Start now

Privacy Policy

Last updated · 2026-10-27

FoodPlanAI is now OnMacros. Same service, same company.

This policy covers OnMacros (the iPhone app, the Android app, the web app at app.foodplanai.app, and this website). All of them use the same account and the same service. It explains what personal data we collect, why, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and Romanian Law 190/2018.

1. Data controller

The data controller is INNOSD LABS SRL, CUI 36529160, Str. Valea Chintaului nr. 48A ap. 1, 400647 Cluj-Napoca, Romania. Contact for data protection matters: hello@onmacros.com. We have not appointed a Data Protection Officer; privacy requests are handled directly.

2. What we collect

2.1 When you visit this website

  • Standard server logs from our hosting provider (Vercel): IP address, user agent, requested URL, referrer, timestamp. Used for security and operational monitoring only.
  • We use PostHog, a product analytics service hosted in the European Union, to understand how visitors use this site. Visitors from the European Union, the United Kingdom, and the European Economic Area are shown a consent banner and nothing is captured until they accept it. Visitors from outside those regions are captured by default and can opt out at any time. We also record sessions. A recording captures what is shown on the page and what is typed into forms, except password fields which are never captured. We do not sell analytics data and we do not use it for advertising.

2.2 When you create an account and subscribe

  • Account data: your email address, your name if you give it, and the identifier of the sign in method you use (Sign in with Apple or an emailed sign in link).
  • Payment data: payments are handled by Apple, Google Play, or Stripe through RevenueCat. We do not see or store your full card number. We receive your subscription status, plan, renewal date, and cancellation events.

2.3 When you use the apps

  • Profile and goals: sex, birthdate, height, weight, activity level, preferred foods, language, time zone, and the daily calorie and macro targets you or the app set.
  • Food logs and meal plans: what you eat, in which amounts and at which meal, and the plans you create.
  • Weight and daily metrics: weigh ins, and sleep and energy if you log them.
  • Training logs: workouts you log.
  • Chat conversations: your messages to the AI assistant and its replies.
  • Memories: facts about your preferences that you confirm so the assistant can remember them.
  • Meal photos: photos you attach to a message. They are stored in a private Cloudflare R2 bucket, shown to you through short lived signed links, and sent to an AI model so it can estimate the meal.
  • Voice notes: audio you record to log a meal is sent to OpenAI for transcription (both recorded and realtime voice). We do not store the audio. The transcript is then tidied by an AI model and treated like any other message.
  • Push notification tokens: a device token so we can send you reminders, if you allow notifications.
  • Coach sheet (early access): if you connect a Google Sheet from a nutrition coach, we read and write the cells you authorize.
  • App analytics: product events and, where you allow it, usage recordings, sent to PostHog in the European Union and linked to your account identifier.

2.4 Health data

Your weight, food logs, and training can reveal information about your health. We process this only with your explicit consent under Art. 9(2)(a) GDPR, which you give when you create your account. You can withdraw it at any time by deleting your account (see Section 7).

3. Why we collect it (legal bases)

  • To deliver the service (Art. 6(1)(b) GDPR, contractual necessity): running your account, the food log, the AI assistant, your subscription, and customer support.
  • Explicit consent for health data (Art. 9(2)(a)): see Section 2.4.
  • To comply with legal obligations (Art. 6(1)(c)): retaining invoices and accounting records as required by Romanian tax law, responding to lawful requests from authorities.
  • Our legitimate interests (Art. 6(1)(f)): preventing fraud, securing the service, and improving the product. Where we rely on legitimate interests, you have a right to object, see Section 7.
  • Consent (Art. 6(1)(a)): for analytics on this website for visitors in the European region, and for push notifications.

4. Who we share data with

We share personal data with the following processors, each bound by a data processing agreement and operating under their own published privacy policies:

  • Vercel Inc., hosting, serverless functions, and the AI Gateway that routes requests to the AI model vendors below.
  • Neon, the Postgres database that stores your account and logs.
  • Cloudflare R2, storage for your meal photos.
  • OpenAI, transcription of voice notes.
  • AI model vendors reached through the Vercel AI Gateway: Anthropic (Claude), Google (Gemini), Alibaba Cloud (Qwen), and Z.ai (GLM). They receive your chat messages, the food and plan context needed to answer, and meal photos you attach. The gateway may serve a vendor's model from that vendor or from a cloud provider that hosts it.
  • Resend, delivery of sign in emails.
  • Upstash, rate limiting to protect the service.
  • PostHog (European Union hosting), product analytics on this website and in the apps.
  • Google Firebase Cloud Messaging (Android) and the Apple Push Notification service (iPhone), delivery of push notifications.
  • Google Sheets and Google sign in for Sheets, only if you connect a coach sheet (early access).
  • RevenueCat, Inc., subscription management. Apple (App Store purchases and Sign in with Apple), Google Play (Android purchases), and Stripe (web payments through RevenueCat Web Billing).

We do not sell your personal data and we do not share it with advertisers. We will share data with law enforcement or regulatory bodies only where legally compelled to do so.

5. International transfers

Several processors are based in the United States: Vercel, OpenAI, Anthropic, Google, RevenueCat, Stripe, Resend, and Upstash. Alibaba Cloud and Z.ai process data outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or, for providers certified under it, the EU U.S. Data Privacy Framework, to ensure an adequate level of protection.

6. How long we keep your data

  • Account data and logs: until you delete your account.
  • Meal photos: until you delete your account.
  • Server logs: 30 days, then deleted automatically by our hosting provider.
  • Analytics events: according to PostHog retention settings, and deleted with your account (PostHog removes them in a weekly batch).
  • Tester list: if you had a tester seat, your email stays on the list until you ask us to remove it.
  • Billing records: up to 10 years where we hold any, as required by Romanian accounting law (Law 82/1991).

7. Your rights under GDPR

You have the right to:

  • Access the personal data we hold about you (Art. 15).
  • Rectification of inaccurate or incomplete data (Art. 16).
  • Erasure("right to be forgotten") where the conditions in Art. 17 apply. You can delete your account in the app or on the web at any time, as described on our account deletion page. We may need to retain certain billing records to meet legal obligations (Section 6).
  • Restriction of processing (Art. 18).
  • Data portability in a structured, machine readable format (Art. 20).
  • Object to processing based on our legitimate interests (Art. 21).
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with the Romanian Data Protection Authority (ANSPDCP) at dataprotection.ro or any other competent EU supervisory authority.

To exercise any of these rights, email hello@onmacros.com from the address associated with your account. We respond within 30 days as required by Art. 12(3).

8. Cookies

We use PostHog, hosted in the European Union, for product analytics on this website, including a cookie that recognizes returning visitors and a cookie that stores your region so the consent banner behaves correctly. European Union, United Kingdom, and European Economic Area visitors are asked to accept before any of this runs, and everyone can opt out at any time. Session recordings are also captured through PostHog. A recording captures what is shown on the page and what is typed into it, except password fields which are never captured. We do not sell this data and we do not use it for advertising. Stripe and RevenueCat may set their own cookies on the checkout pages they host, and their cookie policies apply there.

9. Children

OnMacros is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Security

We take reasonable technical and organisational measures to protect personal data, including encryption in transit (TLS), access control to production systems, private storage for meal photos, and processor side encryption at rest. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the relevant supervisory authority as required by Articles 33 and 34 GDPR.

11. Changes to this policy

We may update this Privacy Policy as the product evolves. Material changes will be communicated in the app or by email and reflected in the "Last updated" date above.

12. Related documents

See also our Terms of Service and how to delete your account.