Privacy Policy

Last updated: October 11, 2026

This Privacy Policy describes how Makrosas ("we", "our", "the app") collects, uses, and protects your personal data when you use our calorie and nutrition tracking application.

1. Important Disclaimer

Makrosas is not a professional nutrition, medical, or dietary advisory service. We are not licensed dietitians, nutritionists, or healthcare providers. The app, including all AI-powered features, provides general informational guidance only. Nutritional values, suggestions, and AI responses may be inaccurate or incomplete. Any decisions you make based on information from the app are entirely your own responsibility. Always consult a qualified healthcare professional before making significant changes to your diet.

2. Data Controller

The data controller is the operator of Makrosas. For data-related inquiries, contact: makrosas.app@gmail.com.

3. Data We Collect

  • Account data: Name, email address (provided during registration or via Sign in with Google or Sign in with Apple).
  • Health and nutrition data: Daily food logs (meals, items, macros), nutrition goals and targets, body measurements (weight, waist), training/rest day preferences. This data is considered special category data under GDPR Article 9.
  • Photos: If you use the camera or photo library to scan food or nutrition labels, images are processed for recognition and may be temporarily stored. Photos are not used for any purpose other than food identification.
  • AI interaction data: Messages sent to the AI nutrition advisor, AI-generated responses. Chat history is retained for 7 days, then automatically deleted.
  • Technical data: Device information and error logs for crash reporting and app stability.

4. How We Use Your Data

  • To provide calorie tracking, macro calculations, and nutrition insights.
  • To power AI features: food recognition, nutrition coaching, analytics.
  • To sync your data across devices via your account.
  • To improve app stability (crash reports).

We do not sell your data. We do not use your data for advertising.

5. Legal Basis (GDPR)

  • Consent (Article 9(2)(a)): Processing of health-related data (food logs, body measurements, nutrition goals) is based on your explicit consent, provided when you create an account.
  • Contract (Article 6(1)(b)): Processing necessary to provide the service you signed up for.
  • Legitimate interest (Article 6(1)(f)): Crash reporting and app stability.

6. Third-Party Service Providers

To deliver the service, we use trusted third-party providers in the following categories:

  • Cloud infrastructure: Database hosting, authentication, and serverless computing. Primary data storage is located in the EU.
  • AI service providers: Food recognition, photo analysis, nutrition coaching and target calculation are processed by OpenAI and Google on our behalf. The data sent is: food descriptions and food photos, messages to the AI coach, and body and goal data (such as weight, height, age, gender and nutrition goals). No name or email address is included. These providers process the data only to deliver these features, under data processing terms that require protection equal to this policy. Before any of this data is sent, the app asks for your permission and names these providers.
  • Payments: Subscriptions are purchased through the Apple App Store or Google Play. Our subscription management provider, RevenueCat, receives your user ID and purchase history to confirm and manage your subscription. We never receive your card details.
  • Subscription management and payments: To manage subscription status. Payments are processed by the App Store and Google Play; we never receive or store your card details.

These providers act on our instructions only, may not use your data for their own purposes, and may not use it to train their models.

6.1. Transfers outside the EU

Some AI service providers are established in the United States. Where data is transferred to them, this is done under the European Commission's standard contractual clauses, which provide protection equivalent to the GDPR.

6.2. List of providers

The specific providers we currently use are listed on our providers page. We update that list whenever a provider changes.

7. Data Storage and Retention

  • Account and nutrition data is stored as long as your account is active.
  • AI chat messages are automatically deleted after 7 days.
  • Error logs are retained for 30 days.
  • When you delete your account, all associated data is permanently removed.

8. Your Rights

Under GDPR, you have the right to:

  • Access your personal data.
  • Rectify inaccurate data.
  • Erase your data ("right to be forgotten").
  • Export your data in a portable format.
  • Withdraw consent at any time by deleting your account.
  • Lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI) at vdai.lrv.lt.

9. Data Security

We use industry-standard security measures: encrypted connections (HTTPS/TLS), row-level security on all database tables ensuring users can only access their own data, and secure authentication protocols.

10. Children

The app is not intended for children under 16. We do not knowingly collect data from anyone under 16.

11. Website analytics and cookies (makrosas.com)

This section covers the makrosas.com website only, not the app. On the website we use Google Analytics (Google Ireland Limited) to understand how visitors find it: where you came from (for example a search), which pages you viewed, and whether you clicked an app download button.

  • Only with consent (GDPR Art. 6(1)(a)). Google Analytics is switched on only after you press "Accept" in the cookie notice. If you decline, the analytics script is not loaded at all and no analytics data is sent.
  • Cookies: _ga and _ga_*, lasting up to 13 months. Analytics data is kept for 14 months.
  • No advertising: Google signals and ad personalisation are switched off, and the data is not used for advertising.
  • Withdrawing consent: press "Cookie settings" at the bottom of the site at any time. Withdrawing deletes the analytics cookies.
  • Necessary cookie: lang_set remembers your language choice for 12 months. It needs no consent, because without it the site would choose your language again on every visit.
  • Transfers outside the EU: Google LLC participates in the EU-US Data Privacy Framework, and standard contractual clauses also apply.

12. Changes

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision.