MacroRun Privacy Policy

1. The short version

• Accounts are optional. You can use MacroRun without an account ("Continue without an account"). If you choose, you can sign in with Apple or Google. Unless you turn on backup, your profile, meal log, workouts, saved foods, and achievements stay on your device.
• Cloud backup is optional and off by default. If you turn on "Back up my data to my account", we store a copy of your app data on our server so you can restore it. You can turn it off, or delete your account in the app, at any time.
• Photo and typed meal estimates are sent through our server to xAI only after you allow it, so we can estimate protein, carbs, fat, and kcal. We do not keep the photo.
• Location is used only when you open or refresh Nearby, and only if you allow it.
• Our server keeps a small scan counter (a random device ID and a salted hash of your IP address) so the free scan limit works.
• Usage analytics are optional and off by default. We record them only if you say yes on the analytics consent screen, and you can turn them off at any time.
• We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not track you across other companies' apps or websites.

2. Information that stays on your device

Unless you turn on cloud backup (section 3c), your profile, meal log, workouts, saved foods, and achievements are stored only on your device. We do not receive them. Deleting the app, or clearing MacroRun's data on your device, removes them. If you haven't backed them up, we can't recover them for you.

3. Information we collect and why

a. Meal photos and typed meal descriptions (only after you allow it). When you allow it, leftover photos, plated-meal photos, fridge photos, and typed meal descriptions are sent through our server to our estimator (xAI Grok) so we can identify food and estimate protein, carbs, fat, and kcal. Fridge photo scans also send your remaining calories, protein, carbs, and fat for today, so the estimator can suggest meals that fit them. We do not keep the photo after the estimate. We keep only a hash of the photo (a fingerprint that can't be turned back into the photo) in server memory, not in our database, for up to 30 days so the same photo is not billed twice. That hash is deleted when it is 30 days old, and sooner if the server process ends. We do not use those photos or descriptions for ads. For a typed meal, only your text (up to 400 characters) and our fixed instructions are sent to xAI from our server; no photos, profile details, account or device identifiers, or IP address are sent with it. Our server uses your IP address only briefly in memory, to limit how often requests can be sent. Empty or unreadable photos are not stored as a meal. You can withdraw that permission in Profile, under Photo estimates, with Turn off. Please avoid including faces, documents, or other personal details in food photos.

b. Account and sign-in (optional). You can sign in with Apple or Google, or choose "Continue without an account". We do not offer email-and-password sign-in. If you sign in, we store: your email address (if you use Apple's Hide My Email, we store the relay address Apple gives us); whether the email address is verified; your name (Apple does not share it with us, so it is empty for Apple sign-in; for Google it is the name on your Google account); your Google profile picture link (Google only); which service you used; and the user ID that Apple or Google gives us for MacroRun. Each time you sign in, we also create a session that stores a sign-in token, its expiry time, your IP address, and your device's user agent (basic app and device software details). Sessions last up to 7 days. We do not store Apple or Google ID tokens or refresh tokens. We use this information only to sign you in, keep you signed in, link your backup to you, keep accounts secure, and reply to your requests.

c. Cloud backup (optional, off by default). If you are signed in and turn on "Back up my data to my account", the app sends a copy of your profile, weigh-ins, meal log, workouts, saved foods, goals, streaks, settings, and badges to our server. It is stored in our database (hosted on Neon) through our server (hosted on Vercel), so you can restore it on a new or reset device. Backup does not include photos. We use the backup only to store and restore your data for you. If you turn backup off, we delete the copy on our server.

d. Camera, photo, and notification access. If you allow camera access (iPhone: the Camera permission; Android: the Camera permission), MacroRun uses the camera to take meal and fridge photos and to scan barcodes. Photos you pick from your library come through the system photo picker, which shares only the photos you choose. Barcode scanning happens on your device. On Android, barcode scanning uses Google's ML Kit, which processes the camera image on the device and does not send it to Google. ML Kit does send Google basic diagnostics and usage metrics (such as device model, app version, performance data, and a per-installation identifier) to maintain and improve ML Kit. On iPhone, barcode scanning uses Apple's built-in camera frameworks on the device. MacroRun does not use the microphone and does not ask for access to your whole photo library. If you allow notifications (iPhone, and Android 13 and later, ask for this permission), MacroRun schedules reminders and streak nudges on your device. These are local notifications: we do not run a push-notification server, and no push token or notification data is sent to us. You can turn notifications off in the app or in your device settings.

