Privacy Policy

1. Who is responsible (data controller)

Tact is a paid, subscription-based nutrition tracking service. The data controller responsible for your personal data under the General Data Protection Regulation (GDPR) is:

Mirza Herdić, Louise-Martini-Weg 3/4, 1030 Vienna, Austria.

Full provider details are in our Impressum. Our lead supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde, DSB). For any privacy question or to exercise your rights, contact us at mirza@mirzaherdic.com.

2. Data we collect

When you create an account and use the app, ask for a founding spot, or book a feedback call, we process the following categories of data:

• Account information — email address and password (hashed by Supabase Auth)
• Profile and health data — date of birth, sex, height, weight, body fat percentage, activity level, weight goals, and (optionally) pregnancy or lactation status
• Dietary preferences — diet type and dietary restrictions (optional)
• Meal and nutrition data — meals you log, meal plans, food items, quantities, and recipes you import
• Voice input — if you use the diary microphone, the spoken utterance (which can include meal descriptions) is transcribed in the browser. We receive only the transcript, not the audio.
• Consented food-search selections (no longer collected) — while this ran, logged-in users who accepted analytics had a keyed search fingerprint, selected food or concept, pre-sort relevance position, search context, ranking version, and timestamp recorded when they picked a result. The plaintext search was never stored. We have stopped collecting these for everyone; the records already held are covered by the retention section below.
• Payment data — handled by Stripe (see processors below). We receive your billing email and subscription status; we never see or store your full card number.
• Push notification data — if you opt in to push notifications, a push subscription (a device identifier issued by your browser's push service) and your notification preferences (which notification types you have enabled). The notification content we send is encrypted in transit.
• Product-test participation — if you join a time-bounded product test, the campaign, signup and test dates, and your versioned permission to receive test-specific follow-up. If you use the linked Google Form, Google also stores your responder email, product-feedback answers, interview preference, and optional timezone or availability. The form asks you not to submit health data or detailed diary entries.
• Founding-spot requests — if you ask for a Tact founding spot through our Tally form: your email address, where you heard about Tact (and which community, post, or person), your answer about your diet goals, and whether you'd do a feedback call. The form asks you not to share health or medical details. This applies whether or not you have a Tact account.
• Feedback-call bookings — if you book a feedback call through our Cal.com page: your name, email address, and chosen time. This applies whether or not you have a Tact account.

Before email signup, we check whether the address you enter already has an account and show that result on the form. The check is rate limited. If you choose Sign in or Reset password, the address is carried in the same browser tab to prefill that form.

Body metrics, date of birth, sex, activity level, and any pregnancy or lactation status are health-related data and count as a special category of personal data under Article 9 GDPR.

3. Why we process it (lawful bases)

• Performance of our contract with you (Art. 6(1)(b)) — to deliver the service: calculate your personalized nutrition targets, score foods and meals, store your meal history and plans, import recipes you submit, and transcribe diary voice input you start. Chrome and Android send that spoken audio to Google LLC in the United States (Google LLC EU-US Data Privacy Framework). Microsoft Edge uses Microsoft's speech service (Azure Cognitive Services when cloud-based; newer Edge builds may recognise speech on-device). Safari may process speech on-device.
• Your explicit consent for health data (Art. 9(2)(a)) — processing the required body metrics, date of birth, sex, and activity level needed to compute your targets is anchored on a separate, explicit health-processing consent you give at signup, or at a separate onboarding checkpoint if no valid signup record is available.
• Separate, revocable consent for pregnancy / lactation (Art. 9(2)(a)) — for profiles recorded as female, these optional fields are only processed if you grant their dedicated consent during onboarding or in your profile. You can revoke it at any time with one click, which clears those fields; the rest of the app keeps working.
• Your consent for push notifications (Art. 6(1)(a)), and Art. 49(1)(a) consent for the international transfer — push notifications are off until you opt in. Apple Safari and Firefox route push delivery through US-based services for which the usual transfer safeguards (Standard Contractual Clauses) are not available, so before we enable notifications we ask for your explicit, specific consent to that transfer under the Art. 49(1)(a) derogation. Google FCM and Microsoft WNS use the EU-US Data Privacy Framework safeguard instead. You can withdraw push consent at any time (see below).
• Your consent for product-test follow-up (Art. 6(1)(a)) — if you join a time-bounded test, we use your account email only for that test's check-in and optional interview invitation. You can withdraw by replying to a research email or contacting us.
• Your consent for founding-spot requests and feedback calls (Art. 6(1)(a)) — we use what you send through the Tally form or Cal.com only to handle your founding-spot request and to arrange and hold a feedback call you book. You can withdraw at any time by emailing mirza@mirzaherdic.com.
• Your analytics consent (Art. 6(1)(a)) — for PostHog and client-side Sentry. It no longer covers food-search selection learning: that processing has been discontinued.
• Legitimate interests / legal obligation — keeping the service stable (server-side error monitoring), anonymous cookieless page and interaction measurement to understand where visitors leave the sign-up path (Art. 6(1)(f), legitimate interest), notifying the service operator when an account is created, and retaining billing records for the period required by law.

