Privacy Policy & Consumer Health Data Notice

1. Information We Collect

We collect the following categories of information to operate TrackMacros:

• Account & identity: name, email address, password hash, and authentication identifiers. If you sign in with Apple or Google, we receive the identifiers, name, and email (including any Apple private-relay email) those services share.
• Health & sensitive data: body measurements (weight, height, body-fat, age, sex), activity level, nutrition goals, meals and nutrition entries, weight history, and any self-reported conditions you mention to AI Coach. We treat this as consumer health data, including inferences we derive from it.
• Connected-device & health-app data (Withings, Apple Health): if you connect Withings, we retrieve weight, body-fat, and selected activity measurements, along with the connection tokens and identifiers needed to sync them. If you allow Apple Health access, the app reads active energy, step count, body weight, body-fat percentage, and workouts. It requests read access only and never writes to Apple Health. You choose which of those types to share, and you can change or revoke that access at any time in the Health app. We use Apple Health data to show your daily steps in the app, and as part of the connected-device context we send to OpenAI to answer your AI Coach messages, described in Section 5. We do not use Apple Health or connected-device data for advertising or marketing, do not share it with third parties for those purposes, and the app excludes Apple Health values from what it sends to our analytics provider.
• Photos: meal photos you submit for AI analysis, meal photos you choose to save, and any profile photo you upload.
• Audio & transcripts: voice recordings you make to log meals are sent to a transcription provider and converted to text. Voice dictation for AI Coach may be processed either on your device or, depending on platform and mode, by a cloud transcription provider.
• AI Coach messages & memory: the messages you send to AI Coach, the responses generated, and memory or summaries derived from your conversations to personalize future responses.
• Purchases & subscriptions: subscription status, product identifiers, transaction identifiers, and related records received from Apple or Google. Payment card details are handled by the app stores and are not collected by us.
• Notifications: push notification tokens and your notification preferences.
• Device, usage & diagnostic data: app and website interactions, screen and feature events, and request timing, status, and error information.
• Website analytics: when you visit our website, our analytics provider (Vercel Analytics) collects usage information. See Section 7.
• Support, security & rights requests: the contents of messages you send us and the records we keep to respond to them.
• Medical reports: the current app and website do not provide a medical-report upload workflow. See Section 12 for the dormant backend capability under review.

2. Sources of Information

We collect information directly from you, automatically from your device and app activity, from Apple and Google when you use their sign-in services, from the app marketplaces for purchases, from Withings and Apple Health when you connect them, and from the service providers that help us operate TrackMacros.

3. How We Use Information

We use your information to create and secure your account; log meals and calculate nutrition totals; transcribe voice input; analyze meal photos; generate AI-assisted coaching responses; set and track goals and dashboards; send reminders and notifications; sync connected devices; process subscriptions; provide support; send product research emails if you have turned them on; maintain reliability and security; and comply with legal obligations.

4. Consumer Health Data

We treat your nutrition, meal, body-measurement, goal, weight, connected-device, and self-reported condition data — and the inferences we draw from it — as consumer health data. We collect it from the sources in Section 2 and use it for the purposes in Section 3. We share categories of this data only with the service providers described in Section 6 to deliver the features you request.

You can withdraw consent and exercise your rights as described in Section 10 and on our Privacy Choices page. Requests other than in-app account deletion are handled manually by email.

The current product code has no advertising integration and does not send consumer health data to an advertising service.

5. AI and Transcription

AI Coach is an automated AI system, not a person or a healthcare professional, and it can produce incomplete or inaccurate information. To answer your AI Coach messages, we send your message and relevant profile, goal, meal, weight, and connected-device context to OpenAI. When you use meal-photo analysis, your photo is sent to OpenAI and/or Google Gemini to estimate foods and nutrition. Voice recordings for meal logging are sent to OpenAI (Whisper) and converted to text.

We have not verified provider-specific training or retention terms, so we make no promise about those practices here.

6. Service Providers We Share Data With

We share limited information with the service providers that help us run TrackMacros. The categories of providers we currently use are:

• Cloud hosting & infrastructure: Fly.io (application hosting); Amazon Web Services S3 (photo storage, when a storage bucket is configured).
• AI & transcription: OpenAI (AI Coach and voice transcription); Google Gemini (meal-photo analysis).
• Authentication: Apple; Google.
• Connected devices: Withings. Apple Health is a source we read from on your device, not a provider we share your data with; the values we read from it are included in the connected-device context described in Section 5.
• Analytics: PostHog (app); Vercel Analytics (website).
• Email: a transactional email service, used over SMTP to send verification and password-reset messages; and, if you have turned on product research emails, a third-party email delivery provider that delivers those messages under a written data protection agreement. See Section 8.
• Nutrition lookups: USDA FoodData Central and Open Food Facts (we send only the food or barcode query, not your identity or profile).

