Privacy Policy

Last updated: July 2026

Who is responsible for your data

This application is operated as a personal project by Oscar Norman. If you have any questions about how your data is handled, contact: contact@trackmyprotein.se

What data we collect

• Email address: used to identify your account
• Password: stored as a salted hash (your actual password is never stored)
• Food and protein intake data: the products, serving sizes, and daily intake logs you enter, including any carbohydrate, fat, and fibre values recorded for a product
• Daily protein goal: if you choose to set one
• Account settings: preferences you choose, such as interface language, food search market, and whether to hide calories
• Security audit log: timestamps, a partial IP address (the last part is dropped, so the exact address is not stored), and the type of security-relevant event (registration, login, logout, password change, account deletion), retained to detect abuse and support account recovery. These entries are kept for up to 90 days (see How long we keep your data)

We do not collect analytics, tracking cookies, or advertising data.

When you use the product search feature, the search term you enter (or the barcode scanned via your camera) is sent to the Open Food Facts API to retrieve nutritional data. Open Food Facts is an independent open-data project; please review their privacy policy for details of how they handle requests.

The barcode scanner uses your device's camera to read product barcodes. Scanning happens entirely in your browser. No image or video is uploaded or stored; only the decoded barcode number is sent to Open Food Facts as described above.

Why we collect it (legal basis)

Your data is processed on the basis of contract: it is necessary to provide the service you signed up for. Without storing your email and intake data, the app cannot function.

How long we keep your data

Your account data is kept for as long as your account exists. You can delete your account at any time from the main dashboard, or by emailing us. Deleting your account immediately removes your email, login credentials, products, serving sizes, daily intake, goal, and settings.

The one exception is the security audit log. When you delete your account, your email address in that log is replaced with a placeholder; the remaining entries, including the partial IP addresses, are then automatically removed after 90 days. Nothing that identifies you is retained beyond that window.

Who we share your data with

We do not sell your personal data. It is shared with the following third parties only as needed to run the service:

• Open Food Facts: when you use the product search or barcode scanner, the search term or scanned barcode is transmitted to their API (see What data we collect above). No account identifiers are sent in that request.
• Resend: our transactional email provider. Your email address and the relevant message are sent through Resend's API in a few cases: when we email you a verification or password-reset link; when you submit feedback (your address is included so we can reply); and when a new account is verified, when a short notification containing that account's email is sent to the operator.
• Railway: our hosting and database provider, which stores the data described in this policy on our behalf (see Where your data is stored).

All of the app's own code, including the barcode scanner, is served from our own server. No third-party content delivery networks or analytics scripts are loaded.

Where your data is stored

Data is stored in a MySQL database hosted on Railway, our infrastructure provider, in their EU West region (Amsterdam, the Netherlands). Your data is therefore stored within the EU/EEA.

Your rights under GDPR

If you are located in the EU/EEA, you have the following rights:

• Right of access: you can request a copy of your data by contacting us
• Right to erasure: you can delete your account from the dashboard at any time; this removes your account data immediately, after which the minimal security log is pseudonymised and deleted within 90 days (see How long we keep your data)
• Right to rectification: contact us to correct inaccurate data
• Right to portability: you can export your data at any time from the dashboard, either as a CSV file of your logged intake history or as a JSON file containing a full copy of your products, serving sizes, goal and intake history
• Right to lodge a complaint: you can complain to your national data protection authority

Cookies and sessions

This app uses two cookies, both strictly functional. Neither is used to track you across other websites, and we use no analytics or advertising cookies.

• Session cookie: keeps you logged in. It is removed when you sign out or your session ends.
• Timezone cookie: remembers your device's timezone (for example “Europe/Stockholm”) so that your daily totals roll over at your local midnight. It contains only the timezone name, no identifier, and is kept for up to a year.

Security

We take reasonable steps to protect the data stored in this application. A Software Bill of Materials (SBOM) is generated on every build and dependencies are scanned for known vulnerabilities using Trivy. If you discover a security vulnerability, please report it privately following the process described in our Security Policy.

Contact

For any privacy-related questions: contact@trackmyprotein.se