Privacy policy

What Lack is

Lack is a health, fitness and nutrition tracker. It reads data from wearables you connect, the food you log and the profile you enter, and turns them into scores, trends and suggestions. It is not a medical device and does not diagnose or treat anything.

What we collect

Account: your email address, and your name if you sign in with Apple or Google and choose to share it. Passwords are stored only as salted hashes by our authentication provider.

Profile: name, username, date of birth, sex, height, weight, goals and preferences.

Health and fitness data: steps, distance, energy, exercise minutes, heart rate, heart rate variability, resting heart rate, sleep, blood oxygen, respiratory rate, wrist temperature, workouts, body measurements and, if you opt in, menstrual cycle logs. This comes from Apple Health, Health Connect, Fitbit exports you import, and entries you type.

Nutrition: food, drink and water entries, favourites and targets.

Social: friends you add, challenges, reactions and the activity feed items you post.

Device: an anonymous per-install identifier, platform and app version, used to sync between your devices and to show which device last synced.

How we use it

To show your data back to you, compute your scores and keep every device signed in to your account in sync.

To share with friends only what you opt in to. Rings, workouts, medals and streaks are shared by default with accepted friends; sleep, recovery, HRV, weight and nutrition are off by default. Raw vitals and cycle data are never shared with anyone.

To read a nutrition label from a photo, when you ask for it. The photo is sent to an AI model, the result is shown for you to confirm, and the photo is not stored.

We never use health data for advertising, never sell it, never share it with data brokers, and never use it for anything other than the features you see in the app. Health data is not written to iCloud or other third-party backups by Lack.

Where it is stored

On your device, and in your account on Supabase (hosted in the European Union), encrypted in transit and at rest. Access is restricted to your account by row-level security.

Processors: Supabase (database, authentication, storage), Anthropic (label reading, no retention), Cloudflare (web hosting). Apple and Google provide sign-in if you choose them.

Your choices and rights

Export: You → Data → Export gives you everything you have entered as JSON.

Delete: You → Account → Delete account removes your account and every row it owns immediately and permanently. You can also email us to request deletion.

Permissions: Apple Health, Health Connect, camera, photos, motion and notification permissions can each be revoked in your phone settings; the app keeps working with less data.

Depending on where you live you may also have rights to access, correct, restrict or port your data. Email us and we will act within 30 days.

Children

Lack is for people aged 13 and over (16 where local law sets that age). We do not knowingly collect data from younger children; if you believe we have, email us and we will delete it.

Changes

We will post changes here and show the date above. Material changes are announced in the app before they take effect.

Contact

Lack · [email protected]