Privacy policy

What Eggsercise keeps, and why.

Last updated 14 October 2026

What we collect

Account

Sign-in is handled by Clerk, which holds your email address (or the identifier from Sign in with Apple or Google). We never see your password. With Sign in with Apple you may choose to share a private relay address instead of your own; Clerk keeps whichever address Apple gives. Our own database keeps Clerk’s id for your account, an internal Eggsercise account id, a display name if you give one, your time zone and units, the country and province or state where you shop if you choose to set them, and when you last used the app. We also keep that you confirmed you are 16 or older, when, and which version of the Terms was current.

Preferences you give us

Your goal, training days, equipment, food pattern, allergies, dislikes, cooking time, budget and schedule, plus height, weight, birth year and sex if you ask Eggsercise to estimate targets (kept only while an estimate is in use). Allergies are treated as hard rules and are never changed by any automated planning.

Movements you pause for a few days and until when, a prep day with how long you can cook then, the nights you share dinners with your household, and private notes you keep on recipes. A pause is applied by rules on our server and is never sent to a model provider.

The runs, rides and sports you plan most weeks, from Runs and sports in Profile: the kind, its days, time, minutes or distance and effort, and a name if you give one. Your planner places strength sessions around them by rules on our server; they are never sent to a model provider.

Before estimating a calorie target, or when you set a target weight, we ask whether any of these applies: under 18; pregnant or had a baby in the last year; living with or recovering from an eating disorder; or following a diet or training restrictions a doctor, dietitian or physio gave you. We store only your yes-or-no answer, never which one. It is never sent to a model provider and never written to logs or analytics. If one applies, or your birth year means you could be under 18, Eggsercise does not estimate calorie targets, plan a deficit, keep a target weight or show distance to one; you can enter targets a professional gave you, and we plan to those.

What you do in the app

Your weekly plans and every version of them, meals you mark as eaten, skipped or eating out, workout sessions and logged sets, grocery check-offs and list edits, pantry items and barcodes you scan, body measurements you log, your answers to the weekly check-in, and the requests you type into “Change my day”.

Runs, rides and sports on your plan: when you tap Mark done, we keep that it was done, the minutes, whether you marked it yourself or beside a workout from Apple Health or Health Connect, and a row in your workout history; Mark not done takes them away again.

Where you shop

If you set where you shop, Eggsercise stores the country and province or state you choose, with your account, only to show estimated grocery prices for your area, and shares it with no one: not with the people in your household (each of you sees prices for your own area), not with analytics (which note only that it was set in Canada or the US, set to somewhere else or cleared, never the country, province or state) and not with any AI provider. You can change or clear it in Profile at any time. Estimated prices come from public tables kept in our own database; showing them sends nothing about you to Statistics Canada, the BLS or the USDA. About estimated prices names the sources.

Recipes you import from a link: when you paste a link, our server fetches that page once (the site sees our server, not your phone or address), keeps the recipe’s name, its ingredients matched to our foods, its steps and the link, and discards the rest of the page.

Shared dinners: if you and someone in your household both choose to share dinners, we keep the nights each of you chose and, for each shared night, the dinner and whether your plate matches it. Household members see each other’s first name, the dinner and plate sizes in servings; never anyone’s calories, targets, allergies or diet. Their food rules are checked on our server only.

The weekly check-in

From Sunday afternoon to Tuesday, Today can offer a look back at your week with one question: how did the week feel, with optional things to focus on next. There is no free text. We keep one answer per week. It shapes one week planned in the following two weeks through fixed rules (the number of sessions, quick cooking, variety); it is never sent to an AI model.

Planner usage

Each time Eggsercise asks an AI model to plan, change or compose something for you, or to draw the photo for a recipe you made, we record one line: the feature, the provider and model, how many tokens or images it used, how long it took, whether it worked and an estimated cost. It never holds the text sent to the model or what came back. We use it to keep costs in check and spot misuse. When you delete your account these lines stay for our cost history with your account id removed.

Subscription

If you buy Eggsercise Pro, the App Store or Google Play takes the payment. We keep your subscription status as RevenueCat reports it to us: whether it is active, set to renew or has a billing issue, when it expires, the product, the store and the kind of period (such as a trial). For each subscription event RevenueCat sends us, such as a renewal or a cancellation, we keep its type and time with your account id, never its contents. We never see your card details.

Notifications

Reminders for meals, workouts, shopping and the pantry are scheduled on your phone, and their times and wording stay there. What reaches our servers is a product analytics event when you turn a kind on or off (which kind, on or off) and when you open a reminder (which kind). Three kinds of notification come from our server: “Next week is ready”, household news (someone joining, items checked off the shared list) and the Sunday week recap. Once reminders are on, at least one of those three is on and your phone allows notifications from Eggsercise, the app registers your phone’s push token with us. We store it per phone with a random id for this installation, the platform, the app version, which of the three you want and when it was registered. When you open the app and the registration is more than a week old, the app registers it again. The token is never exported or written to logs.

