Privacy Policy

Platable is a product of Platable.io LLC, an Indiana limited liability company (“Platable,” “we” or “us”). We run the web app at platable.io and the Platable apps for iPhone, Apple Watch and Android, and we are responsible for the information this page describes. Write to us at support@platable.io.

• There is no advertising in Platable, and nothing you do in it is used for advertising, here or anywhere else.
• There is no analytics, tracking or advertising software in the app or the website: no Google Analytics, no Firebase Analytics, no advertising identifiers, no tracking pixels. The iPhone app never asks to track you, because it doesn't.
• We don't sell your information or share it for advertising, and we don't build profiles of you to sell or to target.
• We don't read your contacts, and we don't look through your photo library: the only photos that leave your phone are ones you pick or take yourself.

Your email address, and your name if you give one or if Sign in with Apple or Google provides it. If you sign up with an email and a password, the password is held as a hash by Firebase Authentication and we never see it. Sign in with Apple may give us a private relay address instead of your own (Hide My Email); that works everywhere an email is used. We also keep when the account was made and whether its email is verified, since the AI features need a verified email.

What you log and set up, kept in your account:

• The meals you log: what you ate, when, and its calories and macros
• Body-weight readings, water, and the body measurements you log (waist, hips, chest, an arm and a thigh)
• Your calorie and macro targets, goal weight, and the sex, age, height and activity level used to work them out
• Dietary preferences and restrictions, such as vegetarian or gluten-free, which can say something about your health
• Saved recipes (with how often you cooked each), favorite meals, meal plans, your meal calendar, your shopping list, your staples and the order of your store's aisles
• Progress photos, if you add them: kept privately in your account, never checked by a model, never on the network, and deleted when you remove them

Meal photos. If you log a meal from a photo, the photo is shrunk on your phone and sent, with any note you add, to OpenAI to read what is on the plate. We don't store it: only the foods and numbers you choose to log are kept. A photo can show more than food, so the app says where it goes before it is sent.

Barcodes. When you scan a product, your phone reads the code and the camera's pictures stay on the phone. Our server asks Open Food Facts for that barcode's label, sending the number and nothing about you, and keeps the answer for anyone who scans the same product.

The food search. The words you type into the search go from our server to the USDA's FoodData Central and to Open Food Facts, with nothing about who asked. Answers are kept for a week and reused for anyone who searches the same words.

Recipes. A recipe you generate is written by OpenAI from what you ask for (see “The coach, the voice and the other AI features”), and its photo, if you make one, is generated there and stored in your account. To import a recipe from a web address, our server fetches that page; when the page doesn't mark up its recipe, the page's text goes to OpenAI to pull the recipe out.

The workouts you log (exercises, sets, reps, weights, duration, distance and pace), your training programs, race blocks, saved plans, season goals, your run records and paces, each exercise's history, and a pause you set when life gets in the way (whether you are sick, hurt and where, or away). A note you write on a workout is marked Only you: it is never shared.

Runs and your location. The apps ask for location only while a run you started is in progress, “while using the app” and never “always,” to measure distance and pace, including while the phone is locked. What happens to the coordinates depends on Run maps (Settings → Privacy):

• Without a profile, or with Run maps off, a run recorded on the phone keeps no route. The coordinates stay on the phone for that run and are discarded when it ends; only the distance is saved.
• With Run maps on (it starts on when you create a profile, and the switch is in the sheet), each run keeps its route, with the time and altitude along it, saved with the run in your account for you to see. The people who can see that workout see the route on a map with every part within 200 m of your start and finish left out. A run, walk or ride that Apple Health brings in from another app (Apple's Workout app, Strava) keeps the route that app saved, under the same rule; with Run maps off, none is read.
• Beacon, if you turn it on for a run, sends your live position to the person you choose (see “Beacon”).

The weather on a run. When a run, walk or ride on the iPhone app or the Watch has a location, the iPhone app asks Apple's weather service once for the weather where it started, sending that point rounded to about a kilometer (and, for a Watch workout, the hour it started) and nothing about you. Only the conditions are kept with the workout; the point isn't. This happens with Run maps on or off, and not on Android or indoors.

