Effective date: November 4, 2026

The rest of this policy gives the details. If you live in Washington or Nevada in the United States, also read our Consumer Health Data Privacy Policy.

Trace is provided by MySupplements LLC, 108-14 72nd Ave, Forest Hills, NY 11375, USA ("MySupplements", "we", "us"). We are the controller of the personal data described here.

Trace is currently offered only in the United States. This policy covers the Trace app, its website (trace-api.mysupplementsapp.com/legal) and the services that support them. It does not cover services we don't control, such as the app stores, Apple or Google sign-in, or the public databases Trace looks things up in. Their own policies apply.

What you record in Trace is health information. It includes:

It is stored on your device. Your device's own backup may also include it (iCloud on iPhone, Google backup on Android), under your device settings. We don't receive this journal, except for the specific pieces a feature sends, described in 3.3.

Food searches run on your phone, in a copy of the USDA's food database built into Trace.

Food barcode and supplement catalog lookups go through Trace's servers on iPhone and Android, without an account. Our servers look the item up in food databases and product catalogs, such as Open Food Facts and the MySupplements catalog, and may pass a catalog request on to another catalog service. They send only the search words, barcode or catalog product identifier needed, without your account details, and these lookups don't send your photos or journal to AI. Our servers may reuse a catalog lookup's answer for about a day when the same lookup comes again. Technical information used to protect the service is described in section 3.7.

When you type a search, Trace may also send unfamiliar Korean or Japanese words, with the kind of item you're looking for, to our AI services, which check whether the words are a brand name and translate them into English search terms (section 3.3).

Other supplement and medication searches may send search words directly to public services such as the U.S. National Library of Medicine and National Institutes of Health. Like any website, a service your phone contacts directly can see your device's IP address. Opening a result's image or source link may also contact the site that hosts it. Our Data sources page lists the public databases Trace uses.

When you use these features, Trace sends what that feature needs to our servers, and our servers send it on to the service providers that process it for us (section 6). You agree to cloud AI analysis when you continue past setup's "Your data is yours" page, which says under its Continue button that continuing accepts our Terms of Service and this policy, and that AI providers may analyze what you submit. Nothing goes to AI before that, and each feature's first-use guide says what it sends. You can use these features with an account or, on iPhone and Android, without one, as described below. The account-free database lookups in section 3.2 are separate from these AI-assisted features.

We keep uploaded meal photos and descriptions only as long as needed to process them and return the result. Uploaded meal photos are deleted automatically, normally within a day, and Trace doesn't store cup photos or photo-check images at all. We don't use any of them to build a profile of you. How long our AI providers keep what they receive is on the Service providers page.

When you ask Trace to research a product, our servers keep your request and its result in memory, to return the answer and to reuse it for about a day, including before you confirm it. Only facts you confirm are added to Trace's product catalog, without anything that identifies you.

Without an account, on iPhone. So these features stay fair without an account, your iPhone proves to our servers that it runs the genuine Trace app, using Apple's App Attest: your iPhone makes a key for Trace in its secure hardware, and Apple confirms it belongs to a genuine copy of the app. Our servers receive an identifier for that key and Apple's confirmation, and give your phone a short-lived guest pass.

Without an account, on Android. Your phone makes a key for Trace in Android's secure key storage, and Google Play Integrity confirms that a genuine copy of Trace from Google Play is running on a device that passes Google's checks. Google processes that check under its own terms. Our servers receive the key's public part and Google's verdict, and give your phone a short-lived guest pass. The check does not send your photos or search words.

If you create an account, we process:

Accounts are managed by our cloud hosting provider's sign-in service. If you have Trace Plus, its records are described in section 3.8.

With "Say it", your phone turns speech into text. On iPhone, this happens on the device. On Android, your phone's speech service, such as Google's, may process the audio under its own terms. Trace receives only the text.

You can turn each one off in your device settings.

Our servers can record technical information needed to run and protect the service, such as IP address, time, the feature used and the request, app version, device type, status and errors. When we check the quality of meal analysis, these records can also include a meal's name and calorie summary. We keep technical records only as long as we need them for these purposes, and longer only to investigate a security incident or when the law requires it.

Android automatic cup tools. Cup fitting and photo cut-outs use Google's ARCore and ML Kit. ML Kit processes images on the phone; it does not send those images or cut-outs to Google. Google services may download models and send identifiers and app/device, usage and performance diagnostics to Google. ARCore may use a Google account identifier or a device identifier for its service analytics. These services operate under the Google Privacy Policy. Cloud AI cup sizing is a separate photo transfer, described in section 3.3.

Trace Plus is a subscription you buy in the app through the App Store or Google Play. The store handles payment: we never receive your card, bank or billing details.

You manage or cancel Plus in your App Store or Google Play subscriptions. Refunds are handled by the store.

If you write to us, we keep your message and our reply for 2 years to help you and to keep records.

We don't receive your payment card or bank details: the App Store or Google Play handles payment. We don't collect your precise location, contacts or advertising identifier. We don't read data from Apple Health or Health Connect. We don't use advertising SDKs or track you across other companies' apps or websites for advertising. The Google service diagnostics used by Android's cup tools are described in section 3.7.

Your journal and Trace's on-device features send nothing. What the lookups and AI features send is described in sections 3.2 and 3.3, and each AI feature also says what it sends in its first-use guide.

Some features use AI models run by our service providers. They return suggestions, which you review and can correct before saving. No decision with legal or similarly significant effects is made about you by automated means.

Our AI providers' terms don't allow them to use your content to train their models, except with your consent through the optional choice in section 4. They may keep it for a short time, as our Service providers page describes.

We are based in the United States, and our servers are in the United States (Oregon). Our service providers may process data in other countries, as described on the Service providers page.

By email to support@mysupplementsapp.com: depending on where you live, you can ask to access, correct, delete or get a copy of your personal data, object to its use, or withdraw consent. We'll verify your request, usually by asking you to confirm from your account's email, and respond within the time the law requires, usually 45 days. We won't treat you differently for using your rights.

Depending on your state, including California, Colorado, Connecticut, Virginia, Texas and others, you have the right to know, access, correct and delete your personal data, to get a copy, and to appeal a decision about your request by emailing us with "Appeal" in the subject line. If we deny an appeal, you can contact your state attorney general. You can use an authorized agent.

We don't sell or share personal data, and we use sensitive personal information (health information and account credentials) only to provide the features you request and for the other purposes the law permits.

Washington and Nevada residents: see our Consumer Health Data Privacy Policy.

Trace is not for people under 18, and we don't knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we'll delete it.

No system is perfectly secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires.

We may update this policy as Trace changes. We'll post the new version with its effective date. For material changes, we'll tell you in the app at least 30 days before they apply, and ask for your consent where the law requires it. When a new feature sends personal data in a new way, the app will say what it sends before you first use it.

support@mysupplementsapp.com · MySupplements LLC, 108-14 72nd Ave, Forest Hills, NY 11375, USA