The token is removed:

• When you sign out: the app asks us to remove it before your session ends. If your phone is offline at that moment, it stays until the phone registers again, Apple or Google report it as no longer valid, or the account is deleted.
• When you turn reminders off, turn all three server kinds off or take notification permission away in your phone’s settings, the next time the app reaches us.
• When the same phone registers for another account, which moves it there.
• When Apple or Google tell us it no longer reaches a device.
• With your account, when you delete it.

Your calendar

On iPhone, from app version 0.5.0, if you turn on Calendar clashes in Profile, Eggsercise reads the times of events in the calendars you choose, on your phone only, to spot when something today or tomorrow overlaps a workout, a run, ride or sport, your cooking or your prep. Eggsercise never changes your calendar. Event titles, times, places, people and notes are never sent to Eggsercise, to analytics or to any AI provider, and which calendars count is kept on your phone. When you apply a suggested move, only that change to your plan is saved, like any change you make yourself. Turn it off in Profile or in your phone’s Settings at any time.

Lock Screen and widgets

Widgets and Lock Screen timers show your next meal or session and your running timer using data kept on this phone. Nothing extra is sent to us. The Next up widget shows names and times only, never calories, targets, weight, allergies or diet, and Timers on Lock Screen in Profile turns the timers off. Both come with app version 0.5.0, on iPhone.

Problem reports

When you send a report from Help and support or from the error screen, we keep your words with the app version and build, the phone model and system version, the screen you were on, your last few request ids and, from the error screen, the error’s name and message. Reports stay in our own database, linked to your account, and are deleted with it. Sentry is told only that a report arrived, with its reference, whether it came from Help and support or the error screen, the app version, platform, screen, request ids and the id of the matching crash report; never your words.

Crash reports

When the app or our API hits an unexpected error, a crash report goes to Sentry, our error tracker: the error and where in the code it happened, the app version, phone model and system version, the name of the screen and request ids. Eggsercise never attaches your account, name or email to a crash report, and the app and the API mask ids, email addresses, amounts such as weights and calories, and allergen words in the error text they send. Crash reports have no in-app switch; Help and support says whether your build sends them.

Product analytics

Named events such as “plan generated” or “workout completed”, with scalar properties like a duration or a location type. We never attach the text of your requests, notes or meal names to analytics, and never your screening answer, the country, province or state where you shop, anything from your calendar or anything read from Apple Health or Health Connect. Analytics stay on our own servers; no third-party analytics SDK runs in the app.

Before you sign in, the app sends only a few events: that it was opened, that the welcome screen or the sample week was shown, and that sign-in was started, sent a code, did not go through or finished. They carry the random id for this installation that the app also uses for notifications, not an account. When you sign in, we link that installation id to your account, so we can count how many people get from installing to their first plan. Deleting your account deletes these events and the link. Events from an installation that never signs in are deleted once it has not been seen for 180 days.

How we use it

• To build and repair your plan, your grocery list and your pantry offsets.
• To plan next week for you from Friday evening, when your plan includes it and you used the app in the last 14 days, so it is ready before Monday. This is what the date you last used the app is kept for; it also holds back a “Next week is ready” note when you have opened the app since.
• To show your progress in plain language, including the Sunday look back.
• To suggest updated targets from your weight trend, only when you asked Eggsercise to estimate them and answered that none of the screening situations applies, and only once you confirm.
• To send the notifications you turn on, and nothing else.
• To keep the service working: request logs are kept for a short period to diagnose faults and abuse, with credentials and tokens redacted, and crash reports go to Sentry as described above.
• To improve Eggsercise from aggregate usage, never from your individual free text.

Who processes it

• Clerk for sign-in and account identity.
• Neon (PostgreSQL) for storage, and Railway for the API that serves the app.
• Vercel for this website only. This website never connects to your account data.
• Anthropic or another model provider, only when Eggsercise asks a model to plan, change or compose something for you. It receives the candidate meal and exercise ids the planner allows, your planning constraints and the request you typed, and, when you import a recipe, ingredient lines it could not read on its own. It never receives your name, email, account id, screening answer or check-in answers, and nothing it returns is used without validation against your rules.
• OpenAI image generation, for the photo of a recipe you create in the app: it receives only the recipe’s title and ingredients.
• RevenueCat, for App Store and Google Play subscriptions once Eggsercise Pro is on sale: the app and our API identify you to it only by your internal Eggsercise account id, and it receives your store purchase records; never your email, name, plan or health data. When you delete your account we ask RevenueCat to delete its record of you.
• Sentry for crash reports and the notice that a problem report arrived, as described above, never with your account id, name or email.
• Expo’s push service, with Apple Push Notification service and Firebase Cloud Messaging, delivers the notifications our server sends: they receive the push token and the notification text (such as “Next week is ready” or a household member’s first name and a count), never your plan, food or health data.
• Open Food Facts when you scan a barcode: the API sends only the barcode. Product data comes back under the Open Database License and is cached on our side. A package photo is shown from Open Food Facts’ own servers when you view that product; we do not store it.
• USDA FoodData Central supplies generic nutrition data to our catalog, and is asked when a food search finds little in our catalog or a barcode is unknown to Open Food Facts: the API sends only the search words or the barcode, never anything about you.

