Privacy Policy

Foundation · Last updated 28 September 2026

Foundation is a personal tracker. It holds things people usually keep private: what you weigh, what you earn, what you owe, what you ate, and what you wrote down. This page says plainly what happens to all of it.

The short version

• Your data belongs to you. It is stored so that you can read it and sync it between your own devices, and for no other purpose.
• There is no advertising and no tracking in this app, and no advertising, analytics or profiling software is installed in it.
• Nothing you record is ever sold or rented, and none of it goes to advertisers, data brokers or anyone building a profile of you.
• The only outside companies that receive anything are the ones the app runs on: the host that stores your account, the service that emails your sign-in code, the App Store and the service that keeps your subscription working, and the price and food databases the app looks things up in. Every one of them is named further down this page, with exactly what it gets and why.
• You can delete your account and everything in it from inside the app.

What is stored, and where

Foundation needs an account, so there is no way to use it without giving us an email address. Your data is saved on your device and synced to a private database record held with Supabase, our hosting provider. That record is protected by row-level security, so no other Foundation user can read it and no request the app makes can reach anyone else's. Said plainly, because it is true of every app like this one: we run the database, so we hold administrative access to it. We do not read your record. Two things would make us open it: you asking us to look at something for you, or a lawful order we are required to answer. If the second one ever happens we will tell you, unless we are forbidden from telling you. Where that record physically sits is a fair question, and it is answered further down this page under Where Your Account Is Kept.

That record holds whatever you have entered, and anything the app reads from Apple Health on your behalf: your name, your targets, settings and display preferences, workouts and saved workouts, weigh-ins, steps, meals and saved meals, transactions, balances, investments, assets, debts and the portfolios you group them into, bills, your checklist and a dated record of what you ticked off it each day, journal entries, notes, goals, and the banked totals behind the charts: your daily scores, your daily eating totals, your daily steps, your weekly training totals and your daily net worth. It also holds the date of each physique photo, so your other devices know which photos exist, a list of things you have deleted, kept so that another device you own cannot put them back, and a few small markers the app keeps for itself, such as which one-time explanations you have put away.

Physique photos are photographs of your body, and they are the most private thing you can put in Foundation. Nothing is uploaded unless you say so. The first time you take one while signed in, the app asks whether to back them up, and until you answer that question nothing new leaves the phone. Builds before September 2026 started with that setting switched on, so photos taken then were uploaded without the question being put, and they are still in those accounts until the photo is deleted. If you say yes they are stored as files in a separate private storage bucket, one folder per account, not in the database record, and readable only by your account. If you say no they stay on that phone, which also means losing the phone loses them.

You can change your mind either way in Settings, Privacy, Photo Backup. Be clear about what turning it on later does, because it surprises people. It uploads every photo still on the phone that has not been uploaded already, including ones taken while backup was off. If you want a photo never to reach our storage at all, delete it before you turn the switch on.

Turning the switch off does not remove copies already in your account. Deleting a photo in the app removes it from the phone and asks our storage to delete the uploaded copy; if the phone is offline at that moment the uploaded file can be left behind, and it goes when you delete your account. The export never carries the images, so with backup off your phone holds the only copy.

Private journal entries and private notes are hidden behind Face ID or your device passcode on this app's own screens. A private note hides its name as well as its words, because for a note the name is the content, and a locked note is left out of search entirely. Being clear about what that is and is not: it prevents the words being shown by the app, but it is a screen lock, not encryption. The words sit in your account record as written, and your export file contains them in plain text, which is why exporting asks for the same unlock first.

The browser version at foundation100.com/app is different. A browser has no Face ID and no passcode check, so nothing marked private is hidden there. If that matters to you, do not sign in to the browser version. Nothing can be bought there either, so none of the payment services below are contacted by it at all.

