How FamilyMacro protects household nutrition data

Information FamilyMacro may collect

• Account details such as name, email address, password hash, family name, family membership, subscription status, and app sessions.
• Household profile details such as names, age groups, nutrition goals, privacy settings, meal logs, shared-meal portions, recipes, plans, shopping-list items, and AI usage counts.
• Optional food photos, nutrition-label photos, typed food descriptions, and voice meal descriptions when you choose AI-assisted logging.
• When you use the Assistant, a separate product-quality ledger may keep the server-sanitised text of your question and limited operational labels, such as the route, provider, outcome, and a coarse response-time range. A server-sanitised AI reply is held separately only while a twice-daily quality review needs it; it is removed after resolution or at a 30-day safety limit. Before storage, FamilyMacro redacts obvious direct identifiers such as email addresses, phone numbers, links, access tokens, secrets, payment-card numbers, and long identifier strings.
• Optional Health Connect exercise import details such as exercise sessions, activity calories, steps, distance, heart-rate summaries, provider/source-app labels, this phone's local Health Connect identity, FamilyMacro workout records written back to Health Connect when you choose to connect and sync them, and your own FamilyMacro meal nutrition records written to Health Connect when you allow nutrition write access.
• Support, billing, purchase status, and operational security details when you contact us, manage a subscription, or use account features.
• Public website analytics such as page path, referrer details, campaign or affiliate code, approximate country, user-agent family, and a pseudonymous visitor identifier.

How the data is used

We use household data to provide private login, family profiles, nutrition logs, shared meals, privacy controls, and billing access. Meal and nutrition entries stay editable so households can review and correct values before relying on them.

AI-assisted photo, voice, exercise, recipe, and insight features use the content you submit to return estimates, summaries, and editable draft entries. Every submitted Assistant text request uses OpenAI first, normally with the GPT-5.6 Luna model. If Luna requests FamilyMacro data, the server checks the signed-in person’s permissions and sends only the authorised, minimised tool results needed for that answer; Luna never receives direct database access, account tokens, or raw internal identifiers. Food-photo analysis normally uses Google Gemini. Where both providers are configured, the alternate provider is tried once only after the primary provider fails. OpenAI processes submitted meal audio for transcription. FamilyMacro starts this processing only after you choose an AI-assisted action.

The separate Assistant question ledger is used to improve product quality and app functionality and to produce aggregate usage and reliability analytics. Twice daily, FamilyMacro automatically flags delivery, formatting, fallback, and slow-response concerns. Only a flagged reply remains available to the owner-review surface until it is resolved; archiving removes the reply text. Its admin review does not expose IP addresses, user agents, account IDs, family IDs, profile IDs, or the keyed one-way account-deletion value. That server-only value is created with a secret and is used only to find and remove matching ledger entries during deletion.

Meal and favourite-food images are stored in private Cloudflare R2 object storage with authenticated, household-scoped access. The retention periods for those images are explained below.

Health Connect exercise and nutrition sync are optional. FamilyMacro asks for Android Health Connect access before reading activity data or writing records. It reads the selected activity data for review, can write reviewed Samsung workout records back to Health Connect when Samsung has not already shared them there, and can automatically write your own logged meal nutrition to Health Connect after you allow nutrition write access. FamilyMacro does not diagnose, treat, or give medical advice from Health Connect data.

During a household’s 5 free days, FamilyMacro may send the household owner up to two reminder emails. The first is sent only if no meal has been saved between about 18 and 72 hours after free access starts, between 16:00 and 19:00 local time. The second is sent on the day before free access ends, between 10:00 and 13:00 local time. Each reminder is sent at most once per household. They are not sent to staff or test households, archived households, owners without an email address, or owners who have turned them off. To send them, FamilyMacro uses the owner’s name and email address, the free-access start and end dates, whether a meal has been saved, and, in the second email, counts of meals, people and days logged. Local time comes from the time zone of the owner’s most recently used device, or Europe/London if none is known. The emails contain no meal names, photos or nutrition values. They are sent through Cloudflare’s email service. Every reminder has a “Stop these reminders” link and supports one-click unsubscribe in mail apps. Turning them off does not affect account, security or billing emails. FamilyMacro sends these reminders on the basis of its legitimate interest in helping new households get value from the service they have started, and you can object at any time by turning them off.

