Privacy Policy

Effective: May 1, 2026  ·  Last updated: June 2, 2026

StackForge Studios builds mobile games and apps. This policy explains exactly what data we collect, why we collect it, who we share it with, and what rights you have over it.

Short version: your data is yours. We don't sell it. We don't share it with advertisers. We don't use it to profile you for anything outside our products.

Our mobile apps do not include third-party advertising SDKs. We do not build ad-first products. Data practices vary by product — more feature-rich apps (like PlateStack) collect more data than simple games. Where practices differ materially, they are called out in Section 0 and throughout.

0. Product-specific data at a glance

Use this table as a quick reference. Sections 1–11 give the full detail.

1. What we collect

1.1 What you give us directly

• Account: email address and display name (apps with optional or required accounts).
• Apple / Google sign-in: a stable user identifier and, on first sign-in, your name and email if you choose to share them. Used only to create and authenticate your account. We never share your Apple Relay email or Google profile with third parties.
• Health and fitness data (PlateStack only): food logs, calorie and macro entries, workout logs (exercises, sets, reps, weight), cardio logs, body weight, measurements, body fat %, sleep summaries, activity totals, and PR history. This data is never used for advertising, cross-app tracking, eligibility decisions (employment, insurance, credit, lending), or any purpose outside operating PlateStack for you.
• Apple Health / HealthKit (PlateStack on iOS, optional): PlateStack may request permission to read steps, active energy, workout history, body weight, body fat %, sleep, resting heart rate, HRV, blood oxygen / SpO2, respiratory rate, blood pressure, VO2 max, mindful minutes, and nutrition data. It may also write workout and nutrition records back to Apple Health. HealthKit access is optional, permission-based, and can be changed any time in iOS Settings › Privacy & Security › Health. We do not use HealthKit data for advertising, marketing, data mining, profiling, or sharing with advertisers or data brokers.
• Android Health Connect (PlateStack on Android, optional): PlateStack may request permission to read steps, active calories burned, body weight, body fat %, and sleep data from Health Connect, and to write workouts, active calories, distance, body weight, and nutrition records. Health Connect access is optional and can be changed any time in Android Settings. We do not use Health Connect data for advertising, marketing, data mining, or sharing with advertisers.
• Profile: age, height, weight, fitness goals, and dietary preferences (PlateStack). Game difficulty and theme preferences (puzzle/arcade games).
• Camera access (PlateStack — barcode scanning and photo logging only): used only when you actively invoke a feature. We do not use the camera in the background.
• Microphone and voice logging (PlateStack only): if you choose to log food by voice, PlateStack records the audio you provide, sends it for transcription, and uses the transcript to create a food log draft. We do not record in the background.
• Food photos (PlateStack): images you take for AI food scanning are sent to an AI vision model in real time and are not stored on our servers. Only the resulting log entry is saved to your account.
• Progress photos (PlateStack): stored privately in your account. Never used for AI scanning, never shared, deletable at any time.
• Social activity (PlateStack, puzzle and arcade games): friend requests, squad or friend-list memberships, shared scores or workouts, leaderboard entries, challenges, and related profile details. Information you choose to share may be visible to the friends or squad members you select.
• Game and puzzle progress (Nineward Sudoku, Tenward, Upward, Twoward): local and server-synced save data including completions, high scores, streaks, daily results, and progression state. No health, fitness, camera, microphone, or location data is collected by these products.
• Support requests: information you provide when contacting support.

1.2 What we collect automatically

• Usage data: which features you use, screens viewed, session length, and in-app events. Used to improve products.
• Device info: device type, OS version, and an anonymous device identifier.
• Crash and performance data: anonymous error logs used to identify and fix bugs. Never tied to your personal identity.

Mobile app analytics disclosure: our mobile apps may use Sentry (crash reporting), PostHog (product analytics), and Expo (push notification delivery). These tools receive only anonymized or pseudonymized usage signals. Our mobile apps do not include Facebook/Meta SDK, TikTok SDK, Google Ads SDK, AppsFlyer, Adjust, AppLovin, or any other third-party advertising or mobile tracking SDK.

1.3 What we collect on our websites (not in apps)

Our marketing websites (stackforgestudios.com and related pages) may use Google Analytics (GA4) / Google Tag Manager, Meta Pixel, TikTok Pixel, PostHog, and Cloudflare. These tools may set cookies to understand how people find and use our sites.

Website marketing pixels are used only on our websites — not inside our mobile apps unless separately disclosed for a specific app. In-app health, fitness, nutrition, photo, voice, and progress data is never sent to website analytics or advertising tools.

1.4 What we never collect

• Location: our products never request or store your GPS location.
• Contacts: we do not access your address book.
• Biometrics: Face ID / Touch ID data never leaves your device. We call your OS's biometric API — we never see or store the underlying biometric data.
• Payment details: payments are handled by Apple App Store, Google Play, or Stripe. We never receive or store your card or banking details.
• Health data for eligibility decisions: we do not use any health, fitness, nutrition, body composition, sleep, activity, or recovery data to make or influence decisions about employment, insurance, credit, lending, or eligibility for any program or benefit.

