Privacy Policy

1. Data controller

The data controller is Mansour Habibou Hamani, sole proprietor (entrepreneur individuel) under French law, trading as Ascelyo Software, SIREN 104386834, with registered office at 2 boulevard Georges Méliès, 94360 Bry-sur-Marne, France.

For anything concerning your personal data, write to support@macro-recipe.com. Privacy requests are handled directly by the controller.

2. Data we collect

Data you provide directly. Account data: your email address, a display name, an optional profile picture, and either a password (stored only as a bcrypt hash — we never see or keep the password itself) or your Apple or Google sign-in identifier if you use social login.

Profile data you enter during onboarding or in settings: age, sex, weight, height, country and optionally your city, preferred measurement system, language and timezone. These feed the macro calculation and menu generation — nothing else.

Food data: your goal, your dietary preferences and exclusions (for example vegetarian or halal, or specific foods you avoid), your allergies, your grocery budget and your macro targets.

Content you create in the app: generated menus and recipes, meals you log, your pantry, your grocery lists, and — only if you opt in — grocery prices you choose to share with the community.

Some of this data is sensitive by nature. A dietary preference such as halal or kosher can indirectly reveal a religious belief, and an allergy can reveal health information (Article 9 GDPR). We process these fields only with your explicit consent, which you give by filling them in. They are used solely to filter and personalise your menus. To do that, they are sent to our AI providers without your name, email address or account identifier (section 5). They are never sold or used for advertising, and you can change or clear them at any time.

Our database schema also contains optional profile fields (such as occupation or religion) that the app does not currently ask for. If the interface never requests a field, we do not collect it: it simply stays empty.

Data collected automatically. Server logs: the IP address and technical request information (user-agent) of calls to our API, kept for security and abuse prevention.

Push notifications: your device's Expo push token, only if you enable notifications, stored with your account, plus a log of the notifications we sent you.

AI usage metadata: when menu generation runs, we record technical metadata about the call (timestamps, volumes, model used) linked to your account on our own servers, to enforce quotas and audit costs. This metadata never enters the prompt sent to the model — see section 5.

Security tokens: short-lived session, password-reset and email-verification tokens.

Usage events: how you use the app — the sign-up steps, the purchase screen (shown, button pressed, purchase failed), how you build and adjust your menu, the menus, recipes and ready-made menus you open and the menu you adopt, your searches (their length and number of results, never the text), the recipes you cook and the steps you complete, the meals you log, the grocery items you check off, the app moving to the foreground or background (screen, time away), your answer to the notification permission request, the result of sign-ins and sign-ups (Apple, email), the calorie figure you choose when the app warns you that it is far from its recommendation, and the errors the app runs into (error message, screen, app version, platform). They are recorded on our own servers with an install identifier and, once you have an account, your account identifier, so we can see where the app fails or loses people. Those linked to your account are erased with it. Those recorded before you created your account, including while you used a temporary account, carry only the install identifier and are not erased with your account.

Install attribution: the app includes the AppsFlyer SDK, which tells us which ad campaign (for example on TikTok or Apple Ads) led to an install. Section 6 lists what AppsFlyer receives.

Data we do not collect. No advertising in the app, and no advertising identifier (IDFA): the app never asks for permission to track you, and the AppsFlyer SDK is built in its “strict” mode, which does not contain the code that reads that identifier. No Google Analytics, Mixpanel or PostHog. No precise location, and never your card or bank details: payment runs entirely through Apple's App Store, not through us.

3. Purposes and legal bases (Article 6 GDPR)

Performance of the contract (Article 6(1)(b)): creating and managing your account, generating your menus and recipes, computing macros and budgets, managing your subscription, sending service notifications and answering support requests.

Legitimate interest (Article 6(1)(f)): keeping the service secure — server logs, rate limiting, anti-abuse checks on accounts and quotas, and error monitoring so we can fix bugs; understanding where the app fails or loses people (usage events); and measuring which of our ad campaigns bring installs (AppsFlyer).

Consent (Article 6(1)(a)): sharing grocery prices with the community (an opt-in you can withdraw at any time) and any optional profile field you choose to fill in.

Explicit consent (Article 9(2)(a)): dietary preferences and allergies that may indirectly reveal a religious belief or health information, as described in section 2.

Legal obligation (Article 6(1)(c)): keeping billing records for 10 years under Article L123-22 of the French Commercial Code.

