Privacy policy

Glycogen is a nutrition and body-tracking app. This policy explains what it stores about you, why, who helps run it, and how to see or delete your data. Questions go to bnsigurdson@gmail.com.

The short version

• No ads, no analytics, no tracking cookies, and no third-party scripts. Even the fonts are served from Glycogen itself.
• Your data is never sold or shared for marketing.
• Your log is private to your account.
• You can download everything, or delete your account and all of its data, at any time from Body → Account.

What Glycogen stores

• Account: your email address, an optional first name, and your password stored only as a salted PBKDF2 hash. If you sign in with Apple, Google or Discord, Glycogen stores that service’s account ID and the email it shares.
• Health and body information you enter: food and drink logs, weigh-ins, body measurements and body fat, progress photos, and your plan details (sex, age, height, activity level, goal weight and pace).
• Products you scan: the barcode and nutrition values, saved to your personal product library.
• AI usage records: for each AI request, when it happened, which feature and model were used, and how many tokens it took, with an estimated cost. This is used to enforce the daily limit and to keep running costs in check. It never includes what you typed or the photos you sent, and only the app’s operator can see it.
• Technical logs: errors and security events (for example failed sign-ins), kept briefly to keep the service working and safe. Glycogen’s host processes IP addresses to deliver and protect the site.

Why, and on what basis

Glycogen uses your data only to provide the app: calculating your targets, showing your progress and keeping your account secure. Information about your body and diet is health data, a special category under the GDPR. Glycogen processes it on the basis of your explicit consent, which you give when you create an account. You can withdraw that consent at any time by deleting your account. Account details are processed because they are needed to provide the service you signed up for.

Who helps run Glycogen

• Cloudflare hosts the app, its database and photo storage. Data may be processed in data centres outside Norway and the EEA under Cloudflare’s data-processing terms and the EU Standard Contractual Clauses.
• Anthropic provides the AI that estimates nutrition. When you describe a meal, photograph a nutrition label or ask for an estimate, that text or photo is sent to Anthropic’s API, without your name or email. Under its commercial terms Anthropic does not use this data to train its models and keeps it only for a limited period. Glycogen asks for your permission before the first time this happens.
• Open Food Facts is queried for scanned barcodes. Only the barcode number is sent, from Glycogen’s server, so the request is not linked to you.
• Apple, Google and Discord are involved only if you choose to sign in with them. Their own privacy policies apply to that sign-in.

Cookies and browser storage

Glycogen sets one cookie to keep you signed in, and a short-lived one during Apple, Google or Discord sign-in. Both are strictly necessary. Your browser also remembers which tab you last had open. Nothing is used to track you across sites.

How long data is kept

Your data is kept until you delete it or delete your account. Deleting your account removes your log, photos, products and sign-in links from the live database and photo storage immediately. Copies in the host’s automatic database recovery points expire within 30 days. Technical logs are kept for a few days.

Your rights

You can access and export your data (Download backup), correct it, delete it (Delete account), take it elsewhere, object to processing and withdraw consent. To use any of these rights, or if you have questions, email bnsigurdson@gmail.com. If you’re unhappy with how your data is handled, you can complain to Datatilsynet, the Norwegian Data Protection Authority, or to the authority where you live.

Security

All traffic uses HTTPS. Passwords are never stored in readable form. Each account’s data is kept separate, and sign-up is by invitation.

Age

Glycogen is not intended for anyone under 16, and it does not knowingly collect data from them.

Changes

If this policy changes, the date at the top changes too, and significant changes will be shown in the app.