Privacy Policy

Stacky is a supplement tracking app, with a website where people publish and discuss their stacks. It knows what you take, when you take it, and how you feel — which is about as personal as data gets. This policy explains exactly what we hold, why, and what you can do about it. It is written to be read, not to be survived.

Who is responsible for your data

Stacky is operated by [FULL LEGAL NAME], an individual trading as Stacky, based in Portugal. Contact: [CONTACT ADDRESS], privacy@stacky-app.com.

Under the GDPR we are the data controller for everything described below.

The short version

• We do not sell your data. Not to anyone, for any price.
• We do not run advertising, and there is no advertising or analytics SDK in the app or on the website. We do not track you across other apps or websites, and we never ask for permission to, because we have nothing to do with it.
• In public you are a handle you chose, never your email. A real name appears only if you give one, and we ask for it when you first publish, not when you sign up.
• We do not build a profile of you for anyone else's benefit.
• You can download your health-tracking and subscription ledger in a portable file, and you can delete your account permanently from inside the app.
• Your private health-profile fields — birth year and biological sex — are encrypted, and we ask for them separately rather than burying the request in a signup form.

What we collect

Account details

Your email address. New accounts sign in with a six-digit code we email you, or with the sign-in link in that same email, so most accounts have no password at all; an account created with a password in an older version keeps it, securely hashed. If you sign in with Apple or Google — in the app or on the website — we receive an identifier from them and the email address you choose to share; Apple's “Hide My Email” works normally with Stacky. When the email a provider has verified matches an existing Stacky account, we sign you into that account rather than creating a second one, so the website and the app are always the same person.

We also store your handle — the name you appear under in public — your first and last name if you choose to give them, your profile picture if you upload one, and your bio.

Health data

Two fields form your private health profile: your birth year and your biological sex. Both are optional. Both are encrypted at rest with a dedicated encryption key, separate from the rest of the database, and neither is ever shown on your public profile. We record the moment you consented to providing them.

We also treat the following as health data, because it is:

• Your stack — the supplements and products you take, their doses, forms, schedules, personal instructions and notes, how much you have left, and what you paid.
• Your intake history — which doses were scheduled, which you marked as taken, and when you marked them.
• Your moods — the score you log, the factors you attach to it, any notes you write, the day the entry is about, and the moment you actually recorded it.
• Your goals — what you are trying to achieve with your stack.
• Your stack change log — an append-only record of what you added, removed or adjusted.
• Readings from Apple Health, if you choose to connect it — the minutes you slept, your heart-rate variability and your resting heart rate, as one value per day. Stacky reads these on your iPhone and stores them against your account so the app can show them beside your routine. You grant this in iOS and can withdraw it there at any time; withdrawing stops new readings but does not delete the ones already stored, which you can download or erase with the rest of your data. We never use them for marketing or advertising.

How you use the app

Your bookmarks, saved stacks, the people you follow and who follows you, the members you have blocked, your conversations with the AI advisor, and your notification preferences.

Web sign-in

You can use Stacky in a browser at stacky-app.com with the same account as the app. You sign in with the emailed code, with the one-tap sign-in link sent in the same email, or with Apple or Google. We store short-lived code hashes and attempt counts, and use an essential, secure session cookie to keep you signed in for up to seven days. The browser also uses an essential cookie to protect forms from forged requests. These are not advertising or analytics cookies. Signing out ends that browser session. The one-tap link is signed rather than stored, works once, and expires with the code it was sent with.

Choosing Apple or Google loads that company's own sign-in script on the sign-in page, which means Apple or Google can see that you opened it; no other page on this site loads their code, and we add no advertising or analytics scripts anywhere. When you complete one of those sign-ins we receive an identifier and a verified email address (Apple's "Hide My Email" relay address counts as verified), and we sign you into the existing Stacky account for that address rather than creating a second one. We never receive your Apple or Google password.

Publishing a stack

Publishing is your choice, one stack at a time. When you publish, we store a version of the shared bottles, the amounts and schedules you entered, and your publication note, under your handle. Ordinary routine edits do not change that version until you publish an update. Private items, medicines, bottles that are not in our catalogue, personal instructions and notes, stock, what you paid, intake history, moods and HealthKit data are never part of it; the publish sheet tells you which bottles will not appear. Unpublishing takes the stack off the web and hides its conversations; we keep the stored version so that publishing it again does not lose the questions people already asked, and you can delete the stack to remove it. Making an item private removes that item from versions we serve. A private "anyone with the link" address is a separate control that publishing never opens or closes, and rotating it revokes the old link, including saved links.

