Privacy Policy
Last updated: August 12, 2026 · Effective: August 12, 2026
This Privacy Policy describes how the MacroHeal mobile application ("App") collects, processes, and stores data from its users. The App is developed and operated by Yukokunoshi.
1. Data We Collect
1.1. Data You Provide
| Data | Purpose | Storage |
|---|
| Email, password | Account, authentication | Firebase Auth |
| Username, country, age, gender, height, weight | Calorie/macro calculation | Device + Firebase |
| Target weight, activity level | Goal setting | Device + Firebase |
| Food logs, water, macros | Daily tracking | Device (SQLite) + Firebase |
| Weight history | Weight chart | Device |
| Profile photo (optional) | Display | Device |
1.2. Automatically Collected
- Device type, OS version (Crashlytics, 90 days)
- Crash reports (Crashlytics, 90 days)
1.3. Permission-Based
- Camera — food photos / barcode
- Gallery — uploading photos
- Notifications — reminders
- Health Connect (Android) / HealthKit (iOS) — steps, calories, weight (optional)
- Microphone — voice search (during recording only)
2. Third-Party Services
| Service | Data | Purpose |
|---|
| Firebase (Google) | Identity, profile, logs | Auth + Cloud |
| Anthropic Claude API | Meal, product label and supplement photos | AI analysis (not stored) |
| USDA FoodData Central | Food search queries | Nutrition DB |
| Open Food Facts | Barcode queries | Product info |
| Resend | Email | OTP verification |
| RevenueCat | Anonymous device ID, purchases | Subscription |
| Google Sign-In | Email, name | Social login (optional) |
| Apple Sign-In (iOS) | Anonymous email, name | Social login (optional) |
Important: Photos sent to the Claude API are not stored for model training. They are deleted after the result is returned.
3. Use Purposes
- Account creation and authentication
- Personalized calorie/macro goals
- Tracking nutritional habits
- AI food analysis
- Diagnosing crashes/performance
- Premium subscription management
- Legal compliance
We never sell, rent, or share your data for advertising.
4. Security
- Data encrypted with AES-256 on Firebase
- Local data in device's secure storage
- Passwords hashed with bcrypt
- All server traffic over TLS 1.2+
5. Retention
- Active account: Retained while active
- Inactive account: Anonymized after 24 months of inactivity
- Account deletion: Permanently deleted within 30 days of request
6. Your Rights (GDPR)
- Know if your data is processed
- Access your data (request a copy)
- Rectify inaccurate data
- Erasure (right to be forgotten)
- Restrict processing
- Data portability
- Object to automated decision-making
In-app: Profile → Delete Account · Other requests: privacy@macroheal.app
7. Children
Not designed for users under 13 years old.
8. International Transfers
Data may be stored on Google Cloud servers (EU or US). For EU users, Standard Contractual Clauses (SCC) apply.
9. Changes
Significant changes will be announced via in-app notification.
10. Contact
Yukokunoshi
Email: privacy@macroheal.app