Privacy
What commercial nutrition apps collect, who they share it with, whether you can leave with your data, and what to do about all of it.
The exit test: can you get your diary out, and can your own tools read it?
Data portability is the privacy property this site actually cares about. We test six commercial trackers on two things: whether you can export your full history without filing a legal request, and whether software you control can read your own diary. One of them has a read-only OAuth endpoint on the free tier; the rest are a screen-scrape or a DSAR.
Privacy posture comparison: six commercial calorie trackers (2026)
A comparison matrix of privacy posture across six commercial calorie trackers in 2026: MFP, Cronometer, Lose It!, MacroFactor, Noom, and PlateLens. Observed traffic, stated policy, GDPR/CCPA responsiveness, and — new in the September 2026 revision — whether you can get your data back out and read it with your own tools.
Lose It! 'Snap It' and the cloud photos question
A traffic capture and EULA review of Lose It!'s Snap It feature. Photos go to a third-party classifier; the EULA permits broad retention; the privacy practices are not transparent.
Threat model: what does serious threat-modelling for personal nutrition data look like?
A practical threat model for personal calorie tracking data. Insurance discrimination, weight-stigma profiling, employer wellness programs, the data-broker ecosystem, and — new for 2026 — the AI assistant you connected to your own diary. Most readers should care more than they do, less than the maximalist case suggests.
Dark patterns in calorie tracker paywalls
Pattern analysis of how the four leading commercial calorie trackers introduce paywalls behind features that were free at sign-up. Habit-anchor exploitation, sunk-cost framing, and the specific UI patterns to recognise — plus what an honestly metered free tier looks like, for contrast.
Practical GDPR (and CCPA) rights against nutrition apps
Step-by-step on filing GDPR access, portability, and erasure requests against nutrition apps. Templates, real timelines, escalation paths to your DPA when an operator drags its feet.
Noom and the third-party sharing fineprint
An audit of Noom's actual outbound traffic and stated data-sharing practices. The 'we don't sell your data' line is technically true and substantively misleading. Real outbound destinations include the usual ad-network suspects.
Cronometer's privacy policy, line by line
A clause-by-clause walkthrough of Cronometer's privacy policy as of early 2025. Better practices than MFP's overall but with three specific clauses that are worth understanding before you commit your nutrition data to them.
MyFitnessPal privacy audit, 2024–2026
Outbound traffic, third-party SDKs, retention, and dark-pattern audit of MyFitnessPal across 2024–2026. The changes since the Francisco Partners acquisition are real but smaller than headlines suggest. The pre-existing posture was already worse than most users assumed.