Privacy Policy

Last updated: 31 July 2026

Macrosaurus (“we”, “us”) is an adaptive macro and body-composition tracker. We try to collect as little as we need to run the app, and to keep what we do hold under your control.

What we collect

• Account details — the email address you sign up with, used to sign you in and contact you about your account.
• Your tracking data — the food, weight, check-ins, recipes and goals you enter, so the app can show your progress and retune your targets.
• Connected Google Health data (optional) — if you connect Google Health, a limited set of read-only fitness and health signals (see “Connecting Google Health” below). This is entirely optional and off until you connect.
• Basic technical data — the minimum needed to keep you signed in and to keep the service secure and working.

Where it lives

Your data is stored with our hosting provider (Supabase) under row-level security, which means each account can only read and write its own rows. We do not sell your data, and we do not share it with advertisers.

The only companies that process your data are the providers we need to run the app: Supabase (database and sign-in), Vercel (hosting), Anthropic (the AI features described below), Open Food Facts (food lookups), Sentry (error monitoring, so we can fix crashes) and PostHog, hosted in the EU, for cookieless product analytics. Each processes your data only to provide that service to us, under terms that forbid using it for their own purposes or to train models on it. We use no advertising or cross-site tracking software.

How we protect your data

We treat your health and fitness data — including everything we receive from Google APIs under the Google Health scopes — as sensitive data, and protect it with the following technical and organisational measures:

• Encrypted in transit. All traffic between the app, our servers and any provider we use is encrypted with TLS 1.2 or higher. The app and this site are served over HTTPS only, and our server-side functions refuse plaintext connections. We never transmit health data over an unencrypted channel.
• Encrypted at rest. Your data is stored encrypted at rest by our hosting provider (Supabase), using AES-256. Backups are encrypted to the same standard.
• Isolated per account. Every table holding your data enforces row-level security in the database itself, so one account cannot read or write another account’s rows even if the app were to ask it to. Isolation is enforced by the database, not only by the app.
• Access tokens never leave our server. Your Google OAuth access and refresh tokens are held only in server-side storage, are never sent to the browser or app, and are never exposed to any third party. Provider API keys are likewise held only as server-side secrets, never in client code.
• Least-privilege access. Privileged database credentials are used only by our server-side functions, never by the client. Access to production systems is restricted to the small number of people who need it, protected by two-factor authentication, and we do not browse identifiable user health data in the ordinary course of running the service.
• Authentication. Sign-in and session handling are managed by our authentication provider (Supabase Auth). We never see or store your Google password, and passwords for email sign-in are stored only as salted hashes by that provider.
• Secure development and testing. Changes are reviewed before they are deployed, dependencies are kept up to date, and secrets are held in managed secret storage rather than in source code. We test the access rules that isolate one account’s data from another as part of our normal release process.
• Independent security assessment. Because the Google Health scopes are restricted, our application must pass an annual independent security assessment against the Cloud Application Security Assessment (CASA) standard — which is based on the OWASP Application Security Verification Standard — before the connection can be offered to users generally. Until we have completed that assessment, Google Health is enabled only on our own internal accounts, and we will maintain the assessment for as long as we use these scopes.
• Incident response. If we become aware of a security incident affecting your personal data, we investigate and contain it, and we notify affected users and the UK Information Commissioner’s Office where the law requires it — within 72 hours of becoming aware, in the cases where that duty applies.
• Deletion on disconnect. Disconnecting Google Health revokes the token with Google and deletes the stored connection and the synced health readings from our systems.
• Deletion on request. You can delete your account and its data from within the app, or ask us to. We remove it from our live systems promptly, and it falls out of encrypted backups within 30 days.

No system can be guaranteed perfectly secure, but we keep the amount of data we hold small and review these measures as the app changes. If you have a security concern, email olly@macrosaurus.com and we will respond.

How long we keep it

We keep your data for as long as your account is active. You can delete your account, and everything in it, at any time from Menu → Account in the app, or by emailing us. When you do, we remove your personal data from our live systems promptly and it falls out of our encrypted backups within 30 days — other than anything we’re required to keep for legal or accounting reasons. You can also export a full copy of your data from the same place at any time.

Where in the world

Some of our providers (such as Supabase and Google) may process data outside the UK. Where that happens, we rely on those providers having appropriate safeguards in place for international transfers.