Imports. When you bring in your history from Hevy, Strong or Strava (their export files), from Apple Health's export, or a weight spreadsheet, the file is read on your phone and never uploaded. Only the workouts and readings made from it are saved, as if you had logged them here, marked with where they came from so Undo can remove that batch.

Share pictures. A workout's share picture is drawn on your phone and handed to your phone's share sheet, which sends it where you pick; we keep no copy. Saving it to Photos asks for add-only access, which writes that picture and reads nothing. Instagram Stories hands the picture to the Instagram app on your phone with Platable's Meta app ID, which tells Instagram which app sent it; nothing else goes with it.

Apple Health (iPhone). Only if you connect it, and only what you allow. Settings → Apple Health has a switch for each group. What Platable can read:

• Weigh-ins: body weight
• Workouts and runs, with heart rate: workouts with their distance (walking and running, cycling, swimming), the heart rate and active energy over each, running power, speed and stride length and cycling power and cadence, and the route another app saved with a run, walk or ride (only while Run maps is on)
• Steps, active energy, exercise minutes: one total each a day
• Sleep, resting heart rate and HRV: one number each a day

What Platable can write, each with its own switch:

• Meals you log: their calories, protein, carbohydrate and fat
• Weigh-ins you log
• Workouts you log, with their distance and active energy
• Water you log
• Your waist, from Measurements

What Platable reads from Health is stored in your account beside what you log by hand. It is used only to run Platable for you: never for advertising, never sold, and never given to anyone for their own use. It goes beyond your account in two ways, both only when you act. A workout you share on the network carries its numbers, so the people who can see a shared run see its average and peak heart rate and each mile's average (a lift's heart rate only if you turn on Heart rate on lifts in Settings → Privacy); running power, stride and cadence are shown to you alone. And a question you ask the coach carries last night's sleep and the week's sessions, in words, to OpenAI to write the answer (see “The coach” below). You can change what Platable may read in the Health app (Sharing → Apps → Platable) and disconnect in Settings.

Apple Watch. A workout started on the Watch reads your heart rate, active energy and, for a run, walk or ride, your location while it runs, saves the workout to Health on the Watch, and sends it to the Platable app on your iPhone over Apple's own pairing. The iPhone app stores it in your account with its route, which you see on your own workout; the route reaches the network only under the Run maps rule. Both copies of the file are then deleted. The phone sends the Watch today's planned session, and a session running on the Watch is mirrored to the phone. The Watch app has no account and never talks to the internet itself.

With the Sleep, resting heart rate and HRV switch on, Platable keeps one number each a day from Apple Health: how long you slept, your resting heart rate and your heart rate variability. They are shown to you alone (the morning line on Today, the week in your recap) and are never shared on the network. Your weekly check-in (how you felt, your energy and your soreness) is kept the same way.

The daily brief at the top of Today, the debrief after a workout, the patterns and the training load are worked out by the app's own rules from what your account already holds. They are not sent to a model.

Some features are written by OpenAI's models: our server sends the request and OpenAI sends the result back. What is sent is the request itself, never your name, your email address or your account's ID:

• A recipe or meal plan: the idea or ingredients you typed and your dietary preferences
• An imported recipe: the text of the page, when it has to be read
• A nutrition estimate: the meal you described, or a recipe's ingredient list
• A meal photo: the photo, shrunk, with any note you added
• A workout plan or a workout you described: your goal, days a week, session length, experience, equipment and anything you wrote

The coach. A question you ask the coach goes with the week it reads, as plain numbers and words: your plan's and program's names and phase, this week's sessions and what you did, your last few sessions, your check-in, last night's sleep and readiness in words, your food targets and today's totals (not the meals themselves), your current fitness, a pause and its reason, the training load, your strongest pattern, and the debrief or the brief you asked about, with the last few turns of the conversation. It never carries your name, email or account ID, your routes, your photos, your private notes or anything from the network. We don't keep the question or the answer, and any change the coach suggests is made by the app's own tools when you tap it.

The natural voice. The lines the app says aloud (a run's cues and numbers, a recipe's steps in cook mode, an exercise's name and your next set's numbers) are sent to OpenAI's text-to-speech to make the audio. A line names nobody, so the clips are kept and reused for everyone who hears the same words. Turn off Natural voice in Settings → Appearance and every line uses your phone's own voice and nothing is sent.

