Last updated: December 6, 2026
These kinds of companies process personal data for MySupplements to run Trace. Most work under contracts with us; the photo, meal and ranking provider currently works under its own published privacy policy, which says it doesn't train on what it receives. To learn which providers process your data, email support@mysupplementsapp.com. We'll update this page when we add or replace a provider, and tell you in the app before a new kind of provider receives your data, unless we must act sooner for security or legal reasons.
Cloud hosting provider
What they do for Trace
Our servers, database and meal-photo storage; account sign-in; passing database lookups on; our team's private website
What they receive
Account data, what phones send to Trace's AI features while we keep it, such as meal and cup photos, descriptions, answers and fixes, lookup requests and answers, technical logs; the feedback you send, with its screenshot and first name, our replies, how you found Trace, and our team's tags and notes; if you turn sharing on, what you share with Trace's team; if you give our team a code for help, what your phone shares; safety signals under a scrambled code
Where
United States (Oregon)
AI model provider
What they do for Trace
AI models that read meal and cup photos and descriptions, research products, including by web search, and translate search words; when you share for help, sorting your fixes by kind of problem for our team
What they receive
Meal and cup photos, descriptions and corrections; a product's name or barcode, its category and the app's language; unfamiliar search words and their category; when you share for help, the words of your fixes
Where
United States, and other countries where it operates
Kept by them
Under its own terms: its standard policy deletes what it receives within 30 days, unless needed longer to enforce its usage policies or the law; not used for training. Its web searches go through its own search partner, which receives only the search words
Photo, meal and ranking provider
What they do for Trace
Photo checks, checking spoken or typed meals, food matching, ranking food search results, checking search words for brand names; judging, from usage numbers alone, whether a flagged pattern looks automated
What they receive
Meal photos and usual-meal thumbnails, meal descriptions, food search words with candidate foods and nutrient summaries, unfamiliar search words and their category; usage numbers from the safety checks, without any ID
Kept by them
Kept only as long as reasonably necessary, under the provider's privacy policy; not used for training
Subscription management provider
What they do for Trace
Keeps Trace Plus working: checks purchases with the App Store and Google Play, and tells our servers about renewals, cancellations and billing problems. Records when it first and last saw each app user ID, which our team sees. Only if we turn it on, asks Apple whether an iPhone install came from one of our App Store search ads
What they receive
A pseudonymous app user ID (an account's identifier, the number our servers know Trace on a phone by, or a random number it makes; the ID isn't a name or email, and we give the provider neither); purchases and renewals from the store, with product, price, currency, store country, trial and renewal dates and cancellation reasons; technical details its software sends, such as platform, app version and language, and the country, which it works out from the internet address without keeping the address; only if we turn it on, Apple's attribution token for the install and Apple's answer: whether the install came from one of our ads, and its campaign, ad group and keyword
Kept by them
Under its own terms, while it provides the service
Services you use directly, under their own terms (not our processors):
•
Apple: Sign in with Apple, the App Store (including Trace Plus purchases and payment), App Attest (which confirms that requests for AI features come from a genuine copy of the app, signed in or not), on-iPhone speech recognition; while we run App Store search ads, AdServices, which gives the app the attribution token for those ads; and the Apple Push Notification service, which delivers a meal's name and calories to its Lock Screen card when an analysis finishes after you leave Trace.
•
Google: Sign in with Google (when available), Google Play (including Trace Plus purchases and payment, and the install referrer, which tells the app which link it was installed from), Google Play Integrity (which confirms on Android that requests for AI features come from a genuine copy of the app, signed in or not), Android speech recognition, and the Android cup tools' Google Play Services for AR (ARCore) and ML Kit. Their models, diagnostics and identifier handling are described in our
Privacy Policy, section 3.7, and the
Google Privacy Policy.
Public databases and product catalogs receive lookup words, barcodes or catalog product identifiers, without account details. Food barcode and supplement catalog requests pass through Trace's servers, which may pass them on to another catalog service; other public database searches may go directly from your phone. See our
Privacy Policy, section 3.2, and Data sources.