Your data and your privacy

What the app knows about you, where it goes, and how to erase it all.

Without an account, your journal does not leave your device. Your journal, how you felt, your recipes and your settings are stored in your browser, on this phone or this computer. No server receives them. They are not encrypted on the device: anyone using this browser, on this device, can read them — so lock it. That is the default behavior, and it stays that way until you create an account. Only anonymous audience measurement totals are sent, described below.

Who is responsible

My Microbiote is published by Romain Le Dû. For any question about your data, or to exercise your rights: contact@mymicrobiote.app.

What is stored, and why

If you create an account, here is what is sent to a server:

Your username, and your email address if you give one — it is used to recover your password, and nothing else. You will receive no marketing messages.
The date and version of your agreement to this policy, as well as the dates your account was created and last signed in to.
Two-factor authentication, if you turn it on: the host keeps the secret key used to check the codes from your app. It is erased when you turn it off, or along with the account.
Your journal: what you logged, with the day and the time, the meals you planned, how you felt and your stools with their time, your recipes, your settings. That is what lets you find your tracking again on your other devices.

Two purposes, and only these: giving you back your data on your devices; and letting the publisher know, as totals, how the app is used. Your data is neither sold, nor rented, nor passed to advertisers, nor used to profile you, and the app contains no advertising tracker.

What the publisher looks at, always as totals, never account by account, and nothing below five accounts: the number of visits counted by the host; the number of accounts created, active, and still used 7 and 30 days after their creation; and, only for the accounts that have agreed to it, the number of notes per account, as a median and an average — only the length of the journal is counted, never what it contains. And, for all devices, the audience measurement described below, nothing below five devices.

Legal basis: your consent, collected through a dedicated box that names this health data, before creating the account — or before continuing with Google or Apple. A food journal says something about health: the law treats it as sensitive data and requires explicit agreement. Until that box is ticked, nothing is sent. You may withdraw your agreement at any time, without having to justify yourself: Settings, Account, “Download your data”, “Withdraw your consent”. Your journal is then erased from our servers and nothing more is sent there; your account stays open, and you can also delete it.

Counting your notes requires a second, optional agreement: a separate box, unticked at first, in Settings, Account, “Download your data”, “Help the publisher”. Syncing does not depend on it, and you can untick it whenever you like. The totals of accounts created, active and still used rest instead on the publisher's legitimate interest: measuring the use of a free service, from dates already recorded.

Audience measurement, anonymous, with or without an account: your device counts the pages you open, the actions you take (logging a food or a feeling, scanning a product, creating a recipe, planning a meal, opening a card or a molecule, sharing your card, signing in), the first time you take each of them, and whether it has reached 1, 3, 7, 14 or 30 logged days. The next day, it only sends that day's totals: not what you logged, not your account, not a device identifier, and your IP address, which the host sees as for any connection, is not stored with them. The server adds them to those of the other devices and only keeps daily totals, for 13 months. What your device keeps for this (actions already taken once, logged days) starts again from zero after 13 months. They are for the publisher alone, to know which features are used, and are cross-referenced with nothing. Exempt from consent under the rules of the CNIL, the French data protection authority, this measurement can be turned off in Settings, “Cookies and local storage”: turned off, nothing is sent.

Reporting a missing plant, with or without an account: the name you type is sent, with the index plant you chose, the app's region and language, and the hour. Nothing that identifies you is stored with it: not your account, not your device, not your IP address, which the host sees as for any connection. These anonymous requests are used to add missing plants, and are erased after one year.

Where your data is, and for how long

It is hosted in the European Union, at Supabase, acting as a processor and making no other use of it. It is encrypted in transit and on the servers.