Children and family privacy

Profiles under 16 stay guardian-visible for nutrition, vitamins, and meals. Parents can optionally give older children their own app login. Adults can choose Private, Shared totals, or Shared meals only. Family members only see what the selected privacy setting allows.

Sharing and advertising

We do not sell household nutrition data. FamilyMacro is designed as an ad-free paid household nutrition tracker, not an advertising profile builder. Service providers may process data only as needed to operate hosting, email, payments, app stores, analytics, support, security, and AI-assisted features.

To measure whether our own Google Play adverts lead to sign-ups, the Android app (version 1.0.64 and later) uses Google Analytics for Firebase to record when a household starts its free access or trial, plus basic app-open events. This can include an app-instance identifier and, where permitted, the Android advertising ID. It never includes meals, nutrition, health, profile or family details. In the EEA, the UK and Switzerland these measurement events are sent without identifiers unless consent is given. We do not use this data for ad personalisation or remarketing. You can reset or delete your advertising ID in Android settings, or contact privacy support to ask about this measurement.

Your privacy choices

You can edit or delete meal and exercise logs, update profile visibility, disconnect Health Connect permissions in Android settings, contact privacy support, and request account deletion. A household owner can stop free-days reminder emails with the link in any reminder, or with the Free-days reminder emails switch in Settings → Notifications in the Android app and on desktop web.

Temporary app diagnostics

Until 8 October 2026 at 14:00 Copenhagen time, FamilyMacro can collect a detailed interaction trail only after the household owner opts in separately. New owners can use the unchecked “Help us improve FamilyMacro” signup checkbox and read the diagnostic terms and conditions beside it. Declining does not affect signup or access, and accepting Terms or this Policy alone does not grant this permission. The trail records approximate tap positions, neutral control types and states, keyboard activation attempts, screen changes, scrolling, timing, and request categories and outcomes. It is linked to the consenting account and is available only in the protected administration service. We do not capture typed text, DOM labels, meal or health values, photos, passwords, screen images, or full page URLs. A temporary random visit ID stays in memory; it is not a device fingerprint.

You can withdraw in Settings → My Account using “Stop and remove detailed diagnostics”. Changing your mind stops detailed collection immediately on this device and removes the account’s interaction records when the server acknowledges the choice; later interaction writes are rejected. Separately, limited technical error categories and bundled-code locations help diagnose app faults; error messages and full stack traces are excluded. Do Not Track and Global Privacy Control disable this temporary collection.

Capture ends automatically at the stated deadline. Diagnostic records stop appearing after 14 days and are physically removed during the next diagnostic write or administration review. They are removed sooner with account or household deletion. The signup choice, time and diagnostic wording version are kept as consent evidence with the active account and removed with its consent records during deletion. The permission expires with this investigation and does not authorise a future investigation.

Data retention

FamilyMacro keeps data only for the period needed to provide the service, meet the choices below, and satisfy limited security, accounting, fraud-prevention, or legal obligations:

