Privacy Policy

1. Information we collect

Account information

• Email address (required to create an account) and the name you give us
• A hashed password, if you sign up with email — we never store your password itself
• If you sign in with Apple or Google, a stable identifier from them and the email address and name they share with us, and, for Apple, a token we store encrypted so we can revoke Trace's access when you delete your account (we do not receive your Apple or Google password)
• Feedback you send from the app, with your email address, account ID, app version, platform, and language

Health and profile information

• Health details you select during onboarding (up to three health concerns, plus any body goals and wellness focus areas you pick)
• Dietary preferences (vegetarian, vegan, halal, kosher, gluten-free, etc.)
• Body statistics: date of birth, biological sex, height, weight, weight goal, activity level
• Optional: GLP-1 medication details (the medication, your dose schedule and the doses you log), kidney dialysis status, menopause stage

Meal data

• Photos of meals and nutrition labels you scan (stored securely in our cloud storage)
• Meal entries — foods identified, portion sizes, nutrient estimates, timestamps, the meal type (breakfast, lunch, dinner, snack)
• Any edits or notes you add to a meal

Exercise, weight, water, and fasting data

• Exercise you log, including workouts you describe in words, plus your weight entries and water intake
• Intermittent fasting windows, which stay on your phone and are not sent to our servers

Apple Health and Health Connect

• If you connect them: your weight, daily step counts, workouts, and active calories burned (see §5)

Device and technical data

• A push-notification token (if you opt in to notifications)
• Device type, operating system version, app version, timezone, and locale — used for correct scheduling of reminders and for diagnostics
• Crash reports, error logs, and performance traces, which can include details of the request that failed — used only to find and fix problems
• Advertising identifiers: the anonymous ID Meta's SDK creates for your installation of the app, your Android advertising ID, and your iPhone's advertising identifier only if you allow tracking (see §6)
• Your IP address, which our servers use to limit abuse. RevenueCat, Sentry, and PostHog also receive it, and so do Meta and TikTok whenever their SDKs in the app contact their servers. RevenueCat may also pass it to Meta with the purchases it forwards (see §6).

Subscription events

• Whether your subscription is active, your plan (monthly or annual), whether you have used a free trial, and when your subscription renews or ends
• We do not receive, store, or process payment-card details. Billing is handled entirely by Apple and Google; Trace learns of purchases, renewals, and cancellations from RevenueCat (our subscription management provider).

Usage analytics

• Events about how you use the app (e.g. “user completed onboarding”, “user scanned a meal”), linked to your account ID rather than your name or email. Some events carry health answers as fixed codes, so we can see how Trace is used for each: the health concerns, goals, and wellness areas you picked (such as “gout”), whether you take a GLP-1 medication and which type, when you log a GLP-1 dose, your menopause stage, and which nutrient an insight is about. A crash event includes the start of the error message. This helps us understand which features matter and improve them.

Referral data

• Referral codes you use or share, referral status, reward amount and currency, and the name and email needed to deliver a reward if you earn one

2. How we use your information

• To operate the Service — authenticate you, sync your data across devices, show your history
• To analyse your meals and workouts — when you scan a meal or a nutrition label, describe a food or a workout in words, or correct a result, we send that content to our AI provider (see §4) to identify foods and estimate portions and nutrients, or to recognise the workout
• To calculate your personalised targets — we use your profile (age, sex, weight, activity, health concerns, goals) to compute daily calorie and nutrient targets based on published scientific guidelines (Mifflin-St Jeor, WHO, USDA) and health-concern-specific adjustments
• To generate insights — we analyse your logged meals across a week to surface patterns (e.g. “you're low on magnesium”) and suggest simple swaps
• To send you notifications — meal and GLP-1 dose reminders, daily tips, notes on your nutrition, and subscription offers, only where you have allowed notifications
• To prevent abuse and keep the Service secure — rate-limiting, fraud prevention, debugging
• To communicate with you — for account matters, such as password resets and replies to feedback you send
• To build Trace's shared food database — nutrition results for foods you describe and labels you scan can be added to a food database that everyone using Trace can search. They are stored without your name, email, or account ID; a one-way code made from your account is kept only so that repeat submissions from one person count once
• To measure our advertising — to see which of Trace's ads lead people to install the app and subscribe (see §6)

3. Who we share data with

Trace uses a small number of trusted service providers to run the app. Each is granted only the data necessary for its specific function, and is contractually bound to confidentiality and data-protection obligations.

