Privacy Policy

Version: VERSION · Effective date: EFFECTIVE DATE Controller: LEGAL ENTITY NAME, REGISTERED ADDRESS Privacy officer: the founder, reachable at privacy@zmacros.com Data protection officer: Not appointed

Security reports: security@zmacros.com

1. The short version

• ZMacros is a calorie, macro and weight tracker. We treat your diary, weight, year of birth, workouts, targets and any pregnancy or breastfeeding setting as health information.
• You can use ZMacros without an account. Your diary then stays on your phone, though the app still goes online for things like food searches, barcode lookups, route maps, your subscription and free-plan ads (section 5). With an account, your logs sync to our servers.
• We do not sell your personal information or use your health, food, weight, location or photo data for advertising. Free-plan ads are non-personalised.
• You choose whether to send a meal photo for the AI to read, and turn on usage records.
• You can see, correct, export and delete your data in the app (section 10).

2. What we collect and why

This policy applies wherever you live. The Regional Supplements add local rights. Washington, Nevada and Connecticut health-data rules are in the Consumer Health Data Privacy Policy.

"Device" below means the app's private storage on your phone. Other apps cannot read it, and uninstalling removes it. We add no encryption of our own on top of your phone's, so use a passcode. "Our servers" means our database, hosted by Supabase on Amazon Web Services in the United States. Each account can read only its own rows, apart from what section 5 describes.

Your phone's own backup (iCloud on iPhone) may include data and photos ZMacros stores on your phone, depending on your backup settings. Apple handles those backups under its own terms. On a new phone, sign in and your synced data comes back; data you never synced may be lost if you delete the app.

2.1 Your account

The app signs you in with email and password. Our website dashboards for staff let you sign in with Google or Apple, which gives us your name and email from that provider, or with a 6-digit code we email you. Our sign-in provider, Supabase, sends and checks the code. We do not ask for a phone number.

We send account emails only, such as sign-in links, password resets and notices of important changes. No marketing email; if that ever changes, we will ask first and every email will have a one-click unsubscribe.

2.2 Your body and goals

2.3 What you eat

To fill in a food's figures, you can photograph its nutrition label. The app reads the label's text on your phone with Google's ML Kit text recognition. The photo stays on your phone and is deleted once read; it is not sent to us or to any AI service.

2.4 Your activity

Apple Health and Health Connect are optional and use your phone's own permission screen. ZMacros reads only the types you allow, never writes to them and does not use what it reads for ads. To disconnect, use Settings → Health → Data Access & Devices → ZMacros on iPhone, or Health Connect → App permissions → ZMacros on Android. ZMacros has no direct link to Fitbit, Garmin, Strava or other services, but may read their data from Apple Health or Health Connect.

Location is used only while you record an activity you started, including with the screen off, which is why your phone may show "background location". This is the same for users under 18. To draw the route map, the app loads map images from Apple Maps on iPhone (Google Maps on Android), which receives the map area, your IP address and device details. An export includes each route's exact start and end points, so take care when sharing it. We do not combine people's routes into heatmaps.

Your Today background, profile photo and Recently eaten thumbnails stay on your phone. If you use Animated cards, your phone finds shapes in your Today background and cuts out part of it, using Apple's own image tools on iPhone; the cut-outs are saved next to the photo. Nothing is sent to us or to any AI service. We do not upload or export these images.

2.5 Subscriptions

Apple or Google takes payment; we never see your card. When the app starts, it contacts RevenueCat, which tracks your plan. RevenueCat receives a random ID (your account ID once you sign in, never your name or email), your platform, app version and IP address, and the purchases the store reports. We keep your plan status and purchase events on our servers. The terms you agreed to at purchase stay on your phone.

Your purchase country. The store tells us the country or region of the Apple or Google account you bought with. We use it to set your plan's price level and monthly scan allowance, and check it again at each renewal (Terms of Service 6.4). We keep it with your plan status.

