Privacy Policy

Last Updated: September 14, 2026

At BioStacks, we are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including our web app and our mobile app (which may load the web app in a WebView).

1. Information We Collect

Personal Information: When you create an account, we collect information such as your name, email address, and profile information.

User Content: We collect information you provide when creating supplement stacks, comments, and reviews. If you use our AI assistant, we also collect the messages you send it and the responses it generates.

Usage Data: We may collect information about how you interact with our services, such as the pages you view, the actions you take, and basic device/browser information. This helps us understand usage patterns and improve the product.

Authentication Data: When you sign in with Google, we receive basic profile information from your Google account.

Health & Wellness Information: When you use BioStacks, you may provide or generate information related to health and wellness (for example: supplement stacks you create, your selected health goals, age group, and similar preferences). This information is used to provide the core functionality of the app (such as stack analysis and personalized views).

Barcode/Camera Data: If you use barcode scanning features, the app may request access to your device camera. We do not store your camera feed; scanning is used to detect a barcode and look up supplement information. If you photo-scan a supplement label, the photo is sent to our AI providers (Anthropic, Perplexity) to read the label and identify the product; we do not store the photo itself.

Advertising Identifiers (Android): On Android, when permitted by your device settings, we collect your Google Advertising ID (GAID) and share it with our advertising partners (such as Meta) to measure the effectiveness of our ads and to attribute app installs and subscription events to specific campaigns. You can reset or limit this anytime in Settings → Google → Ads.

Advertising Attribution (iOS): On iOS, we ask for your permission through Apple’s App Tracking Transparency (ATT) prompt. If you allow tracking, we collect your Advertising Identifier (IDFA) and share it with our advertising partners (such as Meta) to attribute app installs and subscription events to specific ad campaigns. If you decline — or never answer the prompt — we do not collect or share your IDFA, and iOS attribution relies solely on Apple’s aggregated, privacy-preserving SKAdNetwork framework. Declining does not change any part of the app: your scores, recommendations, and features are identical either way. You can change your choice anytime in Settings → Privacy & Security → Tracking.

Subscription & Purchase Information: If you purchase a BioStacks Pro subscription in the mobile apps, we use RevenueCat to manage purchases and entitlements. Payments are processed by the App Store or Google Play — we never see your card details. Limited information about the purchase (such as product, price, and transaction status) may be shared with our advertising partners for ad attribution and reporting.

Refund Requests (App Store): If you request a refund from Apple for a purchase made in the iOS app, we may share information about your use of the app and your purchase with Apple to help Apple evaluate your refund request. This includes data such as whether and for how long you used the app after the purchase, the amount of paid content or features you accessed, and your prior purchase and refund history. Apple makes the final decision on all refund requests. By making a purchase in the iOS app, you consent to this sharing.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process your account registration and authenticate your identity
  • Personalize your experience on BioStacks
  • Respond to your comments, questions, and requests
  • Send you notifications and updates about our services
  • Monitor and analyze trends, usage, and activities in connection with our services
  • Detect, investigate, and prevent fraudulent transactions and other illegal activities

3. Information Sharing and Disclosure

We may share your information in the following circumstances:

  • With service providers who perform services on our behalf, including Supabase (database and authentication), RevenueCat (subscription management), Sentry (error reporting), PostHog (product analytics), Anthropic (AI processing), Perplexity (AI product identification), and Firebase (push notifications)
  • With advertising partners (such as Meta/Facebook) for ad attribution and measurement, including via Apple’s SKAdNetwork framework on iOS and Meta’s Conversions API server-side integration. See Section 6 for details
  • With third-party providers you choose to interact with (for example, when you click outbound links to retailers)
  • To comply with legal obligations
  • To protect and defend our rights and property
  • With your consent or at your direction

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Data Storage and Security

We use Supabase, a secure database platform, to store your information. We implement appropriate security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

However, please be aware that no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee the absolute security of your information.

5. Your Data Rights

Depending on your location, you may have certain rights regarding your personal information, including:

  • The right to access personal information we hold about you
  • The right to request correction of inaccurate information
  • The right to request deletion of your account and personal information
  • The right to object to processing of your information
  • The right to data portability

To exercise these rights, please contact us at team@biostacks.co.