The Health Part, Said Plainly

Some of what Foundation holds counts as health data in the legal sense, not just the everyday sense: your weight and your weigh-in history, your steps, your calories and macros, your training, and above all your physique photos. Several American states treat that kind of data more carefully than ordinary data. Washington and Nevada have laws written specifically about consumer health data, and California's medical information law reaches software that holds health information for a person to manage.

We hold it for one reason, which is that you asked the app to keep it so you could look back at it and see it on your other devices. It is not used for anything else. It is not sold, not rented, not shared with an advertiser, not used to build a profile of you, and not used to train anything. None of it is sent to CoinGecko, Yahoo Finance, Open Food Facts or Frankfurter, which only ever receive a search term, a barcode, a symbol or a currency code. Of the services that hold anything personal to you, only our hosting provider ever holds health data, because it is the database and the photo storage.

Two controls are yours at any time. Settings, Privacy, Photo Backup decides whether new physique photos are uploaded to your account. Settings, Privacy, Apple Health decides whether the app reads anything from Apple Health at all, and you can withdraw that in the Health app itself. Deleting your account deletes the health data with everything else.

Who else receives anything

Foundation talks to a small number of outside services. Supabase stores your record and Brevo sends your sign-in email, so both receive your account email address. Apple takes payment for a subscription, and RevenueCat is who the app asks whether that subscription is currently active. The rest are lookups. They are sent no account identifier, but a lookup is made of something you typed, scanned or hold, so that much does reach the service being asked. Prices are refreshed while the app is open, so the coins and tickers in your portfolio go with every refresh. With a Pro subscription and the Records notifications on (Settings, Notifications, Records), the phone also asks for the closing prices of the days since you last opened the app, at most once a day while the app is closed, to decide whether to post a net worth notice. The same coins and tickers go with that request, and nothing else: those price lookups are the only thing that leaves the phone while the app is closed, and your net worth itself is worked out on the phone and not sent.

Worth saying explicitly, because it is not obvious. Typing in food search sends those words to Open Food Facts, and it sends them while you type rather than when you pick something. Scanning a barcode sends that barcode. Searching for an investment sends what you typed to CoinGecko and Yahoo Finance, and holding an asset sends its symbol to one of them every time a price is refreshed, and, with the Records notifications on, once a day while the app is closed. Changing your currency asks Frankfurter for one exchange rate, and sends it nothing but the two currency codes. Those requests reveal what you searched for, what you scanned and what you hold. They carry no account identifier and cannot be linked back to you by us, though each service sees the internet address the request came from, as every website does.

Supabase, Brevo and RevenueCat are the three that receive anything personal to you. Each is a separate company with its own privacy policy and its own security terms, published on its own site, and it is those terms rather than this page that govern what each one does with what it holds. We cannot make promises on their behalf, so here is our side of it instead. Each receives only what the table above says it receives. None of them is sent anything for advertising or profiling. We use each of them on their ordinary published terms, with no separate arrangement of any kind, and we do not sell, rent or trade any of it to anyone.

Being straight about the limit of that, because it is checkable and every app like this one has the same limit. A company that runs infrastructure for other companies generally reserves the right in its own terms to look at how its service is being used, so that it can run it, keep it secure and improve it. That is not us handing your record over, and it is not advertising, but it is not nothing, and telling you it cannot happen would be untrue.

If you use Send Feedback, the app opens a draft email to us carrying what you wrote, your app version and build number, the operating system and version your device is running, and your account email. All of it is written into the body of the draft rather than hidden in a header, so you can read every line. Nothing is sent until you press send in your own mail app, and you can delete any of it first.

Where Foundation Is Offered

Foundation is made for people in the United States. The iPhone app is offered on the United States App Store and no other, Foundation Pro is priced in US dollars, and the app is written and supported in English only. We do not offer or market Foundation in any other country, and this page is written for someone living in the United States.

The browser version at foundation100.com/app is a public web address, so it is reachable from anywhere and we do not check what country you are in. If you open it from outside the United States you can still make an account. That does not mean Foundation is offered where you are: there is no other version of it, no other language, no other currency, and no other set of terms.

