krasum

Privacy Policy

Updated 2026-07-02

Controller. Krasum is provided by AMOR FATI, obdelava podatkov, d.o.o. (short form: AMOR FATI d.o.o.), Stanežiče 1B, 1210 Ljubljana Šentvid, Slovenia. Company registration number: 9618147000. Tax number: 41688791. Not registered for VAT.

Company representative details are available in the Slovenian business register (AJPES) under registration number 9618147000.

Data protection officer: No data protection officer is appointed. Please direct data protection enquiries to support@krasum.com.

For privacy requests and all data protection questions, email support@krasum.com.

What Krasum is. Krasum is a personal wellness record and logging app. It helps you capture, organize, view, and export your own food, training, hydration, phone sourced health metrics, and laboratory report values exactly as printed. Krasum is not a medical device. It is not for clinical decisions. Nutrition figures and image outputs are estimates.

Where data is stored. Core account data is stored through Supabase infrastructure in the European Union, currently Frankfurt, Germany. Some processors may process limited data outside the EU or EEA as described below.

Data we collect and why

Account identity. We process your email address and sign in provider so we can create and secure your account, sign you in, and contact you about the service. Legal basis: contract under GDPR Article 6(1)(b).

Meal images and recognition inputs. We process meal photos or descriptions you choose to submit so Krasum can return estimated food and nutrition entries for your private log. Legal basis: contract for the service, and consent for any optional longer retention or model improvement use.

Food logs and corrections. We process foods, portions, estimated calories and macros, timestamps, and edits you make so your diary reflects your own entries. Legal basis: contract for your private diary. If you turn on the corrections pool, consent for shared food data improvement.

Profile and onboarding. We process sex, date of birth, height, weight, activity level, goal, optional goal weight, weekly rate, and display preferences to calculate and show your personal targets. Legal basis: contract. Some fields may also be health related, so consent rules may apply where required.

Location. If you turn location on, Krasum records the level you choose: none, country, city, or point of interest. Legal basis: consent.

Connected health data. If you connect Apple Health or Health Connect, Krasum can read only the types you authorize in your phone settings. These may include steps, active energy, weight, sleep duration, bed and wake times, resting heart rate, heart rate variability, body fat percentage, lean body mass, and menstrual flow or cycle records. Legal basis: consent under GDPR Article 6(1)(a) and explicit consent under GDPR Article 9(2)(a).

Lab results. If you turn lab results on, Krasum can store values, units, printed reference ranges, and printed flags from laboratory reports that you add and confirm. Source images or PDFs are used for the scan flow. When you save confirmed values from a scan, Krasum removes the source photo or PDF by default unless you choose to keep the original. Stored source documents stay while your account is active and are deleted when you delete your account. Legal basis: consent under GDPR Article 6(1)(a) and explicit consent under GDPR Article 9(2)(a).

Workout and fitness logs. If the feature is available to you, Krasum processes routines, sessions, sets, reps, weights, notes, and records you enter. Legal basis: contract.

Hydration logs. Krasum processes water entries and related settings you create. Legal basis: contract.

Feedback. If you send feedback, Krasum processes the message, optional screenshot, optional voice note, and app context such as platform and app version. Legal basis: contract for support and legitimate interests for support integrity.

Reliability logs and analytics. Krasum may process crash reports, error events, and privacy filtered product usage events using an anonymous installation ID or a salted hash of your account ID. We do not send raw image URLs, email addresses, connected health data, lab values, feedback screenshots, voice notes, or precise location to analytics.

GDPR Article 9 health data

Connected health data and lab results are special category personal data under GDPR Article 9. Krasum processes this data only when you give explicit consent through the relevant app switch and, for phone sourced data, through your phone permission screen. You can withdraw consent at any time by turning the switch off, disconnecting the source, or removing Krasum permission in phone settings. Withdrawal stops future processing for that purpose. To remove data already stored, delete the related record if that option is available in the app, or delete your account.

Menstrual flow and cycle records are shown only in your private tracking view. They are not used to change food, activity, weight, calorie, or macro targets. They are not sent to analytics, advertising tools, or AI recognition providers.

All optional consent dimensions start off or at the most private setting.

