Khuraki
Download App
Back to Home

Legal & Compliance

Privacy Policy

Last updated: October 2026

1. Overview & Data Controller Identity

Khuraki (“we”, “our”, or “the App”) is a personal nutrition and fitness tracking application developed and published by Samyak Jain as an independent developer and sole proprietorship. We believe privacy is an architectural invariant, not an afterthought.

This Privacy Policy describes how personal, nutritional, biometric, and operational data is collected, processed, stored, and purged across the Khuraki Android mobile application and the companion website (https://khuraki.com).

For any legal, privacy, or data protection inquiries, you may contact our dedicated privacy desk directly at privacy@khuraki.com or general support at support@khuraki.com.

2. Age Restrictions & Children’s Privacy

Khuraki is designed and intended for general adult health, fitness, and nutritional awareness. We enforce age thresholds according to applicable regional legislation:

  • India (DPDP Act 2023): Under the Digital Personal Data Protection Act, 2023, an individual under 18 years of age is classified as a child. Khuraki is intended for independent use by individuals aged 18 and older. Individuals aged 13 to 17 may use Khuraki only under the verifiable consent, guidance, and active supervision of a lawful parent or legal guardian.
  • United States (COPPA): Khuraki strictly complies with the Children’s Online Privacy Protection Act. We do not knowingly collect, solicit, or maintain personal information from children under 13 years of age.
  • European Economic Area & United Kingdom (GDPR Art. 8): Users must be at least 16 years of age, or the applicable statutory age of digital consent established by their EU member state (between 13 and 16 years).

If we discover that personal data of an individual below these age requirements has been collected without verified parental authorization, we will immediately delete that information from our cloud and local databases.

3. Categories of Personal & Fitness Data We Collect

Khuraki collects information that you provide directly to fulfill your personalized nutrition and workout tracking:

  • Account Credentials: When you sign in using Google, Firebase Authentication processes your verified Google identity (Firebase UID, verified email address, display name, and profile picture URL). Khuraki never accesses, handles, or stores your Google account password.
  • Physical & Metabolic Baseline: Chronological age, biological sex, height (cm), scale weight (kg), target weight, estimated body fat percentage, daily activity baseline, and primary fitness goal (Weight Loss / Maintenance / Muscle Gain).
  • Nutritional Diary Logs: Logged meal titles, constituent food items, portion quantities, calculated macronutrients (calories, protein, carbohydrates, fat), dietary preferences (e.g., Vegetarian, Vegan, Halal), and daily water intake (ml).
  • Exercise & Workout History: Logged training sessions, targeted muscle groups, exercise movements, completed sets, repetitions, lifted load (kg), and estimated workout energy expenditure.
  • Daily Points Allowance & Referral Codes: Your daily AI quota allowance (10 base points per day) and generated 8-character referral associations stored in our Cloudflare D1 ledger to calculate quota resets.

4. Local Storage & Android Sandbox Security

Khuraki operates on an offline-first architecture. When you log meals, weights, or workouts, your records are saved immediately to your physical Android device using Android’s Room SQLite database and application SharedPreferences.

Security Boundary: On-device database contents are isolated from other applications by Android’s operating system application sandbox. Access is protected by your device’s hardware-backed operating system security mechanisms, including lock screen authentication and Android File-Based Encryption (FBE) when your device is locked. Khuraki does not implement separate application-layer SQLCipher encryption on the local SQLite file.

5. Cloud Synchronization (Google Cloud Firestore)

For authenticated users, your profile biometrics, daily calorie targets, meal records, scale weights, and workout histories synchronize to Google Cloud Firestore over encrypted TLS connections.

Cloud synchronization enables cross-device continuity and protects against data loss if your mobile device is replaced. If you use Khuraki in an unauthenticated guest state, your data resides exclusively on your local device and is never transmitted to cloud storage until you choose to link a Google account.

