Legal
Privacy Policy
The KaoBurn iPhone app and this website
This Privacy Policy explains how KaoBurn ("we") collects, uses and discloses the personal data of users of the KaoBurn iPhone app (the "App") and visitors to this website ("you") under Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA").
1. Data controller and contact
The data controller is KaoBurn, as the developer and seller of the App, as named as the seller on the App's App Store page, located in Bangkok, Thailand.
You may contact us about personal data matters at [email protected].
2. Personal data we collect
| Type | Details | Source |
|---|---|---|
| Account | Name, email address and system user ID received from the sign-in provider you choose | Apple or Google, when you sign in with that service |
| Profile and goals | Username, sex, date of birth, height, weight, activity level and weight goal | Entered by you |
| Meal log | Dish name, estimated calories, nutrients (protein, carbohydrate, fat), ingredients, servings, AI confidence level and time logged | AI estimates that you review and confirm |
| Food photos and notes | Photos you take or select for scanning, and any note about the meal that you choose to send with the photo | Sent at your choice, see section 5 |
| Exercise | Daily program, chosen exercises, reps, scheduled time and daily results, including verified results such as running distance and time and badminton time | Your use of the App, Apple Health and the device pedometer |
| Apple Health data | Running, badminton and other workouts the App uses to verify missions (distance, duration), read-only. Results used to verify missions are stored in your account | Only if you allow it, see section 7 |
| Motion sensors | Distance from the device pedometer, used together with Apple Health whenever a run is verified (the App uses the higher value) | Only if you allow it |
| In-app notifications | Title, message, time and read status of in-app notifications | Created by the App |
| Points, membership and purchases | Points balance, Points transaction history, Skip Tokens, Freeze Tokens, streak and membership status | Your use of the App and Apple (we do not receive your card or payment details) |
| Username and leaderboards | The username you choose, daily scores and total score. Your username and score are shown to other App users on leaderboards | Your use of the App |
| Invite or partner code | The code you enter when you start using the App (if any) | Entered by you |
| App and consent data | App version used, last active time, and the history of consents given or withdrawn | Created by the App |
| Contacting us | Email, message and attachments you send us | When you contact us |
3. Purposes of use
- Providing the App's core service: estimating calories from food photos, calculating exercise missions, counting and/or verifying exercise movements, including verifying running, badminton and/or other activities that may be added in the future, and showing your statistics
- Sending notifications at the times you set
- Managing Points, Skip Tokens, Freeze Tokens and memberships
- Showing your username and score on leaderboards
- Maintaining your account, security, and responding to your enquiries
We do not sell or transfer your personal data to third parties for commercial purposes or to external applications, except disclosure to service providers that process or store data on our behalf and the other cases set out in section 8 of this policy. We do not use health data for advertising or any sales promotion.
4. Legal basis and consent
| Purpose | Legal basis |
|---|---|
| Providing the App's core service, maintaining your account, and showing your username and score on leaderboards | Performance of a contract (Section 24(3)) |
| Body and activity data (sex, date of birth, height, weight, activity level, goals, Apple Health and pedometer data) to calculate goals and verify missions | Explicit consent (Section 26), requested in the App before you start |
| Sending food photos and notes to an external AI provider to estimate the dish and nutrition | Consent (Section 19), optional. If you have not given it, the App asks again when you tap scan |
| Usage statistics and crash reports | Consent (Section 19), optional. The App does not currently collect this data |
| News and offers by notification and email | Consent (Section 19), optional |
| Disclosure under section 8 to a partner whose code you entered | Performance of a contract (Section 24(3)), as you chose to use that partner's code |
| Preventing fraud, fixing defects, prompting App updates, and keeping records of consent | Legitimate interests (Section 24(5)) |
You may turn the optional consents (AI food scan, usage statistics, and news and offers) on or off at any time at Profile > Terms & Consent. You may withdraw consent for body and activity data by deleting your account in the App, or by emailing [email protected] from your account email; after such withdrawal we can no longer provide the service to you. Withdrawal does not affect processing carried out before the withdrawal.
5. Food photos and the external AI provider
When you scan a meal, the App resizes the photo and sends it, together with any note you type, through our systems to an external AI API provider (currently Google Gemini API) solely to analyse the food and estimate the dish, calories and nutritional values. The photos and notes are not used for any other purpose. We do not store the photo in your account and keep only the estimate you confirm.
We use the paid tier of the Gemini API. Under Google's terms, the provider does not use submitted content to improve Google products.
The App asks for your consent before the first food photo is sent, and you may turn off AI scanning at any time at Profile > Terms & Consent. The App also reads the capture time stored in the photo file on your device to check that the photo is of that meal.
6. Exercise detection and counting camera
When you use the camera to detect exercise movements and count reps, camera images are processed on your device with Apple Vision to locate body joints, check the movement and count reps. Camera images and video are never recorded, uploaded or sent off the device. We store only the results, such as the number of reps completed.
In addition to Apple Vision, the App uses an AI model developed and trained by our Thai development team, which runs on your device to check exercise form and counting. The model is trained only on data from sources other than App users, and is then built into the App or delivered to the App as an update.