We do not use your data for advertising, for selling to third parties, or beyond the app's core functionality, a founding-spot request or feedback call you ask for, and any time-bounded product research you explicitly join.

4. Third-party processors and recipients

We use the following processors and recipients. Providers in the EU involve no international data transfer. Contracted US providers (Cal.com, OpenAI, Resend, Stripe) are covered by DPF and/or Standard Contractual Clauses, and OpenAI, Resend, and Stripe also by their data processing agreements. Feedback-call bookings are also copied to our Google Calendar, a personal Google account with no data processing agreement (see its entry). Browser-determined US services have no DPA with us: Chrome and Android voice input, and Chrome push, use Google LLC's EU-US Data Privacy Framework certification; Edge voice input (when cloud-based) and Microsoft WNS use Microsoft's DPF certification; Apple and Mozilla push rest on your explicit Art. 49(1)(a) consent (see lawful bases above).

• Supabase — database hosting and authentication, in Frankfurt (EU). Your data is stored in a PostgreSQL database with row-level security so you can only access your own data.
• Vercel — application hosting, with functions pinned to Frankfurt (fra1, EU). The signup email check briefly processes the address you enter and returns whether it already has an account; we do not retain its result as an account record. The platform data processing agreement covers residual control-plane and request logs (which may include IP addresses). Vercel Web Analytics provides cookieless, anonymous page and interaction counts, including approved campaign and ad labels. We send no personal or health data in these event fields. Vercel processes request metadata to produce aggregate statistics; its daily visitor hash is discarded after 24 hours. Analytics is not pinned to our Frankfurt function region; international processing is covered by Vercel's data processing agreement and Standard Contractual Clauses.
• Google Forms and Google Sheets — used for the optional seven-day beta check-in and interview request. Google receives your responder email and the answers you choose to submit. Processing may involve the United States and is covered by Google's Workspace data-processing terms and transfer safeguards.
• Tally (Belgium) — hosts our form for requesting a Tact founding spot. Tally receives your answers and stores them in the EU (Google Cloud, Belgium). We have turned off the form features that would pass your answers to Tally's US sub-processors (email notifications, payments, and integrations). Covered by Tally's data processing agreement, which allows transfers outside the EEA only by exception, under Standard Contractual Clauses.
• Cal.com (US) — feedback-call booking and Cal Video calls. Cal.com receives your name, email address, and chosen time, and Cal Video carries the call's audio and video in real time. We do not record or transcribe these calls. Cal.com processes data in the United States; the transfer relies on Cal.com's EU-US Data Privacy Framework certification.
• Google Calendar — each feedback-call booking (your name, email address, and chosen time) is copied to our Google Calendar. This is a personal Google account with no data processing agreement: Google Ireland Limited provides it under Google's own terms and privacy policy. Google may process the data in the United States under Google LLC's EU-US Data Privacy Framework certification.
• OpenAI (US) — used server-side to parse recipe text and, only after your explicit consent, analyse a meal photo you submit. We send the relevant recipe text or meal photo plus known food names; we do not send your profile, account details, or stored diary. A meal photo may reveal health-related information. OpenAI states that API data is not used for training unless a customer opts in; abuse-monitoring logs may be kept for up to 30 days by default. Covered by OpenAI's data processing agreement and Standard Contractual Clauses for relevant EEA transfers.
• PostHog — product analytics, on EU cloud. Captures usage events only after you grant analytics consent (see below); sets no cookies and captures no events until then.
• Resend (US) — sends account emails (sign-up confirmation, password reset, email change) and an alert to the service operator when a new account is created. The alert contains your email address, signup method, and creation time; it does not include profile or health data. Account emails may contain a single-use sign-in link. Emails are sent from Ireland (EU); Resend stores email logs in the United States. Covered by Resend's data processing agreement plus DPF and Standard Contractual Clauses.