We also rely on infrastructure providers that host our database, cache, and application logs.

7. Website Analytics

Our website uses Vercel Analytics to understand aggregate usage. You can opt out of website analytics, and we honor Global Privacy Control (GPC) signals from your browser. See our Privacy Choices page for details.

8. Product Research Emails

If you turn them on, we may email you to ask what you think of TrackMacros: what helps, what gets in the way, and what would make it better. That may be a short set of questions, an invitation to talk to us, or simply a reply to the email. These emails are optional and off unless you turn them on. They are separate from your account and your subscription, and declining changes nothing about what you can do in the app.

Our lawful basis for sending them is your consent. You can withdraw that consent at any time in the app under Profile → Communication Preferences, and every research email we send also carries a way to unsubscribe. Withdrawing stops future emails; it does not undo emails already sent.

Research consent is not marketing consent. Turning on research emails does not sign you up for product announcements, feature news, promotions, subscription offers, or a newsletter, and it is not consent to receive them. Those are a separate choice, and neither choice implies the other. We do not sell your email address, and we do not share it with anyone for their own marketing.

To send a research email we use your email address, and to decide whether it makes sense to contact you at all we use account information such as how long ago you signed up and roughly how much you have used the app. Your meals, your weight, your other health data, and anything you have written to AI Coach are never included in these emails and are never sent to the company that delivers them.

The email itself is delivered by a third-party email delivery provider acting on our instructions under a written data protection agreement. It handles delivery and nothing else, and does not use your address for its own purposes.

Because this is a consent, we keep a record of it: the choice you made, when you made it, which version of the notice you saw, and the screen you made it on. We keep that record as evidence that the choice was made, including after you delete your account — but detached from you, with the identifiers that link it back to your account removed. The record is evidence that a choice happened, not a way to contact you.

The full notice is published at /legal/product-research-emails/2026-09-09. It is versioned: if we change it in a way that affects what you agreed to, we will publish a new version and ask you again rather than rely on your previous answer.

9. Data Retention and Deletion

We have not established a single retention period that applies to every category of data. Temporary voice recordings made for meal logging are removed from your device after transcription or cancellation and when the app launches or you sign out.

You can delete your account in the app (Profile → Sign-in & Security → Delete Account). Deleting your account invokes the backend account-deletion operation and removes stored profile-photo objects. We do not claim that this immediately removes every related record or every copy held by a service provider. For a request concerning another data category, contact us for manual handling.

10. Your Choices and Rights

You may ask us to access, correct, provide a copy of, or delete personal data, or to withdraw a prior consent. We honor Global Privacy Control (GPC) signals on our website.

To turn product research emails off, go to Profile → Communication Preferences in the app, or use the unsubscribe link in any research email. To delete your account, go to Profile → Sign-in & Security → Delete Account in the app. For all other requests, see our Privacy Choices page or email trackmacros.app@gmail.com from your account email address. These requests are handled manually.

11. Children and Teens

TrackMacros is intended for users aged 13 and older. Users younger than 13 may not create or use an account, and we do not knowingly offer TrackMacros to children younger than 13. When an eligible user uses TrackMacros, including a user who is 13 through 17, we collect and process the nutrition, weight, health-profile, AI Coach message, meal-photo, and related information described in this Policy based on the features the user chooses to use. If you believe a child younger than 13 has provided information through TrackMacros, contact us using the email address in Section 15. Requests are handled manually.

12. Medical-Report Capability Under Review

The current TrackMacros app and website do not provide a medical-report upload workflow. The backend contains dormant authenticated medical-report endpoints, but whether that capability will be retained or removed is unresolved and tracked in backend issue #31. We do not describe this as an available product feature. Any future release is conditional on resolving that issue and completing the required implementation work.

13. Security

We use reasonable technical and organizational measures to protect personal data, but no method of transmission or storage is completely secure.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we publish a change, we will update the date above.

15. Contact

For privacy questions or requests, contact ZenPulse Labs LLC at trackmacros.app@gmail.com.