Effective date: 18 October 2026
MacroTracker estimates the calories and macronutrients in a meal from a photograph. This policy describes what the app does with your information.
All of it, unless it is named in the next section.
Every meal you log, its photos, your daily goals, your height, weight, age and activity level, your location history, and any API key you enter are stored on your device. They are not uploaded, backed up to us, or shared. We do not store your meal diary on our servers. The separate credit ledger described below stores purchase and token-usage records.
Your log is also mirrored into your device's Keychain so that deleting and reinstalling the app does not lose it. That mirror is part of your device's own encrypted storage and, if you use encrypted iCloud or computer backups, it travels with those backups under Apple's protection rather than ours.
When you photograph or describe a meal and ask for an estimate, the app sends a single request containing:
The app does not send your name, email, advertising identifier or GPS coordinates with an analysis request. Built-in AI requests include Apple-signed app/purchase proof and a request identifier so our credit service can verify access and meter usage. The credit service can associate those requests with your Apple-provided app transaction identifier. It removes Apple proofs and request identifiers before forwarding the meal to the AI provider.
The request goes to one of the following, depending on how the app is configured and which providers are available:
Their handling of that request is governed by their own privacy policies and their terms for API traffic. We do not control how long they retain it.
Requests reach those services through a relay we run on Cloudflare Workers. It holds the provider API key so that the app does not have to carry one, forwards your request, and passes the answer back. It does not store your photo or the text you sent. Neither is written to disk or to a database, and nothing is kept that could reconstruct a meal request after it has been answered. Token-usage metadata is retained separately.
Two things about the relay are worth stating plainly rather than leaving you to assume:
This page and the support page are served by that same relay.
If you supply your own API key in Settings, the app talks to that provider directly using your key, and requests do not pass through the relay at all.
Apple processes subscription payments. For built-in AI, our Cloudflare service verifies Apple-signed app and purchase transactions. It stores the Apple-provided app transaction identifier, subscription transaction identifiers, product identifiers, purchase times, token grants and refund/revocation state. It also stores request identifiers, request times, reserved/consumed token counts and completion state. We do not receive your payment card details or Apple Account email.
These records provide the shared balance across devices, one-time starter eligibility, rollover, purchase restoration, refunds and protection against repeated grants. They are linked to the app transaction identifier and are used for app functionality and service protection, not advertising or cross-app tracking. Photos, meal text and precise coordinates are not stored in the ledger or forwarded with Apple purchase proofs.
We retain purchase grants and usage totals to maintain unspent credits and handle purchase restoration, refunds, disputes and abuse. There is currently no automatic expiry of these ledger records. The one-time starter eligibility record must be retained to prevent repeated claims after reinstall. Deleting the app or erasing meals does not delete this financial ledger or cancel an Apple subscription.
Contact support below to request access, correction or deletion of credit-service information. We may need purchase information to locate your records and verify the request. We review deletion requests and retain records still needed for unspent credits, purchase/refund obligations, accounting or preventing repeated starter claims. Do not send your Apple password or full signed purchase proof by email. Apple manages cancellation and payment details in its subscription settings.
Location tagging is off until you turn it on, in Settings → Location.
With it on, the app takes a location fix and uses Apple's Maps services to work out which restaurant or cafe you are in. Your coordinates are used on your device to place a meal on a map and are stored with that meal locally. They are never sent to the analysis service — only the venue name, its category, the district and the city are, as described above.
Reverse geocoding and the nearby-venue search are performed by Apple's Maps services, which necessarily receive an approximate location to answer the query. That is Apple's system service, handled under Apple's privacy policy, not ours.
Turning location tagging off stops the app requesting a fix at all.
If you allow it, photos you take inside the app are saved to your photo library at full resolution — the same thing the Camera app does. That needs only add-only access: it can put a photo into your library and cannot read what is already there. Photos you pick from your library are not copied back.
Choose from library uses Apple's photo picker. You can select up to 30 photos without granting access to the rest of your library. One photo opens the usual meal review; multiple photos are prepared on your device as separate meals. You choose which to estimate before their resized photos and any note you entered are sent to the analysis service. Capture dates stay with the meals on your device.
Find meals in Photos is the one feature that reads your library, and it asks for that access only when you first use it. It looks at photos from the period you choose, on your device, to find ones that show food; photos without food are never sent anywhere. You then see the meals it found and choose which to estimate — only those meals' photos (resized, and combined into one image per meal) are sent to the analysis service, the same way a single photo is. Screenshots, shared albums and hidden photos are skipped. The app keeps a list on your device of which photos it has already dealt with, so they aren't sent twice; Erase all meals clears it.
The app can let the analysis service search the web mid-estimate for a packaged product's label or a named restaurant's published figures. Only the food is searched for — never you, and never a venue's address. This can be switched off in Settings → Photo analysis.
MacroTracker is not directed at children under 13, and we do not knowingly collect information from them. It is rated 4+ because it contains no objectionable content, not because it is designed for young children. Calorie tracking is not appropriate for everyone.
The meal diary is local; the separate Apple purchase and AI credit records are described above. Contact support about those records. Requests already sent to an AI provider are handled under that provider's policy.
Everything sent to a provider goes over HTTPS. API keys you enter are stored in your device's Keychain, marked so that they never leave the device and are never included in a backup.
No system is perfect, and an estimate request is only as private as the service answering it. If that matters to you, supply your own API key so your requests go directly to a provider you have your own agreement with.
If this policy changes, the effective date above changes with it, and material changes will be noted in the app's release notes.
Questions about this policy, or about anything the app does with your information: xtde8in7o@relay.firefox.com.