrate amounts, times, notes, favorites and your preferences (such as your daily goal and whether you track total or net carbs) are stored on your device.
If you turn on iCloud sync, your food log and favorites are also stored in your private iCloud database, which is operated by Apple and which we cannot access. We do not have user accounts, and we cannot see your food log.
2. Photos for AI estimates
When you take or choose a meal photo, it stays in memory on your device. It is not saved to your photo library or to app storage.
Only when you tap Analyze Photo does the app send a resized copy of that photo (no larger than 1024 pixels) to our server. Before sending, the app re-encodes the image without location (GPS) or camera metadata. Before your first analysis, the app shows a screen explaining what will be sent.
Our server passes the photo to our AI service provider, OpenAI, to produce carbohydrate estimates. Our server processes the photo in memory only. It does not write the photo to disk or to logs, and does not store it. We ask OpenAI not to store the request, and OpenAI does not use API data to train its models by default. Under its own API data policy, OpenAI may keep request data for up to 30 days to monitor for abuse. See OpenAI's policies.
The result (food names and carbohydrate estimates) is returned to your device for you to review. Our server keeps that result for up to one hour, linked only to your installation's random key identifier, so that if your phone retries a request, the analysis isn't counted twice. After that it is deleted.
We never use your photos for advertising, and nothing from an analysis is added to your food log unless you review it and tap Confirm.
3. Device verification and usage limits
To prevent abuse and enforce monthly AI analysis limits, the app uses Apple's App Attest service. Our server stores:
- a random key identifier and public key for your app installation, which are deleted after 180 days without use; and
- a count of the AI analyses used in the current and previous period, after which the counts are deleted automatically.
Like any internet service, our server receives your device's IP address when the app connects to it. We use it to protect the service, for example by limiting the rate of requests. None of this identifies you by name, email or phone number.
4. Subscriptions and purchases
Purchases are processed by Apple. We do not receive your name, Apple Account details or payment information.
If you subscribe to CarbLuma Pro, the app sends Apple's signed proof of your subscription with each AI request so our server can apply the Pro allowance. Our server verifies it and stores only the subscription's original transaction identifier and your usage count, never the full signed transaction. If Apple notifies us that a purchase was refunded or revoked, we keep that transaction identifier on a list for as long as needed to prevent it from being reused.
5. Barcode lookups
When you scan or type a barcode, the app sends the barcode number to Open Food Facts, an independent, open food database, to find product information. Open Food Facts receives your device's IP address as part of that request. The request does not go through our server. See the Open Food Facts privacy policy.
6. Nutrition label scanning
Nutrition label scanning (a CarbLuma Pro feature) happens entirely on your device, using Apple's on-device text recognition. The label photo is not sent anywhere and is not stored.
7. Exports
If you export your data as CSV or PDF, the file is created in a temporary folder on your device and goes only where you choose to share it. It is removed on your next export or when you delete your data.
8. No ads, no tracking
CarbLuma contains no advertising and no third-party analytics, advertising or crash-reporting software. It does not use your device's advertising identifier and does not track you across apps or websites. If you choose to share crash reports with developers through Apple, Apple provides them to us under its own terms.
9. Permissions
CarbLuma asks for camera access only when you first use a camera feature (meal photos, barcodes or nutrition labels). Choosing a photo from your library uses Apple's system photo picker, which doesn't give the app access to your library. CarbLuma does not request location, contacts, Health, tracking or notification permissions.
10. Data at a glance
| Data | Where it goes | How long |
|---|---|---|
| Food log, favorites, preferences | Your device. Your private iCloud only if you turn on sync | Until you delete it |
| Meal photo | Only when you tap Analyze: our server (in memory) and OpenAI | Not stored by us. OpenAI: up to 30 days for abuse monitoring |
| AI result for a photo | Your device; our server for retry protection | Up to 1 hour on our server |
| App Attest key identifier | Our server | Deleted after 180 days without use |
| AI usage counts | Our server | Current and previous period |
| Subscription transaction identifier (Pro) | Our server | While you use Pro; refunded ones as long as needed to prevent reuse |
| Barcode number and IP address | Open Food Facts | Per the Open Food Facts policy |
| Nutrition label photo | Stays on your device | Not stored |
| Payment details | Apple only | Per Apple |
11. Your choices and deletion
- Delete All Data: in the app, go to Settings → Delete All Data. This removes all food history and favorites from your device, and from iCloud if sync is on. It does not cancel a subscription.
- Delete the app: deleting CarbLuma also removes the data stored on your device.
- Server-side records: to ask us to delete the usage records tied to your installation, email support@clinicaltools.app. Because we don't know who you are, we may ask for information that lets us find the right records, such as a subscription transaction identifier from your Apple purchase history.
- Don't use AI analysis: every other feature works without sending photos anywhere.
Depending on where you live, you may have rights to access, correct or delete personal data, or to object to its processing. Because we hold very little data, and none that identifies you by name, the easiest way to exercise these rights is to contact us. We will not discriminate against you for exercising them.
12. Security
The app connects to our server over HTTPS only. The app contains no AI provider keys; all AI requests go through our server, which verifies each request with App Attest and verifies subscription proofs against Apple's certificates. Our server does not log images, subscription proofs or request bodies. On your device, your food log is protected by iOS Data Protection. No system is perfectly secure, but we work to keep the data we handle to a minimum and protect what we do handle.
13. This website
This website uses no cookies, analytics or third-party content. Like any web server, ours receives your IP address and basic request information when you visit, which we use only to operate and secure the site.
14. Children
CarbLuma is not directed at children under 13, and we do not knowingly collect personal information from children.
15. Medical disclaimer
CarbLuma is not a medical device and does not provide medical advice. AI results are estimates and can be inaccurate. Do not use CarbLuma to calculate insulin doses or to make treatment decisions. See our Terms of Use.
16. Changes to this policy
If we change how CarbLuma handles data, we will update this page and change the "Last updated" date above. If a change is significant, we will also let you know in the app.
17. Contact us
Questions or requests about privacy: support@clinicaltools.app
CarbLuma is provided by ClinicalTools.