Privacy Policy

What Macrodex stores

• Account: your email address and an authentication record. Passwords are hashed by our authentication provider - Macrodex never sees or stores your password.
• Health and body data: body weight logs, and the intake details you provide when generating a plan (age, height, weight, sex, activity level, goals and target weight). This is the most sensitive data in the app. It is collected only with your explicit consent and used only to build and review your plans.
• Plan and tracking data: your meal plans, diary entries and meal completions, prep checklists, and shopping lists.
• AI conversations: transcripts of the chats you have with the plan generator and plan editor, saved so you can re-read and download them.
• Preferences: timezone, theme, notification settings, and preferred weight unit.
• Notification subscriptions: if you enable meal reminders, an anonymous push endpoint identifying your browser or device, plus the encryption keys needed to deliver a notification to it. This identifies a device, not a person, and is deleted when you turn reminders off.
• Subscription status: whether you have an active subscription, which plan, your Stripe customer and subscription IDs, and when the current period ends, plus a log of Stripe's billing events (renewal, cancellation, payment problem). Card details are entered on Stripe's checkout page and never reach Macrodex's servers.
• Messages to us: if you use Contact us, your message, your email address, your account status, and your browser and app version, so we can answer you. The message reaches us by email and is kept with the operational logs.
• Operational logs: server-side records of key events and errors (sign-in failures, plan generation, subscription changes) used to run and debug the service.

Who else processes it

Macrodex relies on a small number of service providers:

• Supabase - database and authentication.
• Resend - delivers account emails (confirming your address, resetting your password), billing notices such as a withdrawal confirmation, and the messages you send through Contact us.
• Vercel - application hosting and privacy-friendly, aggregate usage analytics.
• Anthropic - powers plan generation and plan review. The intake details, goals, and plan data needed for the request are sent to the Anthropic API. Anthropic does not use data submitted through its API to train its models.
• Stripe - processes subscription payments and tells Macrodex when a subscription starts, renews, or ends. Stripe receives your email address, your Macrodexaccount ID, and the payment details you enter at checkout; Macrodex only learns the outcome.
• Push services (Apple, Google, Mozilla, depending on your browser) - deliver meal reminders to your device if you enable them.

These providers process data on Macrodex's behalf to deliver the service. Macrodex does not sell or rent your information to anyone.

Why it is stored

Your account data exists to sign you in. Your plan, intake, weight, and diary data exist to generate plans, show your progress, and produce AI reviews. Notification subscriptions exist to send the reminders you asked for. Messages you send us exist so we can answer them. Subscription and log records exist to run the service, honour the access you paid for, meet accounting obligations, and investigate problems. Macrodex does not use your data for any other purpose.

Plans and progress reviews are written by an AI model from what you enter. They are suggestions you can edit or ignore, and no decision with legal or similarly significant effects is made about you automatically.

Legal bases (EEA, UK, and Switzerland)

• Your explicit consent for your health and body data. You can withdraw it at any time in Settings → Health data, which deletes that data. Withdrawing does not affect what was done before.
• Our contract with you for your account, plans and tracking data, preferences, notifications, and subscription.
• Our legitimate interests in keeping the service secure, preventing abuse, fixing problems, and understanding aggregate usage, for operational logs and analytics.
• Legal obligations for billing and accounting records.

International transfers

Sotek LLC and its service providers are based in the United States, so your data is processed there. Transfers from the EEA, UK, and Switzerland rely on the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as set out in each provider's data processing terms.

How long it is kept

• Account, plan, tracking, and health data: until you delete it or your account, or withdraw your consent for health data.
• Notification subscriptions: until you turn reminders off, or the browser drops them.
• Billing records: as long as accounting and tax law requires.
• Operational logs: 12 months, then deleted automatically.

Data stored on your device

Macrodex is an installable web app that works offline. To do that, it keeps a copy of your recent plan and diary data in your browser's local storage, along with small preferences such as dismissed prompts. This stays on your device. Signing out clears it.

Deleting your data

You are in control of all of it, from Settings:

• Download my data gives you a copy of everything above, as a file you can keep or take elsewhere.
• Delete all data removes every plan with all its history, your weigh-ins, AI conversations, and intake details, keeping your login.
• Health data withdraws your consent and deletes the same data, keeping your login.
• Delete my account permanently removes your login and everything attached to it. This is immediate and cannot be undone.

Deleting your account cancels an active subscription immediately. Afterwards, Stripe's billing event records are retained without any link to you, because payment records are required for accounting; Stripe keeps its own payment records under its privacy policy. Operational logs may keep a user identifier for up to 12 months, for security and debugging.

Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to how it is processed, and withdraw any consent you gave. Most of this you can do yourself in Settings (Download my data, Delete all data, Health data). For anything else, email support@sotek.io from the address you sign in with and we will respond within one month. If you are in the EEA, UK, or Switzerland, you can also complain to your local data protection authority.

Security

Data is transmitted over encrypted connections and stored with per-user access rules that prevent one account from reading another's data. No system is perfectly secure, butMacrodex limits what it collects and who can reach it.

Children

Macrodex is only for people aged 16 and older. If we learn that we hold data about someone younger, we delete it.

Changes

If this policy changes materially, the date at the top of this page will be updated and the app will ask you to accept the new version.

Contact

Questions, requests, or concerns: Sotek LLC, support@sotek.io