Privacy Policy

Last updated 30 September 2026

Metron measures the energy in your food and tracks it against a daily budget. Doing that needs some information about you. This page says exactly what we collect, why, how long we keep it, and how to get rid of it. It describes what the software actually does — not what we might do later.

The data controller is the operator of Metron, reachable at symeon.lampadarios@gmail.com. Personal data is processed and stored in the European Union.

Photographs of food

When you photograph a plate, the image is sent to an EU-hosted vision model that returns a list of food names and estimated weights in grams. The calorie and macronutrient figures you see are then computed on our servers from public reference nutrition data. When a food is not in those tables, the model's own estimate of its figures may be shown instead. It is shown only if it passes an arithmetic check on our servers, it is always marked on screen as the model's estimate, and correcting the item replaces it with reference data.

The photograph is held in memory for the duration of that single request and discarded. It is never written to our database, never written to disk, and never used to train any model.

There is one narrow exception, and it happens entirely on your phone. If a scan fails, the app keeps that photograph in memory on your device for ten minutes so the Retry button has something to send. It is not written to your photo library or to disk, it is never sent to us a second time unless you tap Retry, and it is dropped the moment you leave the screen. Nothing about what we store changes.

Location metadata (EXIF/GPS) is stripped on your device before the image is transmitted. We do not receive it.

What we store

• Account: your email address and an internal user identifier. If you use Sign in with Apple and choose to hide your address, we only ever see Apple's relay address.
• Food log: the items you keep, their weights, and the energy and macronutrients computed for them.
• Body data: the sex, height, weight, year of birth, activity level and goal you enter or authorise Metron to read from Apple Health, used to compute your energy budget; body-fat readings and the method they were taken by, if you log them.
• Movement: the workouts you log — the activity, its duration and intensity, and the energy credited for it — and, if you switch it on, the workouts Apple Health recorded: their type, start and end time, duration, the energy it measured and the identifier Apple Health gave it.
• Your measured expenditure: the nightly estimates Metron derives from your logged days and weigh-ins, kept so the budget it serves can be shown with its evidence.
• Saved meals and preferences: the usuals you save for one-tap logging, your reminder settings, and the consent choices you make in Settings, with when you made them.
• Scan telemetry: for each scan, what the model proposed, how confident it was, what you corrected it to, and which items you rejected. This is what calibrates your portions and what our accuracy dashboards are built from.
• Cycle phase: if you enable cycle-aware guidance, only the phase label (for example "luteal") is transmitted and stored. Your raw period dates stay on your device and are never sent to us — nor is anything Metron reads from Apple Health about your cycle or contraception.
• Subscription status: whether your Pro entitlement is active, and the identifiers needed to verify that with Apple or Stripe. We never see or store your card details.
• Notification tokens: the device token needed to send a push, if you turn one on.

Evening check-ins — the energy and appetite bands you select — stay on your device; they are not transmitted or stored by us. So does a pregnancy, if you tell Metron about one: it changes which guidance the app shows you and which targets it declines to set, and it is never sent to us.

Health data and your explicit consent

Food intake, body measurements and cycle phase are health data under Article 9 of the GDPR. We process them only on the basis of your explicit consent, given when you enable each feature, and only to provide the measurement and guidance you asked for. Withdrawing consent is always available in Settings and takes effect immediately. Everything else — running your account, taking payment — is processed to perform our contract with you under Article 6(1)(b).

Apple Health data is read with your permission through HealthKit and is used solely to keep your budget accurate. It is never shared with advertisers, sold, or used for marketing.

Who else sees your data

• Our EU vision provider, which receives the photograph for the length of one request and is contractually barred from retaining it or training on it.
• Apple and Stripe, who process payments and tell us only whether a subscription is active.
• Our EU hosting provider, which runs the servers.

That is the whole list for the app. We do not sell personal data, and the app runs no advertising SDK and no third-party analytics. Our website's marketing page runs an advertising tag only if you accept cookies there (see below). Metron does not track you across other companies' apps or websites. Where any transfer outside the EU is unavoidable it is covered by Standard Contractual Clauses under Article 46.

Cookies on this website

The app uses no cookies for advertising or measurement and loads no such tag. This section is about our website only.

• Your cookie choice. The marketing page stores your answer to its cookie banner in a first-party cookie, metron_consent, for six months. It holds only "accepted" or "rejected", is strictly necessary to remember your choice, and needs no consent.
• Advertising measurement, only with your consent. If you press Accept, the marketing page loads the Meta Pixel (Meta Platforms Ireland) and/or the Google tag (Google Ireland) to measure whether our advertising works. They set their own cookies and receive your IP address and browser details under their own policies. Nothing loads if you reject or make no choice. You can withdraw at any time with "Cookie settings" at the foot of that page; the page then reloads without them.
• The Android counter. The "Tell us you want Metron on Android" button records only a count per day — no address, no device details, no cookie.
• The visit counter. When our website's pages (the marketing page, the terms and this policy) are opened, we add one to a count for that page and that day. Nothing about you is stored with it — no address, no device details, no cookie — so it cannot be tied back to anyone. It ignores requests from known search and preview robots, so it is an estimate of visits, not an exact figure.

How long we keep it

Your log is kept while your account is open, because a trend is the point of the product. Delete your account and everything tied to it — your billing ledger included — is erased within 30 days by an automated daily sweep, not merely hidden. Photographs are never retained at all, so there is nothing to delete.

Encrypted database backups are kept for a further 14 days after the sweep, so a deleted account can persist in a backup for up to 44 days in total, and nowhere else. Backups are never used to restore an individual account.

Our servers keep request logs — the address you connected from, the time, and the path requested, without query strings — for up to about two weeks on a rolling basis, for security and fault-finding only.

Your rights

You may request access to your data, correct it, export it in a portable format, restrict or object to its processing, and have it erased (GDPR Articles 15–22). Export and deletion are both available directly in Settings, and take effect without you having to ask anyone. For anything else, write to symeon.lampadarios@gmail.com; we answer within one month. You also have the right to complain to your national data protection authority.

Children

Metron is not intended for anyone under 13, and we do not knowingly collect their data. For users who indicate they are under 18, the app deliberately suppresses deficit targets and weight-loss guidance and shows nutritional information only.

Security

All traffic is encrypted in transit with TLS. Passwords are stored as argon2id hashes, never in a recoverable form. Administrative access requires a second factor. Third-party access tokens are encrypted at rest with AES-256-GCM.

Changes

If this policy changes materially, we will tell you in the app before the change takes effect. The date at the top always reflects the current version.