Privacy Policy
Last updated: October 25, 2026
Privacy at a glance
We keep data collection minimal. We don't sell your information, show ads, or track you across other websites.
ShowMacros is a Chrome extension that estimates calories and macronutrients for recipes you view in your browser. This document describes what data the extension handles and why.
Who is responsible
ShowMacros is run by one person in Switzerland, who is responsible for the data described here. Contact: support@showmacros.com.
What we collect
In short:
- The recipe you scan (its ingredients), to look up the nutrition.
- Your email, if you sign in with Google, so your account and Pro work.
- Recipes you save (Pro), so they're there on all your devices.
- A few anonymous counts, like how many scans you've used, and ingredients we couldn't match, to keep the numbers accurate.
The full details:
| Data | When | Why | Storage |
|---|---|---|---|
| Recipe text from the current page (ingredients, title, serving count) | Only when you click the ShowMacros icon (or scan again) on a recipe page | To parse the ingredients and look up nutrition data | Processed in memory; not retained on our servers |
| Recipe page address (phone app, showmacros.com/app) | Only when you share a recipe page to ShowMacros or paste its link | Our server opens that page so the ingredients can be read, since a phone can't run the extension | The page is passed straight to your phone; a copy may be kept up to 10 minutes so a repeat visit is fast. Not linked to you |
| Ingredient name queries | For each ingredient not already cached on your device | Sent to our proxy so we can query the USDA FoodData Central API | Kept in a shared ingredient cache (the ingredient text and USDA's answer only, never who asked) so repeat lookups are fast; request logs ~7 days |
| Anonymous device identifier (random UUID) | On first use | To count free scans for the daily fair-use limit, without an account | chrome.storage.local (phone app: the browser's storage) on your device + a row keyed by this UUID on our server |
| Network address, scrambled (a salted one-way hash, never the address itself) | On each free scan | To stop automated overuse: a daily fair-use limit per network | On our server with the day and a count; deleted after 2 days |
| Email and Google account ID | Only if you sign in with Google | To authenticate you, associate your subscription, and send receipts | Supabase Auth (us-east-1); Stripe customer record |
| Subscription state | If you subscribe | To unlock Pro features | Supabase public.subscriptions table |
| Usage counter (free scans per day, keyed by your account or a one-way hash of your device UUID) | On each free scan | To apply the daily fair-use limit | On our server with the day and a count; deleted after 2 days |
| Your free Pro preview (the page addresses of your first 3 recipes) | On your first 3 scans | To turn on Pro features for those 3 recipes | On your device only (chrome.storage.local; phone app: the browser's storage). Never sent to us |
| Saved recipes (Pro users only: recipe title, page address, servings, ingredients and totals) | After each successful analysis | To provide synced recipe history across your devices | Supabase public.saved_recipes table |
| Daily streak + theme preference | When you scan a recipe / toggle the theme | UX | chrome.storage.local on your device |
Accuracy diagnostics (the cleaned name of an ingredient we couldn't confidently match, a coarse outcome label such as “missing” or “category estimate”, the estimated grams, the website host (for example allrecipes.com, never the page path), your anonymous device UUID, and the extension version) |
When an analysis produces a low-confidence or missing nutrition match, or when you manually correct a value | To find which ingredients our data handles poorly and improve the built-in nutrition tables | Supabase public.low_confidence_parses table |
| Feedback you send (your message, the email address you choose to add, if any, and the extension version) | Only when you send a message from Feedback & ideas | To read your feedback and reply if you asked us to | Our feedback database on Cloudflare (D1); deleted within 12 months |
| Product-usage events (event type, meaning a scan, a paywall view, a tap on a Pro feature, a change during the free Pro preview, or an upgrade click; whether the scan was allowed or blocked; your tier; the plan clicked; and either your signed-in user ID or a one-way hash of your anonymous device UUID) | On each scan and on Pro / upgrade interactions | To understand how often the tool is used and which features people want. First-party only, no third-party analytics | Supabase public.analytics_events table |
We do not collect your browsing history. The only page addresses we keep are those of recipes a Pro user analyzes, for their own recipe history. We also do not collect the content of pages you do not analyze, identifiers beyond the above, or any personally identifying data beyond what Google and Stripe provide when you authenticate or pay.
Who we share data with
- USDA FoodData Central (
api.nal.usda.gov) receives only the ingredient text you're looking up. Public, non-personal data service. - Supabase (our backend host) stores auth sessions, subscription rows, usage counters, and saved recipes.
- Cloudflare hosts showmacros.com and stores messages you send from Feedback & ideas.
- Link, a payments service by Stripe, is the seller of record for Pro. It handles checkout, recurring billing, receipts, sales tax and refunds, and receives the payment details you enter at checkout (we never see your card number). Subject to Link's privacy policy and Stripe's privacy policy.
- Anthropic (Claude API) never provides calories or macros. Only for an uncommon ingredient that isn't in our own tables, its name and USDA's list of possible foods are sent to Anthropic to choose which USDA food it is; if none fits, the ingredient line from the recipe (for example "2 cups chopped kale") is sent once to find the food's name. The same line is also sent once when an ingredient's match or amount looks clearly wrong (for example a can of tuna in oil matched as pure oil), to read it again. Nothing that identifies you is sent. Every number comes from USDA, the chosen match is saved (the ingredient text and USDA's food only, never who asked) so the next lookup needs no AI, and every match is shown in the popup. Anthropic does not train on this data.
- MyMemory (
api.mymemory.translated.net): if a recipe is in a non-English language, ingredient names are sent to this public translation service so we can match them against USDA's English-language database. Only ingredient text is sent, no account identifiers, URLs, or other recipe metadata. Note that MyMemory uses an HTTP GET request, which means the ingredient text appears in the request URL and may be retained in their standard web-server access logs. It receives nothing that identifies you. We do not control its data retention; please consult its privacy policy for details.
We do not sell data, run advertising, or share data with anyone outside the services listed above.
Where data is stored and why we may use it
- Location: our servers (Supabase) are in the United States. Link, Stripe and Cloudflare may also process data outside Switzerland and the EU. These providers use standard contractual safeguards for international transfers.
- Legal basis: we use your data to provide the service you asked for (scans, sign-in, Pro, history), to handle payments and meet legal duties, and, for the anonymous accuracy diagnostics and usage counts, because we have a legitimate interest in making the numbers more accurate and keeping the free tier fair.
- How long: account, subscription and saved-recipe data are kept until you delete your account. Feedback messages are deleted within 12 months. Payment records are kept by Link and Stripe as long as the law requires.
Your rights
- Delete your account: email support@showmacros.com and we'll erase your auth row, subscription record, usage counter, and saved recipes. Link and Stripe keep payment records as required by payment regulations.
- Export your data: same email. You'll receive the above as JSON.
- Correct or object: email us to fix wrong data or to object to any use described here.
- Complain: you can contact a data protection authority. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the authority in your country.
- Cancel subscription: use Manage subscription in the extension menu, or sign in at link.com.
- Accuracy diagnostics: we do not run advertising or cross-site analytics. The only diagnostic data we collect is the anonymized accuracy-diagnostics described in “What we collect”: the name of an ingredient we matched poorly (or that you corrected), an outcome label, the recipe site's host, your anonymous device UUID, and the extension version. It carries no page URLs, account identifiers, or personal data, and is used solely to improve nutrition accuracy. To stop sending it entirely, email support@showmacros.com and we'll exclude your device UUID.
Children
ShowMacros is not directed at children under 13 and we do not knowingly collect data from children.
Changes
We'll post changes here and bump the "Last updated" date. Material changes will be surfaced in the extension popup.