4. Data retention

Your account data and the content you create are kept for as long as your account exists.

If you start without creating an account, your answers and your menu are kept under a temporary account. If that account has not prepared any menu, it is automatically deleted after 2 hours; otherwise, after 30 days without activity. A temporary account with an active subscription is not deleted while the subscription is active.

You can delete your account at any time in the app: tap your avatar to open your profile, then Account › Delete my account. The account is deactivated immediately, and all of your data is then permanently and automatically erased after a 30-day grace period. Deleting your account does not cancel an App Store subscription: cancel it in your iPhone's Settings › your name › Subscriptions.

Security tokens are short-lived: password-reset links are valid for 1 hour, email-verification links for 24 hours, and sessions for 7 days before they must be renewed (30 days for a temporary account, one year for a temporary account with a subscription).

Server logs are kept for the time strictly necessary for security and abuse prevention.

Billing records are kept for 10 years, as French commercial law requires.

5. Artificial intelligence

MacroRecipe uses AI models from two providers, at different steps. Here is exactly what each one receives.

Choosing your dishes (OpenAI). An AI agent picks the dishes of your menu from our catalogue. It receives your nutrition targets for the day and for each meal (calories, protein, carbohydrates, fat), your goal, your language, the number of servings, your allergies, the foods you avoid, your diets, your preferred cuisines, your country, your meals of the day and breakfast preferences, the dishes you pinned or ate recently and, when you ask to cook from your pantry, the names of the products in it.

Searching the catalogue (OpenAI). To find matching dishes, OpenAI turns short texts into vectors (embeddings): dish descriptions (name, cuisine, origin, ingredients), the dish names proposed while your menu is chosen, the dish recognised in a meal photo, the ingredient names looked up while a recipe is adapted to you, and the optional craving you type.

Adapting and writing recipes (Anthropic). To adapt a dish to you and write its steps, Anthropic receives the dish (name, cuisine, origin, ingredients, steps), your per-serving nutrition targets, the number of servings and your constraints — allergies, diets, budget per serving, substitutions, foods to avoid, spices, cooking methods, equipment, and the optional craving, limited to 280 characters and cleaned before sending. Translations, price estimates and recipe imports also go through Anthropic. When you ask for a dish that is not yet in our catalogue, Anthropic receives its name so it can write the recipe.

Photos (Anthropic). When you scan your pantry, photograph a meal to recognise it or estimate its macros, or import a recipe from a photo or a video, the images are sent to Anthropic. Each photo is first re-encoded on our servers, which removes its metadata, location included. We do not keep the photo itself. A photo shows whatever is in the frame: photograph the food, not people.

Video imports (OpenAI). When you import a recipe from a TikTok, Instagram or YouTube link, the audio track of the video (3 minutes at most) is sent to OpenAI's whisper-1 model to be transcribed; the transcript then goes to Anthropic with the post's title and caption and a few images from the video.

Weekly review (Anthropic). When you open your weekly review, Anthropic receives your current targets and the averages of what you logged that week (calories, protein, carbohydrates, fat) with their gap to your targets, how closely you followed your menu and how many planned meals you kept, the days on which you logged meals (date and number of meals) and the grocery budget you spent with its ceiling, so it can suggest new targets.

Your identity (name, email address, account identifier) is never transmitted to these AI providers — and neither are your age, sex, weight or height. They cannot link a request to your name or your account.

Our AI providers are bound by contract — professional APIs with data processing agreements — not to use these requests to train their models.

To be precise: your targets, dietary constraints, allergies, the averages of your week and the photos you choose to send do reach these providers. Nothing that names you or your account does.

6. Processors and international transfers

We use a small number of carefully chosen processors. Each one receives only what its job requires.

Hetzner Online GmbH (Germany) hosts our servers and database. All hosting takes place in the European Union; nothing leaves the EU at this layer.

Resend (USA) delivers our transactional emails — account verification, password reset, data-export links. It receives your email address, your name and the signed links contained in the message. Transfers are covered by Standard Contractual Clauses and a data processing agreement.

RevenueCat, Inc. (USA) manages subscription entitlements. It receives your MacroRecipe account identifier and your purchase and entitlement status — never your payment details. Transfers are covered by Standard Contractual Clauses and a data processing agreement.