e. Scan counter (random device ID and IP address). To enforce the photo-scan limits (Free: 3 successful photo scans per device per 7 days; Plus: 50 per 30 days), our server stores a record with a random device ID created by the app, a salted hash of your IP address at the time of the scan (not the raw IP address), scan counts and times, and whether the Free or Plus limit applied. Typed-meal estimates have a separate limit: 10 per calendar month on Free and 200 on Plus, counted in UTC. Short-term limits on how often requests can be sent apply to everyone. We use it only to apply the limit and to prevent abuse of the free tier. The scan counter is not linked to your account. If you are signed in, it may be keyed by a one-way hash of your account ID instead of a device ID, so we can count scans without storing your account ID in it. We count typed-meal estimates the same way, in a separate counter that resets each calendar month (UTC). It uses the same kind of key and is deleted 90 days after your last request.

f. Location for Nearby (only when you allow it). When you open or refresh Nearby and have allowed location, your device's precise latitude and longitude are sent through our server to Geoapify to list restaurants around you. We then rank them by your food likes, distance, and leftover fit. Restaurant map data is © OpenStreetMap contributors (ODbL). We do not store your coordinates on our server. If you decline location, we do not guess your city. You can turn location off at any time: on iPhone in Settings > Privacy & Security > Location Services > MacroRun, and on Android in Settings > Apps > MacroRun > Permissions > Location.

g. Subscription status. MacroRun Plus is bought through Apple In-App Purchase on iPhone or Google Play Billing on Android. Apple or Google processes the payment. We receive the purchase and entitlement status (for example, whether Plus is active) with a scan request, and we do not receive your card details. We use that status to unlock Plus features and apply the Plus scan limit. We don't store your purchase record or purchase token. To count Plus scans, our server keeps a one-way keyed hash of your purchase's original transaction ID (on Android, of a hash of your purchase token) together with your scan count. It isn't linked to your account and is deleted 90 days after your last scan. On Android, the result of checking your purchase with Google is held briefly in server memory (up to 5 minutes) and is not written to our database.

h. Optional usage analytics (off unless you say yes). MacroRun asks before recording any usage analytics. Analytics are off by default, and nothing is recorded or sent unless you choose "Help improve MacroRun". If you do, your device creates a random analytics ID and sends a small set of product events to our server, which stores them in our database (hosted on Neon), so we can understand how MacroRun is used and improve it. The events are: opening the app (with your Free or Plus plan and days since install); finishing onboarding (which path you took and roughly how long it took); turning reminders on or off, and opening a daily or recap reminder; sharing a badge or recap card; viewing the Plus screen (and whether a limit or your profile opened it); buying Plus (monthly or annual); the reason you pick if you tell us why you're cancelling Plus; and being shown a review prompt. Each event also includes the analytics ID, the date the ID was created, the event date on your device, the time our server received it, your platform (iPhone or Android), and the app version. Events never include your meals, photos, scans, weight, workouts, training programs, location, name, or email address, and we don't store your IP address, device model, language, or time zone with them. Until they're sent, up to 20 events wait on your device for up to 7 days. We keep each event on our server for up to 2 years and then delete it. You can turn analytics off at any time in You → Privacy & data. When you do, the app stops sending events, clears any unsent ones, and asks our server to delete the events linked to your analytics ID, retrying until that succeeds; it then deletes the ID from your device. So that events already on their way aren't stored after you opt out, our server keeps a one-way hash of your analytics ID (not the ID itself) and the time you opted out for up to 48 hours, then deletes it. If you delete the app before the request goes through, those events are deleted within 2 years. We do not use a third-party analytics SDK. We do not sell or share analytics data, and we do not use it for advertising or to track you across other companies' apps or websites.

i. Bug reports and emails. "Report a bug" opens your mail app addressed to hello@tablefourapps.com. We receive whatever you choose to send, such as your email address, your message, attachments, and the optional app and device version. We use it to reply and fix problems.