2.6 Coaches

ZMacros has no coaching features in this version, so no coach can see your data.

2.8 Support and feedback

Feedback and bug reports you send in the app are kept with the app area, app version, device type and system version, linked to your account so we can reply. If you are signed out, they wait on your phone until you sign in. If you email us, we keep the email and our reply. We keep each piece of feedback or bug report for up to 2 years after its last activity (a change you or we make, our reply, a note or a status change), then delete it with its notes and history.

2.9 Safety and security records

We keep:

• any suspension or ban and its reason;
• a log of changes staff make in our support tools;
• counts of your AI scans and searches for fair-use limits, and flags for unusual scan volumes that staff review;
• records of sign-in attempts, forced sign-outs and security alerts;
• a salted, one-way hash of the network address used to sign up, for one day;
• if a suspended or banned account is deleted, a hash of its email (section 9).

When you start a rewarded ad, the app sends a random install ID from your phone's secure storage, so one phone cannot collect unlimited ad credits. Our server keeps only a salted, one-way hash. The ad-credit hash is deleted with your account. On iPhone the ID can survive an uninstall.

2.10 In-app analytics and crash reports

Analytics is off until you turn it on in Settings → Privacy and consents, and offered only in the countries listed in the Regional Supplements. Elsewhere, or if we cannot tell your country, nothing is recorded. If on, we record, linked to your account, with the app version, your phone type and the date and time:

• that you opened the app and whether the last session closed unexpectedly;
• that you logged a food (not what it was or how much);
• that you saved a meal scan, whether you edited it and by what percentage the calories changed;
• that you closed the plans screen, at which step, from which feature, and whether you bought or restored a plan;
• that you sent feedback or a bug report, and its type;
• once, which onboarding screens you reached and how often you left the app on each. This is kept only on your phone during onboarding and sent only after you turn analytics on. It holds none of your answers. Screens that would say something about you (the age check, your state or province, a referral code) are never noted.

Analytics never records what you ate, your weight, body measurements, workouts, location, photos or the content of anything you write. Analytics goes to no analytics company. Turning it off stops new recording; events already recorded are deleted after 13 months or with your account.

Crash reports. The app sends no crash or error reports today. The only exception is the yes-or-no note above that the last session closed unexpectedly, sent only with analytics on.

2.11 Storage on your phone, and our website

The app uses no cookies. It keeps your diary, settings, consent choices, purchase terms and the record of your edits and picks (section 2.3) in its private storage, and your sign-in session and install ID in secure storage. RevenueCat's code stores an app user ID and purchase details there.

Google's ML Kit code, which reads label text on your phone, sends Google technical usage reports (device and app details, performance and error codes, and an ID for the installation), not the photo or its text.

Google's ad code stores and reads information on your phone to show and count ads. In the EEA, UK and Switzerland, Google's consent message asks you first, before any ad loads; if you say no, you see limited ads that use no identifier stored on your phone. Analytics runs only if you turn it on in Settings → Privacy and consents.

zmacros.com sets no cookies and uses no analytics or tracking. Our website dashboards keep your sign-in session in your browser's storage.

3. AI photo scanning

The AI Features Notice has the detail.

• What is sent. The app sends your meal photo (up to 3 per scan) to our server, which sends it to OpenAI to identify the foods and estimate amounts. Location and camera details are removed first. We add only any note you typed, which meal it is, roughly what time, your country (two letters, such as "US", never a state or region) and up to 8 names of foods you log often, taken from our public food database (never foods you created, and never past photo results). No name, email or account ID. Nothing extra is stored.

• What is kept. We do not store or log the photo. A photo taken with the in-app camera is deleted from your phone after the scan, apart from a small thumbnail for Recently eaten. We ask OpenAI not to store it, but OpenAI may keep it up to 30 days to check for misuse, and longer if the law requires or its safety systems flag it. OpenAI does not train on our requests, and we have not opted in to let it. The AI's list of foods, with no image, is kept about 15 minutes in case your connection drops.

