Guide

Checking it yourself.

Nobody has to take a food app's word for it. Apple publishes a privacy label on every product page, iPhone records the domains apps contact, and Exodus Privacy scans Android apps for trackers. Here is how to run those checks, and what each cannot tell you.

By Alen Yaco Double bachelor's in biological sciences and social ecology, UC Irvine Published 18 September 2026

Not on this page. What CalorieCounter collects, keeps and deletes is not covered here. The app is unreleased and cannot be installed yet, and its stated practices live on /privacy.html, with the Apple Health specifics on /health-privacy.html.

How do I check if a calorie app sells my data?

No single check settles it, but four do most of the work: the App Store privacy label, the tracking prompt, App Privacy Report on your iPhone, and, for Android apps, Exodus Privacy. Each answers a different question, and each has a blind spot the others cover.

Two of these are claims and two are measurements. A label and a privacy policy are the developer describing the app. App Privacy Report and Exodus Privacy inspect it. Claims can be wrong and measurements incomplete, so run one of each.

Check	What it shows	What it cannot show
App Store privacy label	Data types the developer declares	Whether the declaration is true
Tracking prompt	That the app wants to link your data with third-party data	Anything, when no prompt appears
App Privacy Report	Domains the app contacted in the past 7 days	What was sent to them
Exodus Privacy	Tracker signatures in a shipped Android package	iPhone apps, or whether a tracker runs

Read the label before installing, then turn on App Privacy Report and look up any domain you do not recognise.

One disclosure before you start. CalorieCounter, this site's own app, is unreleased and cannot be installed, so it can sit none of these four checks today: no listing means no label and no tracking prompt, nothing is installed for App Privacy Report to watch, and Exodus has no Android package to scan.

What does the App Store privacy label actually tell me?

Every App Store product page carries a section headed App Privacy. It lists the data types the developer says the app collects, sorted into Data Linked to You, Data Not Linked to You, and Data Used to Track You, and grouped by purpose.

Purposes appear as headings: App Functionality, Analytics, Product Personalization, and Developer's Advertising or Marketing. Apple's Privacy Definitions and Examples page lists the vocabulary and four outcomes.

Data Not Collected. The developer states the app collects nothing.
Data Not Linked to You. Collected, but not tied to your identity or device.
Data Linked to You. Collected and tied to your identity or device.
Data Used to Track You. Linked with third-party data for advertising, or shared with a data broker.

Four data types matter here. Health covers HealthKit and clinical records, Fitness covers exercise data, Sensitive info explicitly includes pregnancy or childbirth information, and Device ID includes the advertising identifier. The signal is one of those under an advertising purpose.

Two things sit outside tracking: linking done only on your device, and a data broker using shared data only for fraud prevention. An app can collect plenty and still show nothing under Data Used to Track You.

Can I trust a privacy label the developer wrote themselves?

Privacy labels are self-reported. Apple's support page describes the information as supplied by the developer, and a peer-reviewed 2024 study by Ali and colleagues states plainly that Apple does not validate labels. Read a label as the developer's claim on the record, then check the privacy policy.

The 2024 study in the Proceedings on Privacy Enhancing Technologies compared the privacy policies of 474,669 iOS apps with their labels. Around 228,000 had policies suggesting more collection than the label reported, and 97% of apps carrying a Data Not Collected label had a policy indicating otherwise. The authors blame templates and confusion about Apple's definitions, not deceit.

The second problem is staleness. An ACM CHI 2022 analysis by Li and colleagues followed the 137,088 apps that created a label in April 2021. By 5 November 2021, only 7,884 of them, 5.8%, had ever updated it, while 43.4% had shipped a new app version.

A label can be older than the code it describes. Read it anyway: it is a claim on the record under Apple's App Review Guidelines. Both figures are history, with no verified 2026 equivalent.

What does it mean when an app asks to track my activity?

Seeing the tracking prompt means the app wants to link data it collects about you with data collected about you on other companies' apps and websites, for targeted advertising or measurement, or to share it with a data broker. Apple has required that permission since iOS 14.5.

Apple's support article on the prompt is direct about what saying no costs: nothing. You keep the app's full capabilities either way. Ask App Not to Track blocks the system advertising identifier, and also bars the developer from tracking you with other identifying information, such as your email address. Past answers sit in Settings, then Privacy and Security, then Tracking.

A food app sits under a second rule. Section 5.1.2(vi) of the App Review Guidelines says data from HealthKit, Clinical Health Records and the camera, photo and depth APIs may not be used for marketing, advertising or use-based data mining, including by third parties.

If an app never shows the tracking prompt, does that mean it is clean?

No. Apple documents several reasons the prompt never appears: tracking is restricted on the device, the reader switched off Allow Apps to Request to Track, the request came from an app extension, or another request was already pending. In each case the system answers for you.

Apple's developer documentation lists the cases where the system shows nothing and answers for you:

Tracking is restricted on the device.
The person turned off Allow Apps to Request to Track.
Another permission request is already pending.
The call comes from an app extension.

The global switch matters most, because it is silent. With it off, every app that asks is treated as if you had tapped Ask App Not to Track. Apple lists people who cannot turn it on at all: child accounts, users under 18 by birth year, and anyone whose Apple Account is less than 3 days old.

One thing is easy to get backwards. Whether an app may ask you again after you have already answered depends on the region you are in, and those rules change. A repeat prompt is permission for the app to ask a second time, not a case where the system answered for you. Your earlier choice holds until you change it.