Public stacks and their conversations can appear in Discover, public search and a profile under your handle, and may be indexed by search engines. Discover uses deliberate publications and public questions, never private routine edits or tracking events. Unpublishing removes a stack and its conversations from these surfaces; search engines may take time to remove their own cached copies.

You can also build a stack in the browser before signing in. Unsaved edits are kept in your browser tab's session storage so a reload or sign-in does not discard your work. Before Preview, sign-in continuation or saving, we ask for your explicit consent to process the health-related information in the private draft. Preview or sign-in continuation stores it in an essential server session, available for 24 hours in that same browser. Expired draft payloads are removed by scheduled cleanup, normally at the next 15-minute run, including from sessions that remain signed in. Returning from sign-in does not automatically save or publish it. Once you choose to save, the private draft belongs to your account. It contains your title, description, selected catalogue items or custom names and any time of day you entered. We also record whether it is a new stack, an adaptation or an edit of one of your own stacks, and the source or target needed to preserve that relationship.

We record the consent statement, version, purpose and time. Publishing asks separately for explicit consent to make the exact preview public, including discovery and search-engine indexing, and records that consent with the published version. The builder’s Delete this private draft removes its draft contents from the server and this browser; a published stack is a separate record, controlled by unpublishing or deleting that stack. You can keep building locally without agreeing to server storage.

Publishing a web-created stack adds it to your account with daily tracking inactive. It does not create reminders, log doses or set a starting supply. Amounts you have not confirmed are not published. A bottle you named yourself, rather than picked from the catalogue, stays on your own shelf and is left out of the public version. Editing a shared stack in the browser stays in a private draft until you review and publish the update. These edits change what you share; they do not rewrite your existing tracked amounts, schedules or intake history.

Comments, follows and blocks

Questions and replies carry your handle and are visible to everyone who can read that stack. We store their text, optional source links, the stack version they refer to, edits, removal state and your conversation subscriptions. Before a message is published it passes a filter for health claims; a refused message is not stored, only counted. We also store reports, moderation decisions and member blocks to operate and protect the community: a message reported by three different people is hidden until a person reviews it. You may edit or remove your messages, mute conversations, report content or public profiles, or block members; a stack owner can close comments on their stack. Following someone is visible to them, and follower counts appear on profiles. Public content can still be read while signed out. We process community participation to provide the service you requested, and moderation under our legitimate interest in preventing abuse.

Anyone can send an illegal-content notice without an account. We store its exact URL, explanation, name and email (unless the child-safety exception applies), good-faith declaration, timestamps and review decision. These details are private. We send a receipt and outcome to the contact provided, and a specific statement of reasons to an author affected by a content or account restriction. The author’s message does not include the reporter’s identity. These service messages use Resend and are separate from optional community emails; delivery records allow failures to be retried. Email support@stacky-app.com with the reference to appeal or request access to a notice submitted without an account. We retain accountless notice details for review and any appeal, then remove contact details, the URL and free text six months after resolution. Open or reopened reviews are retained until resolved.

Suggestions and bug reports are visible to signed-in members under your chosen public name or handle. We store their text, type, status and votes. These posts pass the same health-claims filter before publication and can be reported or hidden by blocking their author. Three independent pending reports hide a board post from other members until human review; its author retains access. Moderators can also hide a post after reviewing a report.

Saving and adopting a stack

Saving a stack keeps a reference in your collection. If the owner allows it, you may adopt a stack: the bottles land in your own stack by name only, with nothing else of the owner's, and nothing about you goes back to them beyond a notification that someone adopted it. Copies already made can remain in another person's stack after an owner unpublishes the original; they cannot be recalled from that person's possession. Unpublishing does not remove screenshots or copies others have already made. A signed-in member can also place a stack you published, or one they hold your link to, beside a routine of their own. That view is built only from the version you published: adherence, moods, notes, stock and what you paid are never part of it, and any price shown beside a comparison is only ever the reader's own.

