Nate Baum
← Stacking Plates
Draft. This document is a working draft (version 0.1) and has not yet taken effect.

Stacking Plates

Privacy Policy

Version 0.1 (Draft) · Effective date: TBD

This Privacy Policy explains what Nathaniel Baum, a sole proprietor (“we,” “us”), collects when you use the Stacking Plates app and website (the “Service”), how we use it, and the choices you have. Stacking Plates is a fitness and nutrition tracking app, which means some of what you share with us is health-related information — we treat it accordingly and we do not sell it or use it for advertising.

1. Information we collect

  • Account information. Email address and password (stored as a hash), and a display name if you set one.
  • Profile & body metrics (optional). During onboarding or in Settings you may provide weight, height, age, gender, and fitness goals. These are used to personalize targets and calculations. You can use the App without providing them, and you can edit or remove them at any time.
  • Activity data you log. Workouts (exercises, sets, reps, weights, timestamps), routines, personal records, and meals you log or scan — including the nutrition estimates generated for them.
  • Meal photos. If you grant photo/camera access and scan a meal, we process that photo to generate calorie and macronutrient estimates (see Section 3). Photo access is optional; denying it disables meal scanning but not the rest of the App.
  • Payment information. Subscriptions are processed by Stripe. Your full card number goes directly to Stripe — we never receive or store it. We receive from Stripe: the last four digits and brand of your card (shown so you can identify your payment method), subscription status, plan, trial/renewal dates, coupon redemptions, and a customer identifier we link to your account.
  • Device & log data. IP address, device type and OS version, app version, timezone, and server logs of API requests (used for debugging, security, and abuse prevention). During the closed beta, crash reports and diagnostics may also be collected via TestFlight, which is subject to Apple’s terms.

We do not collect your contacts, precise location, or advertising identifiers, and we do not use third-party advertising or tracking SDKs. The App does not use cookies or third-party analytics.

2. How we use your information

  • Provide the Service: store and display your workouts, meals, metrics, and streaks
  • Generate nutrition estimates from meal photos and compute stats (e.g., muscle-group volume, calendars)
  • Process subscriptions, trials, and coupon codes via Stripe
  • Send transactional email (account, billing, and important service or legal-terms notices) — marketing email only with your consent, with unsubscribe in every message
  • Debug, secure, and improve the Service, including investigating abuse
  • Comply with legal obligations

We do not sell your personal information, share it with advertisers or data brokers, or use your data for targeted advertising. Our agreements with our AI service provider do not permit use of your photos or logs to train their models.

3. AI processing of meal photos

When you scan a meal, the photo (and any context text you add) is sent to our AI service provider to generate calorie and macro estimates. The photo is transmitted securely, is used only to produce the estimate, and is handled under our agreement with that provider. Estimates are approximations and can be inaccurate — see the Terms of Service health disclaimers.

We do not use AI or other automated decision-making to make decisions about you that have legal or similarly significant effects.

4. Service providers

We share personal information only with vendors that process it on our behalf, under contracts limiting their use of it:

  • Supabase (PostgreSQL database hosting) — account, profile, and activity data
  • Google Cloud Platform (Cloud Run, us-east1; Secret Manager) — API hosting and logs
  • Stripe — payments, subscriptions, tax calculation
  • Our AI service provider — meal-photo nutrition estimates
  • Apple / TestFlight — beta distribution, crash reporting

5. Other sharing

We may disclose information if required by law or legal process, to protect the rights, safety, or property of users, the public, or the Service, or as part of a merger, acquisition, or asset sale (in which case this Policy continues to apply to previously collected data and we will notify you of any successor). Aside from that and Section 4, we don’t share your personal information.

6. Data retention & deletion

We keep your data while your account is active. If you delete your account (Settings → Delete account, or by emailing us), we delete your personal information from production systems within 30 days, and from encrypted backups within 90 days as backups rotate. We may retain limited records where legally required (e.g., billing records for tax purposes) and de-identified, aggregated statistics that no longer identify you.

7. Security

Data is encrypted in transit (TLS) and at rest, credentials are stored in a managed secret store, passwords are hashed, and production access is restricted. No system is perfectly secure; if a breach affects your personal information, we will notify you as required by law.

8. Your rights & choices

Depending on where you live (e.g., California’s CCPA/CPRA, other US state privacy laws, or the GDPR if you’re in the EEA/UK), you may have rights to access, correct, delete, or export your personal information, and to not be discriminated against for exercising them. Because we don’t sell or share data for advertising, there is nothing to opt out of on that front. To exercise any right, use the in-app tools or email us; we verify requests via your account email and respond within the legally required window (45 days under CCPA, extendable once). If we decline a request, you may appeal our decision by replying to it, and we will respond to your appeal as required by your state’s law. You may also use an authorized agent to submit requests on your behalf; we will require proof of the agent’s authority and may verify your identity directly.

Health-data note. Some states (e.g., Washington’s My Health My Data Act) provide additional rights over consumer health data such as body metrics and nutrition logs. We honor access and deletion requests for this data for all users regardless of state.

9. Children

The Service is for adults 18 and older (matching the Terms of Service). We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it. Contact us if you believe a minor has provided us data.

10. International use

We operate from the United States and store data in the US (GCP us-east1 / Supabase US region). If you use the Service from outside the US, your information is transferred to and processed in the US.

11. Changes to this Policy

We’ll notify you in the App (and by email for material changes) before changes take effect, and update the effective date above. Material changes to how we handle health-related data will require fresh acknowledgment in the App.

12. Contact

Privacy questions or requests: stacking-plates-support@nathanielbaum.com.