1. Who we are

The Maccro app (the "App") is provided by [ПІБ ФОП або назва компанії] ([РНОКПП / ЄДРПОУ], [адреса реєстрації]) ("we", "us"). We are the controller of your personal data under the Law of Ukraine "On Personal Data Protection" and the EU General Data Protection Regulation (GDPR).

Data questions: privacy@sinal.studio
General support: support@sinal.studio

2. What data we collect

Account: email, password (stored only as a hash), name.

Profile: sex, age, height, weight, goal (lose / maintain / gain weight), work and activity (steps, workouts), body measurements (waist, hips, neck, chest, arm, thigh) and body fat percentage — if you enter them.

Food: meal entries (dish names, portions, calories, protein, fat, carbohydrates, fiber, sugar, sodium, time, and your answers to clarifying questions such as "how much oil"), photos of meals you take in the App, and photos of nutrition labels and package barcodes if you use them. Text you dictate or type to have a meal recognised.

Your own foods and dishes: stored on your device and, as a copy, in your account so they survive reinstalling the App. Only you can see them.

Weight and water: weight entries with dates, water entries (water is stored only on your device).

Trainer mode: the trainer–client link, the date and fact of your consent, comments on meal entries, the calorie target set by a trainer.

Only on your device: favourite meals, recent foods, reminder and unit settings. If a different account signs in on the same device, the previous user's data of this kind is deleted from the device.

Technical data: sign-in service data (session token), the number of AI analyses per day (for the free plan limit), saved AI recognition results (so the same photo isn't counted twice), subscription status. An in-app event log — which actions you took (added an entry, took a photo, scanned a barcode, completed a setup step) and whether an error occurred, with the time, App version and platform. We use it to find and fix bugs; it contains no photos and no text of your entries.

We do NOT collect location, contacts or advertising identifiers (IDFA); we show no ads and use no third-party analytics or trackers.

3. Health data

Weight, measurements, body fat, food and activity are health data, a special category of personal data. We process them only on the basis of your explicit consent, given when you register and enter this data (Art. 7 of the Law of Ukraine "On Personal Data Protection", Art. 9(2)(a) GDPR), and only to calculate your targets and keep your diary.

You can withdraw consent at any time by deleting entries or your whole account (Settings → Delete account).

4. Why we use your data

• To calculate your calorie, protein, fat and carbohydrate targets.
• To keep your food, weight and water diary and show statistics.
• To recognise food in photos, nutrition labels and dictated text.
• To show your diary to a trainer — only if you connected to that trainer yourself.
• To send the reminders you turned on in Settings.
• To manage the Pro subscription and the free plan limit.

We do not sell data, do not use it for advertising and do not share it for training AI models.

5. AI food recognition

When you photograph a meal or a label, or describe food in words, the photo or text is sent over a secure connection to Anthropic PBC (USA), Claude model. Your name, email and other profile data are not sent with it.

Under Anthropic's commercial terms this data is not used to train models and is kept by Anthropic for no longer than 30 days for abuse prevention, then deleted.

The result is an estimate, not an exact measurement. Check portions, especially if your health depends on accuracy.

6. Shared product database

When you add a packaged product with a barcode (for example, by photographing its label), its name, brand, barcode and nutrition facts go into a shared database so other people can find that product by scanning or searching.

Your name, email and other data are not shown to anyone. We keep a record of who added a product only to prevent abuse; when you delete your account this link is deleted and the product stays in the database without an author. Your own dishes and recipes without a barcode are never shared. If you don't want to share, turn off "Share products" (Settings → Data); new products will no longer go into it; products already added stay there (without your name).

7. Voice input

Speech is recognised by iOS itself (Apple); audio may be processed on the device or on Apple's servers under Apple's terms. We never receive or store audio — we only get the finished text you see on screen.

8. Apple Health (HealthKit)

Connecting is optional and happens only after you allow it in Apple's system dialog.

What we read: steps (2-week average), workouts (number, type and duration over 4 weeks), weight and body fat percentage. This data is read on your device. Only what you confirm with the "Update target" or "Fill in from Health" button reaches our servers: average steps and workouts in your activity profile, weight and body fat.

What we write: food (calories, protein, fat, carbohydrates, fiber, sugar, sodium), water and weight.

We never use Health data for advertising, never sell it and never share it with third parties, including your trainer. To revoke access: Health → Profile → Apps → Maccro.

9. Trainer

A trainer sees your data only after you enter their code yourself and tick the consent box. The trainer then sees your name and email, your food diary with photos, your targets, weight and measurements, and can comment on entries and set your calorie target.

The trainer is a separate person from us and is solely responsible for how they use what they see. You can disconnect at any time (Profile → Trainer → Disconnect); the trainer's access ends immediately.

10. Who else processes data

We share data only with services the App cannot work without:

• Supabase Inc. — database, sign-in and photo storage. Servers in Ireland (EU, AWS eu-west-1).
• Anthropic PBC (USA) — food recognition (section 5).
• RevenueCat Inc. (USA) — subscription management: receives your account ID and purchase status, no payment details.
• Apple — App Store, payments, Health, speech recognition.
• Open Food Facts (an open product database) — product lookup: only the barcode number or the search text is sent, nothing about you.

Transfers to the USA rely on the EU Standard Contractual Clauses that these companies include in their data processing agreements. We also disclose data where the law requires it.

11. How long we keep data

For as long as your account exists. You can delete entries and photos in the App at any time. The event log is kept for 90 days. Comments on a deleted entry are kept for another 24 hours so the deletion can be undone, then deleted.

When you delete your account (Settings → Delete account), your profile, entries, photos, weight, measurements, own foods, comments and trainer link are deleted from the database immediately, and from the provider's backups within 30 days. Products you added to the shared database stay there with no link to you (section 6). Data on your device is deleted together with the App.

12. How we protect data

Connections are encrypted (HTTPS/TLS) and the database is encrypted at rest. Access is restricted for every database row: everyone sees only their own data, a trainer only the data of clients who gave consent. Photos are kept in private storage and opened through temporary links.

13. Your rights

You have the right to know what data we process and get a copy of it; to correct it; to delete it or your whole account; to restrict or object to processing; to withdraw consent; and to receive your data in a machine-readable format.

Most of this can be done right in the App: you can download a copy of all your data as a file (Settings → Export data) and correct or delete data on the relevant screens. For anything else, email privacy@sinal.studio — we reply within 30 days.

You can also complain to the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua) or to the data protection authority in your EU country.

14. Age

Maccro is for people aged 16 and over. The App does not accept a younger age and we do not knowingly collect data from younger users. If you learn that someone under 16 has an account, email privacy@sinal.studio and we will delete it.

15. Notifications

Reminders are local notifications on your device, only if you turned them on and allowed them in iOS. We do not send marketing emails.

16. Changes

We will tell you about material changes to this Policy in the App at least 7 days before they take effect. The date of the current version is shown at the top of the page.