Privacy Policy — Forkmate

Forkmate is a product of High Country Codes, a Colorado sole proprietorship ("we," "us") — the data controller for the personal data described here. This policy explains what we collect, how we use it, and who helps us run the service. We aim to collect as little as possible. Questions or data-rights requests: privacy@forkmate.ai.

Information we collect

Account information — your email and authentication details, handled by our auth provider (WorkOS/AuthKit). We never see your password.
The data you log — the meals you record and, optionally, profile details you choose to enter (e.g. a calorie goal and body metrics) to personalize your targets.
Payment information — if you subscribe to a paid plan, your checkout and payment are handled by Lemon Squeezy, our Merchant of Record (the seller of record for your subscription, which also collects and remits any applicable sales tax or VAT). To link your subscription to your account, we share your email address and your Forkmate account identifier with Lemon Squeezy — never your meals or health-related data. Your card details go directly to Lemon Squeezy; we do not receive or store your full card number.
Usage & reliability data — privacy-preserving analytics and error/performance telemetry to keep the service working. Telemetry is scrubbed of personal content.
Campaign & referral identifiers — when you reach us from a marketing link or ad, we may receive campaign tags (UTM parameters), the referring page, and a first-party referral identifier so we can understand which campaigns lead to sign-ups. An advertising click identifier (such as Google's gclid) is recorded only if you accept analytics on our marketing site. These identifiers measure marketing and are never linked to your meals or other health-related data.

Importing from other apps

Forkmate can import your history two ways, and neither asks for your login or account password to the other service.

(1) Guided importer (MyFitnessPal): if you already have a food_diary.csv — from MyFitnessPal Premium's CSV export, or one your AI assistant extracted from your export — you upload just that file, and we never ask for your MyFitnessPal login or account password. We read it to create your diary entries — dates, meal, food name, serving, and nutrition values — and then discard it; nothing else is uploaded. A frictionless importer that opens and unlocks the whole encrypted MyFitnessPal export entirely inside your own browser — so the file and its password never leave your device at all — is in final safety review and coming soon.

(2) AI-assisted import: you point your own AI assistant at your export and it logs the food rows into Forkmate through the same secure MCP connection you use to log meals. In this path your file is handled by your AI assistant, not by Forkmate.

Before anything is saved we show you exactly what will be added and ask you to confirm. Imported entries are health-related data and get the same protection, retention, and export/deletion rights as meals you log yourself.

How we use it

To provide and improve the service: store your food diary, compute your daily calories and macros, secure your account, process subscriptions, and diagnose problems. We do not sell your personal data or use your health-related data for advertising.

Health-related data & medical disclaimer

The meals, body metrics, and goals you log can reveal health-related information. We treat this as sensitive: it is never sold and never used for advertising, and we share it only with the processors below, solely to operate Forkmate.

Forkmate is a tracking tool — not a medical device, healthcare provider, or source of medical or nutritional advice. Calorie and macro estimates are for general informational purposes only and may be inaccurate. Consult a qualified professional before making dietary, health, or medical decisions.

Our nutrition figures — including carbohydrates — are estimates drawn from public databases (USDA, Open Food Facts) or your own entries. They are approximate, not lab-measured or per-batch, and are not accurate enough for insulin dosing, blood-glucose prediction, or any other medical decision. Rely on the product's own label and your care team for those.

Forkmate is also not a treatment or monitoring tool for eating disorders or any mental-health condition. If tracking your food or body ever feels harmful or distressing, please seek support from a qualified professional — in the US you can call or text 988, the Suicide & Crisis Lifeline (free, confidential, 24/7, and also helps with eating-disorder distress). See our Terms for details.

Service providers (sub-processors)

We share data only with vendors that help us run Forkmate, under contract. Most act solely on our behalf and never for their own purposes; our payment provider is the exception — as Merchant of Record it is the seller of record and also processes your purchase for its own tax and legal obligations:

WorkOS — authentication and login.
Cloudflare — hosting, storage, and infrastructure security.
Google (Workspace) — business email: when you email us (for example support@, privacy@ or legal@forkmate.ai) or we reply, that correspondence is handled through Google Workspace.
Lemon Squeezy — our Merchant of Record for paid plans: the seller of record for your subscription; it processes payment and collects and remits applicable sales tax and VAT. For that transaction, Lemon Squeezy acts as a separate, independent data controller under its own privacy policy, where you can also exercise data rights against it directly.
Anthropic — powers Forkmate's own in-app AI features that help interpret what you log. Anthropic is contractually prohibited from using your food logs or account content to train its models. This guarantee covers Forkmate's own in-app AI path only: when you connect Forkmate to your own AI client (such as Claude, ChatGPT, or Cursor) over our MCP connection, your conversation with that app is governed by that app's own terms and privacy policy, not ours — some consumer AI tiers may train on your chats unless you opt out in that app's settings, and Forkmate cannot control or guarantee how a third-party client you connect handles that conversation.
Google (Google Analytics 4) — marketing-site traffic and campaign/conversion measurement, used only with your consent and limited to forkmate.ai. Not used inside the app, and never sent your meals or health-related data.
Ahrefs (Web Analytics) — cookieless marketing-site traffic measurement, used only with your consent and limited to forkmate.ai. Not used inside the app, and never sent your meals or health-related data.

Our marketing site (forkmate.ai) uses Google Analytics only after you consent; the app itself uses cookieless analytics. Consent on forkmate.ai is managed by Cookiebot, our consent management platform — you can change or withdraw your choice at any time via the cookie banner.

Cookies

The live list of cookies and trackers used on forkmate.ai, by category, is maintained automatically below:

Your rights & data retention

You can access, export, or delete your data at any time — export and account deletion are available directly in your account settings. We keep your data while your account is active, and after a deletion request or account closure we erase it within about 30 days, after which residual copies in encrypted backups are overwritten on our normal backup rotation. Content sent to our AI provider for Forkmate's in-app AI features is automatically deleted within about 30 days; a small amount of content that an automated safety system flags may be retained longer (up to about 2 years) and may be reviewed by a person for safety. We may retain limited data longer where the law requires it (for example a legal hold or court order), which can override the timelines above. Payment and transaction records held by Lemon Squeezy as seller of record are retained by Lemon Squeezy under its own legal and tax obligations and are not deleted by erasing your Forkmate data — to exercise data rights directly against Lemon Squeezy, see its privacy policy.

Depending on where you live (for example the EU/UK, or US states such as California and Colorado), you may have additional rights — including access, correction, deletion, portability, and the right to opt out of certain processing. Contact us to exercise them. Where we process health-related data, we rely on your explicit consent (given during onboarding), which you can withdraw at any time by deleting the data or your account. Our infrastructure is US-based; where EU/UK data is transferred to the US, we and our providers rely on Standard Contractual Clauses.

If you contact us — or use our access-rate form — to ask about a free or discounted plan, we keep only the name, email, and message you send, for as long as we need to reply and no more than about 90 days, after which it is automatically deleted. We never ask for or accept documents or proof of anything.

Contact

Questions or requests: hello@forkmate.ai.

Changes

We may update this policy; we'll revise the date above when we do.

This is a preliminary policy for an early-stage product and will be expanded with full legal review before we serve regulated markets at scale.