• Sentry — error monitoring, in the EU. Client-side (in-browser) error reports are only sent after you grant consent. Server-side and edge monitoring runs on a legitimate-interest basis with no browser cookies or identifiers.
• Stripe (US) — payment processing. Stripe receives your billing email and subscription details to take payment. Covered by DPF/SCCs.
• Google Web Speech — if you use voice input in Chrome or Android, your browser may send the spoken audio to Google's speech recognition service to turn it into text. That audio can include meal descriptions. We do not receive the audio; the browser returns only the transcript. This is a browser-mediated Google LLC service, not a contracted processor; transfers to the United States rely on Google LLC's EU-US Data Privacy Framework certification (the same Google LLC participation already used for Chrome push delivery). Safari may process speech on-device.
• Microsoft Edge speech — if you use voice input in Microsoft Edge, cloud recognition uses Azure Cognitive Services (Microsoft Corporation, US) under Microsoft's EU-US Data Privacy Framework certification (the same Microsoft participation already used for Edge push). Newer Edge builds may recognise speech on-device, which is not a transfer. We do not receive the audio.
• Browser push services — if you enable push notifications, your browser routes delivery through its own push service: Google (Firebase Cloud Messaging, US) for Chrome/Chromium/Android, Microsoft (Windows Push Notification Service, with Microsoft Corporation as the US recipient, for Microsoft Edge), Apple (APNs, US) for Safari and installed iOS apps, or Mozilla (US) for Firefox. They receive your push subscription endpoint (a device identifier), delivery metadata, and the encrypted notification needed for delivery. Google and Microsoft rely on the EU-US Data Privacy Framework; transfers to Apple and Mozilla rest on your explicit consent under Art. 49(1)(a), because Standard Contractual Clauses are not available for these browser-determined services. Microsoft does not publish a WNS-specific EU data-residency commitment. Notifications sent through WNS are generic prompts that never include your diary, foods, nutrients, numbers, or health details, and we use WNS only while Microsoft delivery is switched on.

Grocery prices shown in the app are entered by users. No personal data is sent to any retailer, and no retailer is a processor of your data.

5. Analytics and error-monitoring consent

Product analytics (PostHog) and client-side error monitoring (Sentry) are non-essential and off by default. During onboarding, you can choose whether to allow them; skipping that step with no earlier choice records a rejection. If no choice is recorded elsewhere, a banner offers acceptance and rejection with equal prominence. Until you accept, no PostHog usage events or client Sentry error reports are sent.

Vercel Web Analytics counts anonymous page views and sign-up-path interactions without cookies or browser storage for attribution. This cookieless measurement is not controlled by the cookie banner and runs independently of your choice, on our legitimate interest in improving the service. Only approved campaign and ad labels are included; there is no personal or health data in these event fields. Unknown link labels are omitted. Counts are best effort: blocking software, network failures and unsafe referrers can prevent collection.

Searching our public food catalogue runs in your own browser, over an index the app downloads. What you type there never leaves your device — it is not sent to us, to PostHog, or to anyone else — and the app requests only the foods you actually open, by their id. Searching your own saved meals works differently: that text is sent to our EU database so it can match your saved meals, and it is used only to answer that search. Selection learning has been discontinued, so no new search records are created whatever your analytics choice is.

Your choice is stored in a single first-party preference cookie and, if you are logged in, on your profile so it follows you across devices. You can change it at any time:

• Logged in: the Privacy section under Account Settings in your profile.
• Logged out: the "Cookie preferences" link in the page footer.