Moderation. Words other people will read (a profile's name, handle and bio, a workout's title, plan line and caption, comments, a club's name, description and posts), your profile photo, every photo you add to a workout, shared or not, and a recipe's photo before it goes on a meal card are checked by OpenAI's moderation model before they are saved, with no identifier. Anything the check flags is refused and not stored, and nothing is queued for a person to read.

OpenAI keeps API requests for a limited time to monitor for abuse, under its own policy. AI output can be wrong: see the Terms, and use Report on anything a feature produced that is wrong, unsafe or offensive.

The network is optional. Nothing of yours is on it until you create a profile, and an account without one stays private. With one:

• Your profile (name, handle, photo and bio) can be seen by anyone signed in to Platable and by anyone with its link. A private account shows only its name and photo to people you haven't approved, and each follower needs your approval.
• We keep who you follow and who follows you, requests, the accounts you block, and the people you remove from your suggestions of who to follow (they aren't told).
• A workout you share goes out as a summary that our server builds: the title, the day and time, the numbers (distance, time and pace, or sets, reps and volume, never a set's weight), a lift's exercises and the muscles they worked, personal bests and firsts, your streak that day, the weather a run started in, the plan it came from ("Week 7 of 16 · Half marathon block"), your caption, up to three photos you add, and the route under Run maps. Never your full log, your meals, your weight or your targets.
• Photos you add to a workout are shrunk on your phone, which drops where and when they were taken, and go wherever that workout goes; your profile shows the latest ones the viewer may see. Removing a photo deletes the file.
• With Run maps on, our server sends Mapbox the trimmed route to draw two pictures of it, a light one and a dark one, kept with the workout.
• Show the time of day (on until you turn it off) decides whether others see when you were out or only the day.
• Kudos and comments you give and receive, with their times. You can delete any comment on your own workouts.
• Tags: you can add people you follow, or who follow you, to a workout. They are asked first and nothing names them until they accept, and either of you can remove the tag.
• Share what I cook (Ask, Always or Never; Ask to start): when you mark a saved recipe cooked, a card with its title, photo, calories and protein a serving and the day can go to the same people who see your workouts. Posting it makes a public copy of the recipe, as Share link does, so they can save it; you see how many did, never who.
• Challenges: your phone counts your progress from your own workouts and meals, private ones included, and sends only the number. The people you follow who joined the same challenge see it on its board. Finishing puts a badge on your profile.
• Clubs: you can start one or join one by its link. Anyone with the link sees its name, its description and how many people are in it; only members see who they are. A club's owner can write posts and events (a day, a time and a place's name) that only members see, and members can say they're going.
• When you join a challenge or a club, or start a club, a line saying so goes to the people your workouts reach by default. Leaving takes it away.
• The friends' week board and last week's leaders are worked out when you open them from workouts you can already see; nothing new is stored.
• Your notifications (new followers, requests, kudos, comments, tags, joins and club posts), in the app and on your phone if you turn that on.

Safety. You can report any profile, workout, comment, meal card or club from the app, and block anyone, which hides the two of you from each other. A report keeps a copy of what was reported, who reported it and why. We review reports and may remove content or suspend a profile from the network; a suspended person is told that it happened.

Deleting your profile (Settings → Privacy) removes your profile, handle and photo, your follows both ways, the workouts you shared with their kudos and comments, your kudos and comments on other people's workouts, your challenge joins and club memberships (closing the clubs you own, with their posts), and your tags on other people's workouts. Your account and logs stay, and your workout photos go back to being yours alone. Your blocks and the record of a suspension are kept.

Beacon (Pro) is off until you turn on Share your live location before a run in the app. Then the run's Start makes a private link and opens your share sheet, so you send it to the person you choose.

• While the run goes, your phone sends your position, distance, pace and the route so far to our server, about every 20 seconds.
• Anyone who has the link sees your first name, where you are and the route so far on a map, with no sign-in, and nothing else about you. The 200 m left out of routes on the network is not left out here, since where you are is the point.
• Ending the run, or Stop sharing, deletes the position and the route at once and leaves only the final distance and time. An hour later the link says it has expired and the record is deleted. A link never lasts more than six hours.
• The map on that page loads its tiles from Mapbox in the viewer's browser; your position and route are drawn there and not sent to Mapbox.
• Deleting your account deletes your links.

