Privacy Policy

Updated 4 November 2026Applies to the TDEE Tracker app and website

TDEE Tracker is run by [Company name] ("Champions Performance", "we", "us"). This policy explains what information TDEE Tracker handles, why, and the choices you have. It applies to the website and the web app, including when you add the app to your phone's home screen. Our Consumer Health Data Policy covers your health data in more detail, as the laws of Washington, Nevada and Connecticut ask.

Who we are

[Company name] runs TDEE Tracker and decides how your information is used (in privacy laws, the "controller" or "regulated entity").

Postal address: [Postal address]
Email: support@championsperformance.net

1. What we collect

Information you enter

• Food log: the foods, recipes, amounts, meals and times you record, plus water, exercise and cardio entries.
• Weight and your weight history.
• Body measurements and health stats you choose to log: body fat percentage, waist, HRV, resting heart rate, sleep, steps, VO₂ max, blood pressure and blood glucose.
• Fasting: when each fast started and ended, and your goal.
• Workouts: exercises, sets, reps, weights, times and distances, optional effort ratings, notes, saved routines, programs and personal bests.
• Weekly check-ins: how the week felt, energy, hunger, sleep quality, things like stress, illness or travel that week, your weekly focus and notes.
• Period / cycle: only if you turn on "Track my cycle" in Settings, whether you had your period in a given week (asked in the weekly check-in). Turning the switch off deletes those answers.
• Progress photos (front, side and back). These stay on your device. They're never uploaded or synced, and they aren't in backups, so clearing the app's data or losing the device removes them.
• Birth month and year: asked once, before you use the app or create an account, to check you're old enough to use TDEE Tracker. It's kept on your device and, if you have an account, in your profile. We never ask for the day.
• Body and goal details: sex, age, height, weight, optional body fat percentage, goal weight, pace, activity level, eating style and, if you tick the box, that you take a GLP-1 medication. These are used to calculate your calorie and nutrient targets.
• Medical disclaimer: the date you agreed to the training and nutrition notice shown the first time you open the app. We don't ask about your medical history. If you answered the health questions in an earlier version of the app, those answers are deleted from your device and your account the next time you open it.
• Goals and motivation: optional performance goals, how important and how confident you feel about your goal, your reason in your own words, and what's made it hard before.
• Pro founding list: if you join it, your email address, the date and how you first found TDEE Tracker (for example from the calculator or an ad). We use it only to tell you about Pro.
• Profile: your name and, if you add one, a profile photo. The profile photo is stored as part of your profile and syncs with your account.
• Custom foods, recipes, saved meals and to-dos you create.
• Settings: units, theme, meal names, which diary sections you show, reminder times, and your privacy switches ("Suggest picks from my logs" and "Track my cycle", both off until you turn them on).

Account information

If you create an account: the date you confirmed you're 16 or older and agreed to the Terms and this policy (and which version); separately, the date you consented to us keeping your health data (and which version of that wording), and the date you withdrew it if you do; your email address, a securely hashed password (we never see the password itself), and the time you signed up and last signed in. If you use an email sign-in link, we store the email address only. If you sign up from TDEE Calculator, the numbers you calculated there (targets, sex, age, height, weight, activity, goal and pace) are saved with the new account until the app first opens, when they're offered as your targets and then deleted from the account.

Older calculator sign-ups: if you made your account with TDEE Calculator's free meal plan form (before 4 November 2026), your account also records that you came from that form and whether you ticked "Also send me tips and offers". We'd only ever send tips and offers to people who ticked it, and every one would have an unsubscribe link and our postal address. To change your choice, email us.

Sign in with Apple or Google: if you choose this, Apple or Google confirms who you are and sends us your email address (with Apple, you can choose a private relay address instead) and, if you allow it, your name and profile picture. We use these only to run your account. We never see your Apple or Google password, and we don't send Apple or Google anything from your log.

Reminders

If you turn on reminders, your browser gives us a push address for that phone or computer. We store it with your time zone and reminder times so we can send reminders like "Nothing logged for lunch yet." You can turn reminders off at any time in Settings, which deletes the push address.

Camera and photos

The camera is used only when you choose: for the barcode scanner, while it's open, and when you take or pick a photo of a nutrition label, a progress photo or your profile picture. Barcodes and nutrition labels are read on your device. The scanner video and label photos aren't recorded, saved or sent anywhere: only the barcode number is looked up (see section 4), and the numbers read from a label just fill in "Create a food" for you to check before you save it.

Usage counts

The app records a few simple events so we can see whether it's working for people, such as opening the app, logging a first meal or weigh-in, opening the weekly check-in or the Pro page, and how many days have been logged. Each event carries a random ID made for your device, your account ID if you're signed in, and where you first came from (the calculator, an ad campaign or directly). Events never include foods, weights, calories, your age or anything else you type in. They're stored with Supabase and aren't shared with anyone else. Nothing is sent until this device has passed the age question: until then, counts wait on your device. A visit to the home page is counted with no device ID or account ID at all, and it waits for the age question too. Events linked to your account are deleted with your account, and all events are deleted after 12 months.