6. Push notifications

Push notifications are optional and off by default. Before your browser asks for permission, onboarding or the notification settings explain what you will receive and that enabling notifications sends a device identifier and delivery metadata to your browser's US push service. For Microsoft Edge, this is Microsoft's Windows Push Notification Service (WNS), for which Microsoft Corporation in the United States is the recipient. It relies on the EU-US Data Privacy Framework and has no published WNS-specific EU data-residency commitment. Safari and Firefox use US services that may not offer EU-equivalent data protection or legal redress, so their transfer relies on your explicit consent under Art. 49(1)(a). We only enable notifications after you give the applicable explicit consent. Notification content is encrypted in transit. In Microsoft Edge, notifications only carry generic prompts such as “Your weekly insight is ready” and never include your diary, foods, nutrients, numbers, or health details. We send notifications through WNS only while Microsoft delivery is switched on; if we switch it off, for example because Microsoft's Data Privacy Framework status lapses, we stop sending to WNS and delete the stored Microsoft Edge push subscriptions.

Once enabled, all notification types are on, and you can switch any of them off individually, or turn off push entirely, in Settings under Notifications. Turning off push deletes your push subscription, and withdrawing the transfer consent both stops delivery and erases the stored subscription, so nothing further is transferred.

7. Cookies

The app uses an authentication cookie to maintain your login session and a single first-party preference cookie that remembers your analytics/error-monitoring consent choice. Signup may also use a short-lived first-party cookie to carry your recorded acceptance and beta-test attribution through a Google sign-in redirect; it is deleted by the callback. No advertising cookies or third-party tracking cookies are used. Analytics (PostHog) sets no cookies unless and until you grant consent.

8. Data retention and deletion

Your data is retained for as long as your account exists. When you delete your account:

• Your user-authored content — saved meals, recipes, and your profile — is hard-deleted.
• Your activity history is retained only in an irreversibly anonymized form that can never be linked back to you. We keep no mapping that would let us re-identify it, so this is genuine anonymization, not pseudonymization.
• Any push subscription and notification preferences are hard-deleted. They are also deleted as soon as you turn off push or withdraw the transfer consent, without waiting for account deletion.
• A product-test roster entry is deleted when you delete your account. The roster entry and its Google Form/linked-Sheet response are otherwise scheduled for deletion 90 days after that test ends.
• Food-search selection records are no longer created for anyone. Those already stored stay in your data export and are hard-deleted with your account; we are erasing the remaining records.
• Spoken voice-input audio is not stored by us. The transcript lives in the diary input until you submit or discard it. Submitting it runs the existing diary quick-log parse (OpenAI in the US under SCCs; OpenAI retains API inputs up to 30 days). Only a confirmed diary entry follows meal-log retention. Browser recognizer retention (Google or Microsoft, depending on the browser) is provider-set. We have no DPA with those browser services and cannot erase their copies.

Founding-spot form answers and feedback-call bookings, including the copies in our Google Calendar, are deleted when founding-member recruitment ends. If you don't have a Tact account, you can still ask us for access to them or their deletion at mirza@mirzaherdic.com.

Deleted data may persist for a short period in our infrastructure provider's encrypted backups before those backups roll off (currently up to 7 days). Billing records are kept for the period required by law, and account deletion stops future subscription charges.

9. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data via your profile settings
• Erase your account and data (see retention above)
• Receive your data in a portable format
• Withdraw consent at any time — analytics/error-monitoring consent via account settings or the "Cookie preferences" footer link, optional pregnancy/lactation health consent via your profile, and push notifications, including transfer consent, via account settings. Withdraw product-test follow-up consent by replying to a research email or contacting us, and founding-spot or feedback-call consent by emailing us
• Lodge a complaint with a supervisory authority (for us, the Austrian DSB)

To exercise any of these rights, use the account settings within the app or contact us at mirza@mirzaherdic.com.

10. Children and minimum age

This service is not intended for anyone under 16 years of age. You must confirm you are at least 16 when you sign up, and your date of birth is validated again during onboarding and on profile edits. We do not knowingly collect data from children under 16.

11. Changes to this policy

This policy may be updated as the service evolves. The version and "last updated" date at the top reflect the most recent revision.

12. Contact

For privacy-related questions or requests, contact us at mirza@mirzaherdic.com. Provider details are in our Impressum.