Gainplate Privacy Policy

Gainplate ("Gainplate", "we", "us", "the app") is an iOS meal-planning app focused on hitting a daily protein target. This policy explains what data the app touches and what leaves your device.

The short version: nothing individually-identifiable about you is uploaded anywhere. Everything you configure — body weight, dietary preferences, favorites, cart selections, swipe history, household size — lives on your iPhone in the app's UserDefaults (or the iOS Keychain, for the optional Claude API key). We do not run servers that receive any of it, and there is no user account to create. The one categorical exception, described in Section 3.5, is that in future releases we may share aggregate, anonymized statistics computed over cohorts of ≥100 users with grocery retailer partners so those partners can see the routing / fulfillment performance of the Gainplate user base. Individual user data never enters those aggregates in an identifiable form, and a single opt-out toggle in Profile → App → Analytics excludes your device from all outbound data collection.

Gainplate is developed and operated by Austin Connor, an individual solo developer, not an incorporated entity. All references to "we" in this document mean that individual.

1. Data we collect and store on your device

The following are stored locally on the iPhone the app is installed on, in UserDefaults (or the iOS Keychain where noted). They stay on-device — they never leave your phone unless you explicitly export them (e.g. by sharing a screenshot) or unless a specific outbound feature described in Section 2 requires them for a single request:

• Body weight and protein multiplier. Used to compute the daily protein target displayed on the Today tab.
• Dietary exclusions and preferred cuisines. Used to filter recipes in Browse and to influence AI-recipe generation prompts.
• Cook-time preference. Sets Browse defaults.
• Household composition (adult / kid counts). Scales ingredient quantities in the Cart and Recipe Detail views.
• Favorites list (FavoritesStore). Recipe IDs you have starred.
• Cart contents (CartStore, key gp.cart.v1). The set of recipes queued for aggregated shopping.
• Per-recipe buy-list filters (BuyListStore). Which ingredients on a given recipe you have marked as "already have" vs "still need to buy" — used to trim the retailer deep-link payload.
• Swipe / preference history (MealPreferences). Per-recipe swipe outcomes and the derived preferenceScore used by the Today ranker and Browse feed. Stays on device.
• Cook-through history. Which recipes you have opened in Detail, added to cart, or handed off to a retailer. Used locally to influence ranking and to render "Recently cooked" surfaces. Stays on device.
• Weekly meal plan (WeeklyPlanStore, key gp.currentWeeklyPlan, Premium+ only). The generated 7-day × 4-meal lineup.
• Preferred retailer setting. Which grocery retailer Profile is locked to (or auto for smart routing per ADR-0019).
• Onboarding acknowledgment. A single boolean recording whether you have seen the AI-recipes disclosure sheet, so we do not re-show it on every launch.
• Optional Claude API key (iOS Keychain, service com.gainplate.app, account claudeAPIKey). Only present if you have opted into the Claude Haiku recipe provider from the DEBUG Developer section of Profile and pasted your own key. Stored in the Keychain, never in UserDefaults, never in a plist we ship, and never transmitted to Gainplate — the app only sends it as the x-api-key header on outbound requests to api.anthropic.com.

Uninstalling the app deletes all of the above (the Keychain entry is scoped to the app's service string and is removed with the app). We do not sync any of it to iCloud by default.

2. Data sent to third-party services

The app calls a small number of anonymous public APIs. No personal data — name, email, device identifier, body weight, dietary preferences, favorites, cart — is transmitted in any of these calls.

2.1 TheMealDB (recipe data)

• What we send: an anonymous HTTPS request for recipe search / lookup by name, ID, or cuisine.
• What comes back: recipe records (title, ingredients, image URL, source URL).
• Provider: TheMealDB, themealdb.com.

2.2 Pollinations.ai (AI-assisted recipe generation and imagery)

• What we send: a food description prompt (protein type, cuisine, meal type, cook-time bucket) and an anonymous HTTPS request. Nothing about your identity or your preferences is included in the prompt.
• What comes back: a generated recipe (name, ingredients, instructions) and a food image.
• Provider: Pollinations, pollinations.ai.
• AI disclosure: AI-generated recipes are marked in the app with a purple AI badge. Their macros are recomputed on-device from an ingredient database — we never trust protein/kcal numbers returned by the language model.

2.3 Walmart and Target deep-links (grocery hand-off)

• What we send: nothing programmatically. When you tap "Shop ingredients" from Recipe Detail or "Shop cart" from the Cart tab, the app opens the chosen retailer's iOS app (or their website in Safari as a fallback) with a pre-populated search query built from your recipe's or cart's ingredient list. The retailer, not Gainplate, handles the resulting session — including any account sign-in, cart persistence, and checkout.
• Which retailer: Walmart (walmart://search?query=… → walmart.com fallback) or Target Drive Up (target://search?query=… → target.com fallback), chosen by the smart-routing rule in ADR-0019 (Target for baskets under $35 to skip Walmart's $6.99 pickup/delivery fee, Walmart otherwise) or locked to a single retailer via Profile.
• What the retailer receives from us: only the search query string (a list of ingredient names). No Gainplate identifier, no user profile, no swipe history, no preference score, no cook-through history, and no account handle is included in the deep link or shared with the retailer through any back-channel. We have no server-side integration with Walmart or Target today.
• Providers: Walmart Inc., walmart.com; Target Corporation, target.com.