  1. Corrections pool. Your corrections may improve shared food data used by Krasum.
  2. Image training. Meal photos may be kept up to 2 years and used to improve recognition.
  3. Personalization. Krasum may use your own logging history to make future logs faster and more accurate for you.
  4. Location. Krasum may record location at the level you choose.
  5. Country in recognition. If a country was captured, Krasum may include it in the recognition request for regional food accuracy.
  6. Health data sync. Krasum may read the health data types you authorize from Apple Health or Health Connect.
  7. Health data for personalizing your targets. Krasum may use body composition and recent step data to refine calorie and macro targets, only when health data sync is also on.
  8. Lab results. Krasum may store laboratory results you add and confirm.

You can change these choices in the app. A snapshot of the relevant consent settings is stored with each meal record so Krasum can show what that record was allowed to be used for.

What we do not do

We do not sell your personal data. We do not share it for advertising. We do not use meal images for model improvement unless you opt in. We do not send connected health data or lab values to analytics or crash reporting. We do not permit a recognition provider to use your submitted images or prompts for its own general model training where our processor terms prohibit that use.

Retention summary

See Data Retention for the full plain language table.

Operational meal images are kept about 90 days. Meal images under image training consent may be kept up to 2 years, with renewal requested around 18 months. Logs, profile, connected health data, lab results, hydration logs, and workout data are kept while your account is active and are deleted when you delete your account. Feedback rows are deidentified on account deletion. Routine backup copies age out on their normal rotations.

Processors and subprocessors

AMOR FATI d.o.o. uses processors under data protection terms and instructions.

  1. Supabase. Authentication, database, storage, and server functions. Region: European Union, Frankfurt. Safeguards include Supabase data processing terms and Standard Contractual Clauses for its own subprocessors where needed.
  2. Google. Google Sign In and AI recognition for meal images, optional recognition hints, and lab source documents during a user started scan flow. Region and transfer path depend on the exact Google service tier in use. Production lab document processing requires a no training, data processing agreement covered setup with acceptable retention, region, and transfer terms.
  3. Apple. Apple Sign In. Apple Health is an on device permission source. If you connect it, authorized records are copied into Krasum storage and processed by Supabase.
  4. Sentry. Crash and error reporting with personal data scrubbing. Region: EU data residency where configured.
  5. PostHog. Product usage analytics with privacy filtered events and pseudonymous IDs. Region: EU Cloud where configured.
  6. Telegram. Founder feedback notifications. Payload is minimized to type marker, feedback row ID, optional platform and app version, and a short feedback excerpt. Screenshots, audio, and account email are not sent.
  7. Notion. Feedback triage sync. Payload includes feedback text, type, status, source, timestamp, feedback ID, and minimal app context. Reporter email, signed screenshot links, and audio are not sent.
  8. Email sender. Account emails such as confirmation or password reset messages. The provider is the platform email sender unless AMOR FATI d.o.o. configures a custom sender.

International transfers

Core storage is in the EU. Where a processor involves a transfer outside the EU or EEA, AMOR FATI d.o.o. relies on appropriate safeguards such as a data processing agreement, Standard Contractual Clauses, an adequacy decision, or a processor EU data residency commitment. Krasum also minimizes the data sent to each processor.

Account deletion

You can delete your account in the app from Settings, then Account, then Delete account. If you cannot access the app, email support@krasum.com from the address associated with your account. See Account and Data Deletion.

When deletion runs, active sessions are revoked, account data is removed from live systems, and your sign in account is removed. Krasum keeps only limited records needed for integrity, compliance, and support integrity, as described in the deletion page and retention page.

Your GDPR rights

You have the right to access, rectify, erase, port, restrict, or object to certain processing of your personal data. You can withdraw consent at any time for consent based processing. You may also lodge a complaint with a supervisory authority.

For Slovenia, the supervisory authority is the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip-rs.si, gp.ip@ip-rs.si.

To exercise your rights, email support@krasum.com. We respond within the GDPR timeframes, generally one month.

Security

Krasum uses row level security, private storage, short lived signed links for private files, no administrator keys in the mobile app, privacy filtered analytics, and EU core data residency. No system is perfect, but Krasum is designed to limit what is collected and who can reach it.

Children

You must be at least 15 years old to use Krasum. Krasum is not directed at children below this age. If you believe a child has provided data, contact support@krasum.com.

Changes

We may update this policy as Krasum evolves. We will update the date above and, for material changes, notify users in the app where appropriate.