So no prompt means one of three things: the app does not track, it could not ask, or it asked when you could not be asked.

How do I see which servers a food app actually contacts on iPhone?

App Privacy Report, built into iPhone since iOS 15.2, records the domains each app contacts and how often apps reach your location, camera and microphone. Turn it on in Settings, under Privacy and Security. It keeps 7 days, and only from the moment you switch it on.

Apple's App Privacy Report is the strongest check a non-technical reader can run: it measures behaviour instead of reading a claim. App Network Activity lists the domains an app contacted over the past 7 days. Data and Sensor Access shows how often it reached sensitive data or a sensor. The report is encrypted and stored only on your device.

Log a few meals, then work down the domain list. A barcode lookup contacts a food database, and a photo estimate contacts a vision service. What deserves a question is a domain belonging to an ad network or attribution vendor, in an app that shows no ads.

Three limits. It starts empty, and records only from the moment you switch it on. Its 7 day window can miss a weekly background sync. And a contacted domain tells you where traffic went, not what was in it.

Can I look up my calorie app on Exodus Privacy?

Only if it is an Android app. Exodus Privacy, run by a French non-profit, statically scans Android packages from Google Play and F-Droid for tracker signatures and lists the permissions requested. It cannot analyse iPhone apps at all, and it only scans software that has shipped.

The iPhone limit is not a gap that might close later. Exodus says so in its own FAQ: "Apple's DRMs strictly forbid us to investigate so we can not say."

Exodus analyses Android applications without decompiling them, matching class names against a list of known trackers, and flags dangerous permissions. Its tracker index listed 432 known trackers on 18 September 2026, and it publishes tracker frequencies.

Tracker	Share of Google Play apps in its database
Google Firebase Analytics	59%, 179,530 apps
Google AdMob	43%, 131,583 apps
Google CrashLytics	36%, 111,060 apps
Facebook Login	19%, 58,835 apps
AppsFlyer	8%, 24,630 apps

Those are shares of Exodus's own database, not of the Play Store, read 18 September 2026. A signature match means the code is in the bundle, which Exodus says is not proof the tracker is active, and its list is not guaranteed complete. Five trackers found means five SDKs shipped, not five data flows.

Reading a report takes a minute. Put the tracker list beside the permission list and weigh both against what the app does for you. A food app that wants the camera has a reason. A subscription app carrying several advertising SDKs is worth an email to its developer.

Is Mozilla's Privacy Not Included still a place to check?

Not any more. Mozilla sunset the Privacy Not Included buyer's guide on 11 August 2026 and folded the work into its Nothing Personal magazine, where product reviews now live. The old guide, methodology and about pages return 404, and the archive sits in the Internet Archive.

Plenty of privacy advice still sends readers there. Mozilla's notice says the guide, launched in 2017, now continues as Product Reviews in its Nothing Personal magazine, with the old guide archived at the Wayback Machine. Whether any calorie app has been reviewed there, this page cannot confirm.

The method is worth copying. The archived methodology page shows Mozilla did not test products in a lab, because consumers cannot either. It worked from policies, company sites, news reports and store listings, emailed each company at least 3 times, and gave its warning label on 2 or more warnings across data use, user control, track record and five minimum security standards. Where it could not get an answer, it recorded a fail.

A question a developer will not answer is itself an answer.

Does HIPAA cover what I log in a calorie app?

Almost never. The HIPAA rules bind covered entities, meaning health plans, clearinghouses and most providers, plus their business associates. The FTC, in guidance built with HHS, ONC and the FDA, says the rules likely do not reach health information held by an app you downloaded yourself.

The US Department of Health and Human Services is explicit: an organisation that is neither a covered entity nor a business associate need not comply with the HIPAA rules. The Mobile Health App Interactive Tool, built by the FTC with HHS, ONC and the FDA, applies that to apps you download yourself.

Outside HIPAA is not outside the law. The same tool, which HHS points developers at, says the FTC Act applies to most app developers, and the Health Breach Notification Rule reaches most health apps HIPAA does not.

That rule has teeth. In its first enforcement action under it, on 1 February 2023, the FTC acted against GoodRx over health information shared with Facebook and Google. GoodRx paid a $1.5 million civil penalty and was barred from sharing user health data for advertising. The FTC also said a seal on its homepage falsely suggested HIPAA compliance. A HIPAA badge on a food app is a marketing graphic, not a legal status.

Hold this site to the same standard. The privacy policy and health data policy here are written claims, which this page put in the weaker of its two evidence categories. Read them, then measure what you can measure.

FAQ

Is a paid calorie app automatically more private than a free one?

Paying removes one reason to sell data, but proves nothing by itself. Subscription apps still ship analytics and attribution SDKs. Check the tracking section of the label, then check which domains the app contacts.

What if the label and the privacy policy disagree?

Assume neither is settled and go and measure. The 2024 Privacy Enhancing Technologies study found mismatch at large scale, mostly from template policies rather than bad faith. Email the developer with the contradiction, then read your own domain list.

An app asked me about tracking a second time. Is that a bug?

Probably not. Whether an app may ask again after you have answered depends on your region and on rules that change. Your earlier choice holds until you change it, so a repeat prompt is a second chance to say no.

Sources

Be first in line.

CalorieCounter is coming to the App Store for iPhone. Leave your email and you get the link the day it is live. One email, nothing else.