Privacy Policy
This policy explains what Macronaut ("the App", "we", "us") collects, why, who it is shared with, and what you can do about it. Macronaut is a macro-tracking app: you scan food, log meals, track weight and supplements, plan meal preps, manage a pantry, and use optional AI features.
1. Who we are
Macronaut is published by HFP Consulting AB, registered in Sweden, which is the data controller for the processing described here. Contact: [email protected].
2. What we collect
2.1 Account
Your email address, or the account identifier supplied by Google or Apple if you use those sign-in options. Passwords are handled entirely by our authentication provider and are never visible to us.
2.2 Health-adjacent information you enter
Sex, age, height, weight, optional body-fat percentage, activity and training level, goal (lose, maintain or gain), dietary style, food allergies and intolerances, weight check-ins over time, and the supplements in your stack. Under GDPR some of this is data concerning health, so it is treated as a special category and processed only on your explicit consent.
2.3 Food, meal and kitchen data
Barcodes you scan, the products returned, the meals and quantities you log with their calories and macros, water intake, meal prep plans and schedules, pantry contents, grocery lists, and your favourites and personal food library.
2.4 Photographs
The App can use your camera, and with your permission your photo library, for three things: scanning barcodes, photographing a nutrition or supplement label, and optionally photographing a meal so the AI can estimate its portion size. Barcode frames are processed on your device and never leave it. Label and meal photographs are transmitted to our AI provider for a single analysis and are not retained as images by us afterwards.
2.5 Subscription information
If you subscribe to PRO, our payments provider records that a purchase exists, its status and renewal date, and a pseudonymous identifier linking it to your account. We never receive your card number or billing address — the transaction happens entirely inside the App Store or Google Play.
2.6 Sign-in security
To stop automated sign-up abuse, the sign-in screen runs a bot check. That check receives your IP address and basic device and browser signals. It is used only to decide whether the request looks automated.
2.7 Technical information
Basic app and OS version information, and server logs kept by our hosting provider which may include IP addresses for a limited period for security and debugging. We do not use any advertising SDK, third-party analytics, tracking pixel or attribution tool. We do not build advertising profiles and we do not track you across other apps or websites.
2.8 Notifications
Meal, supplement and weigh-in reminders are scheduled locally on your own device. They are not delivered through a push server, so no reminder content reaches us.
3. Why we process it, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account email or sign-in identifier | Creating your account, authenticating you, syncing across devices | Performance of a contract, Art. 6(1)(b) |
| Body metrics, goals, weight history, allergies | Calculating calorie and macro targets, showing your trends, avoiding foods you cannot eat | Explicit consent, Art. 9(2)(a) |
| Food logs, pantry, meal preps, groceries | Delivering the tracking features themselves | Performance of a contract, Art. 6(1)(b) |
| Label and meal photographs | Reading nutrition values or estimating a portion, once per photo | Consent, given per scan by taking the photo |
| Data sent to the AI features | Producing the coaching, recipe, micronutrient and estimate outputs you asked for | Explicit consent, Art. 9(2)(a), by choosing to run the feature |
| Subscription status | Unlocking and maintaining PRO | Performance of a contract, Art. 6(1)(b) |
| IP and device signals at sign-in | Preventing automated abuse of sign-up | Legitimate interests, Art. 6(1)(f) — keeping the service usable |
| Server and security logs | Diagnosing faults, investigating abuse | Legitimate interests, Art. 6(1)(f) |
Where we rely on consent you may withdraw it at any time by turning off the relevant feature, deleting the data, or deleting your account. Withdrawal does not affect processing already carried out. Where we rely on legitimate interests you may object; see section 7.
We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use your health data for marketing.
4. The AI features, specifically
Several optional features send data to our AI provider, Anthropic, to generate a result. This is worth stating precisely, because it involves health-adjacent information and not only photographs:
- Label and supplement scanning sends the photograph you took.
- Meal estimates send your description of the meal and, if you added one, the photograph.
- Recipe suggestions send your pantry contents, dietary style and any allergies, so suggestions do not contain something you cannot eat.