A recipe you share. Share link makes a public copy of the recipe (its text, nutrition and photo) at a link anyone can open, signed in or not, and save to their own account. The page doesn't show your name or anything else about you, and the photo is copied so its address doesn't identify your account. Stopping the share, or deleting the recipe or your account, deletes the public copy; copies other people saved are theirs. Anyone can report a shared recipe from its page.

A shopping list you share. The person you share it with sees everything on it: the items, the plans, days and recipes they came from, and who added or ticked what. The invite link works once and for a day. If you both agree to share meals too, they see and can change the meals in the shared slots from that day on, and can see your saved meal plans. Your staples, store order, logs, targets and weight stay your own. Either of you can stop or leave at any time, and each keeps a copy.

Your calendar link (Pro). If you turn it on, we make a private address that a calendar app reads to show your meals and training. Anyone who has the address can read it, with no sign-in, so add it only to your own calendars. It carries what you have planned for the next eight weeks (meal names and their ingredients, session names and a run's distance) and what you logged in the past two weeks, never your weight, calories, macros, notes or routes. If you add it to Google Calendar, Google fetches it from its servers. We keep only a one-way fingerprint of the address, and our hosting logs record the addresses requested for 30 days. New link or Turn off stops the old address at once.

Reminders. If you turn reminders on, we keep a notification token for each device, which reminders you want and your time zone, so they arrive at the right hour.

Your subscription. Whether you are on Free or Pro, which plan, when it renews or ends, and the references Stripe, RevenueCat and the app stores give us. Your card number and bank details go straight to Stripe, Apple or Google; we never receive them. We also count the AI credits you spend each month.

Error reports. When something breaks, the app sends a short report: the error, where in the code it happened, the page (without anything after the address) and whether it was the iPhone app, the Android app or the website. No name, email, account ID or device ID goes with it.

On your device only. A workout in progress, cook mode, the last Today screen (so the app opens at once) and the feed's filter are kept on the device and sent nowhere; signing out removes your account's copy.

These companies process information for us, to run the parts of Platable named here, and for no purpose of their own:

• Google (Firebase and Google Cloud): sign-in, the database your account lives in, file storage, push delivery, hosting and its logs. It holds everything described on this page that we store.
• OpenAI: the AI features, the coach, the natural voice and moderation, receiving only what “The coach, the voice and the other AI features” lists.
• Stripe: subscriptions bought on the website. It receives your email address and collects your payment details on its own checkout page.
• RevenueCat: subscriptions bought in the iPhone and Android apps. It receives your Platable account ID and the store's receipt.
• Apple and Google: billing for purchases in their stores, under their own privacy policies.
• Upstash: short-lived counters, keyed on your account ID (or, for a few signed-out pages, the visitor's IP address, which isn't stored), that limit how fast features can be called.
• USDA FoodData Central and Open Food Facts: the words of a food search and the number of a scanned barcode, sent by our server with nothing about you.
• Mapbox: maps. Our server sends it a shared route, trimmed, to draw its pictures. A browser showing a map (yours, a viewer of your shared run, or someone with your Beacon link) asks Mapbox for the map of that area, so Mapbox sees that browser's IP address and roughly where the map is, and the map tells Mapbox it was loaded, which is how Mapbox counts maps. The picture of your own route on your own workout list is drawn by Mapbox from your whole route, sent from your browser; we don't keep it.
• Apple Weather: the rounded starting point of a run, walk or ride, once, from the iPhone app.
• Meta (Instagram): only when you tap Instagram Stories, and only on your phone, app to app: the picture and Platable's app ID. There is no Meta software in Platable.

The people you choose see what you share with them, as the sections above describe, and a calendar app you give your link to reads it. We may also disclose information when the law requires it, or to establish or defend legal claims. If Platable or Platable is ever sold or merged, this policy goes with it, and we will tell you before your information is handled under a different one.

