Privacy Policy

Last updated: 2026-10-13

MACROcosm is a calorie and macro tracker that keeps your food diary on your device by default. This policy says what leaves the device, when, and what you can do about it.

What the app collects

You choose whether to sign in, and that choice decides almost everything below.

Device-only mode (no sign-in)

If you never sign in, your diary never leaves the device. Every entry, weigh-in, recipe, saved meal and preference lives in this browser's IndexedDB. There is no account, no sync, and no analytics.

Searching for a food is the exception, and it is the one thing worth knowing: see Food databases below.

If you clear this site's data, uninstall the browser, or switch devices, that history is gone. Settings → Data & sync → Export writes a JSON backup you can keep.

Signed-in mode (email and password)

Signing in stores the following on our server — Supabase Postgres, with Row-Level Security scoped to your user id:

• Account: your email address and an internal user id. Passwords are handled by Supabase Auth and are never visible to this app.
• Profile: height, birth year, sex if you gave one, activity level, units, appearance, reminder times, water target, any free-text diet notes.
• Diary: every logged food, quantity, meal, time, and whether you ate it at home, out, or as takeaway. Quick-added calories. Water.
• Body: weigh-ins, your goal and its rate, weekly check-ins.
• Yours to keep: recipes (including the method text you imported or wrote), saved meals, foods you created.
• Sync bookkeeping: timestamps used to reconcile writes across devices.

Row-Level Security is enforced per table at the database. Another signed-in user cannot read or write your rows.

What leaves the device, and where it goes

Food databases

When you search for a food that isn't already on the device, the words you typed are sent to our own endpoint, which queries the U.S. Department of Agriculture's FoodData Central on your behalf (the API key stays server-side). Scanning a barcode sends the barcode number the same way, and — if that misses — to Open Food Facts, directly from your device. Nothing about you is attached to either request beyond what any web request carries, and results are cached locally so the same food is never looked up twice.

The AI coach, described meals, and photos

These are optional, and each one sends something specific to Google's Gemini API through our backend:

• Coach: your message, plus the figures the coach asks for by tool call — days, totals, weights, targets. The coach screen shows what it requested.
• Describe a meal: the sentence you wrote.
• Photo of the plate: the photograph itself, plus any note you added. This is the only feature that sends an image anywhere.
• Recipe ingredients: the ingredient lines that couldn't be weighed locally — text only.

Google processes these requests under their API terms. No model is trained on your data. With no network, or no key configured, every one of these paths declines rather than guessing, and the rest of the app carries on working.

Importing a recipe from a link

The URL you paste is fetched by our own endpoint, because recipe sites don't allow a browser to read them directly. It returns text only — name, servings, cuisine, time, ingredient lines, method. No nutrition figure is ever taken from a web page.

Sign-in emails

Sign-in, confirmation and password-reset codes are emailed through Resend, which receives your email address and the code to deliver them.

Error reports (signed in only)

When something fails in the app — a sync that can't complete, a crash on a screen — a short report is saved to our own Supabase database: the error message and stack, the screen's address without any sign-in tokens, the app version, your browser or device type, and your user id. Nothing is sent to a third-party monitoring service.

Reminders

Reminders are scheduled on your device as local notifications. Nothing is sent to a server to deliver them.

What the app does not collect

• No third-party analytics — no Google Analytics, Mixpanel, or PostHog.
• No third-party crash or error monitoring SDK.
• No advertising, ad identifiers, or trackers.
• No location, contacts, or calendars.
• No camera or photo access beyond the one photo you choose to send.

Where your data lives

• On your device: IndexedDB, including your coach conversations, which are never uploaded, plus an auth session in localStorage when signed in.
• On the server: Supabase (Postgres, Auth, Edge Functions). AI requests transit Google's Gemini API; food lookups transit USDA FoodData Central and Open Food Facts.
• Hosting: Vercel serves the app at macrocosm.fitness/app.

What you can do

• Export. Settings → Data & sync → Export downloads every row as JSON.
• Import. The same screen restores from that file.
• Clear this device. Removes everything in this browser. A signed-in account re-downloads; a device-only one is gone.
• Delete the account. Account → Delete account removes the auth user and cascades to every row you own on the server. It is not reversible.

Retention

Rows persist until you delete them, delete your account, or clear local storage.

Children

MACROcosm is not directed at children under 13, and calorie targets are not appropriate for them. Do not create an account for a child under 13.

Changes

Material changes show up in the "Last updated" date above and, where they matter, in the app.

Contact

Questions: open an issue at github.com/hguha/tracker-apps/issues, or see Support. To delete everything, use Account → Delete account in the app; it removes your account and every row of it from the server.