- The nutrition coach sends recent daily calorie and macro totals, the names of foods you logged, your supplement list, your targets and goal, your recent weight history, and your allergies and dietary constraints.
- Vitamin and mineral analysis sends the names and quantities of foods you logged over the period analysed.
- Daily message and grocery suggestions send summary figures such as your streak, recent average intake and pantry contents.
These calls are made only when you actively use the feature. Anthropic processes the request to return a result and, under our commercial terms, does not use it to train its models. If you would rather no health-adjacent data reached an AI provider at all, do not use these features — every other part of the App works without them.
5. Who else processes your data
We keep the list short deliberately. Each of these is a processor acting on our instructions, or an independent controller where noted:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, authentication, and the server functions the App calls | EU / US |
| Anthropic | The AI model behind the features listed in section 4 | US |
| RevenueCat | Manages subscription state and entitlements. Receives a pseudonymous account identifier and purchase status, never payment details | US |
| Apple, Google | Payment processing for subscriptions, app distribution, and optional sign-in. Independent controllers for their own processing | Global |
| hCaptcha (Intuition Machines) | Bot detection at sign-in; receives IP and device signals | US / EU |
| Expo | Build and delivery of app updates | US |
| Cloudflare | Hosting for this website | Global |
| Public food databases | Barcode lookups: Open Food Facts, Open Beauty Facts, Open Products Facts, USDA FoodData Central, UPCitemdb, go-upc, Icecat and FoodRepo. They receive the barcode number only — never your identity or your logs | Various |
We may also disclose data where we are legally required to, or to establish or defend a legal claim. If the business is ever sold or merged, your data may transfer with it, and you would be told before that took effect.
6. Retention and deletion
We keep your data for as long as your account exists. You can delete the account yourself at any time from Profile → Delete Account. Deletion is immediate and cascades: your profile, targets, food logs, weight history, favourites, food library, meal preps, pantry, grocery lists, supplements and reminders are removed, and the authentication record itself is destroyed. We keep no shadow copy. Encrypted infrastructure backups may retain fragments for a short rolling window before being overwritten.
Deleting your account does not cancel a subscription. Subscriptions belong to Apple or Google and must be cancelled there, or they continue to renew.
How to delete or export your data7. Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. In the EEA, UK and Switzerland these are rights under the GDPR; in California and several other US states there are comparable rights, including the right not to be discriminated against for exercising them.
Most of this you can do yourself inside the App by editing your profile, deleting individual entries, or deleting the account. For anything else, email [email protected]. We answer within 30 days and will not charge you.
If you think we have handled your data badly, please tell us first — but you may also complain to your data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).
8. International transfers
Some providers above are based in the United States, so your data may be processed outside your own country. Where that involves personal data leaving the EEA or UK, the transfer relies on the European Commission's Standard Contractual Clauses and the UK Addendum, together with the safeguards those providers commit to.
9. Security
Data is encrypted in transit with HTTPS and at rest by our infrastructure providers. Access is restricted at the database level so that each account can reach only its own rows. Administrative access is limited to what is necessary to run the service. No system is perfectly secure and we cannot guarantee absolute security, but if a breach affects your data and the law requires it, we will notify you and the relevant authority.
10. Children
Macronaut is not intended for children. You must be at least 16, or older if your country sets a higher age of digital consent. We do not knowingly collect data from anyone below that age; if we learn that we have, we delete it. Calorie tracking is not appropriate for children and adolescents without professional supervision.
11. Health disclaimer
Macronaut produces estimates for general information. It is not a medical device and does not provide medical, dietary or nutritional advice, diagnosis or treatment. Nutrition values, AI-generated content, calorie targets and micronutrient figures may be inaccurate or incomplete. Speak to a qualified professional before changing your diet, particularly if you are pregnant or breastfeeding, have a medical condition, take medication, or have a history of disordered eating.
12. This website
This site sets no advertising or analytics cookies and does not profile visitors. If you join the waitlist we store the email address you submit, use it once to tell you the App has launched, and delete it after that or whenever you ask.
13. Changes
If this policy changes we update the date above. For changes that materially affect you, we will also give notice in the App before they take effect.
14. Contact
HFP Consulting AB, Sweden · [email protected]