Your food log stays yours.
This policy explains what stays on your device, what is sent to services you choose to use, and how to make a privacy request.
Information stored on your device
Food logs, saved foods and meals, goals, body profile, and weight entries are stored in the app's protected container on your device. They are not uploaded to our servers. Delete them with the app's in-app controls or by deleting the app. A device backup is controlled by your device and Apple settings.
Packaged-food search and barcode lookup
When you search online or scan a barcode, the search text or barcode and standard request metadata, including your IP address, are sent to our Cloudflare Worker. The Worker queries Open Food Facts and USDA FoodData Central. Responses may be cached for up to 24 hours. We do not send an account identifier with these requests, and no account is required.
The food-search service also keeps sampled operational logs for about 10% of requests. These logs can include the request URL (the search text or barcode), the IP address, and a coarse location derived from that IP address. We keep them for up to 7 days, for reliability and abuse prevention. These logs are not linked to any sharing profile.
Optional sharing circle
Anyone with your invite link can connect until it expires after 7 days or you revoke it. Creating an invite again shows the same valid link. To replace a link, revoke it in Sharing settings, then create another. Revoking a link prevents new connections; remove existing people separately to end their access.
Sharing is optional and off by default. When you turn it on, the app sends your chosen display name, optional daily goals, and today’s daily totals (calories, protein, carbs, fat, and number of entries) to our Convex backend so connected people can see them. You choose separately for each person whether they see Nothing, Macros, or Macros + Foods; viewers see today only. With Macros + Foods, today’s logged foods are also sent, including each food’s name, amount, calories, protein, carbs, and fat. Logged time, notes, photos, and barcodes are never sent. Foods are uploaded only while you share them with at least one person, are deleted from the server when you stop sharing foods, and older days are deleted. You can stop sharing with everyone, remove a person, or delete your sharing profile at any time; deleting the profile removes your stored totals and foods.
Shared totals are linked to your sharing profile (your display name and a device-generated key), which makes them pseudonymous.
The backend stores a random device-generated profile key, your chosen display name, and a secret verifier (not your secret itself), plus profile creation, update, and deletion timestamps. Daily snapshots contain the day, time-zone identifier, optional daily goals, calories, protein, fat, carbs, entry count, and update time.
To support invitations and access, it also stores invitation token hashes, status, expiry and acceptance timestamps, and the relevant profile references; relationship profile references, pair key, creation and removal timestamps; and sharing grant profile references, relationship, sharing scope, start/end days, and start/end timestamps.
A connection works while at least one of the two people has MACROS Pro, and creating an invite requires Pro. To confirm Pro, the app sends Apple’s signed purchase record to our server; it contains Apple transaction IDs, not personal data.
You can remove people, stop sharing, or delete your sharing profile in Settings. Profile deletion removes associated snapshots, shared foods, invitations, relationships, grants, and purchase links, and tombstones the profile key to prevent reuse. Apple purchase records (transaction IDs, product, dates, and refund status) are kept after deletion so a refunded purchase cannot be used again; they contain no name or contact details.
Apple Health and purchases
Writing nutrition to Apple Health is available to everyone and requires your permission. Importing weight from Apple Health requires MACROS Pro and your permission. Health data stays on your device and is never transmitted to us.
Apple handles purchases. The app receives purchase entitlement status so it can provide the features you bought. We do not receive your payment card details.
Reminders
Reminders are scheduled as local notifications on your device. Reminder content and schedules are not sent to our servers.
Website forms and Cloudflare logs
If you join the waitlist, we store your email address. If you submit a support request, we store your name, email address, and message to respond to you. These form submissions are stored in Cloudflare D1 for 12 months and then deleted.
Cloudflare processes standard request data, such as IP address and browser/request details, in its logs to deliver and protect the website. Log retention is subject to Cloudflare's operational and security practices.
We do not use analytics SDKs or advertising trackers on the website or in the app.
Children
MACROS is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the website.
Your choices and deletion requests
You can use MACROS without creating an account, decline optional search, sharing, or Health features, and manage or delete app data in the app. For deletion of website form submissions or privacy questions, contact us through the support page. We will use the email address and information you provide to locate and handle the request.