Effective date: October 22, 2026
In short
•
Your journal is yours. What you log stays on your phone. You don't need an account.
•
No ads. No tracking. We never sell your personal data.
•
What leaves the phone:
◦
Food searches run on your phone. Supplement, medication and product searches send only the words you type, to public databases and our product catalog.
◦
Barcode scans send only the barcode, to product databases.
◦
Photo analysis, AI descriptions, product lookups and the larger food database work only after you sign in, and only send what that feature needs.
•
You stay in control. You can export or delete everything in Settings, delete your account in the app, and withdraw any consent at any time.
1. Who we are
Trace is provided by MySupplements LLC, 108-14 72nd Ave, Forest Hills, NY 11375, USA ("MySupplements", "we", "us"). We are the controller of the personal data described here.
•
Privacy contact: support@mysupplementsapp.com
•
Privacy officer: Moon Kim, support@mysupplementsapp.com
2. What this policy covers
Trace is currently offered only in the United States. This policy covers the Trace app, its website (trace-api.mysupplementsapp.com/legal) and the services that support them. It does not cover services we don't control, such as the app stores, Apple or Google sign-in, or the public databases Trace looks things up in. Their own policies apply.
3. What we process, and where it lives
3.1 What you log, kept on your device
What you record in Trace is health information. It includes:
•
meals, food photos, descriptions and notes;
•
supplements and medications, their doses and schedules, and doses taken or skipped;
•
check-ins (sleep, energy, mood), weight and activity;
•
your profile: age, sex, height, weight, pregnancy or breastfeeding status, goals and settings.
It is stored on your device. Your device's own backup may also include it (iCloud on iPhone, Google backup on Android), under your device settings. We don't receive this journal, except for the specific pieces a feature sends, described in 3.3.
3.2 Searches and barcode scans
Food searches run on your phone, in a copy of the USDA's food database built into Trace.
When you search for a supplement, medication or packaged food, or scan a barcode, Trace sends only the words you typed or the barcode number to the service that answers: the U.S. National Library of Medicine and National Institutes of Health, Open Food Facts, or MySupplements' own product catalog. No account information is attached. Like any website, these services can see your device's IP address. The full list is on our Data sources page.
3.3 Features that work after you sign in
When you sign in and use these features, Trace sends what that feature needs to our servers, and our servers send it on to the service providers that process it for us (section 6):
Photo analysis
What is sent
The meal photo, and the meal type and time
What happens to it
Analyzed by an AI model to identify foods and amounts; the result returns to your phone
Photo check
What is sent
The meal photo, with small thumbnails of your usual meals
What happens to it
Checked by an AI service for framing and for a match with a usual meal. We keep none of the photos
Say it and AI descriptions
What is sent
The words you typed or spoke
What happens to it
Read by AI to identify foods, amounts and preparation
Fix issue
What is sent
Your correction, the meal's foods and its photo
What happens to it
Read by AI to correct the foods and amounts
Product lookups and the larger food database
What is sent
Product names or barcodes
What happens to it
Looked up by our servers and our AI provider in official registries, such as Korea's Ministry of Food and Drug Safety and Japan's PMDA, and on the web, to find the right product. Product details you confirm may be added to Trace's product catalog, without anything that identifies you
Vitamin and mineral estimates
What is sent
The foods and amounts in a meal
What happens to it
Matched to nutrient data
We keep uploaded photos and descriptions only as long as needed to process them and return the result, and we delete uploaded photos within 24 hours. Deleting your account deletes them straight away. We don't use them to build a profile of you.
3.4 Your account
If you create an account, we process:
•
your email address and, if you sign in with Apple or Google, the identifier and any name or email that service shares with us;
•
an account identifier and sign-in tokens;
•
records of the features you used, for security and limits.
Accounts are managed by our cloud hosting provider's sign-in service.
3.5 Speech
With "Say it", your phone turns speech into text. On iPhone, this happens on the device. On Android, your phone's speech service, such as Google's, may process the audio under its own terms. Trace receives only the text.
3.6 Device permissions
•
Camera: to take meal photos and scan barcodes.
•
Photos: to pick a photo you choose, and to save images you choose to save.
•
Notifications: for reminders you set, scheduled on your phone (we don't send them from a server).
•
Motion sensors: to tell when the phone is held still for a photo. This stays on the phone.
You can turn each one off in your device settings.
3.7 Technical information
Our servers record technical information needed to run and protect the service: IP address, time, the feature used, app version, device type and errors. We keep these logs for 30 days, longer only if needed to investigate a security incident.