6. Artificial Intelligence Processing & Food Photo Privacy

Khuraki integrates artificial intelligence to parse natural language food descriptions, extract meal nutrition from camera photos, generate custom workout routines, and provide concise metabolic trend insights.

A. Transient Food Photo Processing Journey

When you use the AI Food Scanner, image data follows a strictly bounded path:

  1. A temporary camera image file is created in your Android device’s internal application cache directory.
  2. The image is compressed into memory on-device, and the temporary local camera file is deleted immediately.
  3. The compressed image payload is forwarded over encrypted TLS through Khuraki’s Cloudflare Edge proxy directly to OpenAI (“gpt-4o-mini”) solely for nutrient estimation.
  4. Zero Persistent Storage Guarantee: Khuraki does not intentionally retain, store, or archive food photos in application databases, file systems, or persistent cloud buckets. The image is discarded immediately upon completing the nutritional inference.

B. OpenAI API Retention & Model Training Policies

Khuraki connects to OpenAI via their standard commercial API endpoints. In strict accordance with OpenAI’s official Commercial API Data Usage Policy:

  • No Model Training: OpenAI does not use customer data submitted via its commercial API to train or improve its foundational machine learning models.
  • 30-Day Abuse Monitoring Retention: OpenAI retains API inputs and outputs for up to thirty (30) days solely for identifying abuse, fraud, and security violations, after which it is deleted, unless legally required otherwise. Khuraki does not claim custom Zero Data Retention (ZDR) or enterprise-tier configurations.

C. Text Prompts, Daily Overview & Weight Trend Insights

When you request text-based meal parsing, workout generation, weight trend insights, or the evening Daily Overview, only relevant user prompts or pre-calculated mathematical stats (such as calorie variance, hydration status, and workout logged status) are forwarded. Khuraki never sends your full longitudinal biometric history or sensitive identity information to the AI provider.

7. Local Notifications & Device Permissions

The Khuraki Android app requests only the minimum permissions necessary to deliver core functionality:

  • Camera (android.permission.CAMERA): Required solely when you tap the camera icon to capture a food photo for nutritional estimation. Camera access is never invoked in the background.
  • Notifications (android.permission.POST_NOTIFICATIONS): Used to deliver optional hydration reminder alerts.
  • Internet & Network State: Used to synchronize diary records to Cloud Firestore and transmit AI requests over TLS.

100% On-Device Reminders: Hydration reminders are scheduled locally on your device using Android’s AlarmManager. Khuraki does not operate remote push notification servers and does not collect or transmit device push tokens (FCM tokens).

8. Operational Telemetry & 90-Day Retention

To maintain API reliability, prevent rate-limit abuse, and enforce daily quota rules, Khuraki records technical request metadata in a secure Cloudflare D1 database.

These records contain only technical attributes: Firebase UID, timestamp, token usage counts, model identifier, response latency (ms), and HTTP status code. Operational logs never contain user food photos, meal descriptions, prompt text, or AI response copy.

Telemetry records are maintained on a rolling 90-day window for operational security and fraud prevention, after which they are permanently deleted.

9. Self-Serve Data Portability (“Download My Data”)

In accordance with GDPR Article 20 and India’s DPDP Act 2023, you maintain complete ownership of your fitness and nutritional data. Signed-in users can export their complete health archive at any time directly within the app:

Open Khuraki → Profile → Settings → Account Settings → Download My Data → Tap “Download Data Archive (JSON)”

The generated export contains your complete biometrics, daily calorie targets, meal logs with food constituent breakdowns, workout routines with sets and reps, scale weight history, and metabolic calibration history.

Security Notice Regarding Unencrypted Exports: The archive is compiled on-device as an unencrypted, standardized JSON file and dispatched via the Android system Share Sheet. Because this file contains sensitive personal health metrics in plain text, you are solely responsible for securely storing or transferring it to trusted storage destinations.

