Your food log stays yours.

Information stored on your device

Food logs, saved foods and meals, goals, body profile, and weight entries are stored in the app's protected container on your device. They are not uploaded to our servers. Delete them with the app's in-app controls or by deleting the app. A device backup is controlled by your device and Apple settings.

Food search and barcode lookup

As you type a food search, the app sends search text to our Cloudflare Worker to fetch results alongside your on-device matches. Barcode lookup sends the barcode. These requests include standard metadata, including your IP address. The Worker queries Open Food Facts and USDA FoodData Central. No account is required, and the app sends no account identifier with these requests.

The Worker caches search results by normalized query, source, and page: USDA results for up to 24 hours, Open Food Facts results for up to one hour, and empty results for up to five minutes. Barcode responses may be cached for up to 24 hours. The service’s search summary logs record result counts, source contributions, and skipped sources, not the search text.

The food-search service also keeps sampled operational logs for about 10% of requests. These logs can include the request URL (the search text or barcode), the IP address, and a coarse location derived from that IP address. We keep them for up to 7 days, for reliability and abuse prevention. These logs are not linked to any sharing profile.

Optional sharing circle

Anyone with your invite link can connect until it expires after 7 days or you revoke it. Creating an invite again shows the same valid link. To replace a link, revoke it in Sharing settings, then create another. Revoking a link prevents new connections; remove existing people separately to end their access.

Sharing is optional and off by default. When you turn it on, the app sends your chosen display name, optional daily goals, and today’s daily totals (calories, protein, carbs, fat, and number of entries) to our Convex backend so connected people can see them. You choose separately for each person whether they see Nothing, Macros, or Macros + Foods; viewers see today only. With Macros + Foods, today’s logged foods are also sent, including each food’s name, amount, calories, protein, carbs, and fat. Logged time, notes, photos, and barcodes are never sent. Foods are uploaded only while you share them with at least one person, are deleted from the server when you stop sharing foods, and older days are deleted. You can stop sharing with everyone, remove a person, or delete your sharing profile at any time; deleting the profile removes your stored totals and foods.

Shared totals are linked to your sharing profile (your display name and a device-generated key), which makes them pseudonymous.

The backend stores a random device-generated profile key, your chosen display name, and a secret verifier (not your secret itself), plus profile creation, update, and deletion timestamps. Daily snapshots contain the day, time-zone identifier, optional daily goals, calories, protein, fat, carbs, entry count, and update time.

To support invitations and access, it also stores invitation token hashes, status, expiry and acceptance timestamps, and the relevant profile references; relationship profile references, pair key, creation and removal timestamps; and sharing grant profile references, relationship, sharing scope, start/end days, and start/end timestamps.

A connection works while at least one of the two people has MACROS Pro, and creating an invite requires Pro. To confirm Pro, the app sends Apple’s signed purchase record to our server; it contains Apple transaction IDs, not personal data.

You can remove people, stop sharing, or delete your sharing profile in Settings. Profile deletion removes associated snapshots, shared foods, invitations, relationships, grants, and purchase links, and tombstones the profile key to prevent reuse. Apple purchase records (transaction IDs, product, dates, and refund status) are kept after deletion so a refunded purchase cannot be used again; they contain no name or contact details.

Apple Health and purchases

Writing nutrition to Apple Health is available to everyone and requires your permission. Importing weight from Apple Health requires MACROS Pro and your permission. Health data stays on your device and is never transmitted to us.

Apple handles purchases. The app receives purchase entitlement status so it can provide the features you bought. We do not receive your payment card details.

Reminders

Reminders are scheduled as local notifications on your device. Reminder content and schedules are not sent to our servers.

Website forms and Cloudflare logs

If you join the waitlist, we store your email address. If you submit a support request, we store your name, email address, and message to respond to you. These form submissions are stored in Cloudflare D1 for 12 months and then deleted.

Cloudflare processes standard request data, such as IP address and browser/request details, in its logs to deliver and protect the website. Log retention is subject to Cloudflare's operational and security practices.

Website analytics

The website uses Cloudflare Web Analytics to count visits and measure page speed. Cloudflare adds a script from static.cloudflareinsights.com to our pages. The script sends the page address, the referring site, and page load timings to the /cdn-cgi/rum address on our own domain. Cloudflare uses that request to report your country, browser, operating system, and device type in aggregate.

Cloudflare says it does not use cookies or localStorage for this, and does not track visitors over time by IP address, user agent, or fingerprinting. We see aggregate visit counts and page performance, not individual visitors. We do not use this data for advertising. Cloudflare describes what it collects and its privacy approach in its own documentation. An ad blocker can stop the script.

The app has no analytics SDK or advertising tracker. Analytics apply to the website only.

Children

MACROS is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the website.

Your choices and deletion requests

You can use MACROS without creating an account, decline optional search, sharing, or Health features, and manage or delete app data in the app. For deletion of website form submissions or privacy questions, contact us through the support page. We will use the email address and information you provide to locate and handle the request.