3.8 Contacting us
If you write to us, we keep your message and our reply for 2 years to help you and to keep records.
3.9 What we don't collect
We don't collect your precise location, contacts or advertising identifier. We don't read data from Apple Health or Health Connect. We don't use advertising or analytics SDKs, and we don't track you across other companies' apps or websites.
4. Why we use it
•
To provide the features you ask for.
•
To process health information for those features, with your consent, which you give in the app and can withdraw at any time.
•
To send content to AI services to analyze it, with your consent in the app, given before first use.
•
To keep the service secure, prevent abuse and fix problems.
•
To comply with the law and respond to lawful requests.
•
To create de-identified, aggregated statistics, for example how often a feature fails. Data that is truly de-identified is no longer personal data.
•
Optional: to use your content to improve Trace's analysis and AI, or for health research, only with your separate consent, which is off unless you turn it on.
If you don't give the health-data consent, you can still use Trace's on-device features. Features that need it will ask first.
5. Artificial intelligence
Some features use AI models run by our service providers. They return suggestions, which you review and can correct before saving. No decision with legal or similarly significant effects is made about you by automated means.
Our AI providers' terms don't allow them to use your content to train their models, except with your consent through the optional choice in section 4. They may keep it for a short time, as our
Service providers page describes.
6. Who we share it with
•
Service providers who process data for us under contracts that limit their use of it to our instructions and require protection at least equal to this policy. They host our servers and accounts, provide AI analysis, and check photos. Our current list, with what each receives and where, is on the
Service providers page. We'll update that page, with notice, before we add or replace a provider.
•
Public databases, which receive only search terms and barcodes (section 3.2).
•
The law. We disclose data when we must by law, or to protect the rights, safety or property of our users, the public or MySupplements, and only what is required.
•
Business transfers. If MySupplements is involved in a merger, acquisition, financing or sale of assets, personal data may transfer to the successor. It stays subject to this policy, and we'll notify you before it becomes subject to a different one.
•
With your consent, for any other purpose you agree to.
We don't sell personal data. We don't share it for targeted or cross-context advertising, and we don't use it to profile you for advertising.
7. Where your data is processed
We are based in the United States, and our servers are in the United States (Oregon). Our service providers may process data in other countries, as described on the
Service providers page.
8. How long we keep it
•
Your journal on your device: until you delete it in Settings or delete the app.
•
Uploaded photos and descriptions: see section 3.3.
•
Your account: until you delete it. Then we delete account data within 30 days, and from backups within 90 days.
•
Technical logs: see section 3.7.
•
Exceptions: we keep anything we must keep by law, or to establish or defend legal claims, only as long as needed for that.
9. Your rights and choices
In the app, at any time:
•
export your data (Settings › Your data › Export backup);
•
delete everything on your device (Settings › Your data › Delete all data);
•
withdraw consents (Settings › Privacy);
•
turn off device permissions.
By email to support@mysupplementsapp.com: depending on where you live, you can ask to access, correct, delete or get a copy of your personal data, object to its use, or withdraw consent. We'll verify your request, usually by asking you to confirm from your account's email, and respond within the time the law requires, usually 45 days. We won't treat you differently for using your rights.
9.1 Your rights under U.S. state laws
Depending on your state, including California, Colorado, Connecticut, Virginia, Texas and others, you have the right to know, access, correct and delete your personal data, to get a copy, and to appeal a decision about your request by emailing us with "Appeal" in the subject line. If we deny an appeal, you can contact your state attorney general. You can use an authorized agent.
We don't sell or share personal data, and we use sensitive personal information (health information and account credentials) only to provide the features you request and for the other purposes the law permits.
10. Children
Trace is not for people under 18, and we don't knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we'll delete it.
11. Security
•
Data is encrypted in transit (HTTPS, TLS 1.2 or later) and at rest on our servers, including our database, its backups and photo storage.
•
Access is limited to people and systems that need it, and secrets are stored in a managed vault.
•
Your journal on the phone is protected by your device's security.
No system is perfectly secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires.
12. Changes to this policy
We may update this policy as Trace changes. We'll post the new version with its effective date. For material changes, we'll tell you in the app at least 30 days before they apply, and ask for your consent where the law requires it. New features that use personal data in a new way will ask first.
13. Contact
support@mysupplementsapp.com · MySupplements LLC, 108-14 72nd Ave, Forest Hills, NY 11375, USA