Technical information

Our hosting providers (Vercel for the website and app files, Supabase for the database) keep standard server logs (IP address, browser type, pages or data requested, timestamps) for security and to keep the service running. We do not run advertising trackers, social media pixels or third-party analytics (including Vercel's) on the app; the usage counts above are our own and stay with us. No other company collects information about you over time or across other websites through TDEE Tracker.

What we don't collect

We don't access your contacts, location or microphone, and we don't read data from other apps or wearables. If photo logging of meals is added later, you'll be asked before it's turned on.

2. Health data and your consent

Most of what you log is health-related information. Some laws, such as Washington State's My Health My Data Act, Nevada's consumer health data law and Connecticut's data privacy law, treat it as consumer health data with extra protections. We follow these principles everywhere, not just where the law requires it:

• We ask first, separately. Before your account keeps your health data, we ask for your consent in its own box: it isn't pre-ticked and isn't part of agreeing to the Terms. It says what we keep, why, who gets it and how to withdraw. Accounts made before we asked this way are asked once in the app. We record when you consented and which wording you saw. If you'd rather not, you can use the app without an account, and your log stays on your device.
• You choose what to log. Apart from the details needed to calculate your targets, every field is optional. We use what you log only to provide the features you use, as described in section 3.
• The most sensitive features are off until you turn them on. Cycle tracking and suggestions from your logs each have their own switch in Settings, with a plain explanation next to it. They start off.
• We never sell it or use it for ads. Your health data is never sold, never shared with advertisers or data brokers, never used to target ads, and never used to build profiles for other companies.
• You can withdraw consent at any time: Settings → Privacy → Health data consent → Withdraw. Your account then stops collecting your health data and you're signed out (what's already saved stays until you delete it or your account). You can also turn a switch off, delete entries, delete your account or email us. See section 7.
• No geofencing. We don't collect location data and don't use location-based tracking of any kind.

3. How we use your information

• Show your diary, totals, nutrient breakdown, stats and weight trend from what you've logged.
• Calculate calorie, macro and nutrient targets from your body and goal details.
• Sync your data between your devices when you have an account.
• Sign you in and send account emails (confirmation, sign-in links, password resets), using your email address.
• Weekly check-in suggestions, worked out from the last 7 days of your log, weights and check-in answers.
• Coach's pick suggestions, only if you turn on "Suggest picks from my logs". The app chooses them on your device from your recent logs (for example, protein coming up short on several days). Nothing about which pick was shown, or why, is sent to us, the brands, the stores or any ad network. Coach's picks aren't shown to anyone under 18.
• Send the reminders you turn on.
• Provide Pro features if you subscribe (when available), using your account and subscription status.
• See which parts of the app help people, and where they get stuck, using the usage counts.
• Email you when Pro opens, if you joined the founding list.
• Keep the service secure and fix problems, using server logs.
• Reply when you contact us, using your email and message.

All suggestions in the app (targets, pace zones, check-in tips) are calculated from your own entries using published formulas. They are general wellness guidance, not medical advice. We don't use your data to train AI models, and we don't sell or give it to anyone who does.

Ads. There are no ads in the app today. When free users start to see some, they won't appear on food logging or the weekly check-in, they won't use your health data, and Pro will have none. We'll update this policy before any ads appear.

4. Who we share it with

We share data only with the service providers that run the app for us, and only what they need to do that job. They act on our instructions and are not allowed to use your data for their own purposes.

• Supabase, Inc. (United States): our database, accounts and sign-in, and the server code that sends reminders. It stores your account and everything you've synced, your consent records and your push address if you use reminders. It also receives your food searches and barcodes to look them up in our copy of the USDA packaged-food list; we don't save your searches.
• Vercel, Inc. (United States, global edge network): hosts the website and the app's files. Its server logs see your IP address, browser and which pages load. It doesn't receive your log.
• Resend (United States): delivers our account emails (confirmation, sign-in links, password resets), so it gets your email address and the message. These emails don't include anything from your log.
• Apple and Google (United States), only if you sign in with them: they confirm your sign-in, as described under Account information, and so know you use TDEE Tracker. They get nothing from your log.
• Cloudflare, Inc. (United States), only when a bot check is shown on the sign-in page: its Turnstile check sees your IP address and browser details to tell people from bots. It gets nothing from your log.
• Stripe, Inc. (United States), when Pro launches: processes payments. It gets your email, payment details and billing country; we never see card numbers. It gets nothing from your log.

Food databases. When a packaged food isn't in our own list, a food search or barcode lookup sends only the search text or barcode number to USDA FoodData Central (a US government database) and, for barcodes, Open Food Facts (a nonprofit food database). Nothing else from your log or account goes with it. Like any website, their servers see your IP address, and product photos from Open Food Facts load from their servers.

Push services. Reminders are delivered by your browser's push service: Apple, Google, Mozilla or Microsoft, depending on your browser. They receive the push address, the time it's sent and an encrypted message that only your device can read, and nothing from your log.