j. Basic technical data. Our app and API are hosted on xAI's Grok Build platform, which uses Cloudflare (network edge and security, including bot protection) and Vercel (application hosting) as its infrastructure providers. Like any internet service, these providers process your IP address and basic request details (such as time and the app request made) to deliver and secure the service when the app or our website talks to our server. This data is used to deliver the request, keep the service secure, and debug errors.

k. Security cookie. Cloudflare may set one strictly necessary security cookie, __cf_bm, when our website or the app connects to our server, to detect bots. It is not used for advertising or analytics. Cloudflare says it expires after 30 minutes of continuous inactivity.

l. Food search and barcodes. When you search for a food or scan a barcode, the app sends the search text or barcode number to our server. Our server looks it up in USDA FoodData Central and Open Food Facts and sends them only the search text or barcode number, never your IP address or account details.

We do not collect your contacts or advertising identifier (IDFA or Android advertising ID), and we do not use third-party ad or analytics SDKs. We collect your name only if you sign in with Google (section 3b).

4. Who we share information with

We share information only with service providers that process it for us so the app works:

About hosting: xAI's role as our hosting platform (Grok Build) is separate from its role as our AI estimator (Grok API). The zero-data-retention option described below applies to the Grok API, not to hosting request logs.

About xAI: xAI processes the photo or text only to return the estimate. We use xAI's zero-data-retention option, under which xAI does not store the request after returning the response, and under xAI's API terms it does not use API inputs or outputs to train its models.

About Geoapify: Geoapify's privacy policy says it generally keeps data for successful API requests for no longer than 24 hours.

About sign-in: when you sign in with Apple or Google, that company handles the sign-in under its own privacy policy and tells us the details listed in section 3b. Apple and Google know you used their service to sign in to MacroRun.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our business (in which case this policy continues to apply to it). We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use it for targeted advertising. We do not "track" you as Apple defines it.

5. Estimates, not medical advice

Protein, carbs, fat, and calories are estimates (4×P + 4×C + 9×F). MacroRun is not medical advice, diagnosis, or a dietitian.

6. Third-party How-to sites

If you tap How-to, your device may open MuscleWiki, ExRx, or another allowlisted demo site. That visit is between you and that site, under its privacy policy. MacroRun does not receive the page content from that visit.

7. How long we keep information

8. Security

We use reasonable safeguards for the kind of information we handle. These include encrypted connections (HTTPS) between the app and our server, access controls on our systems and vendor accounts, and minimising what we collect and keep. No method of transmission or storage is completely secure, so we can't guarantee absolute security.

9. Data breaches

If a data breach affects your personal information, we will investigate promptly, take steps to contain it, and notify you and the relevant regulators when the law requires it. See the regional supplements for Australia and New Zealand.

10. Your choices and rights

• Photo estimates: turn them off in Profile → Photo estimates → Turn off. If you do, photos and typed descriptions are no longer sent to xAI.
• Camera, location, and notifications: decline the permission, or turn it off later in your device settings (iPhone: Settings > Privacy & Security; Android: Settings > Apps > MacroRun > Permissions). Features that need the permission then stop using it.
• Usage analytics: they stay off unless you opt in. Turn them off any time in You → Privacy & data, and the app asks our server to delete the events linked to your analytics ID.
• Account: sign-in is optional. To delete your account, go to You > Settings > Delete account. This deletes your account, your sessions, the link to your Apple or Google sign-in, and your cloud backup from our server. We also revoke MacroRun's Sign in with Apple access (and ask Google to revoke access, where Google allows it). Data on your device stays until you delete the app. You can also ask us to delete your account by email (below) or through our web page at https://macrorun.tablefourapps.com/delete-account/.
• Cloud backup: off unless you turn it on. Turn it off any time; we then delete the copy on our server.
• On-device data: delete it by clearing MacroRun's data or deleting the app.
• Requests: you can ask us to tell you what personal information we hold about you, give you a copy, correct it, or delete it. If you are signed in, you can delete your account in the app (above). Or email hello@tablefourapps.com with the subject "Privacy request", from the email address on your account if you have one. If you don't have an account, we may ask for the approximate date and time of your scans and the IP address you used, so we can find a scan-counter record. We may ask for information to verify your request. We won't discriminate against you for using your rights. The regional supplements describe additional rights.