10. Account Deletion & 30-Day Recovery Grace Period

Khuraki complies with Google Play Store data deletion mandates by providing two distinct pathways to delete your account:

  • In-App Self-Serve Deletion: Within the Android app, navigate to Profile → Settings → Account → Delete Account & Data. To prevent accidental or unauthorized loss, you must verify your identity via fresh Google Credential Manager re-authentication. Upon confirmation, an immediate local wipe is executed on that device (purging Room database tables, cached session data, and SharedPreferences), and your cloud profile is flagged for deletion.
  • External Deletion Request Portal: If you no longer have access to your Android device, you can submit an email-authenticated deletion request via our public Account Deletion Portal or by emailing support@khuraki.com from your registered Google email address.

The 30-Day Recovery Window: Following a deletion request, your cloud Firestore records enter a dormant 30-day grace period. If you sign back into Khuraki on Android within this 30-day window, you will be presented with an explicit prompt to either select “Restore Account” to resume your profile or remain scheduled for deletion. Signing in alone does not automatically cancel scheduled deletion.

Permanent Cloud Purge: If no restoration is executed within 30 days, automated backend routines permanently delete your Cloud Firestore user documents, diary subcollections, and Firebase Authentication identity forever.

11. Legal Bases & Third-Party Service Providers

Under the General Data Protection Regulation (GDPR) and international privacy frameworks, we process your data under the following lawful bases:

  • Contractual Necessity (GDPR Art. 6(1)(b)): Delivering core metabolic calculations, maintaining your daily diary, and computing macro targets.
  • Explicit Consent (GDPR Art. 6(1)(a) & Art. 9(2)(a)): Accessing the camera for optional meal scanning and processing health-related biometrics.
  • Legitimate Interests (GDPR Art. 6(1)(f)): Enforcing API rate limits, monitoring technical errors, and safeguarding backend infrastructure against abuse.

Khuraki shares data strictly with essential infrastructure processors over encrypted channels:

  • Google Firebase (Alphabet Inc.): Cloud database synchronization and user authentication (United States & global data centers).
  • Cloudflare, Inc.: Global edge network proxy, DDoS protection, static hosting, and D1 operational telemetry database.
  • OpenAI, LLC: Nutritional and workout text inference and transient meal photo analysis (United States).

Ecosystem Isolation & Zero Ad Networks: Khuraki contains zero third-party advertisement SDKs, zero tracking pixels, and zero analytics trackers. Khuraki does not sell, rent, or trade your health data to data brokers or insurance providers. We do not read from, share to, or synchronize data with Google Health Connect, Apple Health, or external wellness platforms without your affirmative consent.

12. Your Legal Rights, Grievance Redressal & Health Disclaimer

Depending on your jurisdiction (including India, the European Union, the United Kingdom, and California), you possess the right to:

  • Access and review personal information we hold about you.
  • Request correction or rectification of inaccurate biometric or profile records.
  • Request the erasure of your personal records (“Right to be Forgotten”).
  • Export your data in a portable, structured JSON format (“Right to Data Portability”).
  • Withdraw previously granted consent at any time without penalty.

Grievance Redressal Officer (India DPDP Act 2023 & IT Rules)

In accordance with the Information Technology Rules, 2021 and the Digital Personal Data Protection Act, 2023, the designated Grievance Officer for Khuraki is:

Officer Name: Samyak Jain
Entity / Publisher: Samyak Jain (Khuraki)
Grievance & Privacy Desk: privacy@khuraki.com
Support Desk: support@khuraki.com

Grievances and rights requests are acknowledged within 48 hours and resolved within 30 days of receipt.

Non-Medical Fitness & Metabolic Disclaimer

Khuraki is an informational and educational lifestyle application. Caloric calculations, BMR/TDEE estimates, adaptive adjustments, and AI nutritional estimates are generated using scientific equations (such as the Mifflin-St Jeor formula) and machine-learning heuristics.

Khuraki is not a medical device and its outputs do not constitute medical, clinical, dietary, or healthcare advice, diagnosis, or treatment. Always consult a qualified physician or registered dietitian before undertaking any significant dietary changes or strenuous exercise regimens.