2.4 Anthropic (optional Claude Haiku recipe generation)

• When this runs: only if you have opted into the Claude Haiku provider in the DEBUG Developer section of Profile and pasted your own Anthropic API key. Off by default. Not exposed in production release builds.
• What we send: a food description prompt (protein type, cuisine, meal type, cook-time bucket) plus your API key as the x-api-key header, direct from your device to api.anthropic.com. No Gainplate identifier, body weight, dietary preference list, favorites, cart, or swipe history is included in the prompt.
• What comes back: a generated recipe.
• Provider: Anthropic PBC, anthropic.com. Anthropic's use of the request is governed by their own privacy policy and the terms attached to your API key.

2.5 Apple StoreKit (subscription payments)

• What is sent: standard StoreKit purchase flow. Apple handles all payment processing, receipt validation, and subscription-lifecycle events.
• Provider: Apple, standard App Store payment infrastructure.
• Note: Gainplate never sees your payment method, billing address, or Apple ID.

3. What we do NOT do

• We do not sell your data to advertisers. Ever. This is not a business model we will ever adopt. The app has no advertising SDKs integrated today, no ad SDK is served, and there is no back-door mechanism that ships user data to an ad network under any circumstance.
• No user accounts, no sign-in, no email required to use the app.
• No cross-app or cross-website tracking. We do not use the iOS IDFA, we do not fingerprint your device, and we do not correlate activity across other apps or websites you use.
• No transmission of any individually-identifiable user data (body weight, dietary preferences, favorites, cart, swipe history, cook-through history) to Gainplate servers or any third party. See Section 3.5 for the strict boundary on aggregate statistics.
• No advertising SDKs. (The app contains stubs for rewarded ads as a future free-tier unlock mechanism, but no ad SDK is integrated and no ads are served.)
• Today, no analytics or telemetry SDK is shipped in the app. Zero analytics data leaves your device in current release builds. If and when a first-party product-analytics SDK (e.g. PostHog) is added in a future release to power the aggregate-partner-statistics use case in Section 3.5, it will land behind the opt-out toggle described in Section 3.5, this policy will be updated with the new effective date, and the change will be surfaced in-app before the SDK ships.

The current release's PrivacyInfo.xcprivacy manifest declares NSPrivacyTracking = false and an empty NSPrivacyCollectedDataTypes list, reflecting the fact that no analytics or partner-aggregate pipeline is active in the shipped binary today. Any future release that changes this will update the manifest in the same commit.

3.5 Data sharing with partners (grocery retailers)

Gainplate's long-term business model is to license aggregate, anonymized recipe-intelligence insights to grocery retailer partners (e.g., Walmart, Target, Kroger, Instacart) so those partners can see the fulfillment performance of routed Gainplate users. This section sets the hard boundaries on what that ever means for your data.

3.5.1 What is NEVER shared with partners

Individual user data is never shared with any grocery retailer, data broker, or other third party in individually-identifiable form. That prohibition specifically includes, and is not limited to:

• Swipe preferences (MealPreferences outcomes and derived scores).
• Cook-through history (which recipes you opened, added to cart, or handed off to a retailer).
• Favorites (FavoritesStore starred recipe IDs).
• Macro history (per-day protein / kcal actuals derived from cooked meals).
• Purchase intent (which recipes you routed to Walmart or Target and which ingredients survived the buy-list filter).
• Body weight, protein target, dietary exclusions, household composition, or any other Profile field.

3.5.2 What MAY be shared with partners

Aggregate, anonymized statistics computed across a cohort of Gainplate users may be shared with grocery retailer partners solely to demonstrate routing performance — for example, "median basket size for Gainplate users who chose Walmart in the past 30 days," or "cook-through rate for AI-generated recipes vs TheMealDB-sourced recipes."

Every aggregate export is subject to the following irreducible constraints:

• Cohort minimum of 100 users. Any aggregate statistic shared externally must be computed over a cohort of at least 100 Gainplate users. Sub-100 cohorts are dropped, not published, to prevent re-identification by joining a small-cohort statistic back to a single user.
• No personally-identifying information in the export. Aggregate exports carry no name, no email address, no IP address, no advertising identifier (IDFA), no vendor identifier (IDFV), no device model string tied to an individual, and no cohort key that could resolve to a single user. Only the aggregate statistic itself and the cohort size travel to the partner.
• No re-identification-capable joins. We do not ship keys, hashes, or tokens that a partner could use to line up a Gainplate aggregate row against a specific user in their own systems.
• Retailer-neutral cohorts. Aggregate cohorts are constructed across the Gainplate user base as a whole (or across all routed users of the retailer in question); we do not slice cohorts in ways that would encode information about specific individuals.