• No training of language models. We do not collect, use or sell personal data to train large language models.

• Permission and age. Scanning is for adults. The app does not offer it under 18, and our server checks your year of birth again. Before your first scan the app asks your explicit permission, naming OpenAI and the 30 days. Withdraw it in Settings → Privacy and consents.

• Corrections. If you change what the AI suggested, we save its suggestion and your change (food, brand, amount, confidence, preparation, any uncertainty) to your account. No image, and not sent to OpenAI. We use them to check and improve how scanned foods are matched to our food database, not to train AI models. This is part of your scan permission: if you withdraw it, no new corrections are saved, and you can ask privacy@zmacros.com to delete the ones we have.

• Country checks. To follow sanctions and OpenAI's supported countries, our server checks your app's country setting and your IP address's country before a scan, and uses the IP address in memory for rate limits. We do not store it, though our host's request logs may.

4. Legal bases

Where the law requires one (for example the GDPR and UK GDPR):

Do you have to give us your data? No law requires you to. To use the tracker you must accept "Store my food, weight and activity"; without it the app cannot keep a diary. The app asks your year of birth to apply the age rules and cannot be used without it. Syncing needs an account, which needs your email. Everything else (AI scans, health apps, analytics) is optional, and the rest of the app works without it.

5. Who can see your data

• You. Your account reads only its own rows.

• Our staff. Support tools show your account ID, display name, account status and feedback, not your diary, weight, workouts or location. Staff changes in these tools are logged. Staff can give you a badge, for example for testing the app or reporting a bug. People with administrator access to our database can technically reach all data and use it only to run, repair and secure ZMacros, or when the law requires.

• Service providers in section 6.

• Authorities, where the law requires. We will tell you unless the law forbids.

• A buyer of ZMacros or our company, who must follow this policy. We will tell you before a different policy applies.

We do not sell your personal information or share it for cross-context behavioural (targeted) advertising. No data broker receives it.

Advertising

• The free plan shows small ads marked "Ad" and optional rewarded ads that earn AI scans, from Google AdMob. Premium has no ads.
• Ads are non-personalised for everyone. We do not show Apple's tracking prompt or read your advertising ID.
• Google's ad code receives what it needs to show and measure ads, such as your IP address and device details. We do not send it your health, food, weight, body, location or photo data.
• We block ads for weight loss, diets, supplements, cosmetic surgery, alcohol, gambling, tobacco and dating. For users under 18 we limit ads to Google's lower content ratings and tell Google the user is a minor. If we do not know your age, we show no ads.
• In the EEA, UK and Switzerland, Google's consent message asks for your consent before any ad loads (section 2.11).
• After a rewarded ad, Google confirms it to our server with a one-time code, not your account ID, and we add the credit. Credits have no cash value.

6. Service providers and other parties

Details are in the Sub-processors list. Each service provider below works on our instructions under a contract that requires it to protect your data at least as well as this policy does.

Under their own terms, these also receive data when you use a feature: Open Food Facts (text searches and, when your phone asks directly, barcodes, with your IP address); USDA FoodData Central (search words from our server, which does not store them); Apple Maps or Google Maps (route maps); Google (AdMob ads, and ML Kit usage reports from the label reader); Apple and Google (downloads, purchases, health-app permissions, and dashboard sign-in).

These parties receive only the data described here. We send none of them your health data. Each party handles what it receives under its own privacy policy.

7. International transfers

Our providers mainly process data in the United States, and some server functions run in the region nearest you. Where the law restricts transfers (for example from the EEA, UK, Switzerland, Brazil, Quebec or Türkiye), we use the standard contractual clauses in each provider's data processing agreement, with the UK Addendum and Swiss changes, and the clauses other countries require. For a provider certified under the EU-US Data Privacy Framework (or its UK or Swiss versions) we may rely on that instead; the Sub-processors list says which. Ask privacy@zmacros.com for a copy of the safeguards.