If you request account deletion, we will delete or anonymize your personal information within a reasonable time, subject to any legal, security, or operational retention needs (for example, retaining limited logs for fraud prevention or debugging).

6. Analytics, Advertising, and Tracking

We use analytics, diagnostics, and advertising attribution tools to understand usage, improve reliability, and measure the effectiveness of our ads, including:

  • PostHog for product analytics, session replay, and AI observability, to help us understand how people use the app, improve UX, and review the quality of AI features. Conversations with our AI assistant (your messages, the assistant’s responses, and the database lookups it performed to answer) and the results of AI-powered label scans (the extracted text — your photos themselves are not sent to PostHog) are recorded to PostHog for quality review and debugging. When you use BioStacks through ChatGPT, we record the anonymized user and conversation identifiers ChatGPT provides, plus a bounded record of the supplement lookup or label/stack request sent to our tools. We do not receive the rest of your ChatGPT conversation through this connection.
  • Anthropic (Claude API) for AI processing. Messages you send to our AI assistant and supplement label photos you scan are processed by Anthropic’s Claude API to generate responses and read labels. Under Anthropic’s commercial API terms, this data is not used to train its models.
  • Perplexity (Sonar API) for AI product identification. When you photo-scan a supplement label, the photo may also be processed by Perplexity’s Sonar API to identify the product and look up its ingredient panel from public web sources. Perplexity’s handling of API data is governed by its own API terms.
  • Sentry for error reporting and diagnostics, to help us detect and fix crashes and bugs.
  • Meta (Facebook) SDK and Conversions API for ad attribution and measurement. On Android, when you install the app from a Meta ad and have not opted out of ad personalization, your Google Advertising ID (GAID) is shared with Meta to attribute the install and subsequent events (such as starting a subscription) to specific ad campaigns. On iOS, the same applies to your Advertising Identifier (IDFA) only if you allowed tracking at the App Tracking Transparency prompt; if you declined, no IDFA is collected or shared. Subscription events are also forwarded to Meta server-side via RevenueCat’s integration with Meta’s Conversions API, along with hashed identifiers (such as a hashed email) for matching.
  • Apple SKAdNetwork (iOS) is Apple’s privacy-preserving attribution framework, which we rely on for iOS ad measurement — and which we use for all iOS users regardless of your tracking choice. It provides aggregated, anonymized install attribution to advertising networks. SKAdNetwork does not share your personal identity with us or with advertisers.
  • Firebase for push notification delivery on Android and iOS.

These tools may collect technical information such as device/browser type, pages visited, timestamps, error messages, stack traces, and related diagnostic metadata. We use this information to improve product performance and reliability.

Session replay is enabled and configured to mask password fields and sensitive UI regions. Other text you type in the app — such as searches and messages to our AI assistant — may be recorded in session replays and analytics so we can understand and improve how the product is used. We do not record payment information (purchases are handled by the App Store or Google Play, outside our interfaces), and we avoid sending direct identifiers such as email addresses to analytics providers.

Your Choices:

  • iOS: You control tracking through Apple’s App Tracking Transparency prompt, and can change your answer at any time in Settings → Privacy & Security → Tracking. If you decline, we do not collect your IDFA and iOS attribution relies solely on Apple’s aggregated, privacy-preserving SKAdNetwork framework. Declining has no effect on how the app works.
  • Android: You can reset or limit the use of your advertising identifier (GAID) anytime in Settings → Google → Ads.

7. Cookies and Local Storage

We use cookies and browser storage for essential functionality and to improve your experience:

  • Authentication: To remember your login state
  • Preferences: To store your website preferences
  • Analytics & Diagnostics: To measure usage and help troubleshoot issues

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our service.

8. Affiliate Links and Third-Party Sites

BioStacks may provide links to third-party websites (for example, retailers such as iHerb or Amazon) to help you find products. These links may sometimes be affiliate links, meaning we may earn a commission if you make a purchase, at no additional cost to you.

When you click an outbound link, you will be leaving BioStacks. Your interaction with third-party sites is governed by their own privacy policies and terms.

9. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we learn we have collected personal information from a child under 18, we will delete that information.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at team@biostacks.co.

Return to Homepage