Metriform
Privacy Policy
Metriform ("the app", "we") is a fitness and nutrition app. This policy describes what data the app collects, why, and what happens to it. We keep it short because the practice is short: your data is used to run the app for you, and for nothing else.
What we collect
- Account: your e-mail address and authentication identifiers (Sign in with Apple / Google / e-mail).
- Profile you enter: age, sex, height, weight, goals, training experience, dietary preferences, allergies, supplement list, and optional menstrual-cycle inputs.
- What you log: workouts, sets and weights, meals, water, body weight, daily check-ins.
- What you save in the app: saved meals and activities (presets, including a photo you attach to one), your supplements, pantry, recipe library, shopping list (what you check off, what is at home, your own items, your store's pack sizes and store-name settings), chef and training settings, exercise preferences, app settings (language, units, theme, reminders, glass size) and your last 100 messages with the assistant are stored with your account, so they are there after a reinstall or on another phone. They are deleted with your account. If you turn on store names in the shopping list (Pro), the app also uses the country from your phone's time zone and region settings (or one you pick) — not your location — and sends that country code and the list's product types to look up the names, and — after you allow AI processing — the names of items you added yourself.
- Meal photos: if you photograph a meal or your fridge, after you allow AI processing, the photo is sent to an AI model to identify the food. Meal images you save are stored with your account.
- Voice input: when you choose to send a recording and allow AI processing, the audio is sent through our server for transcription. The resulting text can be used for your meal entry or assistant message.
- Apple Health (optional, with your permission): steps, sleep, workouts, body weight and height, active energy, heart-rate variability (SDNN), resting heart rate, menstrual data and logged mood where available. We read only what you allow, for on-device calculations and to show sleep history and our experimental recovery estimate. For this history, sleep, SDNN and resting-heart-rate observations include their measurement times and source app names and identifiers.
- Smart scales (optional, in compatible beta builds): with Bluetooth permission, the app can read weight measurements from supported scales while it is open. We process the weight, measurement time, source name and measurement identifier, and keep the selected device locally. Xiaomi S400 needs a device key and Bluetooth address. You can enter these manually or retrieve them through optional Xiaomi sign-in. The password is entered on Xiaomi's own page; Metriform does not receive it. The app requests your device list, the selected supported scale's key and, where supported, weight history directly from Xiaomi. History may include several family profiles; their names and measurements are processed on your phone so you can choose your profile. Only the latest valid weight from your selected profile and scale is eligible for import, with its original measurement date. Manual Metriform records are not overwritten. Cloud history requires internet access; direct Bluetooth readings remain a separate option.
- Withings scales (optional, when this beta connection is enabled): after you sign in to Metriform and authorize access on Withings' own page, our server requests weight measurements from the last 21 days and linked-device information to verify that they came from your scales. Only the latest eligible weight is offered for import, with its original measurement time, source and an opaque measurement identifier. Manual Metriform records are not overwritten. This uses data already uploaded to Withings, requires internet access and does not read the scale directly over Bluetooth. We do not receive your Withings password or read body-fat, ECG, pulse, sleep or recovery measurements through this connection.
- App events and in-app activity: first-party technical events (e.g. "plan generated", app build number, errors) and how the app is used — which screens and steps are opened, what is tapped (the label on it), which text fields were filled in (not what you type), values picked on wheels and sliders, sheets and alerts shown, that a photo or voice note was attached (not the photo or recording itself in this log), and when the app goes to the background. A random install identifier (not an advertising ID) links the steps you take before signing in, such as onboarding, to your account. It is stored in our own database, used only to fix bugs and improve the app, and activity older than 90 days is deleted. Xiaomi setup and history events and Withings connection/sync events record the stage, outcome, a general reason and counts where relevant. They contain no measurement values or dates, profile names, Xiaomi or Withings account identity, device names or identifiers, connection keys, encrypted access records, addresses, sign-in links or tokens. Recovery-history events record outcomes, general reasons, counts and data-availability flags. Taps on recovery cards and history rows use a fixed control name; these records contain no health values, measurement dates or source identifiers. We use no third-party analytics, advertising or tracking SDKs.
- Early-access sign-up (website): if you leave your e-mail on metriform.app, we store it with the page language to invite you to the beta, and our team gets an e-mail notice of the sign-up. It is not used for anything else; write to support@metriform.app to have it removed.
What we do with it
- Generate and adapt your training program, meal plan and daily targets.
- Show sleep and an explained recovery estimate from your completed morning check-ins and available Health measurements. This experimental 0–100 estimate is calculated on your device, without an AI request; it is not a medical assessment or a Garmin or Apple score.
- After you allow AI processing, our server sends eligible information you enter yourself, and text, meal photos or voice recordings you choose to submit, to generate plans, analyze meals and answer questions. The model provider is Google (Gemini). Replicate processes eligible dish descriptions to generate illustrative meal images and, on Pro, an English product name the AI makes from an item you added to your shopping list yourself, to draw its photo, which is stored with your account for up to 30 days. When you request a menu, meal alternative or recipe from your ingredients, we also send the daily or meal calorie, protein, carbohydrate and fat targets selected in the app. These numeric recipe parameters may have been calculated on your device using imported data. The underlying weight, sleep, pulse, HRV and other Apple Health or scale readings, their history and other estimates or summaries are excluded from automatic AI requests. Inputs of unknown origin and old personalized text are not reused automatically. Information you deliberately type or include in a submitted photo or recording is part of that chosen content. Requests go through our server; our API keys and prompt instructions stay there. Public exercise instructions and eligible new menu text can also be translated into your selected app language.
