Privacy Policy

Feedback and support

When you submit feedback, we store its category, title, description, any reproduction details you enter, platform, app version and build, account link, submission reference, and timestamps. OS version and device model are included only when you enable the optional technical details. We do not automatically attach tracking history, health data, photos, device names, stable device identifiers, or application logs. Please avoid including passwords or unnecessary personal or health information in your message.

Your submissions and their status are visible only to you and authorized Site Admins. Admin priority, private notes, and review audit records are available only to Site Admins. You may separately allow follow-up at your existing account email; no email is sent automatically. Feedback submissions are not sent to AI providers, friends, analytics payloads, a public tracker, or an external ticketing service. Feedback and associated review records remain while your account exists and are removed from the live database on account deletion. Historical backups follow the operator's backup retention and rotation; deletion must be reapplied after a backup restore. Deleting an administrator's account removes their actor link without deleting another user's feedback.

Referral rewards

We record referral codes, the referring relationship, gift dates, earned rewards and verified store payment/refund events to operate the program. Referral activity shown to other users is anonymous and contains no health data or payment details. On account deletion, account identifiers are removed from retained referral records; email and transaction digests remain to prevent repeat gifts and duplicate rewards. Unused rewards are lost when the account is deleted.

Information we process

Account information includes your email address, password-derived credential, rotating session records, single-use password reset records, and account identifiers. If you choose Google sign-in on Android, Google verifies your identity and we store your Google account identifier and verified email to connect your account. Your Google password is never shared with Macro Tracker, and Google sign-in does not grant access to tracking or health data. Your synchronized app state includes your onboarding profile, nutrition targets, saved foods, food logs, body measurements such as weight and body fat percentage, and daily activity summaries such as steps, active calories, distance, exercise time, and workout count.

If you explicitly connect a supported system health service and grant its permissions, the app reads only the health categories you approve. Imported weight and daily activity summaries become part of your synchronized Macro Tracker state. The integration does not write data to the health service. Connection preferences and health permission controls remain on the device.

If you use Circle, we process your chosen display name and optional profile photo, friendship and invitation records, sharing preferences, blocks, reports, preset encouragement, buddy challenges, private personal challenge targets, and derived progress snapshots. Your display name and profile photo are visible to mutual friends and intended invitation recipients. Friends receive only the general progress categories you enable. For a nutrition challenge, the other participant receives only successful-day counts; for a weight challenge, they receive only normalized percentage progress and whether you reached your target. Your exact challenge targets, weights, calorie or macro totals, food items, meal photos, body measurements, email, and raw app state are not shared through Circle.

If you request a photo estimate or revision, the selected image and any feedback you add are sent through the Macro Tracker server to its AI provider. If you request a text or voice meal proposal, the description or in-memory recording and resulting transcript are sent to the AI provider. The reference server does not save image files, photo feedback, recordings, submitted descriptions, or transcripts. Operational metadata such as request time, status, model, provider request identifier, token counts, and estimated provider cost may be retained to enforce allowances and prevent abuse.

If you subscribe, your app marketplace processes the purchase. RevenueCat associates store subscription status and one-time AI purchases with your Macro Tracker account identifier and provides product, entitlement, expiration, and store-management information. Macro Tracker does not receive your payment-card details. The API stores purchase transaction identifiers, quantities, refund status, and AI credit usage to maintain your extra-use balance.

Authorized Site Admins can review account identity, subscription status, verified purchase amounts and currencies, refunds, and recorded store offer or referral codes for billing support and business reporting. The billing ledger does not contain health records or payment-card details. Account links in billing events and role audit entries are removed when the account is deleted.

For a missing barcode, the server checks live Open Food Facts and may send the barcode to OpenAI for web search. No food log, health information, or account state is included in this recovery request. Recovered product details and source URLs are stored as an account-owned proposal that is available for review for 24 hours. Expired proposals are removed on your next proposal creation, and all your proposals are removed on account deletion. Only explicit approval publishes the reviewed product details and sources to the shared catalog. Shared product records remain after account deletion with the approving account link removed.