Apple (Ireland and USA) processes in-app payments through the App Store — the only payment channel MacroRecipe uses. Your payment details stay with Apple; we only learn whether the purchase succeeded. Transfers are covered by Standard Contractual Clauses and data processing agreements.

Anthropic, PBC (USA) provides the language model that adapts and writes recipes, translates them, estimates prices, reads imported recipes, recognises the food in your photos and proposes new targets from your weekly review. As described in section 5, it receives your constraints, targets, the averages of your week and photos — never your name, email address or account identifier. We use its professional API under Standard Contractual Clauses and a data processing agreement that excludes training on our requests.

OpenAI (USA) provides the agent that chooses the dishes of your menu, computes embeddings (text-embedding-3-small) of dishes and of the craving you type, and transcribes the audio of imported videos (whisper-1). As described in section 5, it receives among other things your nutrition targets, goal, allergies, diets, foods to avoid, cuisines, pantry and country — never your name, email address or account identifier. Transfers are covered by Standard Contractual Clauses and a data processing agreement.

Sentry (Functional Software, Inc., USA) collects error reports from our backend so we can fix bugs. An error report may include the account identifier or email address of the account affected by the error. Transfers are covered by Standard Contractual Clauses and a data processing agreement.

Expo (USA) delivers push notifications using your device's push token. Transfers are covered by Standard Contractual Clauses.

AppsFlyer Ltd. (Israel) measures which ad campaign led to an install of the app (attribution), for example on TikTok or Apple Ads. Through its SDK, AppsFlyer receives technical data about your device (model, iOS version, language), your IP address (which gives an approximate location), an install identifier it generates, the identifier for vendor (IDFV) and app launches. AppsFlyer also receives the ad clicks or views that ad networks and Apple's attribution systems (SKAdNetwork, AdServices) report to it. When it attributes an install to an ad network, AppsFlyer can notify that network (for example TikTok) so it can measure its campaign. It does not receive your name, email address or account identifier, nor the advertising identifier (IDFA): the SDK is built in its strict mode, without the code that reads it, and the app never shows the tracking permission prompt. Legal basis: our legitimate interest in measuring our ad campaigns (section 3). Data may leave the EU: Israel benefits from an adequacy decision of the European Commission, and transfers to the USA are covered by the Standard Contractual Clauses of AppsFlyer's data processing agreement.

Firecrawl (USA) fetches the public web page whose address you paste to import a recipe. It receives that address only — nothing about you or your account.

Open Food Facts is an open-data source (ODbL licence) we use for nutrition and price data. It is not a processor: we read from it, and it receives nothing about you.

Where the processors above receive personal data outside the European Union, the transfer is governed by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) or by an adequacy decision of the Commission (Israel).

7. Cookies and local storage

The mobile app uses no cookies. It keeps on your phone an install identifier, used for its usage events (section 2). The AppsFlyer SDK keeps its own install identifier there and reads the identifier for vendor (IDFV) (section 6).

The macro-recipe.com website is a static site: no cookies, no trackers, no analytics scripts. That is why you see no cookie banner — there is nothing to consent to.

8. Minors

MacroRecipe is intended for users aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child under 16 has created an account, contact us at support@macro-recipe.com and we will delete it.

9. Your rights

Under the GDPR you have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21), plus the right to withdraw any consent at any time without affecting past processing.

The two most common requests are built into the app, from your profile (tap your avatar): Privacy › Export my data prepares an archive of all your data and emails you a signed download link, and Account › Delete my account permanently deletes your account, as described in section 4.

For everything else, write to support@macro-recipe.com. We respond within one month, as the GDPR requires.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French supervisory authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

10. Security

All traffic between the app and our servers is encrypted in transit (HTTPS/TLS). Passwords are hashed with bcrypt and are never stored or logged in clear text.

Sessions rely on short-lived access tokens with rotating refresh tokens. Password-reset and verification links are single-purpose and expire quickly (see section 4). Our API applies rate limiting to prevent abuse.

In the event of a personal data breach likely to result in a risk to your rights, we will notify the CNIL within 72 hours and inform you directly if the risk is high, as Articles 33 and 34 GDPR require.

11. Contact

For any question about this policy or your personal data: support@macro-recipe.com. The controller identified in section 1 answers privacy requests personally.

12. Changes to this policy

We may update this policy as the product or the law evolves. The date at the top always reflects the current version. If a change materially affects how your data is processed, we will inform you in the app or by email at least 30 days before it takes effect.