Privacy Policy

Last updated: October 29, 2026

This Privacy Policy describes how Tech Forge ("we", "us", or "Wholesum") collects, uses, and shares information about you when you use the Wholesum mobile application, website, and related services (collectively, the "Service").

1. Information we collect

1.1 Information you provide

• Account information: email address, display name, and password (stored as a hash, never plaintext).
• Profile information you choose to share: age, biological sex, height, weight, activity level, weight goal, weekly rate of change, carbohydrate/fat preference, country, and which optional nutrients you track (fiber, sugar, saturated fat, sodium). We use these inputs to calculate your personalized calorie and macro targets.
• Pregnancy and breastfeeding status: if you choose to record it, we store whether you are pregnant or breastfeeding and, for pregnancy, your due date. We use it for one purpose: adjusting your calorie target, which changes by trimester. This is sensitive health information. It is optional, you can clear it at any time in Settings, and it is never shared with friends or any third party.
• Health and nutrition data: food logs (including the food, meal, portion and nutrition values), weight check-ins, daily carbohydrate/fat ratios, recipes you build, and food items you favorite.
• Images: photos you attach to a recipe, and food images supplied by the food databases described in section 3.
• Social data: friend usernames you search for and friend requests you send or accept.

1.2 Information collected automatically

• Camera: the app asks for camera access only to scan a product barcode. Frames are processed on your device to read the barcode and are not stored, uploaded, or sent anywhere. You can decline and still log food by searching for it.
• Food searches: when you search for a food or scan a barcode, the search term or barcode is sent to the food databases named in section 3 so they can return results. These requests are not tied to your account.
• Crash and usage analytics: none at present. The app contains optional hooks for crash reporting and product analytics, and both are disabled — no such data leaves your device today. If we turn either on, we will update this policy and this date before doing so.

2. How we use your information

• Calculate and adapt your personalized calorie + macro targets.
• Save your daily food logs, weight check-ins, and recipes.
• Share data you explicitly choose to share with friends (recipes you publish, today's meals visible on your friend profile).
• Send transactional emails (account verification, password reset).
• Keep the app working — diagnosing a problem you report, and protecting accounts from abuse.

3. How we share information

We do not sell your personal data. We share data only with the following categories of service providers, each of which is contractually bound to protect your information:

• Supabase: database hosting, authentication, and the transactional emails described above. This is where your account and everything you log is stored. Data is held in the United States (AWS us-east-1).
• USDA FoodData Central and Open Food Facts: public food databases we query to populate search results and barcode lookups. They receive the search term or barcode only. We do not send them your account, your identity, or anything you have logged.
• Vercel: hosting for this website. It does not hold app data.

We do not currently use any crash-reporting, advertising, or product analytics provider, and the app contains no advertising and no in-app purchases. If that changes, we will update this policy and the date at the top before the change takes effect.

3.1 Where your data is held

Wholesum is operated from the United States and your data is stored there (see Supabase above). If you use the app from outside the United States, your information is transferred to and processed in a country whose data-protection laws may differ from your own. By using the Service you understand that this transfer takes place.

4. Friends and shared content

When you accept a friend request, that friend can see:

• Your username and display name.
• Recipes you have created.
• Your daily food logs (date and meal entries, not weight).

You can unfriend anyone at any time from the Friends screen; the previously-friended user immediately loses access to your data.

5. Your rights and choices

• Access and export: email tech.forge.engineering@gmail.com to request a copy of your data.
• Correction: edit your profile, goals, and logged entries directly in the app.
• Deletion: email tech.forge.engineering@gmail.com or use the in-app delete-account flow (when shipped). Account deletion removes profile, food logs, check-ins, recipes, and friendships; backups are purged within 30 days.
• Withdraw consent: uninstall the app and request deletion to revoke ongoing data processing.
• EU / UK residents: you have additional rights under the GDPR (objection, restriction, portability). To exercise them, email tech.forge.engineering@gmail.com.
• California residents: the CCPA gives you the right to know, delete, and not be discriminated against. Email tech.forge.engineering@gmail.com.

6. Data retention

We retain your data for as long as your account is active. After you delete your account, we purge identifying records within 30 days, with two exceptions: (a) audit logs retained for fraud prevention, and (b) data we are legally required to keep.

7. Children

Wholesum is intended for adults. You must be 18 or older to use the Service, and the onboarding flow will not accept an age below 18. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has provided us information, email tech.forge.engineering@gmail.com and we will delete the account and its data.

8. Security

We use industry-standard safeguards: HTTPS / TLS for all transport, encryption at rest in Supabase, row-level security on every user-owned table, and one-way password hashing. No system is perfectly secure; we will notify affected users of any breach without undue delay.

9. Changes to this policy

We'll update this page when we materially change how we handle your data. We'll notify you in the app and bump the "Last updated" date above.

10. Contact

Questions about this policy or your data: tech.forge.engineering@gmail.com.

Pending legal review. The data practices described above were checked against the running app and database on the date shown and are accurate as written. What still needs counsel, not engineering: the jurisdiction-specific clauses — the transfer mechanism for users outside the United States, the GDPR lawful basis for the pregnancy and breastfeeding fields, which are special-category data under Article 9, and CCPA / state-law disclosures.