Privacy Policy

Stacks is a personal workout and nutrition tracker. We store the data you log so the app can show it back to you. We don't sell it, we don't advertise against it, and we don't share it with third parties for marketing. We also collect anonymous, EU-hosted usage statistics to see which features people use and improve the app — they hold no personal or health data, and you can turn them off in the app.

Stacks is operated by Aurélien Durier (an individual), based in France. For any privacy question, write to the email at the bottom of this page.

When you create an account and use Stacks, we store:

• —Account: email address, hashed password, account creation date.
• —Profile: sex, year of birth, height, weight, activity level, fitness goal (cut/maintain/bulk).
• —Nutrition: meals you record, food entries, recipes, daily targets.
• —Workouts: exercises, sets, reps, weights, workout templates, sessions.
• —Body composition: bodyweight entries you record over time.
• —Technical: session tokens (so you stay signed in), and standard web-server access logs (IP, timestamp, requested route) kept by our hosting provider for security and abuse prevention.
• —Anonymous usage analytics: which features and screens you use, recorded as plain counters and flags (e.g. "a workout set was logged", "the weekly review was opened") tied to a random per-install identifier — never your meals, foods, exercises, or bodyweight values.

We do not collect: your contacts, your location, your photos, your microphone, or any health data from Apple Health or Google Fit. The camera permission is used only when you choose to scan a barcode — images are not stored or transmitted.

The legal basis under GDPR is the performance of a contract (article 6.1.b) — we need this data to run the app you signed up for. Without your meals and workouts, there is nothing to display.

Profile data (sex, age, weight, height, activity) is used to compute your daily energy and macro targets. We don't use it for any other purpose.

For the anonymous usage analytics described above, the legal basis is our legitimate interest(article 6.1.f) in understanding how the app is used so we can improve it. Because the data is anonymous and limited to our own product measurement, it does not override your rights — and you can object at any time by turning analytics off in Settings → Account & data.

If you enter your email on our website to be notified (for example about the Android version or product news), we store that email address, the page language, and the date you signed up, so we can email you about Stacks. The legal basis is your consent (article 6.1.a), given when you submit the form. This is separate from your app account: you do not need an account to join, and joining does not create one. We keep your email until you ask us to remove it, or until the waitlist purpose ends (for example once the Android app has shipped), after which it is deleted. We use Resend (EU region) to send these emails, and every message includes a one-click unsubscribe link. You can ask us to delete your address at any time by writing to the address at the bottom of this page.

If you turn on reminders and allow notifications, your device registers a push token that we store with your account, so our server can send the reminders you enabled (meals, weekly review, weigh-in) at the times you choose. The legal basis is your consent (article 6.1.a), given when you allow notifications and enable a reminder; you can withdraw it anytime by turning reminders off in Settings → Notifications or revoking the notification permission. The reminder text is generic and contains no personal or health data. We send these through Expo's push service, which relays them to Apple's notification service for delivery; Expo does not store the reminder text. We store the token only to deliver these reminders, and it is removed when you sign out or delete your account.

We use a small number of subprocessors, strictly to operate the service:

• —Hosting: Hostinger (VPS, European Union). The Next.js app and the Postgres database run there.
• —Database backups: Cloudflare R2. A daily Postgres backup, encrypted at rest, retained for 30 days. International transfer covered by Cloudflare's Standard Contractual Clauses.
• —Transactional email: Resend, EU data region (Ireland). Used to send account and transactional emails. Processed in the European Union and covered by Resend's GDPR-compliant DPA.
• —Crash reporting (iOS app only): Sentry (EU region, hosted in Frankfurt, Germany). Receives stack traces, device model, OS and app version. We have configured the SDK to drop IP addresses, request bodies, and user identifiers before sending — your meals, workouts, and bodyweight are never included.
• —Product analytics: PostHog (European Union region, eu.i.posthog.com). Receives anonymous usage events — feature and screen usage as counters and flags, plus device model, OS and app version. We never call its identify function, so events are not linked to your account, and your meals, foods, exercises, and bodyweight values are never sent. Processed in the EU and covered by PostHog's GDPR-compliant DPA. You can switch it off in Settings → Account & data.
• —Food database lookup: Open Food Facts (French non-profit, EU-hosted). When you scan a barcode or search for a food, the app queries Open Food Facts. The query and your IP address are visible to them; no account information is shared.
• —Push notifications: Expo (Expo Push service, operated by 650 Industries, Inc., United States) relays reminder notifications to Apple's notification service. It receives the device push token and the generic reminder text (which it does not store), and no personal or health data. 650 Industries self-certifies under the EU-US Data Privacy Framework, which covers the transfer to the United States.

We never sell your data, and we don't share it with advertisers, data brokers, or AI training pipelines. The product analytics above is anonymous and used only by us to improve Stacks.

As long as your account exists. When you delete your account from Settings → Account & data → Delete account, all your data is permanently removed within 30 days, except minimal records we're legally required to keep (e.g. proof of consent), which are erased after their statutory retention period.

Under GDPR, you have the right to:

• —Access your data (Settings → Account & data → Download my data exports a JSON copy).
• —Correct inaccurate data (edit it directly in the app).
• —Delete your account and all related data (Settings → Account & data → Delete account).
• —Object to or restrict processing — including turning off anonymous usage analytics (Settings → Account & data).
• —Lodge a complaint with the CNIL (cnil.fr) if you believe your rights are not respected.

To exercise any of these rights, you can act directly in the app, or email the address at the bottom of this page. We respond within 30 days.

Passwords are hashed (never stored in clear). Traffic between the app and our server is encrypted (HTTPS). Database backups are encrypted at rest. Access to production data is limited to the operator and audited.

Stacks is not intended for users under 16. If you believe a child has created an account, contact us and we will delete it.

If we change this policy, we'll update the effective date at the top and, for material changes, notify you in the app before the change takes effect.