11. Children

MacroRun is for people 13 and older and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has sent us information, contact us and we will delete it.

12. Do Not Track

MacroRun does not track you across other companies' apps or websites, so there is no cross-site tracking for a Do Not Track signal to turn off. We do not change our practices in response to browser Do Not Track signals.

13. Changes to this policy

We will post any changes here and update the effective date. For material changes, we will also tell you in the app before the change takes effect. We will update this policy, and ask for consent where required, before we turn on any new data collection or change what usage analytics include.

14. Contact us

TableFour LLC, Attn: Privacy Officer
2108 N St Ste N, Sacramento, CA 95816
Email: hello@tablefourapps.com

Our Privacy Officer handles privacy questions, requests, and complaints for all regions.

Regional supplements

These supplements add to the main policy for people in specific places. If a supplement conflicts with the main policy, the supplement controls for that region.

United States

• California (CalOPPA): this policy lists the categories of personal information we collect and the types of third parties we share it with (sections 3–4), explains how to review and request changes (section 10), how we notify you of changes (section 13), our effective date (top), and how we respond to Do Not Track (section 12).
• California Consumer Privacy Act and other state privacy laws: based on our current size, TableFour may not be subject to the CCPA or similar state laws. Even so, we do not sell or share personal information (including for cross-context behavioral advertising), and we honor the access, correction, and deletion requests described in section 10 for all US users. We do not use sensitive personal information to infer characteristics about you. California "Shine the Light": we do not disclose personal information to third parties for their direct marketing.
• Children (COPPA): see section 11. MacroRun is for users 13 and older.
• Consumer health data (Washington, Nevada, Connecticut, and similar laws): see the Consumer Health Data Privacy Policy below.

Consumer Health Data Privacy Policy

This section is our consumer health data privacy policy under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's consumer health data provisions, and similar laws. It can be linked on its own.

What consumer health data we collect. We treat the following as consumer health data because they may reveal information about your diet, nutrition, or body:

• meal, fridge, and leftover photos and typed meal descriptions you choose to send for an estimate;
• the protein, carbs, fat, and kcal estimates returned for them;
• for fridge scans, your remaining calories, protein, carbs, and fat for today;
• if you turn on cloud backup, the weigh-ins, meal log, workouts, goals, and related profile details in your backup.

Unless you turn on cloud backup, your profile, goals, meal log, weigh-ins, and workouts stay on your device and are not collected by us. We do not use your location to infer anything about your health, and we do not store it.

Where it comes from. Directly from you, when you take or pick a photo, type a description, or turn on cloud backup, and from our estimator's response.

Why we collect and use it. Only to give you the food estimate or meal suggestion you asked for, to avoid billing the same photo twice (photo hash), and to store and restore your backup if you turn it on. We do not use it for advertising, and we do not sell it.

Consent. We collect this data only after you allow it: photo estimates in the app, and cloud backup with the "Back up my data to my account" switch. You can withdraw consent at any time: Profile → Photo estimates → Turn off, and turning backup off (which deletes the server copy) or deleting your account.

Who we share it with. Only processors acting on our behalf: our hosting providers, xAI's Grok Build platform with Cloudflare and Vercel (which host our server and relay requests); Neon (our database, which stores your backup if you turn it on); and xAI's Grok API (which produces the estimate). See section 4 for what xAI keeps and for how long. We do not share consumer health data with any other third party or affiliate, and we do not sell it.

How long we keep it. We do not store the photo or description after the estimate is returned. The photo hash is kept in server memory for up to 30 days, then deleted, and it is not stored in our database. The estimate itself is saved only on your device, if you choose to log it. If you turn on cloud backup, we keep it until you turn backup off or delete your account. Deleted data may remain in our database provider's backup history for a limited time before it's overwritten.

Your rights. Subject to applicable law, you can:

• confirm whether we collect, share, or sell your consumer health data, and get a copy of it;
• get a list of the third parties and affiliates we have shared it with (currently xAI, Cloudflare, Vercel, and, if you use backup, Neon), with their contact details on request;
• ask us to delete it (we will also instruct our processors to delete it);
• withdraw your consent.

We don't keep photos or descriptions after the estimate. If you haven't turned on cloud backup, in most cases we will hold no consumer health data about you by the time you ask, and we will tell you so. If you have, you can delete it yourself by turning backup off or deleting your account.

