Privacy Policy & Consumer Health Data Notice

1. Information We Collect

We collect the following categories of information to operate TrackMacros:

• Account & identity: name, email address, password hash, and authentication identifiers. If you sign in with Apple or Google, we receive the identifiers, name, and email (including any Apple private-relay email) those services share.
• Health & sensitive data: body measurements (weight, height, body-fat, age, sex), activity level, nutrition goals, meals and nutrition entries, weight history, and any self-reported conditions you mention to AI Coach. We treat this as consumer health data, including inferences we derive from it.
• Connected-device data (Withings): if you connect Withings, we retrieve weight, body-fat, and selected activity measurements, along with the connection tokens and identifiers needed to sync them.
• Photos: meal photos you submit for AI analysis, meal photos you choose to save, and any profile photo you upload.
• Audio & transcripts: voice recordings you make to log meals are sent to a transcription provider and converted to text. Voice dictation for AI Coach may be processed either on your device or, depending on platform and mode, by a cloud transcription provider.
• AI Coach messages & memory: the messages you send to AI Coach, the responses generated, and memory or summaries derived from your conversations to personalize future responses.
• Purchases & subscriptions: subscription status, product identifiers, transaction identifiers, and related records received from Apple or Google. Payment card details are handled by the app stores and are not collected by us.
• Notifications: push notification tokens and your notification preferences.
• Device, usage & diagnostic data: app and website interactions, screen and feature events, and request timing, status, and error information.
• Website analytics: when you visit our website, our analytics provider (Vercel Analytics) collects usage information. See Section 7.
• Support, security & rights requests: the contents of messages you send us and the records we keep to respond to them.
• Medical reports: the current app and website do not provide a medical-report upload workflow. See Section 11 for the dormant backend capability under review.

2. Sources of Information

We collect information directly from you, automatically from your device and app activity, from Apple and Google when you use their sign-in services, from the app marketplaces for purchases, from Withings when you connect it, and from the service providers that help us operate TrackMacros.

3. How We Use Information

We use your information to create and secure your account; log meals and calculate nutrition totals; transcribe voice input; analyze meal photos; generate AI-assisted coaching responses; set and track goals and dashboards; send reminders and notifications; sync connected devices; process subscriptions; provide support; maintain reliability and security; and comply with legal obligations.

4. Consumer Health Data

We treat your nutrition, meal, body-measurement, goal, weight, connected-device, and self-reported condition data — and the inferences we draw from it — as consumer health data. We collect it from the sources in Section 2 and use it for the purposes in Section 3. We share categories of this data only with the service providers described in Section 6 to deliver the features you request.

You can withdraw consent and exercise your rights as described in Section 9 and on our Privacy Choices page. Requests other than in-app account deletion are handled manually by email.

The current product code has no advertising integration and does not send consumer health data to an advertising service.

5. AI and Transcription

AI Coach is an automated AI system, not a person or a healthcare professional, and it can produce incomplete or inaccurate information. To answer your AI Coach messages, we send your message and relevant profile, goal, meal, weight, and connected-device context to OpenAI. When you use meal-photo analysis, your photo is sent to OpenAI and/or Google Gemini to estimate foods and nutrition. Voice recordings for meal logging are sent to OpenAI (Whisper) and converted to text.

We have not verified provider-specific training or retention terms, so we make no promise about those practices here.

6. Service Providers We Share Data With

We share limited information with the service providers that help us run TrackMacros. The categories of providers we currently use are:

• Cloud hosting & infrastructure: Fly.io (application hosting); Amazon Web Services S3 (photo storage, when a storage bucket is configured).
• AI & transcription: OpenAI (AI Coach and voice transcription); Google Gemini (meal-photo analysis).
• Authentication: Apple; Google.
• Connected devices: Withings.
• Analytics: PostHog (app); Vercel Analytics (website).
• Email: a transactional email service, used over SMTP to send verification and password-reset messages.
• Nutrition lookups: USDA FoodData Central and Open Food Facts (we send only the food or barcode query, not your identity or profile).

We also rely on infrastructure providers that host our database, cache, and application logs.

7. Website Analytics

Our website uses Vercel Analytics to understand aggregate usage. You can opt out of website analytics, and we honor Global Privacy Control (GPC) signals from your browser. See our Privacy Choices page for details.

8. Data Retention and Deletion

We have not established a single retention period that applies to every category of data. Temporary voice recordings made for meal logging are removed from your device after transcription or cancellation and when the app launches or you sign out.

You can delete your account in the app (Profile → Sign-in & Security → Delete Account). Deleting your account invokes the backend account-deletion operation and removes stored profile-photo objects. We do not claim that this immediately removes every related record or every copy held by a service provider. For a request concerning another data category, contact us for manual handling.

9. Your Choices and Rights

You may ask us to access, correct, provide a copy of, or delete personal data, or to withdraw a prior consent. We honor Global Privacy Control (GPC) signals on our website.

To delete your account, go to Profile → Sign-in & Security → Delete Account in the app. For all other requests, see our Privacy Choices page or email trackmacros.app@gmail.com from your account email address. These requests are handled manually.

10. Children and Teens

TrackMacros is intended for users aged 13 and older. Users younger than 13 may not create or use an account, and we do not knowingly offer TrackMacros to children younger than 13. When an eligible user uses TrackMacros, including a user who is 13 through 17, we collect and process the nutrition, weight, health-profile, AI Coach message, meal-photo, and related information described in this Policy based on the features the user chooses to use. If you believe a child younger than 13 has provided information through TrackMacros, contact us using the email address in Section 14. Requests are handled manually.

11. Medical-Report Capability Under Review

The current TrackMacros app and website do not provide a medical-report upload workflow. The backend contains dormant authenticated medical-report endpoints, but whether that capability will be retained or removed is unresolved and tracked in backend issue #31. We do not describe this as an available product feature. Any future release is conditional on resolving that issue and completing the required implementation work.

12. Security

We use reasonable technical and organizational measures to protect personal data, but no method of transmission or storage is completely secure.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we publish a change, we will update the date above.

14. Contact

For privacy questions or requests, contact ZenPulse Labs LLC at trackmacros.app@gmail.com.