Is Cal AI Safe? What the 2026 Data Incident Means for AI Calorie Apps

Is Cal AI safe? Short answer: Cal AI has not confirmed a data breach. Multiple outlets reported in March 2026 that a hacker claimed to have exposed data belonging to over 3 million Cal AI users — that claim is unconfirmed by the company, so treat it as alleged, not settled fact.

A quick naming note

“Cal AI” functions more like a category description than a single trademark, and there are several similarly named calorie-counting apps across the App Store and Google Play. This article — and every report it cites — refers specifically to the app at calai.app, listed on the App Store as “Cal AI Calorie Tracker.” That’s the app that was acquired by MyFitnessPal and the one named in the reports below.

What was reported about Cal AI’s data?

On March 9, 2026, a hacker using the alias “vibecodelegend” posted a data dump on the forum BreachForums claiming to have compromised Cal AI’s backend, according to reports from Cybernews, SC Media, and Hackread. The claimed dataset totaled roughly 14.6GB across eight files and allegedly contained more than 3.2 million user records — reportedly including names, dates of birth, gender, email addresses, subscription details, physical stats like height and weight, and timestamped meal entries.

Cybernews reported that its research team reviewed a sample of the leaked data and found it “appeared legitimate.” SC Media and Hackread reported the same underlying claims, citing the threat actor’s own posts. As of this writing, neither Cal AI nor its parent company MyFitnessPal — which completed its acquisition of Cal AI on March 2, 2026, according to TechCrunch — has publicly confirmed the breach.

The reported root cause, per the attacker’s own claims as relayed by Cybernews and SC Media, was an unauthenticated Google Firebase backend that allegedly allowed the app’s entire subscription table to be read without credentials. That’s an allegation from the threat actor, not a confirmed technical finding from Cal AI or an independent audit.

A note on Cal AI’s pricing

Separately from the security reports, it’s worth knowing how Cal AI’s paywall works: it’s dynamic and A/B-tested, meaning different users can be shown different offers, typically built around a 3-day trial that requires entering a card upfront. Reported price points vary and aren’t independently verifiable, so we’re not citing a specific number here — check the current offer inside the app itself before subscribing.

What to Look for in an AI Nutrition App’s Privacy Practices

Whatever app you land on, a few checks apply regardless of brand:

• Does the privacy policy say plainly whether your data is sold, and to whom it’s shared?
• Is health data encrypted both in transit and at rest, not just described as “secure”?
• Does the app disclose which third parties — analytics, ad networks, AI providers — receive your data?
• Is the backend access-controlled, or has the company had reports of publicly readable databases?
• Can you actually delete your account and data on request, and does the policy say how?

A privacy policy that’s vague on these points, or missing entirely, is itself worth treating as a red flag — regardless of which app you’re evaluating.

Is Cal AI Safe Enough to Use Right Now?

This is the practical question that “is Cal AI safe” searches are usually really asking, and it doesn’t have a single yes-or-no answer. Cal AI itself hasn’t confirmed the reported Cal AI data breach, so there’s no official acknowledgment to point to — but unconfirmed isn’t the same as resolved. The claim came from a named threat actor citing specific numbers and technical detail, multiple outlets reviewed and reported on it independently, and neither Cal AI nor MyFitnessPal has published a statement disputing the specifics. That combination is why security researchers tend to describe reports like this as credible-but-unverified, rather than either confirmed or debunked.

Cal AI safety and Cal AI privacy are really two separate questions worth pulling apart. Safety, in the sense used above, is about whether the reported breach happened and whether Cal AI’s backend was genuinely misconfigured the way the attacker described. Privacy is a broader, ongoing question that applies regardless of whether that specific incident is ever confirmed: what does Cal AI’s own privacy policy actually say about selling data, sharing it with third parties, or how long it’s retained? That’s not something this article can answer on Cal AI’s behalf — it’s worth reading directly in Cal AI’s policy before deciding whether to trust it with health data.

That question isn’t unique to Cal AI, either. Any ai nutrition app privacy policy deserves the same scrutiny, because the category as a whole handles data most people would consider sensitive — what you eat, your weight and body stats, and sometimes health goals tied to medical conditions. An app being popular or well-reviewed doesn’t substitute for actually checking what its policy says about data sale, encryption, and account deletion. The checklist above applies to every app in this space, Trackbie included, not just the one this article is about.

If the uncertainty here is enough to make you want a Cal AI alternative while this gets sorted out, that’s a reasonable reaction to an unresolved report, not an overreaction. Trackbie is one option worth comparing directly, and not only on the logging side: it covers the same instant photo, voice, or text calorie and macro breakdown Cal AI does, then goes further with Plan My Day, which builds a full meal plan automatically from your real eating pattern, an AI health coach you can chat with about a plateau or a rough week, and Squads for accountability with people you actually know — none of which depends on the security question above being resolved one way or the other. See the full side-by-side on our Cal AI alternative page for exactly where the two apps overlap and where they don’t.

Whatever you decide, treat this as a live situation rather than a closed one. Unconfirmed breach reports sometimes get confirmed later, sometimes get quietly walked back, and sometimes never get an official answer either way. Checking back on official statements from Cal AI and MyFitnessPal directly, rather than relying on a single article’s snapshot of the story, is the more reliable approach.

Where this leaves you

If you’re weighing alternatives while this remains unresolved, Trackbie is one option worth a look — it covers the same photo, voice, and text calorie and macro breakdown, plus proactive planning through Plan My Day. We can’t speak to Cal AI’s security practices, and we’re not claiming ours is flawless either — but our own Privacy Policy states plainly what we collect, how it’s protected, and that we don’t sell your data. See the full feature comparison on our Cal AI alternative page. Whichever app you choose, the checklist above is the same either way.