Privacy Policy for KetoVoyage

Last updated: 22 September 2026

1. Provider and contact

KetoVoyage is provided by Yannick Castel, IT-Service Castel.
Alt-Buckow 51 A, 12349 Berlin, Germany.
Website: https://www.it-service-castel.de/
Email: Kontakt@it-service-castel.de

2. Core principle

KetoVoyage is a local, offline-first app. There is no KetoVoyage account and no KetoVoyage server to which personal app entries are sent. The app contains no embedded advertising or analytics SDKs. Personal details, recipes, plans and tracking data are processed on the device.

Planning and tracking work offline. Only when you choose and confirm an export are the contents described in section 7 passed to your selected destination. KetoVoyage does not provide its own cloud backup.

3. Data processed locally

Depending on the modules voluntarily enabled, the app may process on the device:

Profile details are not required when the app is used only for recipes. Users can always override suggested targets manually. Steps are stored as daily aggregates and do not create an additional calorie credit.

Local planning, consumption and reminders

The chosen accent color and shopping-list source dates and calculation status are stored locally. Marking a meal as eaten creates a separate local record of its name, personal nutrition values, date and known consumption time. Replacing or removing a plan does not remove recorded consumption. A separately confirmed correction changes the displayed totals; original closed-day items and a correction marker remain locally stored until the relevant data is erased.

When local reminders are enabled, Android can retain a periodic background repair job across restarts. After device unlock it reconciles future reminders. It does not send personal data, record consumption or open the app automatically. Android may delay or restrict execution. The job does not restart a paused phone step counter. Turning off the relevant reminders cancels the job when no reminder needs it; deleting all app data also cancels it.

4. Health Connect

Health Connect is optional. KetoVoyage requests only the read permissions needed for Health features enabled by the user. Each data type is controlled separately. KetoVoyage does not write data back to Health Connect.

The first import covers no more than the preceding 30 days. Later syncs replace only affected local daily values. KetoVoyage stores daily values, the source packages reported by Health Connect and the sync time. KetoVoyage does not send Health data off the device or use it for advertising, advertising profiles, credit decisions or sale. Personalised local calculations are described below.

Permissions can be revoked in Android or Health Connect settings. Disabling the module pauses syncing but does not automatically erase existing local data. “Delete all data” first attempts to revoke Health access and then removes local Health data, permission tokens, app data and scheduled work. Partial failures are shown in the app.

Daily active energy is used to estimate the local daily energy balance and calculated calorie target. The estimate combines resting energy, active Health energy and enabled manual additions. Workout details and steps do not add calories again. A manually set nutrition target takes precedence. Reported zero energy remains distinct from missing energy.

Weight and height are stored with measurement time, record identifier and source; only these profile fields are updated on import. KetoVoyage also stores failed import dates for retry and the daily target used for later completed statistics. Explicit imports cover at most 30 local calendar days including today. Opening the app updates today, yesterday and failed days within that window. Synchronization can be paused separately. Manual entries remain stored when manual entry is disabled.

Imported workout details include the workout type and any title, start and end time, source package and record identifier.

5. Notifications

When water reminders are enabled, Android schedules local notifications using the selected frequency and quiet hours. Android may require notification permission. Reminder data is not sent to IT-Service Castel. Disabling the water module cancels scheduled water reminders.

6. Storage, backup and deletion

Data normally remains on the device until it is deleted in the app, removed by “Delete all data”, or erased with app uninstallation. KetoVoyage excludes its databases, app files and settings from Android backup and device transfer. IT-Service Castel has no server copy and therefore cannot inspect or restore local data for the user.

During initial setup, Android may keep the current step and unfinished entries in the local state of the open task so they can be displayed again after system-managed process restoration. This includes entered profile and body data. It does not create a completed profile or grant a new permission. Successful completion removes this draft. Deliberately ending the task or force-stopping the app may discard it.

A reset first stops Health synchronization and phone step recording. Its remaining steps run in sequence. If a step fails, the app reports the failure and later steps may not have run, so deletion can remain incomplete. Resolve the indicated issue and retry. The app reports success only after all reset steps have completed.

Local entries are stored in the private Android app storage, with access controlled by Android and the device settings. KetoVoyage does not provide a separate app PIN or additional application-level database encryption. A suitable device lock helps protect access to the device.

For sharing, KetoVoyage temporarily creates export files in its private app cache. The recipient app you select receives limited read access to the relevant file. “Delete all data” removes these app-owned export files and revokes their grants. This does not erase copies already saved or sent, clipboard contents, or entries in the device calendar or an external service. Remove those contents at the respective destination yourself; that destination’s retention and backup rules apply.

7. External services and links

Source, website and privacy links opened voluntarily are passed to a browser. The support link opens an email app. KetoVoyage does not attach local profile or health records to these links.

If you choose to send a support email, IT-Service Castel receives the information you include in that message. Visiting the company website is also separate from processing entries inside the app. The statement that local app entries are not transmitted does not mean that a support email or website visit involves no processing by the respective services.

The published website and support privacy information is available at https://www.it-service-castel.de/datenschutz.html. It describes STRATO as the hosting and email provider, technical access data, handling your enquiry, legal bases, retention and your rights. Those notices also apply when you visit our website or choose to send us a message. Only send information necessary for your enquiry; local health data is not automatically attached to your message.