Your account lives in Google's Firebase, and our providers are based in the United States and process data there and in other countries. Every connection to Platable and to those providers is encrypted with HTTPS, and our providers encrypt data at rest. Access rules keep one account from reading another's, and the network, shared links and billing are written and read by our server, not your browser. No system is perfectly secure, so please use a strong password you don't use anywhere else.

Everything in your account stays until you delete it or delete your account. Beyond that:

• Your network profile and what you shared stay until you delete the profile or the account; blocks stay until the account goes.
• A Beacon's position and route last until the run ends; the record, an hour after that (six hours after the start at most).
• A download of your data lasts a day; afterwards we keep only when you last asked for one.
• A shopping-list invite lasts a day or until it is used. A shared list stays while two people are on it.
• A shared recipe's public copy lasts until you stop sharing it, delete the recipe or your account, or we take it down after a report.
• Rate-limit counters last minutes. Error reports and our hosting logs last 30 days.
• Food-search answers are kept for a week, and barcode labels are kept; neither says who asked.
• OpenAI keeps API requests under its own retention policy for abuse monitoring. Stripe, RevenueCat, Apple and Google keep payment records under their own rules and the tax rules that apply to them.
• Reports, and the record of a suspension, are moderation records and are kept after the accounts involved are deleted.

Anything you log, save or share can be deleted on its own, and you can delete your network profile and keep your account. To delete everything, go to Settings → Delete account in the app, or read how to delete your account. Deletion is immediate and cannot be undone. It cancels any subscription billed through our website, deletes your recipe links, takes you off the network as deleting a profile does, leaves a shopping list you share (the other person keeps it), stops your calendar link, deletes your Beacon links and any download of your data, then deletes your account with everything under it (every meal, reading, workout, route, photo, recipe, plan and setting) and finally your sign-in record.

Three things stay: a subscription bought in the App Store or Google Play, which you cancel in that store; moderation records (reports you filed or that were about you, and the record of a suspension); and copies of your shared recipes that other people saved to their own accounts.

• Apple Health: a switch for each group it reads and writes, in Settings → Apple Health, and the Health app's own permissions.
• Run maps, in Settings → Privacy: off, no route is kept or shared. On, you can still keep any one run's map off. Turning it off removes every route and map picture you have shared at once.
• The privacy zone: on the network every route leaves out 200 m around where you started and finished.
• Who sees your workouts: your followers (the default), everyone on Platable, or only you, for each workout or as your default; a private account approves each follower.
• Show the time of day, Heart rate on lifts and Share what I cook, in Settings → Privacy.
• Edit past workouts, in Profile & privacy: one audience for every workout before a date, at once. It never publishes a workout from before your profile that you never shared.
• Beacon is off for every run until you turn it on for that run.
• Natural voice, in Settings → Appearance; reminders and notifications, each with its own switch.
• Download your data, in Settings → Account: a zip of what you have logged (your workouts, each run's whole route as GPX, your meals, weights, water and measurements as spreadsheets, your recipes, training and photos), behind a link that works for a day, once a day.

Depending on where you live, you may have the right to see a copy of your information, correct it, delete it, take it elsewhere, object to how it is used, and withdraw your consent. Most of this you can do yourself in the app: everything you enter can be edited or deleted, Download your data gives you a copy, and deleting your account is one button. For anything else, email support@platable.io and we will answer within 30 days. We won't treat you differently for asking.

If you are in the UK or the European Union, we use your information to provide the app you signed up for, with your consent for the health information you choose to enter and for reminders, and in our legitimate interest in keeping the service safe and handling reports. You can complain to your data protection authority.

You must be 13 or older to use Platable, or older if the law where you live sets a higher age for using an app like this without a parent's consent. We don't knowingly collect personal information from children under 13. If you are under 18, use Platable with a parent's or guardian's permission; calorie and macro targets are only worked out for people 18 and over. If you believe a child under 13 has an account, email support@platable.io and we will delete it.

When this policy changes, the version and its date at the foot of this page change with it, with a line saying what changed. For anything significant we will tell you in the app or by email before it takes effect.

Platable.io LLC, organized in Indiana. Notices by email: support@platable.io reaches the people who run Platable, for questions about this policy, requests about your information, and anything else.