AI features

Some features are powered by AI: the label scan and meal estimate, the recipe importer, and your buddy’s coaching notes and chat. These run through our own server, which passes your request to Anthropic (the Claude API) and returns the result. We never expose an AI provider key to the app, and you do not need to supply one.

When you use one of these features, only the content that feature needs is sent: the photo or text you submitted, or a short snapshot of the figures shown on your screen. Anthropic processes it on our behalf to return that single answer. Under Anthropic’s API terms, your content is not used to train their models, and we do not use it to train any model of our own.

Connecting Google Health

Availability. Google Health is currently enabled only on our own internal accounts while we complete the independent security assessment described above. It is not offered to users generally yet, so unless you have been told otherwise this section describes a connection you cannot currently make. It is written in full because the integration is live in the product, and it is how the feature will work when we open it up.

Connecting Google Health is optional. If you choose to connect it, Macrosaurus requests read-only access to a limited set of daily fitness and health signals so it can show your movement, sleep and recovery and adapt your coaching:

• Activity — daily step counts.
• Sleep — time asleep and, where your device reports them, sleep stages (deep, REM, light, awake).
• Health metrics — heart-rate variability (HRV), resting heart rate, and blood-oxygen (SpO₂).

We use this data only to power features you can see in the app — your Move, Sleep and Readiness dials, your sleep and readiness scores, streaks and coaching. Specifically:

• Access is read-only. We never write to, or change, your Google Health data.
• Your Google sign-in tokens are held securely on our server and are never exposed to the app or to any third party. The health readings are stored on your own account under row-level security, readable only by you.
• We do not sell this data, use it for advertising, or transfer it to data brokers, advertisers, or anyone else for their own purposes. We do not use it to develop, improve or train AI or machine-learning models, and we do not allow anyone we work with to do so.
• The one place it leaves our systems: if you use the AI coaching features (your buddy’s “deeper dive” and chat), a small snapshot of the figures on your screen is sent to Anthropic, our AI provider, to write that one reply. Where you have connected Google Health, that snapshot can include three derived daily values: your readiness score, your hours asleep last night, and today’s step count. It never includes raw Google Health records, your Google account details, or your Google tokens. Anthropic acts purely as our processor: it returns the reply and, under its API terms, does not use the content to train its models. If you do not use the AI coaching features, no Google Health data is sent to any third party at all.
• You can disconnect at any time from Settings in the app, or revoke access directly at myaccount.google.com/permissions. Disconnecting stops all future syncing and deletes the stored Google connection.

Limited Use of Google user data

Macrosaurus’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to any additional requirements that apply to Google Health and Fitness data. In particular, information obtained through Google Health is used only to provide and improve the user-facing features described above; is not transferred to others except as necessary to provide those features, with your consent, or as required for security or law; is not used for advertising; and is not read by humans unless you have given consent, it is necessary for security or to comply with the law, or the data has been aggregated and anonymised.

This applies to our use of AI as well. Neither the raw data we receive from Google APIs nor anything derived or aggregated from it is used to develop, improve or train any AI or machine-learning model, ours or a third party’s. Where an AI provider processes this data to deliver a feature you asked for, it does so as our processor, under terms that prohibit training on that content.

Cookies & analytics

We use only the storage needed to keep you signed in and to let the app work offline. We do not run third-party advertising trackers, and we set no advertising or cross-site tracking cookies.

We do use two privacy-respecting tools to keep the app working: PostHog (hosted in the EU) for product analytics, and Sentry for crash and error reporting. PostHog is configured to be cookieless, with session recording and autocapture switched off; Sentry is configured for errors only, with session replay and tracing switched off. Both record only what we need to run and fix the app — which actions you take (for example signing up, or logging a meal) and any errors, tied to your account id. They never receive your food names, your photos, your health values, or any data we receive from Google Health.

Your rights

Under UK GDPR you can ask us to access, export, correct or delete your data, and you can close your account at any time. To make a request, email olly@macrosaurus.com and we will action it.

Children

Macrosaurus is not intended for anyone under 18. If you believe a child has created an account, contact us and we will remove it.

Changes

If this policy changes in a meaningful way, we will update the date above and, where appropriate, let you know in the app.

Contact

Questions about your data? Email olly@macrosaurus.com.