Data arising from your use of the App, including camera images, pose data and exercise results, is not used to train, improve or develop our models and is not used for any purpose other than those set out in this policy. No video is recorded or stored during exercise.
7. Health data and Apple Health
- The App requests read-only access to workouts in Apple Health to verify running, badminton and other necessary activities, and does not write data back to Apple Health.
- Results used to verify missions (such as running distance and time and badminton time) are stored in your account on our cloud systems together with that day's mission data.
- You may refuse or revoke access at any time in iPhone Settings and continue to use the App, but runs can then be verified only with the device pedometer, and badminton and other activities that require Apple Health cannot be verified.
- Apple Health data is never used for advertising or marketing, never sold, and never stored in iCloud.
8. Recipients and international transfers
| Recipient | Purpose |
|---|---|
| Cloud service provider (data storage, authentication and server-side processing) | Storing your account, profile and logs, authenticating you at sign-in, and passing food photos on to the AI provider |
| AI API provider (currently Google Gemini API) | Analysing food photos and notes solely to estimate the dish, calories and nutritional values |
| Apple | Sign in with Apple, Apple Health and In-App Purchase |
| Google Sign-In | When you choose to sign in with Google |
| Partners whose code you entered (such as gyms or content creators) | Tracking users who signed up with the partner's code, as described below |
All in-app purchases and memberships are processed directly through Apple In-App Purchase. The App does not collect or store your card or financial data.
If you enter a partner's code, such as a gym or content creator, that partner can see the following through the partner system: your partially masked username (the last 3 characters replaced with xxx, or the whole username masked if it is 3 characters or fewer), the date the code was linked, membership status and plan, the dates payment started or was cancelled, the number of paid billing cycles, and the commission amount attributable to you, as well as anonymised aggregate gender and age-range statistics of users linked to that partner, in which groups of fewer than 5 people are not shown. Partners cannot see your email address, real name, body data, meal log or exercise data.
Your personal data may be stored or processed on servers located outside Thailand by providers with appropriate personal data protection measures. We transfer data abroad only as necessary to provide the service you request (Section 28) or with your consent (for food photos sent to the AI provider).
9. Retention periods
| Type | Period |
|---|---|
| Meal log, exercise results and daily missions | About 1 year back. Older entries are deleted automatically when you open the App |
| Food photos and notes | Not stored; used for the scan only |
| Account, profile, Points, Points history, Skip Tokens, Freeze Tokens and other account data | Until you delete your account |
| Username and score on leaderboards | Scores remain on the leaderboards after account deletion so that other users' ranks do not change, with "-del" added to the username. Daily scores that are not shown publicly are deleted within 90 days of account deletion |
| Records of consent given or withdrawn | Retained as evidence for as long as necessary for legal compliance and for the establishment, exercise or defence of legal claims, including after account deletion. They contain the text version, time, the consents given or withdrawn, and your user ID, with no body data |
| Emails or requests you send us, including attachments | Retained for no longer than 1 year from the date the matter is closed, then deleted |
Deleted data may remain in system backups for no longer than 1 year, after which it is permanently deleted. We do not use such data during that period.
10. Deleting your account and data
You may delete your account yourself in the App. On deletion, your account data and data linked to your account are deleted, except the data set out in section 9. See the full steps on the Account deletion page.
11. Data subject rights
Under the PDPA, you as the data subject have the following rights:
- To access and obtain a copy of your personal data
- To request transmission or transfer of your personal data
- To object to the collection, use or disclosure of your personal data
- To request erasure or destruction of your personal data
- To request restriction of use of your personal data
- To request rectification of your personal data so that it is accurate, up to date and complete
- To withdraw consent previously given
- To lodge a complaint with the Office of the Personal Data Protection Committee
You may submit a rights request to [email protected].
We respond to rights requests within 30 days of receipt and may ask you to send the request from your account email to verify your identity.
12. Minors and minimum age
This app is for people aged 18 and over. We do not knowingly collect data from anyone under that age; if we find such data, we delete it promptly. If you are a parent and believe your child uses the app, contact [email protected].
13. Data storage and security
- Personal data is stored on cloud infrastructure that meets international security standards, with encryption both in transit and at rest.
- Access to data is limited to the App's systems and authorised personnel for providing the service and processing under this policy, and the system's access rules allow each account to access only its own data.
- Data may be stored or processed on servers located outside Thailand by providers with appropriate personal data protection measures.
However, no system is completely secure. If a personal data breach occurs, we will give notice as required by law.
14. This website
This website has no membership or sign-in and does not set cookies itself. Fonts on this website are served from this website's own server, not from Google Fonts.
The website stores 2 essential values in your browser (your chosen theme and your cookie consent choice) and loads analytics tools (if any) only after you consent. See the Cookie Policy for details.
Cloudflare, as the website hosting provider, processes technical data such as IP addresses to deliver pages to you and protect against attacks.
15. Changes to this policy
If we change this policy, we will update the effective date at the top of this page and notify you in the App of any material change.
The Thai version of this policy is the governing version; versions in other languages are translations.