New custom foods have community sharing enabled by default, which you can turn off before saving. Opted-in food details become searchable after account sync without your account identity or food log. Existing private foods require opt-in. Turning off sharing or removing a saved custom food withdraws its catalog listing on the next sync. Site administrators can review and manage all synced custom submissions, including private ones, but cannot publish private submissions. Admin edits affect catalog results without changing saved foods or log snapshots. Deleted submissions retain a moderation record to prevent republication by later syncs. Account deletion removes your custom submissions and their moderation records.

Omi integration

If you connect Omi, your linked Omi account can add food entries and request answers about your synchronized food log and current goals. Omi receives the requested tool results. Relevant meal descriptions, saved foods, nutrition records, and goals are sent to the configured AI provider for the requested logging or answer. The server stores your Omi connection, timezone, and completed request receipts to prevent duplicate logging. Disconnecting revokes access and removes pending linking requests; completed receipts remain with your Macro Tracker account to prevent old requests from logging again after reconnection. Account deletion removes all Omi connections and receipts.

How information is used

We use this information to authenticate accounts, synchronize devices, calculate and display tracking trends, search the hosted food catalog, provide requested AI estimates, verify subscription access, meter trial and paid feature allowances, operate private Circle features, prevent abuse, respond to reports, and maintain service security.

Service providers

Infrastructure providers process data needed to host the API and PostgreSQL database. The configured transactional email provider processes your email address and single-use reset link only when you request a password reset. OpenAI processes images, photo feedback, typed meal descriptions, voice recordings, and transcripts submitted for requested AI food estimates under the configured service account. RevenueCat processes account identifiers and store subscription status. Your app marketplace processes store purchases. USDA FoodData Central receives generic-food search terms, and the separately hosted Open Food Facts-derived catalog receives branded-food and barcode search terms; those food sources do not receive your account state.

Retention and deletion

Account and synchronized data are retained while your account exists. Session, metering, subscription-status, and operational records may expire or be removed as part of service maintenance. Image files, photo feedback, voice recordings, submitted descriptions, and transcripts are not retained by the reference server. You can leave Circle without deleting tracking data, or permanently delete the account in the app. Account deletion removes the login, synchronized state, sessions, AI and barcode usage records, subscription-status cache, profile photo, and associated Circle records from the application database. Store subscription cancellation is managed separately through your app marketplace account.

Macro Munch arcade leaderboards are optional and separate from health sharing. The friends board uses mutual Circle friendships and Circle names; the global board shows a separately chosen public player name and game score. Each board requires an explicit opt-in in the arcade. We store account bests, temporary run tickets, and friend comeback prompts. Completed runs are verified from game inputs. Run tickets expire after 24 hours. Discovery is saved per account. If you enable comeback push notifications, we store a device token and delivery receipts and send the friend’s Circle name and game score through Expo and Apple or Google notification services. Push participation is separate from leaderboard participation. You can disable push notifications, leave either board immediately, report player names, block players, or delete your account to remove arcade records.

Your choices

You can stop future health imports, manage health permissions in system settings, export tracking state, change Circle sharing fields, remove friends, block accounts, report concerns, leave Circle, or delete the account in the app. Disconnecting a health integration does not silently delete records already imported; clear tracking data or delete the account to remove synchronized imports. Circle is optional and currently limited to adults age 18 and older.

Security and accuracy

Credentials are hashed or stored as opaque-token hashes on the server, and native session credentials use the device’s secure credential store. No system is perfectly secure. Nutrition databases and AI estimates can be wrong; Macro Tracker is not medical advice.

Account deletion

See account deletion instructions to delete your account in the app or request deletion without the app.

Contact

Questions, privacy requests, and safety concerns can be sent to support@reciplan.pro.