Purchase, payment, download, licence management and any store diagnostics are processed by Google Play as a separate service. KetoVoyage receives no nutrition or Health Connect data through this process. Google's privacy terms apply to that processing.

Community and review links open Discord, Google Play or a browser. The selected service’s privacy terms apply; KetoVoyage does not attach local profile or Health Connect records to these links either.

Optional calendar and shopping-list exports

You can export selected plan dates or shopping items as a calendar file (.ics), text file (.txt), CSV, copied text or through the Android share menu. For direct export to a calendar available on the device, you choose the destination calendar. KetoVoyage shows a preview of the actual contents before handing them over, and you decide whether to continue. Automatic changes to your internal plan do not update external copies automatically. Opening the share menu does not confirm a successful import.

Calendar exports contain dates and, where applicable, times, recipe names and total servings. Shopping lists contain selected item names, quantities and units, including manually added items. Profile values, personal nutrition values, Health Connect records and diners’ names are not automatically included in these exports. However, recipe or item text you enter yourself may contain personal or health-related information. Review the preview and share only contents you wish to provide to your chosen recipient.

Handover to the Android device calendar uses Android. Whether that calendar subsequently syncs with an online account and which devices receive the entries depends on your calendar provider and settings. The same applies to your chosen recipient app and to subsequently pasting copied text. KetoVoyage receives no server copy through this process. Direct online account connections within KetoVoyage are not enabled in version 1.4.0.

For destination selection, KetoVoyage displays the calendar and account labels reported by the device. The app stores export mappings and technical entry identifiers locally to find its own events when you initiate a later update. Calendar exports also contain technical entry identifiers; calendar files contain a creation timestamp.

8. Sharing and international transfers

KetoVoyage does not send local profile, tracking or Health Connect records to IT-Service Castel. However, the exports you expressly initiate in section 7 pass the contents shown in the preview to your selected destination. Depending on the recipient app, calendar account and their settings, these contents may leave the device and be processed outside your country. The respective provider’s information applies. External links and Google Play remain separate services.

9. Your choices and permissions

Manual entries, including profile details, nutrition entries and supplement names or doses, are stored locally when you use the relevant functions. Saving these entries does not require a Health Connect, physical activity, notification or exact alarm permission.

Importing Health Connect data requires the read permission for each data type. The phone step counter needs physical activity permission. Notifications and exact alarms have their own Android controls. These permissions govern technical access; granting them is not, by itself, proof of an explicit data-protection consent covering all local health-related processing.

Revoking Health Connect access stops new imports. Pausing synchronization, switching off the phone counter or disabling reminders stops the respective function. These actions do not automatically erase existing entries. Retained profile and history data may still be used by enabled local views and calculations. Manual features remain available. Section 6 explains local deletion.

You use the described app functions for personal purposes on your device. IT-Service Castel supplies the software, has no access to your local entries and does not provide remote access to these data. Website visits, voluntary support messages and Google Play are covered separately in section 7.

Direct device-calendar export requires Android calendar permissions to read available calendars and previously linked export entries and to write the events you confirm. You can revoke calendar permissions in Android settings. File and text exports and other local app features remain independent of those permissions. The app has an INTERNET permission; that permission alone does not mean that your entries are transmitted automatically or that an account connection is enabled.

10. Rights

Subject to applicable data-protection law, rights may include access, rectification, erasure, restriction, portability, objection and withdrawal, and the right to complain to a competent supervisory authority. Because IT-Service Castel receives no copy of local app data, local entries can be corrected in the app and removed on the device using the available deletion features. The exports described in section 7 cover selected plans and shopping lists; they are not a complete backup or access copy of all app data. Questions, including questions about portability, can be sent to the contact above.

11. Audience and health information

KetoVoyage is intended for adults. It is an organisation and education tool and does not replace medical advice, diagnosis or treatment. It guarantees neither ketosis nor weight loss.

12. Changes

This policy will be updated if features or data processing change. The current date and material changes will be identified at the beginning of this page.

Optional phone step counter

The phone counter starts disabled and requires a suitable step sensor and Android physical activity permission. After explicit activation, a pausable health foreground service works with the screen off. It stores daily counts, sensor counter, boot identifier, measurement time, recording start, time zone and partial coverage locally. No location or body sensor permissions are requested. Denying notification permission does not prevent the service; Android shows it in active apps. Health steps take priority when a daily measurement is available; the sources are never added. Disabling stops recording but retains history; data reset removes it. Water quantities, personal quick amounts and booking identifiers are also stored only locally.

SUPPLEMENTS

Supplement names, optional doses, weekdays, reminder times and confirmed intake timestamps are stored locally. Earlier intakes retain the name and dose recorded at that time. Archiving stops reminders and retains history; permanent deletion removes the supplement and its history. Enabling reminders can request notification permission and special access for exact alarms; saving a supplement without reminders does not require these permissions. Without exact alarm access, reminders use approximate times. Supplement notifications show only a neutral title and reminder text, without a supplement name or dose. This also applies when the device is unlocked, regardless of the selected Android preview setting. Opening the notification leads to the matching intake in the app. On a locked device, the “Mark as taken” action first requires Android unlocking; the current unlock state is checked again before saving. A cancelled or failed unlock request does not confirm an intake. An intake already confirmed can be undone in the app. Updating the app removes earlier supplement notifications; this does not automatically confirm pending intakes. No supplement data is sent to Health Connect or a server.