• DigitalOcean — runs Trace's servers, in Singapore
• Neon (PostgreSQL) — our main database, in Singapore, where your account, profile, logs, and synced health data are stored
• Upstash (Redis) — short-lived data such as rate limits, subscription status, and cached lookups
• Cloudflare — stores your meal and label photos (Cloudflare R2) and hosts this website
• Google (Gemini) and Anthropic (Claude) — AI providers that analyse the content described in §4. Trace uses Gemini; Claude is a backup we can switch to. Content is sent over encrypted connections, analysed on their infrastructure, and the result is returned to Trace.
• RevenueCat — manages subscriptions. It receives your purchases from Apple and Google, your Trace account ID, and identifiers from your device (your IP address, your iPhone's vendor identifier or your Android ID, and the advertising identifiers described in §6), keeps your Pro access accurate, and may pass purchase events to Meta (see §6)
• Apple and Google — process all subscription payments through the App Store and Google Play, and confirm who you are if you sign in with Apple or Google. Trace does not receive your payment card details at any point.
• Meta and TikTok — receive app events and advertising identifiers so we can measure our ads (see §6). They never receive your health information, meals, or photos.
• Expo — delivers push notifications and app updates. For notifications it receives your device's push token and the notification text, which can mention your nutrition or your GLP-1 doses, and passes them to Apple's or Google's push service.
• Resend — delivers our emails, such as password resets, and sends feedback you submit in the app to our support inbox, which is hosted on Gmail
• PostHog — records pseudonymous usage events (see §1) to help us improve the product
• Sentry — captures crashes, errors, and performance data so we can fix problems. An error report can include details of the request that failed, including what you entered and your IP address.
• USDA FoodData Central — a food reference database we search by barcode for nutrient data. These requests contain only the barcode — never your identity or profile.
• Tremendous — delivers referral rewards if you earn one. We share only the name, delivery email, payout amount, and currency needed to send the reward.

Apart from the measurement data described in §6, we do not share your data with advertisers. We will only disclose your data to law enforcement if we are legally compelled to do so, and where permitted we will notify you.

4. AI analysis

Some Trace features use an AI service: Google's Gemini, with Anthropic's Claude as a backup. When you use them, Trace sends:

• photos of meals you scan
• photos of nutrition labels, with the barcode number when you photograph a label after scanning a barcode Trace could not find
• food descriptions you type
• workouts you describe in words
• corrections you write in Fix Results, with the meal's current ingredient list

Each request also includes your app language, so the result comes back in it. Trace does not send your name, email address, account ID, or health profile with these requests, and sends the content only to get the result back.

The app asks for your permission before it first sends any of this, and you can turn it off at any time in the app.

Neither service uses what Trace sends to train or improve its AI. Trace uses Google's paid Gemini API, under which Google does not use prompts, photos or responses to improve its products and keeps them for a limited time only to detect misuse. Anthropic does not train its models on what is sent through its API.

5. Apple Health and Health Connect

If you connect Apple Health on iPhone or Health Connect on Android, Trace reads your weight, daily step counts, workouts, and active calories burned. It writes one type of data back: the weights you log in Trace.

Trace stores what it reads with your account on our servers: your latest weight as a weight entry, your daily step totals, and each workout's type, duration, intensity, calories burned, and start time. We use it to show your activity and calories burned alongside what you eat, keep your weight history, and keep your targets up to date.