- Before the first AI request, we explain the recipients, purpose and data categories. You can decline and use manual tracking. Your choice is stored with your account, or on the device before you sign in, and can be changed in Settings. A guest choice does not grant permission for a new account. Apple Health permissions are separate from AI permission.
- If you link a household partner, your first name, daily calorie target and day progress are visible to that partner (and theirs to you).
What we never do
- We do not sell your data. To anyone.
- We do not use your data for advertising. Apple Health data in particular is never used for advertising, marketing or data mining, and is never sold. Processing needed to provide your requested app features is described above; connecting Health alone does not grant AI permission.
- We do not run third-party ad or tracking SDKs.
Where it lives
Data is stored with Supabase (hosted on AWS, EU region — Ireland). Payments are processed by Apple; we never see your card details. Our subscription status records come from RevenueCat. Early-access sign-up notices reach our team through Cloudflare Email Routing to the team's Google (Gmail) mailbox.
New AI request diagnostics record outcomes, general failure reasons, counts and timing. They do not retain your prompts, recordings, photos or complete AI replies. Optional QA traces record request metadata rather than the content of a request or reply. Account deletion removes the account and its private uploaded photos; a failed cleanup must be retried before deletion can complete. Shared generated meal-image caches are not private account uploads.
The dated Health observations used by the sleep and recovery feature stay in the app's local storage. Each successful refresh replaces this copy with the readable observations from the last 90 calendar days, including their measurement times and source details. This feature does not upload that history or its calculated score to our servers or AI providers. Completed morning check-ins, including a Health sleep duration you confirm in the form, are saved locally and sync with your account in Supabase; up to 90 days of check-ins are restored in the app after sign-in. Imported values remain excluded from automatic AI requests even when saved in a profile or check-in. Calculated recovery scores and other summaries remain excluded. The only exception for locally calculated food goals is the selected numeric recipe parameters sent when you request a menu or recipe, as described above; this does not include the underlying readings or recovery history.
Bluetooth scale connection details stay on your device. The selected scale's key and Bluetooth address are held in its secure storage. If you connect Xiaomi Home history, the phone's secure storage also holds the session token, signing secret and account, region, device and selected-profile identifiers needed to read that history again. Metriform does not receive or save your Xiaomi password. Temporary sign-in data is cleared when setup ends, is cancelled or expires; only the selected connection's access is retained. Expired Xiaomi authorization requires signing in again. These access details, device and profile lists, scale key and Bluetooth address are not sent to our servers, analytics or AI providers. Xiaomi manages its own sign-in page and browser cookies.
For Withings, our server temporarily handles the authorization code, access and refresh tokens, authorized account identifier, linked-device information and requested weight measurements to exchange access and return your latest eligible reading. It returns access as an encrypted record bound to your Metriform account, saved only in your phone's secure storage. The app sends that encrypted record back to the server for later reads or token refresh; no Withings token table or device list is retained in our database. Withings passwords are never received. Connection secrets, encrypted access records and raw Withings identifiers are not sent to AI providers or written to our technical event logs. Withings manages its own sign-in page, browser cookies and the original measurements in its service.
Imported weight records, including accepted Withings readings, are stored locally and may sync with your account; their weight, date, source and measurement identifier may be stored with Supabase. Imported weight values can support calculations on your device. The selected calorie and macro targets may be sent when you request a menu or recipe, as described above. The underlying weight records and other calculations based on them remain excluded from automatic AI requests.
Deleting your data
Settings → Delete account removes your account and all associated data from our servers. Cost-accounting rows are kept in anonymized form (no link to you). You can also write to support@metriform.app and we will delete your data manually.
Signing out, changing accounts or deleting your account clears the local Health recovery history and check-ins. Signing in again restores synced check-ins from your account and, when Health is connected, re-reads the permitted Health history. This does not delete the original records in Apple Health. You can change Health permissions in iOS; a successful refresh removes observations that are no longer readable from the app's local copy.
Disconnecting a scale removes its local connection details, device key, saved Xiaomi history access or encrypted Withings access; it does not delete weight records already imported into your journal. Signing out or deleting your account also clears the local scale connection, key and saved Xiaomi history access or encrypted Withings access. If the phone temporarily prevents secure deletion, we retain a reference to the data awaiting deletion and retry. Signing out immediately disables the connection; a failed removal in Settings can be retried there. Removing Withings stops future reads by Metriform but does not unlink your scale, delete data in Withings or revoke consent there. You can separately revoke Metriform's access in Withings. Use account deletion to remove the associated records from our servers.
Your rights
You may request a copy of your data, correction, or deletion at any time via support@metriform.app. If you are in the EU/EEA, these are your GDPR rights; we honor them for everyone.
Changes
If this policy changes materially, the effective date above changes and the app will point to the new version.