Privacy Policy

Last updated: September 2026

This policy explains what personal information Metabolica collects through app.metabolica.health and this website, why we collect it, who we share it with, and the choices and rights you have over it. We've written it in plain language wherever we could, while still being precise about what actually happens with your data.

1. Scope of this policy

This policy applies to personal information collected through Metabolica's web app (app.metabolica.health) and this marketing site (metabolica.health). Metabolica is currently a single, self-contained product — there are no separate corporate affiliates, enterprise/employer accounts, or third-party apps with their own privacy policy to worry about. If that changes, we'll update this policy to reflect it.

2. Our guiding privacy principles

We don't sell your identity or your health data.

We have never sold, and do not sell, personal information — including the health data you log — to third parties in exchange for money.

We collect and keep only what we need.

We don't collect data "just in case." Every field we store exists because a feature of the app actually uses it.

Your data stays yours, and stays private between you and us.

Row-level security in our database ensures no other user of Metabolica — and no one on our infrastructure providers' side — can read your records outside of what's needed to run the service.

3. Personal information we collect

Information you provide directly

Account data: the email address and password you sign up with, and an optional display name and profile photo.
Health and lifestyle data you log: ketone and glucose readings, fasting start/end times, mood entries and any notes you write, sleep times, and habit streaks (e.g. alcohol- or tobacco-free days) along with any labels or notes you attach to them.
Profile preferences: things like your usual bedtime/waketime and weekly goals, used only to personalize your own dashboard.

Information collected automatically

Authentication and session data: handled by our authentication provider (Supabase) to keep you signed in securely.
Basic technical data: standard web request metadata (like IP address and browser type) that our hosting provider (Vercel) processes to serve the app and keep it secure — we don't use this for tracking or advertising.

We do not use tracking pixels, ad networks, cross-site trackers, or third-party analytics inside the app itself. This website may use standard, privacy-respecting hosting logs; we do not run ad-targeting scripts here either.

What we deliberately don't collect

We don't ask for government-issued ID, payment information, precise geolocation, or biometric identifiers. Metabolica has no subscription or payment flow today, so we hold no billing data of any kind.

4. How we use your information

To provide the service: powering your dashboard, charts, streaks, and history — this is the primary and near-exclusive reason we process your data.
To operate your account: authentication, password resets, and account-related emails (see "How we share your information" below for who sends these).
To keep the service secure and reliable: detecting and preventing abuse, unauthorized access, or activity that could compromise the app or other users' data.
To comply with the law: when we're legally required to, such as responding to a valid legal request.

We do not use your data to train machine learning models, and we do not use your health data for advertising of any kind — we don't run advertising at all.

We rely on a small number of infrastructure providers to run Metabolica. Each of them processes data strictly on our behalf, under their own security commitments, and does not use it for their own purposes:

Provider	What they see	Purpose
Supabase	All account and health data you store in the app	Database hosting and authentication; access is restricted per-user by row-level security rules
Vercel	Standard web request metadata	Hosting the app and this website
Resend	Your email address and the content of transactional emails	Delivering sign-up confirmation and password-reset emails

Beyond these providers, we only share personal information:

If required by law, subpoena, or valid legal process
To protect the rights, safety, or property of Metabolica, our users, or the public
In connection with a merger, acquisition, or sale of assets — in which case we'd require any successor to honor this policy for data collected under it
With your explicit direction or consent

We do not sell personal information, and we do not share it with advertisers, data brokers, or marketing partners.

6. Your choices

Access and correct: most of your profile information can be viewed and edited directly in the app's Profile screen.
Delete individual records: the Profile screen lets you delete specific logged days or entries at any time.
Delete your account: email info@metabolica.health and we'll permanently delete your account and all associated data.
Export your data: email us and we'll send you a copy of your logged data.
Opt out of account emails: account-related emails (confirmation, password reset) are functional, not marketing, so there's no separate opt-out — we don't send marketing email today, and if that ever changes, it will come with its own unsubscribe option.

We aim to act on any of these requests within 30 days.

7. Other sites and services

This policy covers Metabolica only. Any link that takes you to a third-party site (for example, a research or citation link) is governed by that site's own privacy policy, which we encourage you to review — we're not responsible for how third-party sites handle your information.

8. Security

Data is encrypted in transit (HTTPS/TLS) between your device and our servers. Access to your records in the database is restricted by row-level security, so no other user can read or modify your data. Passwords are hashed and never stored in plain text. No system is perfectly secure, and we can't guarantee absolute security — but we take reasonable, industry-standard measures to protect your information and will notify you if we ever become aware of a breach affecting your data, as required by law.

9. International data transfer

Our infrastructure providers (Supabase, Vercel, Resend) may process and store data in the United States or other countries where they operate. If you're accessing Metabolica from outside the country where our servers are located, your data may be transferred internationally as part of normal service delivery.

10. Retention

We keep your data for as long as your account is active, so the app can continue showing your full history. If you delete your account, your data is permanently removed from our production database; backups that may still contain it are cycled out within a limited retention window.

11. Children and teens

Metabolica is not directed at, and should not be used by, anyone under 18 years old. We don't knowingly collect data from anyone under 18. If we learn that we've collected information from someone under 18, we'll delete it.

12. Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

13. How to contact us

Questions, requests, or concerns about your data: info@metabolica.health.

14. U.S. state privacy rights notice

If you're a resident of a U.S. state with a consumer privacy law (such as California's CCPA/CPRA, or similar laws in other states), you may have the right to:

Know what personal information we've collected about you and why
Access a copy of that information
Correct inaccurate information
Delete your personal information
Opt out of the sale or sharing of personal information for targeted advertising — this doesn't apply to Metabolica today, since we don't sell or share data for advertising at all
Non-discrimination for exercising any of these rights

You can exercise any of these rights by emailing info@metabolica.health. We may need to verify your identity (typically by confirming you can access the email address on the account) before completing a request. Nevada residents: we do not sell personal information for monetary consideration, but you may still contact us to confirm your opt-out preference.