Privacy Policy
MacroSync is a nutrition and workout tracker available at www.macrosync.co.uk. This policy explains what personal data the service collects, why, where it is stored, who it is shared with, and how you can get it back or have it deleted.
The short version. Your logs, measurements and any health data you choose to sync are private to your account. We do not sell personal data, we do not use it for advertising, and we do not show it to other users unless you deliberately post it to the community feed. You can delete your account, and everything in it, at any time.
1. Who is responsible for your data
MacroSync is operated by an individual developer based in the United Kingdom, acting as the data controller for the purposes of the UK GDPR. Contact: james@rattu.co.uk.
2. What we collect
Only what the app needs to work. There is no advertising or tracking network in MacroSync.
| Category | What it includes | Why |
|---|---|---|
| Account | Email address, and — if you sign in with Google — your Google display name and profile picture. | To create and secure your account and to sign you in. |
| Profile | Display name, optional bio and avatar image. | Shown to other users on your profile, posts and comments. |
| Body and goal data | Age, sex, height, weight, activity level, goal, and your calorie and macro targets. | To calculate and display your daily targets. Private to you. |
| Logs | Food entries, weight entries, saved foods, workout routines and completed sessions. | The core function of the app. Private to you, except routines you mark public. |
| Community content | Posts, comments, reactions, follows, and images you upload to posts. | Visible to other signed-in users. This is the only data you publish by design. |
| Google Health data | Steps, active calories, distance, sleep duration and exercise duration — only if you connect it. See section 4. | Shown on your Progress page. Private to you. |
| Technical | Standard server logs kept by our hosting providers, such as IP address and request time. | Security, abuse prevention and diagnosing faults. |
MacroSync does not use advertising cookies or third-party analytics. The only browser storage used is what is needed to keep you signed in.
3. Legal bases for processing
- Contract — account, profile, logs and targets: we cannot provide the service without them.
- Consent — Google Health data, which is special category health data. You choose to connect it, and you can withdraw at any time by disconnecting.
- Legitimate interests — keeping the service secure, preventing abuse, and moderating community content.
4. Google user data
Signing in with Google
If you sign in with Google we receive your email address, name and profile picture, solely to create and identify your account.
Google Health
Connecting Google Health is entirely optional. You can skip it during sign-up, add it later, or never use it — the rest of MacroSync works exactly the same either way.
If you connect it, we request these read-only permissions:
googlehealth.activity_and_fitness.readonly— steps, active calories, distance and exercise sessions.googlehealth.sleep.readonly— sleep duration.
We request read access only. MacroSync cannot create, change or delete anything in your Google Health account.
Limited Use. MacroSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, health data obtained through Google APIs:
• is used only to display your own figures back to you inside MacroSync;
• is never sold, and never used for advertising or profiling;
• is never transferred to third parties except as needed to run the service, or where the law requires it;
• is not read by any human, except with your explicit consent, to resolve a security issue, or where the law requires it.
How the connection is secured
The access and refresh tokens that authorise the connection are held server-side and are not readable by any browser — including yours. Database access rules make the token table unreadable to every ordinary user of the system. Only the server components that perform the sync can use them.
Administrators of MacroSync can moderate community content and delete accounts, but have no access to any user's health data.
Disconnecting
Go to Settings → Google Health → Disconnect. This revokes MacroSync's authorisation with Google immediately, and you will be asked whether to delete the health figures already synced or keep them. You can also revoke access from your Google account permissions page.
5. Who your data is shared with
We do not sell personal data. We use these processors to run the service:
- Supabase — database, authentication and file storage, hosted in the EU (Stockholm).
- Vercel — application hosting and content delivery.
- Google — sign-in and, if you connect it, the Google Health API.
- Open Food Facts — food and barcode lookups. Search terms are sent through our server; your identity is not.
- GIPHY — GIF search, if you open the GIF picker. Search terms are sent through our server; your identity is not.
Exercise demonstration images are loaded from a public CDN (jsDelivr) serving the open-source Free Exercise DB. As with any image request, that CDN sees your IP address.
We may also disclose data where we are legally required to, or to protect the rights and safety of users.
6. International transfers
Your account and logs are stored in the European Union. Some providers listed above may process data outside the UK and EU; where they do, transfers rely on the safeguards those providers put in place, such as standard contractual clauses.
7. How long we keep it
- While your account exists — your profile, logs, community content and any synced health data.
- On disconnecting Google Health — tokens are deleted immediately; synced figures are deleted too if you choose that option.
- On deleting your account — everything you own is deleted, including posts, comments, routines, logs, uploaded images and health data.
- Server logs — kept for a short period by our hosting providers for security and diagnostics.
8. Your rights
Under the UK GDPR you have the right to:
- access a copy of your personal data;
- have inaccurate data corrected — most of it is editable in Settings;
- have your data erased;
- restrict or object to processing;
- data portability;
- withdraw consent for Google Health at any time, without affecting anything else.
To exercise any of these, email james@rattu.co.uk. You also have the right to complain to the Information Commissioner's Office.
9. Security
All traffic is encrypted in transit. Access to your records is enforced at the database level by row-level security rules, so one user's account cannot read another's private data. OAuth tokens are isolated as described in section 4. No system is perfectly secure, but we aim to hold health and body data to a higher standard than the rest of the app.
10. Children
MacroSync is not intended for children. The app requires an age of 13 or over, and we do not knowingly collect data from anyone younger. If you believe a child has an account, contact us and we will remove it.
11. Changes to this policy
If this policy changes materially — particularly regarding health data — we will update the date at the top and, where the change is significant, notify you in the app.