• Account and household records: login details, profiles, nutrition and exercise history, goals, favourites, recipes, plans, and household settings are kept while the account or household remains active. Individual records are removed earlier when you delete them. Account data is removed from active FamilyMacro systems when the relevant account or household is deleted.
• Login sessions: app sessions expire after 30 days and are removed sooner when you sign out or delete the account.
• Meal and favourite images: standard accounts keep an uploaded original for 7 days and its private thumbnail for 30 days. Extended or lifetime entitlements keep an original for 183 days and its thumbnail for 365 days. Images are removed sooner when the related record, profile, or household is deleted.
• AI-assisted inputs: FamilyMacro does not keep a reusable copy of raw meal audio after sending it for the requested transcription. A transcript, estimate, or submitted image follows the retention period of the meal, exercise, favourite, or other record that you choose to save.
• Product-use measurement: for signed-in app use, we record at most one activity day per person and household per UTC day. Reports use a 90-day window, and older activity rows are pruned when new activity is recorded. This record contains no meal details, precise activity time, IP address, device ID or visited screen. It helps us distinguish repeat use from sign-ins.
• First-meal activation: after the server confirms a household's first food save, a separate service-quality milestone records the household and that confirmation time. It contains no food contents, profile details, health values, image, device ID or IP address. It helps measure whether new households can save food within their first 48 hours. This milestone is retained for 90 days and pruned at the next milestone write or activation report; household deletion removes it sooner. A later deletion of an individual food entry does not undo this household-level record of completed first use.
• Assistant question ledger: server-sanitised question text and limited operational labels stop appearing in review after 90 days. Expired rows are physically removed during the next ledger write or review, and matching rows are removed sooner when the associated account, profile-owned login, profile, or household is deleted. A separate sanitised reply-review record exists only while the reply is pending or needs resolution; the twice-daily review removes reply text after resolution and no reply remains longer than 30 days.
• Support, billing, security, and legal records: these are kept only as long as needed to resolve the request, administer the subscription, prevent abuse, meet accounting or other legal duties, or establish and defend legal claims. Payment providers and app stores may retain their own transaction records under their policies and legal obligations.
• Public website analytics: pseudonymous page, referral, campaign, approximate-country, browser-family, and visitor-hash records are kept for trend reporting and service security. They are not joined to a FamilyMacro household profile and are deleted or anonymised when no longer needed for those purposes.
• Free-access record: when a household uses the 5-day free access, FamilyMacro keeps a one-way hash of each member's email address, even after account deletion, so the same people cannot start free access again. The hash cannot be turned back into the email address and is used only for this fraud-prevention check.
• Free-days reminders: FamilyMacro records which reminder was sent to a household, when, the time zone used, and whether the email provider accepted it, so no reminder is sent twice. If you turn reminders off, that choice and when you made it are kept. Unsubscribe links are stored only as one-way hashes. These records are removed when the account or household is deleted.
• End of free access: when a household’s free access ends, FamilyMacro keeps a counts-only service-measurement record: the start and end dates, numbers of meals, meal days and active days, the last active day, when the first meal was saved, whether each reminder was sent, and whether the household moved to a plan. It contains no meal content, health values or email address, and is removed when the household is deleted.
• Offers after deletion: if you tick "Keep my email so FamilyMacro can send me occasional offers" when deleting your account, FamilyMacro keeps that email address, the wording you agreed to and the date, only to send occasional offers. Every offer email has an unsubscribe link, and unsubscribing removes the address. If you do not tick the box, your email address is not kept.

If a limited record must be retained after deletion for a legal, security, fraud-prevention, or dispute purpose, FamilyMacro restricts it to that purpose and removes it when the obligation ends. Deleted account content is not restored to the product from an operational backup.

How to request account and data deletion

1. Inside FamilyMacro: sign in, open Settings, choose Delete account, type DELETE, and confirm. A household owner deletes the whole family account and its FamilyMacro data. A household member deletes that login and the member's profile-owned data; the household may retain a de-identified “Deleted member” placeholder so other people's shared records remain intact.
2. If you cannot sign in: open the FamilyMacro account deletion page, follow its link to the support form, choose Privacy or deletion, enter the email address used for the account, and ask us to delete your FamilyMacro account and associated data.

We may ask for enough information to verify that the requester controls the account. We respond without undue delay and normally within one month. If a legal exception requires us to retain limited data or extend the response period, we will explain that to the requester. Deleting FamilyMacro does not by itself cancel every Google Play subscription or remove records already written to Android Health Connect; those can be managed separately in Google Play and Health Connect settings.