Privacy Policy

Matro — How we collect, use, and protect your data.

Version 1.3 Last updated 2 October 2026 · GDPR compliant

1. Introduction

Matro is a minimalist food tracking app developed and provided by Kolibri Nest AS. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our mobile application and related services.

We are committed to processing your data lawfully, transparently, and only to the extent necessary to provide you with a useful experience. We do not sell your data, and we do not show ads inside the app. We do advertise Matro itself on other platforms, and we measure how well those ads work as described in section 5.5.

2. Data Controller

The data controller responsible for your personal data is:

Kolibri Nest AS

Org. no.: 925 795 119

Email: hello@matroapp.com

Website: matroapp.com

3. Personal Data We Process

Depending on how you use Matro, we may process the following categories of personal data:

Account data: email address, password (hashed)
Profile data: name (optional), date of birth, gender, height
Body measurements: weight, body weight history, weight goal, waist, neck and hip measurements, body fat percentage (entered by you, measured with a tape measure, or imported from Apple Health with your permission)
Dietary and nutrition data: foods logged, meal times, calorie and macro intake
Saved meals and custom food items you create
Health questionnaire responses (used to calculate calorie targets)
Apple Health data (iOS only, if you connect it): weight and body fat percentage read from Apple Health; active energy and workouts read from Apple Health to display in the app. See section 5.6.
App usage data: feature interactions, session data, crash logs
Advertising measurement data: app installs and launches, completed registration, subscription and free trial starts, an anonymous app installation ID, and, on iOS only if you allow tracking, your device's advertising identifier (IDFA). See section 5.5.
Device data: device type, operating system version, app version
Images you submit to the AI food recognition feature (not stored after analysis)

4. Data Sources

We obtain personal data directly from you as you create an account and interact with the app. Some technical data (e.g. device type, crash logs) is generated automatically during use. On iPhone, data can also come from Apple Health, but only if you connect Matro to Apple Health yourself and grant permission in iOS. We do not purchase or obtain personal data from third-party data brokers.

5. Purposes and Legal Basis

We process your personal data for the following purposes, on the stated legal basis under GDPR:

5.1 Providing the App and Its Features

Legal basis Performance of a contract (Art. 6(1)(b) GDPR)

Creating and managing your account
Logging food, calculating calories and macros
Generating personalised calorie and nutrition targets
Storing your food diary, saved meals, and custom items
Providing AI-based food recognition via text or image

5.2 Health and Dietary Data

Legal basis Explicit consent (Art. 9(2)(a) GDPR)

Data about what you eat, your body measurements, weight goals, and related health information is considered special category data under GDPR. We process this data only with your explicit consent, which you provide when setting up the app. This data is essential to the core functionality of Matro — without it, we cannot provide food tracking or personalised recommendations.

You may withdraw your consent at any time by deleting your account.

5.3 App Improvement and Debugging

Legal basis Legitimate interests (Art. 6(1)(f) GDPR)

Analysing anonymised usage patterns to improve the app experience
Diagnosing crashes and technical errors

We have assessed that this processing does not override your interests or fundamental rights, given that only anonymised or aggregated data is used.

5.4 Legal Obligations

Legal basis Legal obligation (Art. 6(1)(c) GDPR)

Retaining accounting and transaction records as required by Norwegian bookkeeping law

5.5 Measuring Our Own Advertising

Legal basis Consent (Art. 6(1)(a) GDPR) for the advertising identifier; legitimate interests (Art. 6(1)(f) GDPR) for anonymous app events

We advertise Matro on Facebook and Instagram. To understand which ads lead people to download and use Matro, the app includes the Meta SDK, which sends a small number of app events to Meta Platforms Ireland Ltd.:

App installed and opened
Registration completed
Subscription or free trial started (reported by the App Store and Google Play)

We never send health, food, weight, body measurement, goal data or any data from Apple Health to Meta, and we never send your name, email address or account ID.

On iOS, Matro asks for permission to track before your device's advertising identifier (IDFA) can be shared. If you decline, the identifier is not shared, and Meta only receives the anonymous events above, measured through Apple's privacy-preserving methods. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking. On Android, Matro does not access your device's advertising ID.

We do not show ads inside Matro, and we do not sell or rent your data to third parties. There is no automated decision-making or profiling with legal or similarly significant effects (Art. 22 GDPR). Meta processes the data it receives in accordance with its own Privacy Policy.

5.6 Apple Health (iOS)

Legal basis Explicit consent (Art. 9(2)(a) GDPR)

Connecting is optional and off by default. You choose what Matro may access in Apple's permission screen, and can change it any time in the Health app (Profile → Apps → Matro) or with the switches in Matro.