8. How long we keep it

9. Deleting your account

Settings → Account → Delete my account deletes your account straight away, with no recovery period. It removes your logs, custom foods, AI corrections, usage counts, subscription records we hold and analytics, and clears your profile. What stays:

• Audit records for 7 years (section 8), to defend legal claims and prevent fraud (GDPR Art. 17(3)(e) and 9(2)(f), and similar rules elsewhere).

• Feedback you sent, with your account ID removed. If you wrote personal details in it, ask us to delete it.

• A ban marker, only if your account was suspended or banned: a salted, one-way hash of your email with the type, reason and region of the action. It holds no name, account ID or health data, and it blocks nobody automatically.

• Backups at our host, until they are overwritten on its regular backup cycle, within 7 days. We never restore data from a backup without first deleting again everything that was deleted after that backup was made.

• Other companies' records. Apple, Google, RevenueCat, Resend and OpenAI keep their own under their terms. Meal photos reach OpenAI without your name, email or account ID, so we cannot ask it to find yours; it keeps them up to 30 days, longer if flagged or required by law.

Deleting your account does not cancel a subscription; cancel it in the App Store or Google Play first. Without the app, or if your account is suspended, email privacy@zmacros.com from your account's address (see zmacros.com/delete-account) and we will delete it or send you your data.

10. Your rights

Wherever you live, you can:

• see and export your data in Settings → Data & Privacy → Export my data. The file covers your phone's data (diary, weights, workouts, routes, the record of your edits and picks) and some server records (consents, products you added), not everything. For a full copy, email privacy@zmacros.com;
• correct it in the app, and delete it (section 9);
• withdraw consent in Settings → Privacy and consents, without affecting what was done before;
• object to or restrict our use of it, and complain to us or a regulator.

We reply within one month (45 days under US state laws) and tell you if we need longer where the law allows. We may check the account is yours. Using your rights will not change how we treat you. Settings → Data & Privacy → Your privacy rights lists them. The Regional Supplements add local rights and appeals.

11. Children

ZMacros is for people 16 and over; 18 in many countries and when we do not know your country; 20 in Thailand. The Terms Regional Supplements list ages by country. The app asks your year of birth and refuses younger people. AI scanning and the fasting timer are adults only. If we learn we hold data of someone under the minimum age, we delete it. Where 16 and 17-year-olds may join, they confirm a parent or guardian agreed; we record this and the wording version on the phone, and on our servers once they have an account. Under-18s get safer target limits and no fasting timer. Parents can email privacy@zmacros.com.

12. Security

Everything the app sends uses encrypted connections (HTTPS). Database rules limit each account to its own rows. Our staff tools show no health data and log every change. Our host encrypts stored data. If a breach affects you, we will tell you and the authorities as the law requires. Report security problems to security@zmacros.com.

13. Automated decisions

ZMacros works out your targets and estimates automatically. They are suggestions you can change and have no legal or similar effect. AI scanning has automatic limits: a cool-down or a pause until tomorrow for unusually heavy use, and a stop when your plan's monthly allowance is used up, until it resets at the start of the next calendar month (UTC). Your plan's price level and monthly allowance are set automatically from the country of the store account you bought with. Staff set longer scan pauses (24 hours, 7 days, then until review). These limits affect scanning only. A person decides any suspension or ban. Ask us to review a limit at support@zmacros.com.

14. Changes

Before a material change takes effect we will tell you in the app, and by email if you have an account, and ask for consent again where the law requires. Ask privacy@zmacros.com for earlier versions.

15. Contact and complaints

LEGAL ENTITY NAME, REGISTERED ADDRESS, privacy@zmacros.com. You can also complain to your data protection authority; the Regional Supplements name them.

EU Digital Services Act. Our single point of contact for users and for EU authorities is support@zmacros.com, in English.