Macro CorePrivacy Policy
Who we are
Macro Core is made and run by an independent developer in Reykjavík, Iceland (“we”). We are the controller of your personal data. Contact: support@macrocore.app.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: your Sign in with Apple identifier, an account ID, and the email Apple shares with us (this can be a private relay address) | To create and secure your account and sync your data | Contract (GDPR art. 6(1)(b)) |
| Year of birth, sex, height, activity level, goals | To calculate your calorie and macro targets | Contract and your explicit consent (art. 9(2)(a)) |
| Health and fitness logs: weight, body measurements, food and nutrients, workouts, fasting times | To store and sync your history across your devices | Your explicit consent (art. 9(2)(a)) |
| Your stack: supplements, medications, hormones or peptides you log, with doses, schedules, notes and side-effect ratings | Same | Your explicit consent. Encrypted on your phone before upload; we cannot read any of it. |
| Progress photos (only if you turn on photo sync) | To keep your photos safe in your account | Your explicit consent (art. 9(2)(a)). Encrypted on your phone before upload; we cannot view them. The key is kept in your iCloud Keychain and in a recovery key you can save. If you lose both, nobody, including us, can recover your photos. |
| Beta waitlist: your email address and the time you signed up (on macrocore.app) | To send you a beta invite and tell you when the app launches | Your consent (art. 6(1)(a)). Kept until the app launches, then deleted, or sooner if you ask. |
| Support emails | To answer you | Legitimate interest (art. 6(1)(f)) |
| Technical logs (IP address, request times, errors) | Security and fixing problems; kept 30 days | Legitimate interest (art. 6(1)(f)) |
We do not sell your data, use it for advertising or marketing, build advertising profiles, or use tracking or analytics tools. We don't use your health data for anything except running the app for you.
Who processes data for us
We use these service providers, under data processing agreements that require them to protect your data and use it only on our instructions:
- Supabase Inc. (USA): database, file storage and sign-in. Your data is stored in its EU region in Frankfurt, Germany (Amazon Web Services). Supabase's sub-processors are listed at supabase.com/legal/customer-resources/subprocessor-list.
- Cloudflare, Inc.: hosts this website and stores the beta waitlist in its EU region.
- Apple: Sign in with Apple and, if you subscribe, payments. Apple acts under its own privacy policy.
Food searches and barcode scans are sent from your phone to Open Food Facts (France) and USDA FoodData Central (USA) to look up nutrition data. Only the search text or barcode and your IP address reach them.
Where Supabase or its sub-processors access data from outside the EEA, the transfer is protected by the EU Standard Contractual Clauses.
How long we keep it
As long as your account exists. Records you delete are removed after 30 days. When you delete your account, your data is deleted from our live systems immediately and from backups within 7 days. If you don’t use your account for 24 months, we’ll show a notice in the app and delete it 3 months later unless you sign in. Support emails: 12 months.
Security
Data is encrypted in transit and at rest, the database only lets each account read its own data, and progress photos and stack names and notes are end-to-end encrypted. If a breach affecting you is likely to cause high risk, we will tell you without undue delay.
Your choices and rights
In the app you can view and edit your data, export all of it (Settings > Export), turn photo sync off at any time (your photos are then deleted from our servers and kept only on your phone), and delete your account (Settings > Account > Delete account). Because storing your health data is how the app works, withdrawing that consent means deleting your account. Withdrawing consent doesn't affect processing before you withdrew it.
You also have the right to access, correct, delete, restrict or object to processing, and to data portability. Email support@macrocore.app and we'll answer within one month. You can complain to the Icelandic Data Protection Authority, Persónuvernd (www.personuvernd.is), or your local authority.
Age
Macro Core is for adults 18 and over. We delete accounts we learn belong to anyone younger.
This website
macrocore.app uses no cookies, analytics or third-party scripts. If you join the beta waitlist, we store only your email and the time. Our host, Cloudflare, processes your IP address to deliver the page and protect it from attacks.
Changes
We'll show important changes in the app before they take effect, and ask for your consent again where the law requires it.