Community notifications

A question, a reply, an adoption or a new follower creates an inbox event even without an installed app, and each names the member who caused it. These events also appear in the app's notification inbox beside your reminders; what that list shows is read from the live records, so a message removed by moderation, a conversation you can no longer see or a member you blocked stops appearing there. Email and push delivery for these events are separate, optional settings. Push is off until you enable it. Email is a choice you make when you publish a stack on the website, where “Email me when someone asks a question” is offered ticked and you can untick it, and again on your own stack page or in the inbox. Email is sent through Resend and covers conversations only. Push is sent through Expo using generic wording that never quotes what anyone wrote: at most one community notification a day, batched, never inside your quiet hours and never in the hour before your first reminder. An email includes a link to the conversation. You can switch off delivery in the inbox, unsubscribe from email using the link in any message, or mute one conversation. Operational delivery records include attempt and read timestamps. Your data export includes your community drafts, publications, authored messages, saved references, subscriptions, preferences, blocks, reports and adoption records in a machine-readable file. Community records follow the account retention and deletion rules below; copies another person was permitted to make remain that person's data.

Prices you share

When you record what you paid for a bottle and where you bought it, both stay in your own stack and are shown to no one. Once at least five people have recorded a price for the same product, the app shows everyone a range — “people paid €18–€26” — computed from those figures. The range carries no names and no figure below that threshold, and it cannot be traced back to you. We do not scrape prices, and we earn nothing from any shop.

Arriving from the website

A link on our website to a stack opens that stack in the app or in the App Store. The link carries the stack's address and nothing about you: no tracking parameter, no advertising identifier, no third party in the path. We keep no record of where you arrived from: nothing on our server notes that an adoption began on the website, and nothing is sent to anyone else.

If you install the app after copying a stack's address, the app can pick it up from your clipboard. On launch it checks only whether the clipboard holds any text — it does not read the text — and offers a “Paste the link” card once per installation. The clipboard is read only when you tap that card, and only a Stacky address is used; anything else is ignored and not kept. Which stack you arrived at is stored on your device so Today can greet it, and is sent to our server only as the stack's address when the app fetches that stack. You can dismiss the card and it does not return.

Device and technical data

A push notification token, if you enable reminders. Standard server logs. Crash and error reports, described below.

Camera and photo library

The app uses your camera to scan supplement barcodes and, optionally, to photograph a label, counter or shelf so it can be read automatically. You can also select an existing scan photo or a profile picture from your photo library. The scan picker receives only the photo you choose, without requiring access to the rest of your library.

We do not store scan photos on our servers. A barcode image is processed on your device and only the resulting barcode number leaves it. A label, counter or shelf photo is sent to Groq (listed below) for reading, without account details attached. What comes back is the names, forms and label figures on the packaging. The provider's retention terms are described below; avoid including people or personal documents in a scan.

Profile pictures are stored in Supabase and displayed on your profile until you replace or remove them, or delete your account. Replacing or removing a picture also requests deletion of the previously stored file. Copies already cached or saved by others may remain.

Payment data

If you subscribe, Apple processes the payment. We never see your card number, billing address, or any payment details. We receive only whether your subscription is active, which plan, and when it renews or expires.

Why we use it, and our legal basis

Health information is a special category of personal data under Article 9 of the GDPR. We rely on your explicit consent to process it, and you can withdraw that consent at any time by deleting the relevant entries or your whole account. Withdrawing does not affect processing that already happened.

Who else touches your data

We use a small number of service providers. Each one processes data only on our instructions, under a data processing agreement. We do not sell or rent data to anyone, and none of the companies below are permitted to use your data for their own purposes.

Two of these deserve a specific note:

The AI advisor. When you request an analysis or ask a question, we send the AI provider your question, conversation context, goal and the contents of your stack — supplement names, doses and forms. To answer questions about your log, we also send the last seven days' counts of scheduled and taken doses and which products you recorded taking yesterday. We do not attach your account name, email, date of birth, biological sex, mood history or any account identifier to this context. Your own questions and conversation history are sent as written, so they include any personal information you choose to put in them. Products you have marked private are excluded from both the stack contents and these log summaries. Groq's current service agreement does not permit it to use our inputs or outputs to train or fine-tune models unless we explicitly instruct it to do so. It may temporarily retain inputs and outputs for service reliability or abuse monitoring for up to 30 days; Groq says ordinary inference requests are not retained by default, and we do not use its batch or fine-tuning features for this purpose.

The label and shelf reader. When you take or select a photo of a label, counter or shelf, the photo goes to Groq for reading and comes back as text: product names, forms, and the figures printed on the label. The same provider terms apply as above. We do not store scan photos on our servers or attach your account details to the reading request. The photo itself contains whatever you chose to photograph.