3.5.3 The Analytics opt-out (kill-switch)

Every form of outbound data collection — the future product-analytics SDK described in Section 3, and the aggregate-partner rollups described in Section 3.5.2 — is governed by a single opt-out toggle:

Profile → App → Analytics

Turning this toggle off disables ALL outbound data collection by Gainplate: no product-analytics events fire, and your device's activity is excluded from every aggregate cohort computed for a partner. The toggle is a hard kill-switch, not a preference — turning it off means your device produces zero outbound analytics signal from that point forward, including for the partner-aggregate use case in Section 3.5.2.

The toggle's state is stored on-device and is respected client-side before any analytics event is emitted, so opting out does not require trusting a server round-trip. Toggle state defaults are documented in the in-app disclosure the first time the app introduces the toggle.

3.5.4 We do not sell to advertisers

Nothing in Section 3.5 permits the sale of user data (individual or aggregate) to advertisers, ad networks, or data brokers. Aggregate statistics under Section 3.5.2 are provided to grocery retailer partners for the sole purpose of demonstrating fulfillment / routing performance under a B2B licensing arrangement. They are not provided to any advertising ecosystem, and they are not brokered.

4. Data retention

Because all app data lives only on your device, retention is entirely under your control:

• In use: data persists in the app's UserDefaults for as long as the app is installed.
• Reset: clearing the app's data (iOS Settings → General → iPhone Storage → Gainplate → Delete App and reinstall) removes all stored preferences, favorites, and cart entries.
• Deletion: uninstalling the app deletes all Gainplate-owned local data. There is nothing for us to retain because nothing was ever uploaded.
• Backups: if you use encrypted iCloud or iTunes device backups, Gainplate's local data is included in those backups per Apple's standard backup behavior. We do not manage or access those backups.

5. Your rights (CCPA, GDPR, and international users)

Gainplate is designed so that data-subject-rights requests are trivial to satisfy: since we do not collect, store, or process your personal data on our servers, there is nothing for us to hand over, correct, port, or delete on your behalf. Nevertheless, we recognize the rights below and describe how each maps to Gainplate:

• Right to know / access: all data the app has about you is visible inside the app (Profile tab shows body weight, protein target, dietary preferences, favorites, cart, household). No server copy exists.
• Right to deletion: uninstalling the app deletes all data. There is no server copy to also delete.
• Right to correction: edit any field directly in the Profile tab.
• Right to portability: screenshot or export the visible data yourself. We do not lock you into a proprietary format.
• Right to opt out of sale / sharing: we do not sell your personal data to anyone, for any purpose, ever. We do not share individually-identifiable personal data with third parties for their own use. The only category of data that ever leaves Gainplate in a form derived from user activity is the ≥100-user aggregate, anonymized cohort statistics described in Section 3.5.2, and even those are gated behind the Profile → App → Analytics opt-out toggle (Section 3.5.3), which lets you exclude your device from every aggregate cohort at any time.
• Right to non-discrimination: we do not condition access to the app on you providing personal data (there is no login).

These rights are honored regardless of your jurisdiction. If you are in California (CCPA/CPRA), the EEA/UK (GDPR/UK-GDPR), Brazil (LGPD), or elsewhere, the same policy applies.

6. International data transfers

Not applicable. No user-identifying data leaves your device. The third-party HTTPS endpoints listed in Section 2 are called anonymously from your device to whichever regional edge those providers serve — this is a browser-style anonymous fetch, not a data transfer we control or process.

7. Children's privacy

The app is not directed to children under 13 and is not designed to attract them. If you are a parent or guardian and believe your child under 13 has used the app, contact us at the email below — but since Gainplate does not collect any personal information off-device, there is nothing to delete beyond uninstalling the app from that child's device.

The App Store age rating for Gainplate is 4+ because the content is non-objectionable — this is not an invitation for use by children under 13, who should not be using apps that reference macro or weight-based nutrition targets without adult supervision.

8. Security

Data stored on-device is protected by the standard iOS data-protection class assigned to UserDefaults, which encrypts the value when the device is locked. We use HTTPS (TLS 1.2+) for every third-party API call.

9. Changes to this policy

If the data-handling behavior of the app changes (e.g. we add accounts, cloud sync, activate the analytics pipeline foreshadowed in Sections 3 and 3.5, or enter into a specific grocery retailer partnership that changes the aggregate-export cadence or scope), this policy will be updated and the version, effective date, and last-updated date at the top of this document will change. Where the change is material — including any activation of the outbound analytics SDK, any new category of aggregate export, or any new partner category beyond grocery retailers — the app's on-device disclosure will reflect it before the change ships, and the Profile → App → Analytics opt-out toggle (Section 3.5.3) will continue to govern all outbound data collection.

10. Contact

Privacy questions or requests:
feedback@gainplate.app

Responses within a reasonable time — this is a solo-developer app, not a support call center.