Affiliate links. If you tap a Coach's pick link, the store (such as Amazon) can see that you came from TDEE Tracker. We don't send the store anything about you or your logs.

We will also disclose information if the law requires it, to protect someone's safety, or as part of a sale or merger of the business, in which case this policy will continue to apply to your data.

We do not sell your personal information and have not done so in the past 12 months.

5. Where your data is stored

Without an account: your data is stored only in your browser on your device. We can't see it, and clearing your browser data removes it. The "Copy backup" button in Settings lets you save a copy as text.

With an account: your data is stored on servers in the United States operated by Supabase, encrypted in transit and at rest. A copy is also kept on each device you sign in on so the app works offline. If you use TDEE Tracker from outside the United States, you understand your data is transferred to and processed there.

Progress photos are always kept only on the device you took them on, with or without an account.

6. How long we keep it

• Your log and profile: for as long as your account exists. Withdrawing your health data consent stops new data reaching your account; to erase what's already there, delete your account (or ask us).
• After you delete your account: your data is removed from our live database immediately and from backups within 30 days, except purchase records (next).
• Without an account: only on your device, until you erase it or clear the app's data.
• Consent records (when you agreed to the Terms and consented to, or withdrew, health data collection, with the version): for as long as your account exists, and deleted with it.
• Pro purchase records (when Pro launches: what you agreed to at checkout, meaning the terms shown, the boxes you ticked, the price and the time, plus refunds, payment disputes and the billing reminders we sent): at least 3 years after the purchase, even if you delete your account, because California's automatic renewal law asks us to keep proof of that agreement. After an account is deleted they're kept without the account ID, linked only to the payment provider's customer record. Your payment records also stay with Stripe as financial and tax rules require.
• Calculator numbers saved with a new account: until the app first opens, then deleted from the account.
• "Tips and offers" choice (older calculator sign-ups only): with your account, and deleted with it.
• Push addresses: until you turn reminders off, sign out on that device or delete your account, or until your browser's push service tells us the address no longer works.
• Founding list: until Pro opens and we've emailed you about it, or sooner if you ask us to remove you. The list is kept apart from accounts, so deleting your account doesn't take you off it: email us and we will.
• Usage counts: 12 months, then deleted. Counts linked to your account are deleted with it sooner. Counts from before you signed in carry only a random device ID, aren't linked to your account and are deleted after 12 months.
• Server and email delivery logs: up to 90 days.
• Support emails: up to 2 years, so we can follow up on earlier questions.

7. Your rights and choices

Whatever country or state you live in, you can:

• See and export your data. Settings → "Copy backup" gives you everything as text, and "Download your data" gives you spreadsheet (CSV) files. You can also email us for a copy.
• Correct it. Every entry can be edited in the app.
• Delete it. Delete individual entries in the app, use "Erase all data" in Settings, delete your account in Settings, or email us to delete it. Deleting your account removes your data from our servers; you'll also want to clear the app's data on each device.
• Withdraw consent for us to collect your health data: Settings → Privacy → Health data consent → Withdraw. Or turn a switch off, delete the data or delete your account.
• Use the app without an account. All free tracking features work with data kept only on your device.
• Not be treated differently for exercising any of these rights.

To make a request, email support@championsperformance.net from the address on your account. We'll confirm it's you, then answer within 45 days. If we need longer, we'll tell you why within those 45 days and finish within 45 more. Requests are free. If we can't fulfil a request we'll tell you why. You can appeal by replying with "Appeal" in the subject line; we'll answer the appeal within 45 days and, if we still say no, tell you how to contact your state's Attorney General. Health-data requests follow the same steps, set out in our Consumer Health Data Policy.

If you're in the EU, UK, California or another place with a privacy law, you may also have the right to complain to your local regulator.

8. Security

Passwords are hashed and never stored in plain form. Data travels over HTTPS and is encrypted at rest. Each account can only read and change its own records, enforced at the database level. No system is perfectly secure; if we ever learn of a breach affecting your data, we'll notify you as the law requires.

9. Children and teens

TDEE Tracker is for people 16 and older and isn't directed at children. Before anyone uses the app or creates an account, we ask for their month and year of birth. If the answer is under 16, the app stays closed on that device and anything saved on it is erased. If that person was signed in, their account and everything stored with it are deleted.

If you're 16 or 17, the app doesn't show Coach's picks or suggestions, doesn't set weight-loss goals, and doesn't offer fasts longer than 16 hours. We never sell the data of anyone under 18 or use it for targeted advertising.

We don't knowingly collect personal information from anyone under 16. If you're a parent or guardian and think your child has given us information, email support@championsperformance.net and we'll delete it.

10. Changes to this policy

If we change how we handle your data in a meaningful way, we'll update the date at the top and tell you in the app or by email before the change takes effect. If a change means using your health data in a new way, we'll ask for your consent again first.

11. Contact

[Company name] ("Champions Performance")
[Postal address]
Email: support@championsperformance.net