What MacroTrackr does with your data, in plain words.

Your account: your email address and password (stored hashed, never in plain text), or your name and email if you sign in with Google.

Your profile: first name, sex, age, height, weight, activity level, goal, target weight, chosen pace, diet and excluded foods, unit system, language and time zone.

Your log: the meals you record (name, calories, macros, nutrients, ingredients, notes), the meal photos you send, your weigh-ins and your hydration.

Your progress: XP, levels, streaks, badges, pinned meals and routines. If you use the friends league: your list of friends, and your first name and weekly XP, visible to them only. Your friends never see your weight or your meals.

Your subscription: your Stripe customer ID, your subscription status and end date. MacroTrackr never sees or stores your card number.

Technical data: your IP address (to limit abuse), error reports, and internal usage events tied to your account (for example “meal logged” or “subscription started”) used to understand and improve the product.

Your weight, height, age, sex and what you eat may be health data. MacroTrackr only processes them with your explicit consent, asked with a checkbox when you sign up. The date of that consent and the version of the wording you agreed to are recorded.

They are used only to calculate your targets, show your tracking and analyse the meals you submit. They are never sold, never used for advertising and never shared with an insurer, an employer or an advertiser.

You can withdraw your consent at any time by deleting your account from your profile: all of this data is then erased.

Running the service (account, log, targets, history, sync across devices): performance of the contract formed when you create an account.

Processing your health data: your explicit consent (GDPR article 9).

Analysing a meal photo or description with AI: performance of the contract, only when you ask for it.

Managing your subscription and payments: performance of the contract, and legal obligations to keep accounting records.

Protecting the service (abuse limits, bot checks, error detection): legitimate interest in keeping MacroTrackr safe and available.

Measuring traffic on the public pages of the site, anonymously and without cookies: legitimate interest in understanding what visitors are interested in.

Sending a few onboarding emails (at most three when you start, and your league's weekly recap if you have friends): legitimate interest. Every email contains an unsubscribe link.

MacroTrackr relies on providers who only receive what they need for their task, and who act on MacroTrackr's behalf.

Supabase: database, authentication and photo storage. Servers in Ireland (European Union).

Vercel: hosting of the site and the application server. United States.

Google (Gemini API): analysis of the meal photos and descriptions you submit, to estimate what they contain. United States.

Stripe: payment and subscription management. Ireland and United States.

Resend: sending emails. United States.

Sentry: error reports, configured not to send personal data. Germany (European Union).

PostHog: anonymous, cookieless traffic measurement on the public pages. European Union.

Upstash: request rate limiting, based on IP address and account ID, kept for the length of the limit window (one minute to one day).

Cloudflare (Turnstile): bot checks on sign-in and sign-up. United States.

Google (sign-in): if you choose “Continue with Google”.

Open Food Facts: when you search for a food or scan a barcode, the text or code is sent from our servers, without your identity or IP address. France.

Voice input uses your browser's built-in speech recognition: depending on the browser (for example Chrome), the audio may be processed by its vendor, under its own terms.

When data is transferred outside the European Union, those transfers are covered by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework, depending on the provider.

Your account, profile and log data and your photos are kept for as long as your account exists.

When you delete your account, they are erased immediately and permanently, photos included, and your subscription is cancelled.

Stripe keeps payment data for as long as its legal obligations require. Error reports are kept for a limited time at Sentry, then deleted automatically.

If you unsubscribe from emails, that preference is kept for as long as your account exists, so it is respected.

MacroTrackr only uses strictly necessary cookies: those for your sign-in session and the one that remembers your language. They do not require consent.

No advertising or third-party tracking cookies are used. Traffic measurement on the public pages works without cookies.

Your browser also keeps a few preferences locally (light or dark theme) and the draft of your sign-up, so nothing is lost if you reload the page. That data stays on your device.

You can access your data, correct it, erase it, get it back in a reusable format, object to some processing, ask for it to be restricted, and withdraw your consent at any time.

Two of these rights are self-service in your profile: exporting all your data (a ZIP of CSV files) and deleting your account. You can correct your profile directly in the app.

For everything else, write to support@macrotrackr.app. You will get an answer within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

Traffic to MacroTrackr is encrypted (HTTPS), passwords are never stored in plain text, photos sit in private storage reachable only through temporary links, and each account can only reach its own data.

MacroTrackr is for people aged 16 and over. Weight-loss goals are not offered under 18.

This page may change as the product evolves. The last update date is shown at the top. For a significant change, you will be told in the app or by email.