Privacy policy
StackingRight stores your email, the supplements and medications you enter, your daily intake and symptom logs, and your profile inputs such as sex and timezone. We do not sell your data, do not share it with advertisers or supplement brands, and do not use it to train models. You can delete your account and all associated data at any time.
What we collect
Account data: your email address and, optionally, a display name. Authentication is handled by our backend provider using hashed credentials; we never see your password.
Health inputs you provide: your supplement and medication list including doses, your profile inputs such as sex, birth year, weight, height, diet type, conditions and goals if you enter them, your daily taken or skipped logs, your symptom check-ins, and any lab values you record.
Technical data: basic request logs needed to operate and secure the service, plus aggregate usage analytics described below. We do not run third-party advertising trackers or cross-site advertising trackers.
Why we collect it
The stack, profile inputs and logs exist to compute your intake totals, your interaction results and your Stack Score. That is the entire purpose. Symptom and intake logs exist so you can see whether adherence correlates with how you feel.
Email is used for account access and, if you opt in, a weekly digest. It is not used for marketing beyond that, and you can turn the digest off in settings.
What we will never do
We will never sell your health data. We will never share your stack, logs or symptoms with advertisers, supplement brands, insurers or data brokers. We will never use your logged health data to train machine learning models. We will never recommend a specific product to buy based on your data.
If that ever changed, it would require your explicit opt-in consent and a clear description of the new use before any data was touched.
Who can see your data
You, and no other user. Access is enforced at the database level: every record is scoped to your account identifier, and the database rejects any request that does not match the signed-in user. This is enforced server-side, not merely hidden in the interface.
Our hosting and database providers process data on our behalf under their own security commitments. We do not otherwise disclose your data except where legally compelled, and we would notify you unless prohibited from doing so.
Data retention and deletion
Your data is retained while your account exists. You can delete individual stack items and logs at any time, and deleting your account removes your profile, stack, intake logs, symptom logs and score history.
Deleting a supplement from your stack removes its associated intake log rows, because those records are meaningless without the item they refer to.
Your rights
You can access, correct, export or delete your data at any time from within the app. If you are in a jurisdiction with specific data protection rights, including access, portability, rectification, erasure and objection, those rights are honoured. Contact us if you need help exercising them and the in-app tools are not sufficient.
Analytics
We use Google Analytics 4 to understand which pages are useful, how visitors arrive and where people get stuck. It sets cookies and collects your IP address, which Google truncates before storage, along with the pages you view, your approximate location, your device and browser type, and referring site.
We have IP anonymisation enabled. We do not send your health data to Google: your supplement stack, doses, logs, symptoms and lab values are never transmitted to the analytics service, and analytics events are never joined to your account. Analytics tells us that a page was viewed, not who viewed it.
Google processes this data as an independent controller under its own privacy policy. You can opt out of Google Analytics across all sites using the official browser add-on, and blocking cookies in your browser also prevents it from tracking you.
Cookies and local storage
We use browser local storage for two things: keeping you signed in, and remembering whether you prefer light or dark mode. Google Analytics additionally sets first-party cookies (names beginning with _ga) to distinguish visitors and sessions. There are no advertising cookies, no cross-site advertising trackers and no fingerprinting.