This data is never used for advertising or marketing, and it is never sent to Meta, TikTok, or our AI provider. Trace does not store it in iCloud.

You can stop syncing at any time with the Apple Health or Health Connect switch in Trace's Profile, or remove Trace's access in the Health app on iPhone or in Health Connect on Android. Data already synced stays in your Trace history and is deleted with your account.

6. Advertising and measurement

To measure and improve Trace's own ads, the app sends a small set of events to Meta and TikTok:

• Meta — app installs, launches, and sessions, finishing onboarding, and your first saved meal scan. When you start a trial, subscribe, or renew, RevenueCat may also send that purchase to Meta, together with your account ID or a hashed form of it. Meta matches these events using the anonymous ID its SDK creates for your installation of the app, your Android advertising ID, and, on iPhone, your advertising identifier (IDFA) only if you allow tracking.
• TikTok (Android only) — app installs and launches, finishing onboarding, your first saved meal scan, and starting a trial or subscribing. TikTok matches these events using its own app identifiers and your Android advertising ID.

These events contain no health information. Trace never sends Meta or TikTok your health profile, meals, meal photos, or Apple Health or Health Connect data, and never gives them your name or email address.

On iPhone, Trace asks whether you allow tracking, using Apple's App Tracking Transparency prompt. It asks during onboarding or, if you have already finished onboarding, once on Trace's Home screen. You can change your choice at any time in Settings > Privacy & Security > Tracking.

On Android, you can reset or delete your advertising ID in your phone's settings, under Settings > Privacy > Ads (on some phones, Settings > Google > Ads).

7. Meal-photo retention

Meal and label photos are deleted from our cloud storage 30 days after the meal is logged, by a job that runs once a day. If you log the same meal again, its photo is kept until 30 days after the latest time you logged it. Deleting a meal also deletes its photo, unless another meal still uses it; a meal can be deleted for up to three days after the day it was logged.

8. Data retention

We keep your account and health data for as long as your account is active. When you delete your account, we delete your account, profile, meal history, logs, and synced health data straight away, and we delete your photos from our cloud storage. Some records are not deleted with your account: usage events and crash reports already sent to PostHog and Sentry, our server logs, records of subscription events we received from RevenueCat (which keep your account ID), feedback emails you sent us, and food results you added to the shared food database (see §2). Your purchase records stay with Apple or Google and with RevenueCat.

9. Your rights

You have rights over the data we hold about you. Depending on your region, these include:

• Access — request a copy of the data we hold about you
• Portability — export your data in a machine-readable format
• Correction — update any inaccurate data
• Deletion — delete your account and the data associated with it (see §8)
• Objection and restriction — object to, or restrict, certain processing
• Withdrawal of consent — where processing relies on consent (for example, push notifications, AI analysis, or tracking on iPhone), withdraw it at any time

You can exercise most of these rights directly from the Profile screen in the app, including exporting your data and deleting your account. You can also email support@tracenutrient.com and we will respond within a reasonable time.

10. Security

We use TLS to encrypt data in transit between your device and our servers, and encryption at rest for stored data. Passwords are hashed with bcrypt. Access to production systems is restricted to authorised engineers and audited. No system is perfectly secure, but we take reasonable, industry-standard measures to protect your data.

11. Children

Trace is not intended for anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, please contact support@tracenutrient.com and we will delete it.

12. International data transfers

Trace's servers and main database are in Singapore. Our service providers (listed in §3) may process your data in other countries, including the United States and the European Union. Where we transfer data across borders, we rely on appropriate legal safeguards such as Standard Contractual Clauses or equivalent mechanisms.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you in-app or by email before they take effect. The “Effective” date at the top of this page always reflects the current version.

14. Contact

For privacy questions, data-access requests, or complaints, email support@tracenutrient.com. If you're in the EU or UK and you are not satisfied with our response, you have the right to lodge a complaint with your local data-protection authority.