Last updated: November 6, 2026
1. Who we are
Stacly Sync is operated by MAHALO ADS NEGOCIOS DIGITAIS LTDA (CNPJ 60.528.953/0001-59), R Santa Catarina, 45, Sala 1, Parque Residencial, Jacutinga/MG, CEP 37.590-000, Brazil — the controller of your personal data for the purposes of this policy. Contact: mahaloads@outlook.com.
2. Who this policy applies to
Stacly is intended for users 18 and older. We do not knowingly collect personal data from anyone younger. See Section 11.
3. What we collect
Account: the name, email address, and profile photo made available by your Google sign-in (we never see or store your Google password). Content you enter: supplements (name, brand, notes), bottles (quantity, unit, status, purchase/opened/depletion dates, expiration date and batch/lot number if you enter them), dose schedules (amount, unit, frequency, start/end dates), a history of actions like pausing or resuming a supplement, purchases (store, price, date, quantity if you choose to record them), store names you've used before, and reminder preferences. Photos you capture: bottle label photos taken with Scan Bottle are sent to our AI provider to prefill supplement details, then automatically deleted from temporary storage within 24 hours — whether or not you finish adding the supplement. They are never kept permanently. Optional profile photo: if you choose to upload a custom avatar (instead of using your Google photo), it is stored privately in our file storage. Feedback you submit: if you use the in-app Feedback form, we keep the category, message, and the app version you were using. Consent records: which version of this Privacy Policy and the Terms of Use you accepted, and when. Usage signals: a small number of in-app events (for example, that a reminder notification was opened) used only to improve reminders for your own account. These are never sold, shared with advertisers, or used to build an advertising profile. What we do not collect: Stacly does not use any advertising or behavioral-analytics SDK, does not use push notifications (reminders are scheduled entirely on your device), and does not read your photo library, contacts, or location. The app includes a privacy-preserving crash/error-reporting capability (Sentry) that is not currently turned on for any user — see Section 6 for what it would and would not receive if we turn it on in the future.
4. Why we collect it
To let you track your own supplement routine, calculate how much you have left, remind you about doses, remind you before you run out, let Scan Bottle prefill a label for you, let Ask Stacly answer questions about using the app, and to operate, secure, and improve Stacly itself.
5. Our legal basis for processing
Where applicable law requires a legal basis (including Brazil's LGPD and, for users in the EEA/UK, the GDPR), we process your data based on your consent, given when you accept this Privacy Policy and the Terms of Use, and, where relevant, on our legitimate interest in operating and securing the service or on the necessity of processing to provide the app you asked for. Dose and supplement-consumption records can, depending on what you choose to record, indirectly reveal information about your health. We treat this category of data with the same heightened care LGPD gives to "dado pessoal sensível" (Art. 5º, II) and GDPR gives to special-category health data (Art. 9) — in practice, this means we rely on your consent as the basis for this specific data, we do not use it for any purpose beyond running Stacly for you, and we never sell it or share it for advertising.
6. Who processes your data on our behalf
Supabase — database, authentication, and file storage. Our production environment is hosted on Supabase's infrastructure on AWS, in the United States (us-east-1 region). Google — provides Sign in with Google (we never receive your Google password) and, separately, the Gemini API that powers Ask Stacly. OpenAI — provides the AI service Scan Bottle uses to read label photos. Open Food Facts — a public, non-commercial barcode database your device queries directly when you scan a barcode; no account information is sent to it, only the barcode number. Expo/EAS — builds and delivers app updates; it does not process your account content. Sentry (not currently active): Stacly is built to optionally send crash and error reports to Sentry to help us find and fix bugs. As of this version, this is not turned on for any user. If we turn it on, it would receive only technical details about the error (what failed and where) — never your name, email, password, or any supplement/dose/health-adjacent content you entered, which are automatically removed before anything is sent. We will update this Policy's effective date if and when this is activated. We do not sell your data. We do not share it with advertisers or data brokers. We only share it with the providers above, each only for the specific function described, and never beyond what each function needs.
7. International data transfers
Because our infrastructure is hosted in the United States and our AI providers are US-based, your data may be transferred outside Brazil, the EEA, or the UK. Where that transfer concerns a user protected by LGPD, GDPR, or UK GDPR, we rely on contractual safeguards — such as Standard Contractual Clauses — and/or our providers' own certifications under applicable international data-transfer frameworks, as implemented by each provider.
8. How long we keep it
Your data is kept while your account exists. Bottle label photos are deleted automatically within 24 hours of being captured. If you delete your account, all of your content is deleted along with it — including your custom profile photo, if you uploaded one — except for a minimal audit record (that an account existed and was deleted, with no content) kept for security accountability.
9. Your rights
You can access, export a full copy of, and permanently delete your data at any time from the Privacy screen, without needing to contact us first.
9.1 If you are in Brazil (LGPD)
You have the rights listed in Art. 18 of the LGPD, including confirmation of processing, access, correction, anonymization, deletion, and data portability. As a small-scale processing agent, we have designated mahaloads@outlook.com as our privacy contact channel instead of appointing a formal Data Protection Officer, consistent with ANPD Resolution CD/ANPD nº 2/2022.
9.2 If you are in the European Economic Area or the United Kingdom (GDPR / UK GDPR)
You have the rights to access, rectify, erase, restrict, or object to processing, and to data portability, and the right to lodge a complaint with your local supervisory authority. We have not appointed an Article 27 representative in the EU or the UK; this is a pending item we will revisit if and when we actively serve those markets at scale, and it does not limit your right to contact us directly at mahaloads@outlook.com.
9.3 If you are in the United States, including California (CCPA/CPRA)
Given our current size, the CCPA/CPRA's revenue and data-volume thresholds likely do not apply to us. We nonetheless voluntarily extend comparable rights to all users: you can know what we collect (Section 3), request deletion, and request a copy of your data, directly from the app. We do not sell or share your personal information for cross-context behavioral advertising — there is nothing to opt out of.
9.4 Everyone else
Regardless of where you are, you can always export or delete your data from the Privacy screen, or write to mahaloads@outlook.com with any request.
10. Automated decision-making
Stacly does not use your data to make any automated decision that produces a legal or similarly significant effect on you. AI-assisted features (Scan Bottle, Ask Stacly) only prefill or answer — you always review and confirm before anything is saved.
11. Children
Stacly is not directed at anyone under 18, and we do not knowingly collect personal data from them. If we learn that an account belongs to someone under 18, we will delete it.
12. Security
Access to your data is protected by row-level security rules at the database layer, so one account can never read another account's data through the app. Our infrastructure providers encrypt data in transit and at rest by default. No system is perfectly secure, and we cannot guarantee absolute security.
13. Changes to this policy
We record which version of this Privacy Policy and the Terms of Use you accepted, and when. If we make a material change, you will be asked to accept the new version before continuing to use the app; your earlier acceptance record is preserved, not overwritten.
14. Contact
For any privacy question or request, write to mahaloads@outlook.com.