The other processors, each for one thing only: Resend sends the account emails (password reset, address confirmation, security alerts) and receives your email address for that purpose — the emails are sent from Ireland, but records of them are kept for 30 days in the United States; Cloudflare hosts the site and forwards mail addressed to the publisher to their Gmail inbox, at Google — its technical logs keep the IP address of each visit for a limited time; Google or Apple, if you choose to sign in with them, pass on your address, your name and your profile photo. Supabase's authentication logs also keep the IP address and the browser used; they are erased after 30 days. The logs of its other services keep the IP address and the browser of each call made by the app — audience measurement included — for one day. These technical logs rest on the legitimate interest of the publisher and its hosts: keeping the service secure and preventing abuse.

It is kept for as long as your account exists.
An account left unused for two years — no sign-in and no sync — is deleted, along with its data.
If you deactivate your account, it is deleted 30 days later. You can cancel everything until then by signing back in.
If you delete your account, it is erased from the database immediately. The host keeps no backup copy of it, and its technical logs are erased within a few days.
Data left on your device is never erased remotely: you erase it from Settings.
Messages sent to the contact address are erased one year after the last exchange; the record of a request to exercise your rights is kept for five years, so that the reply can be proven.

Transfers outside the European Union

Some processors are established outside the European Union, or may access the data from abroad. Each transfer relies on a safeguard recognized by the European Commission:

Supabase: the data stays hosted in the Union, but the contract is concluded with Supabase Pte. Ltd (Singapore), whose support staff may access it from abroad — safeguard: the European Commission's standard contractual clauses.
Cloudflare and Google (United States): certified under the EU–US data protection framework (Data Privacy Framework).
Resend (an American company; the emails are sent from Ireland, and records of them are kept in the United States): certified under the same framework, and bound by the standard contractual clauses.

You can obtain a copy of these safeguards by writing to the publisher.

The other services the app may contact

Three features, and only those, send anything off your device. Each one is triggered by you, and the screen says so as it happens:

Scanning a barcode sends the code to Open Food Facts, an open community database, to get the product sheet. No data about you goes with that request.
A photo of a plant, if you take one, is sent directly to Pl@ntNet (a French scientific plant-identification database), with the personal key you created with them; Pl@ntNet returns the species recognized. The image does not go through the app's server, and Pl@ntNet does not keep it; it keeps the date and time of your requests on your account. Your key stays on this device.
Signing in with Google or Apple, if you choose it, tells Google or Apple that you are signing in to this app, and has them pass on your address, your name and your profile photo to the host. You can avoid it by using a username and a password.

Your rights

At any time, and directly from the app, you can:

See everything that is stored: it is what the app displays, and nothing is kept beyond that.
Take your data away in a file other software can read: Settings, Account, “Download your data”.
Correct a note: every note, in the Calendar on the Feeling page (tap its day), can be moved to another date or deleted.
Erase everything: “Deactivate your account” with time to reconsider, or “Delete” with no delay. And “Erase all my data” for this device alone.
See who accesses your account: Settings, Account, “Security and account access” shows your open sessions (device, browser, IP address, dates) and the history of sign-ins to your account over the last 30 days, and lets you close a session. These are the authentication logs described above, shown to you alone: nothing more is collected, and the IP address is not used to locate you.

You also have a right to object and a right to restriction of processing. If an answer does not satisfy you, you may complain to the CNIL (cnil.fr), the French data protection authority, or to the authority of your own country.

After your death

You can leave instructions on what should happen to your data after your death: keeping it, erasing it, or passing it on to a person you designate. Send them to the publisher, at the address above, with your username; you can change or withdraw them at any time. Without instructions, your heirs can ask for your account to be closed and its data erased.

Security, and what we do not promise

Access to your account is protected by your password, the connection is encrypted, and the server enforces a rule that forbids one account from reading another's journal. What we do not claim: your data is not end-to-end encrypted, meaning the host technically holds the means to read it. If that bothers you, do not open an account: the app is complete without one.

Children

The app is not intended for anyone under 16: a checkbox has you confirm this before creating an account, and no account should be created for a child without a parent's agreement.

If this policy changes

Any significant change will be announced in the app, and your agreement will be asked again before any further sending of your data. Last updated: October 8, 2026.