Privacy Policy

Stacky is a supplement tracking app. It knows what you take, when you take it, and how you feel — which is about as personal as data gets. This policy explains exactly what we hold, why, and what you can do about it. It is written to be read, not to be survived.

Who is responsible for your data

Stacky is operated by Nuno Guilherme Neves Duarte, an individual trading as Stacky, based in Portugal. Contact: Rua Garcia Resende 32, 2790-349 Queijas, privacy@stacky-app.com.

Under the GDPR we are the data controller for everything described below.

The short version

• We do not sell your data. Not to anyone, for any price.
• We do not run advertising, and there is no advertising or analytics SDK in the app. We do not track you across other apps or websites, and we never ask for permission to, because we have nothing to do with it.
• We do not build a profile of you for anyone else's benefit.
• You can download your health-tracking and subscription ledger in a portable file, and you can delete your account permanently from inside the app.
• Your private health-profile fields — birth year and biological sex — are encrypted, and we ask for them separately rather than burying the request in a signup form.

What we collect

Account details

Your email address and a securely hashed password. If you sign in with Apple or Google, we receive an identifier from them and the email address you choose to share — Apple's “Hide My Email” works normally with Stacky.

We also store your public username handle, your first and last name if you provide them, your profile picture if you upload one, and your bio.

Health data

Two fields form your private health profile: your birth year and your biological sex. Both are optional. Both are encrypted at rest with a dedicated encryption key, separate from the rest of the database, and neither is ever shown on your public profile. We record the moment you consented to providing them.

We also treat the following as health data, because it is:

• Your stack — the supplements and products you take, their doses, forms, schedules, how much you have left, and what you paid.
• Your intake history — which doses were scheduled, which you marked as taken, and when you marked them.
• Your moods — the score you log, the factors you attach to it, any notes you write, the day the entry is about, and the moment you actually recorded it.
• Your goals — what you are trying to achieve with your stack.
• Your stack change log — an append-only record of what you added, removed or adjusted.

How you use the app

Your bookmarks, saved stacks, the people you follow and who follows you, your conversations with the AI advisor, and your notification preferences.

Device and technical data

A push notification token, if you enable reminders. Standard server logs. Crash and error reports, described below.

Camera and photo library

The app uses your camera to scan supplement barcodes and, optionally, to photograph a label so it can be read automatically. It accesses your photo library only when you choose a profile picture. We do not store your photos. A barcode image is processed on your device and only the resulting barcode number leaves it. A label photo is sent for one-off reading and is not retained.

Payment data

If you subscribe, Apple processes the payment. We never see your card number, billing address, or any payment details. We receive only whether your subscription is active, which plan, and when it renews or expires.

Why we use it, and our legal basis

Health information is a special category of personal data under Article 9 of the GDPR. We rely on your explicit consent to process it, and you can withdraw that consent at any time by deleting the relevant entries or your whole account. Withdrawing does not affect processing that already happened.

Who else touches your data

We use a small number of service providers. Each one processes data only on our instructions, under a data processing agreement. We do not sell or rent data to anyone, and none of the companies below are permitted to use your data for their own purposes.

Two of these deserve a specific note:

The AI advisor. When you request an analysis or ask a question, we send the AI provider your goal and the contents of your stack — supplement names, doses and forms. We do not send your name, email, date of birth, biological sex, mood history or any account identifier. Products you have marked private are excluded. Groq's current service agreement does not permit it to use our inputs or outputs to train or fine-tune models unless we explicitly instruct it to do so. It may temporarily retain inputs and outputs for service reliability or abuse monitoring for up to 30 days; Groq says ordinary inference requests are not retained by default, and we do not use its batch or fine-tuning features for this purpose.

Crash reporting. Sentry is configured on both the app and our servers to exclude personal information and request bodies, specifically because health data is sensitive. Crash reports are also disabled entirely in development builds.

Barcode lookup. When you scan a barcode, the barcode number alone is sent to Open Food Facts, a public database. Nothing identifies you, and nothing about your stack is included.

Data leaving the EU

Some providers above are based in the United States. Where that is the case, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent approved safeguard. You can ask us for details.

How long we keep it

We keep your data while your account exists. When you delete your account, we permanently erase it — your profile, your stack, your entire intake history, your moods, your goals, your health profile, your AI conversations, your bookmarks, your follows and your devices are removed from our database. This is a real deletion, not a hidden flag, and it cannot be undone.

Some records outlive the account for narrow reasons: transaction records Apple and we are required to keep for tax purposes, and backups, which are overwritten on a rolling cycle. Anonymous, non-identifying data may be retained.

Your rights

Under the GDPR you can:

• Get a portable copy of your tracking ledger. Settings → Export my data produces a download containing your stack, your complete intake history with timestamps, your moods, your stack change log, your health profile, and your subscription state and lifecycle records, as spreadsheets plus one machine-readable file. To request a copy of other personal data associated with your account, email privacy@stacky-app.com.
• Delete your account permanently, from inside the app. Settings → Delete account.
• Correct anything inaccurate, mostly directly in the app.
• Withdraw consent for health data processing at any time.
• Object to or restrict processing.
• Complain to a supervisory authority. In Portugal that is the Comissão Nacional de Protecção de Dados (CNPD), at cnpd.pt. You can also complain to the authority where you live.

Export and deletion are built into the app so you never have to ask us. For anything else, email privacy@stacky-app.com and we will respond within 30 days.

What you choose to make public

Some things in Stacky are public by design, and only when you choose:

• Your username, name, bio and profile picture appear on your public profile.
• A stack you mark public is visible in Explore, and other people can save it.
• The Passport card you share shows the products you tick and nothing else. Mood, adherence, notes and streaks are never included in a shared card — not as a setting you could switch on, but because they are not in the shared data at all. Products you mark private start unticked. Cost is opt-in.

Anything you share publicly may be seen, saved or screenshotted by others. Please think before you post.

Security

Passwords are hashed and never stored in readable form. Your health profile fields are encrypted at rest with a dedicated key. Connections use HTTPS. Access to production systems is limited and authenticated.

No system is perfectly secure. If a breach ever affects your rights, we will tell you and the CNPD as the law requires.

Children

Stacky is not for children. You must be at least 16 to use it. We do not knowingly collect data from anyone under 16 — if we learn that we have, we delete it. If you believe a child has given us data, email privacy@stacky-app.com.

Changes to this policy

If we change this policy meaningfully, we will tell you in the app or by email before the change takes effect. The date at the top always reflects the current version.

Contact