How to make a request. Email hello@tablefourapps.com with the subject "Consumer health data request". We will respond within 45 days. Where the law allows, we may extend this by another 45 days if reasonably necessary, and we will tell you if we do. We may ask for information to reasonably verify your request.

Appeals. If we decline your request, you can appeal by replying with the subject "Consumer health data appeal" within 45 days of our decision. We will respond in writing within 45 days, explaining what we did and why. If your appeal is denied, you may contact your state Attorney General: Washington (atg.wa.gov), Nevada (ag.nv.gov), or Connecticut (portal.ct.gov/ag).

Australia

We handle personal information of people in Australia in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We do this whether or not a legal exemption might apply to a business of our size.

• Collection notice (APP 5): we are TableFour LLC (contact details in section 14). We collect the information described in section 3, directly from you and your device (and, if you sign in, your name, email, and user ID from Apple or Google, and subscription status from Apple or Google), for the purposes described there. No Australian law requires you to give us this information. You don't need an account. If you don't allow photo estimates, location, or backup, those features won't work, but the rest of the app will. We disclose information to the service providers in section 4.
• Sensitive information: we treat meal photos, descriptions, and nutrition figures you send, and the weigh-ins, meal log, workouts, and goals in a cloud backup, as potentially health information. We collect them only with your consent (APP 3), which you can withdraw at any time (section 10), and use them only for the purpose you gave them to us for (APP 6).
• Overseas disclosure (APP 8): our service providers are located overseas, mainly in the United States (xAI, Vercel, Neon, USDA FoodData Central, and Apple and Google for app-store and sign-in services), where your account and any cloud backup are stored, and Germany/the EU (Geoapify). Open Food Facts (a non-profit open food database) receives only food search text or barcode numbers. xAI may also process data in other countries where it and its sub-processors operate. Cloudflare runs a global network and usually handles requests at the location nearest you. We choose providers with contractual privacy and security commitments. We remain responsible under the APPs for how they handle your information for us.
• Access and correction (APPs 12 and 13): email us to access or correct personal information we hold. We will respond within a reasonable time, usually within 30 days, and there is no charge for making a request. If we refuse, we will tell you why and how to complain.
• Complaints: contact our Privacy Officer first. We aim to respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, 1300 363 992.
• Notifiable Data Breaches: if we have an eligible data breach likely to result in serious harm, we will notify affected individuals and the OAIC as the Notifiable Data Breaches scheme requires.

New Zealand

We handle personal information of people in New Zealand in line with the Privacy Act 2020 and its Information Privacy Principles (IPPs).

• Privacy officer: our Privacy Officer (section 14) is responsible for compliance with the Privacy Act.
• Collection: we collect the information in section 3 for the purposes described there, mostly directly from you (IPP 1, IPP 2 and IPP 3). We collect only what we need for those purposes. The only information we get from another organisation about you is your subscription status from Apple or Google and, if you sign in, your name, email address, and user ID from Apple or Google (IPP 3A). We use these only to provide Plus and your account. Giving us information is voluntary: you don't need an account, and without photo, location, or backup permission, those features won't work. If you turn on backup, we collect the health-related information in it (weigh-ins, meal log, workouts, goals) only with your consent.
• Overseas service providers (IPP 12): our service providers in the United States (where your account and any cloud backup are stored) and Germany/the EU, Open Food Facts (a non-profit open food database, which receives only food search text or barcode numbers), and Cloudflare's global network (usually at the location nearest you) (section 4), process information on our behalf, only for the purposes in this policy. We remain responsible for that information under the Privacy Act, and we require providers to protect it.
• Access and correction (IPPs 6 and 7): you can ask for access to, or correction of, personal information we hold about you by emailing us. We will respond as soon as reasonably practicable, and within 20 working days.
• Complaints: contact our Privacy Officer first. If you're not satisfied, you can complain to the Office of the Privacy Commissioner: www.privacy.org.nz, 0800 803 909.
• Privacy breaches: if we have a notifiable privacy breach (one that has caused, or is likely to cause, serious harm), we will notify the Privacy Commissioner and affected people as soon as practicable.

Additional regional supplements will be added here if MacroRun becomes available in more countries.