Privacy Policy

Last updated 1 November 2026 · version 2026-11-02.1

This policy explains what personal data MacroArc ("we", "us") collects through the MacroArc app and website, why, who it is shared with and the choices you have. We are the Data Fiduciary for your data under the Digital Personal Data Protection Act, 2023. We collect only what we need to run the app.

1. What we collect

Account details: your name, email address and an encrypted (hashed) password. If you sign in with Google, we receive your name, email address and Google account ID from Google.

Health and profile information you provide: age, sex, height, weight, goal weight, activity level, dietary preferences, allergies and injuries. This is sensitive information and we treat it with extra care.

Health conditions and medicines, only if you choose to add them: the conditions you pick or type (for example diabetes or high blood pressure) and the medicines you list. We ask for your separate consent before saving them, use them only to tailor your diet and workout plans (they are sent to the AI with your plan request), and you can change or remove them at any time in Profile > Health. Removing them also withdraws that consent. Plans are general guidance, not medical advice.

What you log: meals, foods, portions, water, weight, notes, meal photos, meal descriptions and food searches.

Plans: the choices you make when creating diet or workout plans, and the plans generated.

Purchases: subscription status and payment references. Card or UPI details are handled by Google Play and never reach us.

Device and usage data: push notification token, app version, your phone's time zone (so streaks and reminders follow your day), and in-app usage events used to improve the app: which screens you open and for how long, which features you use, and the screen you were on when you left the app. They are linked to your account and kept for up to 12 months. These events stay on our own servers; we do not use third-party analytics or advertising tools.

Crash reports: if the app or our server hits an error, we record the error message and technical details, the screen you were on, the app version and your account, so we can fix it. They stay on our own servers and are kept for up to 90 days.

Feedback: messages and ratings you send from the app, with your email so we can reply.

2. Why we use it, and your consent

To provide the service: calculate your targets, analyse meals, suggest foods, write plans, show your progress and send the notifications you ask for.

To keep the service safe and working: preventing abuse, fixing problems, securing accounts and meeting our legal obligations.

We process your data with your consent, which you give when you create an account and accept this policy, and when you choose to use a feature such as Snap-to-track. You can withdraw consent at any time as easily as you gave it, by deleting your account or emailing us; we then stop processing your data, except where the law requires us to keep it. Withdrawing consent means we can no longer provide the service to you.

We do not sell your personal data, and we do not use it for third-party advertising. Offers and PRO reminders are sent only while that notification setting is on.

3. AI processing

When you snap a meal, use Chat-to-track, ask for AI food suggestions in search, or create a plan, the relevant photo, text and profile details are sent to Google's Gemini AI models on Google Cloud (Vertex AI) to produce the result; a second Gemini model checks meal estimates. Google processes this data on our behalf under its paid business terms, which do not allow it to be used to train its models.

Foods the AI suggests for a search are added to the shared food list so other people can find them too. They are saved without your name or account details; only the search words are used.

Foods you add or correct yourself are private to you: only you find them in search and Chat-to-track, where they come before the shared list. Once a day an AI model reviews new private foods; one that is a common food with plausible nutrition is copied to the shared food list, with only its name, serving and nutrition and nothing that links it to you. Your own food stays as it is. To keep personal details out of the shared list, the review leaves out anything that looks like a private recipe or names a person.

To keep the AI features accurate and safe, we keep a record of each AI request, including the photo or text you sent and the model's response. Authorised MacroArc staff can review these records to investigate problems or misuse; every review is logged. These records are deleted automatically after 90 days.

4. Who we share it with, and where it is stored

Service providers that process data for us, only to run MacroArc and under contracts that require them to protect it: Amazon Web Services (hosting and storage), GoDaddy (email), Google Cloud (AI models), Expo, Google and Apple (push notifications), and Google Play (payments).

Your account data is stored on Amazon Web Services servers in Mumbai, India. Meal photos and plan PDFs are stored with Amazon Web Services in Mumbai, India, and AI requests may be processed by Google Cloud outside India. We transfer personal data outside India only as the Digital Personal Data Protection Act, 2023 and Government of India orders allow.

Authorities, when required by law or to protect the rights and safety of our users or others.

5. How long we keep it

We keep your account data while your account is active. AI request records are kept for 90 days.

When you delete your account it is closed immediately: you can no longer sign in, it is removed from the app and we stop using your data. The closed account's records are kept for 30 days, so we can help if the deletion was a mistake or unauthorised, and are then permanently erased, except what we must keep by law (for example, payment records for tax purposes, and security logs for the period the law requires).

6. Security and breaches

Data is encrypted in transit, and meal photos and plan files are stored encrypted. Passwords are stored as one-way hashes. Sign-in tokens on your phone are kept in the device's secure storage. Access to personal data within MacroArc is limited and logged.

If a personal data breach affects you, we will tell you without delay what happened, its likely impact and what we are doing about it, and report it to the Data Protection Board of India and CERT-In as the law requires.

7. Your rights and choices

You can view and edit your profile and logs in the app, turn notifications on or off in settings, and ask for a summary or copy of your data, its correction or completion, or its erasure.

You can withdraw your consent at any time, and nominate another person to exercise your rights if you die or become unable to.

You can delete your account yourself in the app (Profile → Delete account) or on our account deletion web page.

To exercise any of these rights or raise a grievance, email support@macroarc.in. We respond within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

8. Children

MacroArc is only for adults (18 and over); the app does not accept a younger age at sign-up. We do not knowingly collect children's data. If you believe a child has created an account, contact us and we will delete it.

9. Changes and contact

We will tell you in the app about significant changes to this policy before they apply, and you may be asked to accept it again.

Grievance officer and the person who answers questions about your data: email support@macroarc.in.