No data is sold or shared for advertising.

Health information

Eggsercise provides general wellness planning. It does not diagnose, treat or advise on medical conditions, and it will not build specialised medical, pregnancy, paediatric or eating-disorder diets. Anything you enter about allergies or limitations is used only to keep those items out of your plan.

Apple Health and Health Connect

• Each switch is off until you turn it on in Profile, and does only what is listed here.
• With sync on, Eggsercise reads body weight, to show your trend, and writes the workouts you finish, with their name, start and end. A run, ride or sport you confirm with Mark done on its own page, with no recorded workout beside it, is written too, on its own day for the minutes you confirm: at its planned time, or ending as you mark it done if it would otherwise end later. A one-tap Mark done on Today writes nothing, and Mark not done removes Eggsercise’s entry and nothing else.
• From app version 0.5.0, a second switch, Runs and sports from Apple Health or Health Connect, reads workouts other apps and watches save (type, start, end and minutes), only to offer Mark done on a planned run, ride or sport this week. When you tap Mark done beside one, Eggsercise keeps that it was done, the minutes and the platform’s name with your account, and nothing else from the workout. Nothing is marked done by itself.
• Distance, routes, heart rate and calories are never read. A workout from these apps never changes your plan or your food targets.
• Data from these apps is never sold, used for advertising or sent to an AI model provider.
• An imported weight is stored with your account like one you log yourself.
• You can turn either switch off in Profile, and revoke access in the Health app or in Health Connect.
• Use of Health Connect data follows the Health Connect Permissions policy, including its Limited Use requirements.

Getting a copy of your data

In the app, Profile → Export my data gives you one JSON file with your account settings (including where you shop) and preferences (including the screening answer above and your runs, rides and sports), every weekly plan and each of its versions (with its runs, rides and sports and whether you marked them done), the changes you asked for (including what you typed into Change my day), meals you logged, workout sessions and sets, your programs and recipes, favourites and Not for me, lifts you follow, movements you paused, recipe notes, your prep day, your body log, your household memberships, the invites you created, your shared-dinner nights and the shared dinners you were part of, the pantry, household foods and list lines you share, list edits you made, your analytics events, your planner usage records, your subscription status, problem reports you sent, your check-in answers, the phones registered for notifications (platform, app version, the three switches and dates; never the token) and a record of your exports.

Other household members’ names and data are not included. Progress photos never leave your phone and are not in the file. Your sign-in email is held by Clerk; you can see it in the app. You can make up to three copies a day, on every plan, free.

Retention and deletion

Your data is kept while your account exists. Delete your account from Profile: Eggsercise deletes your preferences and answers (where you shop and your runs, rides and sports among them), plans and versions, change requests, logs, sessions, programs, recipes and their photos, body log, favourites, check-in answers, problem reports, registered phones and their push tokens, subscription status, analytics events (including those from before you signed in on your phones) and export records, then asks Clerk to delete your sign-in and RevenueCat to delete its record of you.

On your phone: signing out cancels Eggsercise’s scheduled reminders, turns reminders, Health sync and workout reading and Calendar clashes off for whoever signs in next, ends a Lock Screen timer and leaves the Next up widget asking you to open the app. Progress photos stay on the phone, shown only to the account that took them, until you delete that account in the app or remove the app.

If you share a household, the shared pantry and list stay with the other members, and the remaining member who joined earliest becomes its owner; list lines you added stay on the shared list without your name. Two records stay with your account id removed: planner usage lines, kept for cost history, and the subscription events RevenueCat sent us, kept as a billing audit. A subscription event that arrives after your account is gone is stored without any id. Deleting your account does not cancel a store subscription; cancel it in your App Store or Google Play account first.

Backups roll off within 30 days. You can also ask us to delete your account by email; see Deleting your account.

Your choices

• Camera access is only requested when you choose to scan a barcode.
• Body measurements are optional and can be deleted individually.
• Estimates are optional: skip them and your plan stays protein-first, with no calorie number.
• The Sunday look back and its question are optional.
• Notifications are off until you turn on reminders, and each kind can be turned off in Profile.
• Health sync is off until you turn it on, and reading workouts from it has its own switch, also off until you turn it on.
• Where you shop is optional: without it, Shop shows no prices.
• Calendar clashes are off until you turn them on, and you choose which calendars count.
• You can export a copy of your data from Profile at any time.

Children

Eggsercise is for people 16 and older. The app asks you to confirm your age right after you sign in, before anything else, and does not plan for anyone who says they are younger. If you believe someone under 16 has an account, write to us and we will delete it.

Contact

Questions or requests: privacy@eggsercise.app. We answer within a few days.