Where Your Account Is Kept

The database and the private photo bucket are both hosted with Supabase in its Canada (Central) region, which is near Montreal, so your record and any physique photos you have backed up are stored in Canada, whichever country you are using Foundation from. This is an American app priced in dollars, so people reasonably assume the machines are American too, and it is better read here than discovered later.

Two honest limits on that sentence. Our host takes routine backups of its database as part of running the service, and its documentation does not say which region those are held in, so this page does not claim one. And when you open one of your own photos, the file reaches you through a delivery network with servers in many countries, the same way every image on the internet reaches you. Where your photo is stored is Canada. Where a copy of it travels on the way to your screen is wherever you are.

Being stored in Canada is not a shield, and it would be dishonest to let it read like one. That region runs on American cloud infrastructure, and United States law reaches data an American company holds wherever in the world it sits. Canadian law applies to the buildings themselves. So your record sits under two legal systems rather than outside either of them, which is the true position and not an unusual one. If any of this changes, this page changes with it.

Subscriptions and payment

Foundation Pro is bought through the App Store. We never see your card, your bank details or your billing address. Apple takes the payment and tells us nothing about you; all the app is ever told is whether a subscription is currently active.

Between the app and Apple sits RevenueCat, the service that keeps track of that answer so one subscription covers every device you sign in on. It is sent your account's identifier, which is the random string that identifies your account rather than your email address, along with your app version, device model and country, and a record of each purchase, renewal and cancellation. That is how a subscription works, and there is no version of it that records nothing. What it is never sent is anything you log: not a workout, not a weight, not a figure, not a word you wrote.

The app asks that question when it opens and again when it returns to the foreground, so the answer is ready before you reach anything Pro covers. If you cancel, nothing of yours is deleted: the Pro features stop opening and everything on your account stays exactly where it was.

Apple Health

Foundation can read from and write to Apple Health. It is off until you turn it on yourself, in Settings, Privacy, and the app asks your permission before it reads anything.

It reads two things: your step count and your body weight. It writes one thing back: the weigh-ins you log in Foundation, as body weight, so your other apps can see them. Nothing else is read and nothing else is written. Your workouts, your heart rate, your sleep, your meals and everything else in Apple Health are not touched, and the app can only ever change the weigh-ins it wrote itself.

What the app reads from Apple Health while it is open is saved with the rest of your record, so it syncs to your account like everything else. With Apple Health on and the Records notifications on (Settings, Notifications, Records), the phone also reads new step counts and weigh-ins from Apple Health while the app is closed, only to decide whether to post a notice, such as a first day past 20,000 steps or a weigh-in on your target weight. That read is not saved and is not sent anywhere; the figures reach your record only when you next open the app and it reads them itself. None of it is ever used for advertising, never sold, never used to build a profile of you, and never sent to any of the services listed above. You can withdraw any of it at any time in the Health app, under Sharing, and Foundation will simply stop receiving it.

What is never sent anywhere else

• Notifications. Every notification is scheduled on the phone itself. Nothing is sent from a server, and no notification content is transmitted anywhere. Many of them put something of yours on the lock screen: the name and amount of a bill, the name of a debt, the title of a goal you set, the name of a checklist item, a body weight, a step count, a calorie figure such as your measured maintenance, and money figures such as your net worth or what a bill cost last year. Settings, Notifications, Hide Details On Lock Screen takes every name, title, figure and weight out of all of them, and leaves each one saying only that something is due or has happened. Scores, streak lengths, day counts and dates stay in either way. The same screen switches each group of notifications off. No notification ever contains the words of a journal entry or a note, and the look-backs and trophy anniversaries skip everything you have marked private. The date of a private entry or private note can still be given where a notice names the day something began: the journal's anniversary and its 1,000th day, and your record's anniversary and its 100th and 1,000th days. With the Records notifications on, a few are worked out while the app is closed, on the phone: from what Apple Health has just recorded, and from the closing prices of what you hold. The daily nudges are the same words for everyone.
• Step counts are read from the phone's motion sensor, or from Apple Health when you have turned Apple Health on. They are never sent to a third party. The counts the app reads while it is open are saved with the rest of your record, so they sync to your account like everything else. With the Records notifications on, Apple Health's counts are also read while the app is closed, to decide whether to post a notice; that read is not saved or sent anywhere.
• Face ID. The app is told whether the check passed. Your biometric data is handled entirely by iOS and is never available to Foundation.
• Payment details. Your card, bank details and billing address are handled by Apple and never reach us, or RevenueCat, or any other service listed above.