Crash reporting. We use Sentry for technical error reports and sampled performance traces. Default personal-data collection is disabled on both the app and our servers. Our servers also exclude request bodies and exception-local variables. The app adds a route pattern, method and status to handled request-failure reports. Diagnostic metadata may include pseudonymous account, device or item identifiers and request addresses or query strings; these records are not anonymous. App crash reports are disabled in development builds.

Barcode lookup. When you scan a barcode, the barcode number alone is sent to Open Food Facts, a public database. Nothing identifies you, and nothing about your stack is included.

Links out to brands and retailers. A public product page carries the manufacturer’s own address and a plain search at Amazon and iHerb, so you can find the bottle. Those are ordinary links and nothing more: we set no cookie for them, we send no referrer — the shop is not told which page you came from — we pass nothing about you or your stack, and we earn nothing: no affiliate tag, no referral fee, no paid placement. Which Amazon marketplace a link points at is read from the language your browser already sends with every request; we do not look up your location and we store nothing about it. Following one of these links takes you to that company’s site, where their privacy policy applies, not ours.

Data leaving the EU

Some providers above are based in the United States. Where that is the case, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent approved safeguard. You can ask us for details.

How long we keep it

We keep your data while your account exists. When you delete your account, we permanently erase it — your profile, your stack, your entire intake history, your moods, your goals, your health profile, your AI conversations, your bookmarks, your follows, your blocks, your published stacks, your comments and your devices are removed from our database. This is a real deletion, not a hidden flag, and it cannot be undone. A stack someone else adopted from yours stays theirs: it holds the names of bottles and nothing about you.

Some records outlive the account for narrow reasons: transaction records Apple and we are required to keep for tax purposes, and backups, which are overwritten on a rolling cycle. Anonymous, non-identifying data may be retained.

Your rights

Under the GDPR you can:

• Get a portable copy of your tracking ledger. Settings → Export my data produces a download containing your stack, your complete intake history with timestamps, your moods, your stack change log, your health profile, your Apple Health readings, and your subscription state and lifecycle records, as spreadsheets plus one machine-readable file. To request a copy of other personal data associated with your account, email privacy@stacky-app.com.
• Delete your account permanently, from inside the app. Settings → Delete account.
• Correct anything inaccurate, mostly directly in the app.
• Withdraw consent for health data processing at any time.
• Object to or restrict processing.
• Complain to a supervisory authority. In Portugal that is the Comissão Nacional de Protecção de Dados (CNPD), at cnpd.pt. You can also complain to the authority where you live.

Export and deletion are built into the app so you never have to ask us. For anything else, email privacy@stacky-app.com and we will respond within 30 days.

What you choose to make public

Some things in Stacky are public by design, and only when you choose:

• Your handle is what other people see, on your profile, on your published stacks and on your comments. It is pseudonymous: we never show your email. Your bio and profile picture appear on your profile if you add them, and a real name only if you give one — we ask for it when you first publish, never at signup.
• A stack you publish is visible to anyone on stacky-app.com and in the app's Explore, with the bottles you did not mark private. Medicines, private items and bottles outside our catalogue never appear. What you paid, how much you have left, what you took and how you felt are not part of a publication.
• Comments you write carry your handle and are visible to everyone who can read that stack. Following someone is visible to them; follower counts appear on profiles.
• The Passport card you share shows the products you tick and nothing else. Mood, adherence, notes and streaks are never included in a shared card — not as a setting you could switch on, but because they are not in the shared data at all. Products you mark private start unticked. Cost is opt-in.

Anything you share publicly may be seen, saved or screenshotted by others. Please think before you post.

Security

Passwords are hashed and never stored in readable form. Your health profile fields are encrypted at rest with a dedicated key. Connections use HTTPS. Access to production systems is limited and authenticated.

No system is perfectly secure. If a breach ever affects your rights, we will tell you and the CNPD as the law requires.

Children

Stacky is not for children. You must be at least 16 to use it. We do not knowingly collect data from anyone under 16 — if we learn that we have, we delete it. If you believe a child has given us data, email privacy@stacky-app.com.

Changes to this policy

If we change this policy meaningfully, we will tell you in the app or by email before the change takes effect. The date at the top always reflects the current version.

Contact