Macrition Macrition

Privacy policy

Last updated: September 2026

Overview

Macrition offers two distinct ways to use the site, with different data implications:

  • Calculator-only (no account): All calculator inputs stay in your browser. Nothing is sent to our server unless you explicitly submit a contact form.
  • With a free or paid account: You can save your profile, diary, meal plans, AI conversations, and subscription. This data is stored on our servers as described below.

What we collect

Account data (only if you register):

  • Email address (used for login, verification, and account notifications)
  • Display name (optional)
  • Password (stored as a bcrypt hash; we never see the plaintext)
  • Profile metrics you choose to enter: age, sex, height, weight, activity level, goal
  • Food diary entries, meal plans, and progress tracking data

AI conversation data (only if you use the AI assistant):

  • The messages you send to the AI assistant
  • Your dashboard context (goals, recent diary entries) that is included in the AI prompt so the assistant can personalize responses
  • AI responses, which are stored in your conversation history

Subscription data (only if you purchase Pro or Premium):

  • Stripe customer ID, PayPal subscription ID, and internal subscription reference tokens (we do not store your full card number; Stripe and PayPal handle all payment details)
  • Subscription tier, billing cycle, and renewal dates
  • Payment amount, transaction ID, and timestamp (for your receipt history)

Security and operational data:

  • IP address and User-Agent for login history and rate limiting
  • Server logs retained for 90 days for security and abuse prevention
  • Active session records (IP, device, last-active timestamp) so you can manage devices and we can detect compromised accounts

AI assistant data sharing

Important: When you use the AI assistant, your messages and relevant profile context are sent to a third-party AI provider (such as OpenAI, Anthropic, or another configured provider). The provider processes your input on their servers to generate a response.

  • The AI provider may retain your input according to their own data retention policy. Review the provider's privacy policy for details.
  • We do not send your password, payment information, or session tokens to the AI provider.
  • AI conversations are stored on our servers for your conversation history and are deleted after 180 days of inactivity (configurable via the MACRITION_AI_RETENTION_DAYS setting).
  • You can delete your AI conversation history at any time from the AI assistant page.

AI safety: The AI assistant is a nutrition coach, not a doctor. It will not diagnose conditions or prescribe medications. High-risk topics trigger an automatic disclaimer recommending you consult a qualified healthcare provider.

Cookies

Cookie use on Macrition is tiered, and the cookie banner reflects exactly what is active:

  • Essential cookies, always on: the session cookie (login), the remember-me cookie (only if you opt in), and the theme preference cookie.
  • First-party analytics, only with your consent: when you accept analytics in the cookie banner we record pseudonymous first-party page views: the page path, a daily-rotating visitor hash derived from your IP address and browser signature with a cryptographic key we hold, your session identifier, the referring page, your browser's user-agent string, and - if you are signed in - your account reference. Your raw IP address is not stored - only the daily-rotating hash above (and the consent click itself is recorded server-side in an audit ledger, linked to the same pseudonymous hash, never to your address). The visitor hash cannot be reversed to a person and cannot be correlated across days, but because these fields can identify you within a day (and within your account), we describe them honestly as pseudonymous rather than anonymous. If you decline, or your browser sends a Do Not Track signal, nothing is recorded.
  • Optional third-party services: administrators can enable integrations such as Google Analytics 4 or AdSense. When enabled, they only load after your consent choice and the banner names them. They are disabled by default.

We never use cross-site tracking cookies and we never sell advertising data.

Third-party services

  • Stripe & PayPal: Payment processing for subscriptions. Your credit card and bank account details never touch our servers. See Stripe's privacy policy and PayPal's privacy statement.
  • AI providers (OpenAI, Anthropic, etc.): Process your AI assistant messages as described above.
  • Open Food Facts API: Barcode lookup, queried only when you scan a barcode.
  • SMTP provider (Hostinger): Delivers transactional emails (verification codes, password resets, security notifications).
  • Google OAuth (optional): If you choose "Sign in with Google," we receive your Google ID, email, and profile name. We do not receive your Google password.

We do not sell, rent, or share your data with advertisers, data brokers, or any third party not listed above.

Data retention

  • Account data: Retained until you delete your account. Deleting your account removes your profile, diary, meal plans, custom foods, bookmarks, AI conversations, and settings. Identifying fields on retained billing, webhook, and security records are anonymized rather than kept: a minimal payment, event, and audit record persists where accounting, fraud prevention, or legal duties require it, and it no longer identifies you.
  • AI conversations: Deleted after 180 days of inactivity (configurable).
  • Server logs: 90 days.
  • Session records: Until you log out or the session expires (2 hours of inactivity).
  • Stripe records: Retained per Stripe's policy for billing and dispute resolution.

Your rights

If you are in the EEA, UK, or California, you have the right to:

  • Access: Download your data, including your complete AI conversation history, in one machine-readable export from your dashboard.
  • Rectification: Correct inaccurate data.
  • Erasure: Delete your account yourself. Account content is removed and retained records are anonymized as described under Data retention.
  • Restriction: Limit how we process your data.
  • Portability: Export your data in a machine-readable format.
  • Objection: Object to certain processing.

Email privacy@macrition.com to exercise any right. We respond within 30 days.

Security

We protect your data with industry-standard measures:

  • Passwords hashed with bcrypt (unique salt per password, cost re-tuned with current hardware)
  • HTTPS enforced on all pages (HSTS enabled)
  • CSRF protection on all forms and API mutations
  • Encryption at rest for AI provider API keys and OAuth secrets (AES-256-GCM)
  • Rate limiting on authentication endpoints (login, registration, password reset)
  • Two-factor authentication (TOTP) available for all accounts
  • Tamper-evident audit logging for high-risk admin actions

No method of transmission or storage is 100% secure. If a breach occurs, we will notify affected users within 72 hours per GDPR Article 33.

Children's privacy

Our site is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has registered an account, contact us and we will delete it.

Changes to this policy

We may update this policy. We will notify users of material changes by posting a notice on the homepage for 30 days. The "Last updated" date above reflects the most recent revision.

Contact

Questions about this policy? Email privacy@macrition.com. For GDPR complaints, you can also contact your local data protection authority.