How long it is kept

Most of what you enter is kept until you delete it, because a record you cannot look back at is not a record. Some of it the app deletes on a schedule by itself, whether or not you ask, and that is the part worth knowing before you need it.

• Individual meals are deleted at the end of the following day. Only today and yesterday are kept, so yesterday can still be re-logged with a tap.
• Individual workout sessions are deleted once the week rolls over.
• The totals survive both. A day's calories, protein, carbs and fat, and a week's training totals, are banked before the entries behind them go. What is lost is the detail, not the day.
• Daily scores, daily eating totals, daily step counts, daily net worth and the day-by-day record of what you ticked off your checklist are kept for the most recent 730 days. Older days fall off on their own. That is the daily record only: the checklist itself is kept until you change it.
• Weekly training totals are kept for the most recent 260 weeks, which is five years.
• Transactions, weigh-ins, journal entries, notes, goals, bills, investments, assets, debts and physique photos are kept until you delete them, or until you delete your account. Nothing is deleted for being old and nothing is deleted for being unused.

Deleting your data

Open Settings, then Account, then tap the row showing the email you signed in with. Delete Account is at the foot of that screen. It removes your database record, your stored photos and your sign-in, and it deletes the photo files from this device. This cannot be undone. The record itself goes at once. Three things outlive it, and it is fairer to name them here than to let you find out later.

Our hosting provider keeps routine backups of its database as part of running the service, and anything of yours inside one goes when that backup expires.

If you ever subscribed, the subscription service keeps its own record of that subscription against your old account identifier: which purchases, renewals and cancellations happened, and when. It holds none of what you logged. Apple, which took the payment, keeps its own record of the transaction under your Apple Account, as it does for anything bought from the App Store, and we cannot reach either of those from here.

The service that sends your sign-in emails keeps a delivery log showing that an email went to your address and when. Write to [email protected] if you want those records chased, and we will ask each service to remove what it holds about you.

You can also export your record from Settings, Account before you go. It is a JSON file holding everything the app is currently holding, and it carries any private entries and notes in plain text, which is why it asks for Face ID first when you have any. The photo images themselves are not in it. The date of each photo is.

Children

Foundation is not directed at children, and nothing in it is built to attract them. You need to be at least 13 to use it. We do not knowingly hold data from anyone younger, and if we learn that an account belongs to someone under 13, however we learn it, we will close the account and delete what it holds. If you believe a child has an account, write to [email protected] and we will delete it.

How This App Was Built

Foundation was written by one person working with AI coding tools. A large part of the code that shipped was drafted by a machine, and the app is that one person's responsibility all the same. It is worth saying plainly, because people are entitled to know how the thing holding their data was made.

What it does not mean matters more, so here it is flatly. No AI service receives anything you log. Your weight, your money, your photos, your notes and your journal are not sent to an AI, read by one, summarised by one or scored by one, and nothing you record is used to train anything. There is no AI feature in the app and no AI company on the list of services above, because the app does not contact one. Every number Foundation shows you, including your daily score, is ordinary arithmetic done on your phone from figures you entered.

Changes

If this policy changes in a way that affects what happens to your data, the date at the top will change. This page is always the current version, so it is worth a look after an update.

Contact

Questions about any of this: [email protected]