2. How we use your information

• Run the product: store your data and power your experience.
• AI features (PlateStack): send food photos, voice transcripts, and coach queries to OpenAI and Anthropic APIs to generate nutrition estimates, coaching responses, and meal plans. AI model providers do not train on your data under our commercial agreements.
• Gamification: calculate streaks, scores, achievements, and leaderboard positions.
• Push notifications: send reminders and alerts — only if you grant permission.
• Subscriptions: verify membership status via RevenueCat (mobile) and Stripe (web).
• Improve our products: analyze anonymous usage patterns to fix bugs and build features.
• Legal: meet our legal obligations, resolve disputes, and enforce our Terms of Service.

3. Storage and security

• Database: account and usage data is stored in Supabase (PostgreSQL) on AWS infrastructure in the United States.
• On-device: an encrypted session cache is stored locally via Expo SecureStore where applicable.
• In transit: all data in transit is encrypted via TLS 1.3.
• At rest: data at rest is encrypted with AES-256.
• Access controls: row-level security (RLS) policies mean only your account can read or write your records.
• Retention: your data stays as long as your account is active. Delete your account and all personal data is permanently purged within 30 days, except where we are legally required to retain limited records.

4. Advertising and tracking

We do not use your personal data to serve third-party ads inside our products. We do not sell your data. We do not share it with data brokers or advertising networks. We do not build ad-first products.

We never use Apple Health / HealthKit or Android Health Connect data for advertising, marketing, data mining, or profiling of any kind.

Marketing pixels on our websites are used only to measure whether our own ads are working — not to build profiles for resale. They do not receive any mobile app data.

5. Third-party processors

We share only what each processor needs to provide their service:

• Supabase: database, authentication, real-time, and edge functions.
• AWS: cloud infrastructure under Supabase.
• Cloudflare: CDN, DDoS protection, and Workers.
• OpenAI: food photo scanning, nutrition estimation, and voice transcription (PlateStack only).
• Anthropic: AI Coach chat and meal plan generation (PlateStack only).
• RevenueCat: mobile subscription management for App Store and Play Store purchases.
• Stripe: web checkout and payment processing.
• Apple App Store / Google Play: app distribution and mobile payment processing.
• Expo app services: mobile app runtime libraries, push notification delivery, and over-the-air update support where enabled.
• Sentry: mobile crash reporting (anonymized).
• PostHog: product analytics (anonymized) — mobile and website.
• Google Analytics / Meta / TikTok: website analytics and ad measurement — websites only, not in mobile apps.

6. Your rights and account deletion

• Access: view your data inside the product at any time.
• Correction: edit your profile and settings in the app.
• Export: request a data export by emailing hello@stackforgestudios.com.
• Deletion: you can initiate full account and data deletion inside the app (Settings › Account › Delete Account) or by emailing us. We purge all personal data within 30 days.
• Opt-out of website tracking: use a browser extension, "Do Not Track," or contact us.

For step-by-step account deletion instructions, see our Account Deletion page.

6.1 California residents (CCPA / CPRA)

• Right to know: request disclosure of personal information we've collected.
• Right to delete: request deletion of your personal information.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell personal information. We do not share it for cross-context behavioral advertising beyond Section 1.3.
• Right to non-discrimination: we won't treat you differently for exercising these rights.

To exercise any California right, email hello@stackforgestudios.com with "CCPA Request" as the subject. We respond within 45 days.

6.2 EEA, UK, and international users (GDPR / UK GDPR)

If you are in the European Economic Area or United Kingdom, you have additional rights under GDPR / UK GDPR:

• Legal bases for processing: we process your data based on contract performance (running the service you signed up for), legitimate interests (improving our products, security), legal obligation, and your consent where required.
• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: correct inaccurate data.
• Right to erasure ("right to be forgotten"): request deletion — subject to legal retention requirements.
• Right to data portability: receive your data in a machine-readable format.
• Right to object or restrict processing: object to certain uses of your data.
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.
• Right to complain: you have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or your national DPA in the EU).
• International transfers: your data is transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for these transfers.

To exercise any GDPR right, email hello@stackforgestudios.com with "GDPR Request" in the subject. We respond within 30 days.

7. Children's privacy

Our products are intended for users 13 years of age or older (17+ for products that include social leaderboards and competition). We do not knowingly collect personal information from children under 13. No StackForge product is designed or marketed as child-directed under COPPA. If you believe a child under 13 has provided personal information, contact us immediately at hello@stackforgestudios.com and we will delete it promptly.

8. Health disclaimer (PlateStack)

PlateStack is a fitness and wellness tracker, not a medical device. Nothing in any of our apps constitutes medical, clinical, or dietary advice, or a substitute for professional care. AI calorie estimates are best-effort approximations — always review before logging. Consult a physician, registered dietitian, or certified trainer before starting any program, especially if you have an existing health condition.

9. International data transfers

StackForge Studios is operated from the United States. If you are outside the US, your data is transferred to and processed in the US. We rely on standard contractual clauses and equivalent safeguards for transfers from the EEA and UK. By using our products, you acknowledge this transfer.

10. Changes to this policy

We update this policy when needed. "Last updated" at the top tells you when. We will notify you in-app if something material changes.

11. Contact

Questions, requests, or concerns about privacy:

hello@stackforgestudios.com
StackForge Studios  ·  United States

For account deletion: stackforgestudios.com/account-deletion/