What Matro reads: weight and body fat percentage, and active energy and workouts.
What Matro stores on our servers: imported weight (one weigh-in per day), and body fat percentage only if you choose to use a new reading. These are treated like measurements you enter yourself. We never import data from before the date you started using Matro.
What Matro does not store: activity data (active energy and workouts) is read directly on your device each time it is shown and is never sent to or stored on our servers.
What Matro writes to Apple Health: your logged meals (energy, protein, carbohydrates, fat and the food name), from the day you connect. If you turn this off, Matro stops writing; data already in Apple Health stays there and is yours to manage in the Health app.

Data from Apple Health is never used for advertising or marketing, never sold, and never shared with third parties, including Meta and other advertising or analytics providers. It is not used for any purpose other than providing Matro's features to you.

You give this consent when you connect Matro and grant permission. You can withdraw it at any time by turning off access in the Health app or in Matro.

7. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA), including in the United States. Where such transfers occur, we ensure appropriate safeguards are in place, including:

EU Standard Contractual Clauses (SCCs) approved by the European Commission
The EU-U.S. Data Privacy Framework, where applicable

8. Data Retention

We retain your personal data only for as long as necessary:

Account and food diary data: Retained for as long as your account is active
Images submitted to AI: Deleted immediately after analysis — never stored
Weight and body fat imported from Apple Health: As long as your account is active, like other body measurements
Activity data from Apple Health: Not stored
Anonymised usage and crash data: Up to 12 months
Advertising measurement data held by Meta: In accordance with Meta's own data retention policy
Accounting and payment records: As required by law (5 years under Norwegian bookkeeping regulations)

If you delete your account, all personal data associated with it will be permanently deleted within 30 days, except data we are legally required to retain.

We will also delete or anonymise inactive accounts after a period of extended inactivity.

9. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right to be informed: To know how your data is processed (this document)
Right of access: To receive a copy of the personal data we hold about you
Right to rectification: To have inaccurate or incomplete data corrected
Right to erasure: To request deletion of your data (“right to be forgotten”)
Right to restriction: To limit how we process your data in certain situations
Right to data portability: To receive your data in a structured, machine-readable format
Right to object: To object to processing based on legitimate interests
Right to withdraw consent: To withdraw consent for health data processing at any time
Right to lodge a complaint: With your national supervisory authority

To exercise any of these rights, contact us at hello@matroapp.com. We will respond within 30 days. You can also delete your account directly from within the app.

In Norway, the supervisory authority is Datatilsynet (datatilsynet.no). If you are located in another EEA country, you may contact your local data protection authority.

10. Security

We take appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit (TLS/HTTPS)
Encryption of data at rest
Role-based access controls
Regular security reviews

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected users without undue delay.

11. Children

Matro is not directed at children under the age of 13, or the applicable age of digital consent in your country if higher. We do not knowingly collect personal data from children below this threshold.

If you become aware that a child has submitted personal data to Matro, please contact us at hello@matroapp.com and we will delete the data promptly.

12. Cookies and Tracking

The Matro app does not use cookies. The app does include the Meta SDK for measuring our own advertising, as described in section 5.5. On iOS, the advertising identifier is only shared if you allow tracking, and on Android the advertising ID is not accessed. Our website (matroapp.com) uses Google Analytics to understand how visitors find and use our site. This data is anonymised and aggregated and is not used for advertising purposes. You can opt out of Google Analytics tracking via your browser settings or by using the Google Analytics Opt-out Browser Add-on. We do not use cookies for behavioural tracking or targeted advertising.

12b. Washington State Privacy Rights

If you are a resident of Washington State, you have additional rights under the Washington My Health MY Data Act (MHMD Act) regarding your health data.

Matro collects and processes health-related data including body weight, dietary information, and calorie intake. If you connect Apple Health, this also includes weight and body fat percentage imported from Apple Health. This data is considered consumer health data under Washington law. Activity data from Apple Health (active energy and workouts) is shown in the app but not stored.

You have the right to:

Access the consumer health data we hold about you
Delete your consumer health data at any time (via Settings → Account → Delete account, or by contacting us)
Withdraw consent for the collection and sharing of your consumer health data

We do not sell consumer health data. We do not share consumer health data with third parties except as necessary to provide the App's core functionality, as described in Section 6 of this policy.

To exercise your Washington privacy rights, contact us at hello@matroapp.com. We will respond within 45 days.

13. Changes to This Policy

We may update this Privacy Policy as the app evolves. We will notify you of material changes through the app or by email before they take effect. The current version is always available at matroapp.com/privacy.

Continued use of Matro after changes are notified constitutes acceptance of the updated policy.

14. Contact

For questions about this policy, to exercise your rights, or to raise a concern about how we handle your data, please contact: