Cal AI

Is Cal AI safe?

Cal AI is convenient, but it is not a careful home for health data. You photograph a meal and the app estimates calories and macros, which explains its more than 15 million downloads. Behind that, the app tracks you for advertising, its terms let it train AI on what you upload, and in March 2026 a hacker posted files said to hold the body measurements and meal logs of more than 3 million users. Cal AI has not publicly confirmed that leak.

We score Cal AI 50/100, below its new owner MyFitnessPal (57) and well below wearable apps such as Oura (76). It is the kind of app to use with a throwaway amount of personal detail.

Who runs Cal AI now?

Cal AI started as a project by two teenagers, Zach Yadegari and Henry Langmack. MyFitnessPal bought it in a deal that closed in December 2025, TechCrunch reported in March 2026, after Cal AI reached more than $30 million in yearly revenue. The price was not disclosed. MyFitnessPal kept the seven-person team and says the app stays separate, now drawing on MyFitnessPal's food database.

The paperwork has not fully caught up. The App Store still lists Viral Development LLC as the seller, the terms name Cal AI, Inc. of Boca Raton, Florida, and the May 2026 privacy notice gives an address in Austin, Texas. MyFitnessPal's own record, including its 2018 breach of about 150 million accounts, does not transfer to Cal AI, so we score this app on its own label, policy and incidents.

What happened in the reported March 2026 leak?

On 11 March 2026 the security news site teiss reported that a hacker using the name "vibecodelegend" had put about 14.6GB of Cal AI data up on a cybercrime forum. The files reportedly held more than 3 million email addresses, names, genders, birth dates, height and weight, exercise goals, macro targets, meal logs, the times people usually eat, and subscription records. Some sample records belonged to people born in 2014.

The hacker said the data came from a Google Firebase database left exposed, and that logins relied on a four-digit PIN with no limit on guesses. These are the attacker's claims. Cal AI had not publicly confirmed the incident when teiss reported it, and we found no statement or breach notice since. We also found no security page, no bug bounty and no two-step login option, which leaves little to weigh against the report.

What Cal AI collects and how it is used

Apple's privacy label lists identifiers and usage data that may be used to track you across other companies' apps. It lists purchases, contact info, user content and sensitive info as collected but not linked to you, and nothing at all as linked to you.

The privacy notice tells a fuller story. Cal AI collects your name, email, birth date, gender, food, drink and medication logs, voice and photo entries, height, weight and progress photos, plus your IP address and advertising ID. It says it does not "expressly sell" data but that some cookie uses may count as selling or sharing under US state laws, and it uses targeted advertising and cross-device tracking. Data from Apple Health is not used for marketing. Where the label and the policy differ, we score on the policy, so the label understates what Cal AI does.

The terms add one more catch. You keep ownership of your photos and entries, but grant Cal AI a worldwide, irrevocable licence to use them, including to train AI models.

Accuracy, age and eating habits

Cal AI's FAQ says the app is "about 80% accurate," and the terms call every figure an automated approximation. That is fine for rough tracking and poor for anyone whose health depends on exact numbers. The app has a community feed whose rules ban posts that promote extreme restriction or thinspo, which is a sensible line for a calorie app.

Age is a gap. The terms set 13 as the minimum, with parental consent up to 18, and bar under-18s in Europe and the UK. The App Store, though, rates the app 9+. Daily calorie counting is not a habit to hand a child, and a parent should check this one before allowing it.

How to use Cal AI more safely

1. Refuse the tracking prompt on iPhone and turn off targeted ads in the app's profile settings.
2. Sign in with Apple and hide your email, and do not reuse a password or PIN from another service.
3. Skip progress photos and face pictures; anything you upload falls under the AI training licence.
4. Cancel through Apple or Google settings, not by deleting the app.
5. To delete your data, email [email protected] and ask for confirmation once it is done.

How we scored it

The regulatory record (86) is Cal AI's strongest factor only because no regulator has acted on the app yet. Security (40) is the weakest, driven by the reported leak of more than 3 million users and no visible security programme. Privacy (42) reflects ad tracking, a label that understates the policy and an AI training licence you cannot withdraw. Scams and harmful content (60) is held back by the 9+ rating on an app the terms reserve for teens and adults.