Metrisi

Privacy policy

What the Metrisi app and its servers store and send, and to whom. Written to be checkable against the code.

Last updated 22 October 2026. This describes what this version of Metrisi and its servers actually do, not what they might do one day. It is written to be checkable against the code.

Who we are

Metrisi is made by Metrisi Corporation, a Delaware corporation. In this policy “Metrisi”, “we” and “us” mean Metrisi Corporation, which is responsible for the personal information described here.

For anything about your privacy — a question, a complaint, or a request to see, correct, export or delete what we hold about you — write to support@metrisi.app.

The short version

Your log lives on this phone. Using the app requires an account, so we hold the email address you sign in with, the profile you make, and whatever you choose to publish. Nothing you log, take or measure reaches us in a form we can read unless you deliberately publish it.

Three exceptions, stated up front because they are the ones people are surprised by:

There are no ads and no tracking. We do not sell or rent your information, and we do not share it with anyone for their own purposes.

What is stored on this phone

One file, in the app's private storage, rewritten whenever you change anything. It holds everything: what you logged and when, doses, injection sites, your notes, daily check-ins, the sleep, heart rate variability and resting heart rate read from Apple Health, lab results (the ones you keep from Health Records or a lab PDF, and panels you enter by hand), photos of bottles you scanned and the pictures of products in your cabinet, your profile photo, what you entered under About you, your schedules, stacks and inventory counts, the challenges and communities you joined, your interests, your recent searches, and the list of substances you chose to hide from everything you publish (Settings → Publishing → Private substances).

It is encrypted by the app — AES-GCM, with a key held in this phone's Keychain that never leaves the device. If the Keychain ever cannot give the app that key, the file is saved unencrypted rather than lost, and it is sealed again the next time the app opens or saves it with the key available. Two other copies of a log can sit beside it: when you restore a backup over a log this phone already had, the app keeps that log, sealed the same way, in case the restore was a mistake; and a log file the app cannot read is moved aside, untouched, rather than overwritten. Both stay until you use Delete everything (Settings → Your data) or delete the app.

A few small settings are kept beside the file in the app's ordinary preferences, which the app does not encrypt: whether backup is on, when it last ran and a fingerprint of the last log it sent (so an unchanged log is not sent twice), your account's id and handle, which posts and entries you reported and whose they were (so that they stay out of your feeds), which communities you have caught up on and when, when you were last told about new posts there, which tips you have seen, which sections of your cabinet you folded, your choice of units, and that the app has been opened on this phone before. None of them holds anything you logged.

Answers from our servers, and the label pictures the app fetches, can also be kept for a while in the app's network cache, which iOS manages and empties as it needs the space: feeds, profiles, search results, the catalog's answers about products you scanned or opened, and your own account's details, for instance. Delete everything empties it too.

Your sign-in session is held separately, in the iOS Keychain, marked device-only so it never rides a backup to another phone. It is not in your log backup.

One key is held differently on purpose: your backup key, kept in iCloud Keychain so it can reach your other iPhones. Apple end-to-end encrypts iCloud Keychain. It opens your log backup and nothing else.

Your phone's own iCloud or computer backup also contains the log file and any copies beside it, sealed with this phone's device-only key (unless one had to be saved unencrypted, as above) — so on its own, restoring that to a new phone does not bring your log back. Log backup is what does.

What leaves this phone, and exactly when

No tracking, ever. There is no telemetry, no analytics SDK, no crash reporter and no advertising identifier. The app contains no third-party code: every line of it is Apple's frameworks or our own. Two things run on their own, both described below: your encrypted log backup, and the check for new posts in your communities.

We run three servers, all hosted by Railway on machines in the United States: our account server (accounts, publishing, posts and communities), our catalog server (the product catalog) and our web server (the website, app.metrisi.app, which also answers at site-production-73fe.up.railway.app). This version of the app reaches the account server at accounts-production-2d15.up.railway.app and the catalog server at catalog-production-0fd4.up.railway.app, their addresses at Railway; the same two servers are also registered under our own names, app-api.metrisi.app and app-catalog.metrisi.app. The app sends something only for these reasons:

Signing in — the only way in is an eight-digit code we email you. Your address goes to our account server, and to Resend, the service that delivers the email. We keep a scrambled form of the code (a one-way hash), which works once and expires after ten minutes. When you first sign in we store your address, when the account was made, and when you confirmed you are 18 or older. Each sign-in also stores a scrambled form of the session the app is given, which lasts a year. Signing out removes it from this phone and asks our server to end it too (if the phone is offline at that moment, the server's copy lapses at the end of its year); deleting your account removes every session from our server.

Accepting the terms — when you accepted, and which version, is stored with your account, because an agreement nobody recorded is not evidence of one.

Product updates — the sign-up screen asks whether you want email with tips, new features and updates from Metrisi. The box starts unticked, and we send them only if you tick it; you can turn them off again at any time in Settings → Account. Your answer, and when you gave it, is stored with your account. This is separate from sign-in codes, which you get either way.

Your profile — the handle you claim, and the name, bio and private-account setting you choose, are stored with your account. Your profile photo is not: it stays on this phone.

Onboarding — after you make an account, the last screens ask our account server whether the handle you type is free, without your session, and, with your session, who is worth following and who matches a name you search for.

Apple Health — only if you allow it. When you connect Apple Health, and each time you sync it, the app reads up to the last 180 days of three things: sleep (from the sleep stages your watch or ring records), heart rate variability and resting heart rate. If your hospital or lab sends records to the Health app, the app can also read your Health Records lab results — only the lab-result category, never conditions, medications, allergies or notes — when you tap Read records, and you choose which results to keep. All of it is read on this iPhone, and the app never writes to Apple Health. What it reads stays on this phone, stored with the rest of your log, and so, when Log backup is on, it is included in your encrypted log backup: sealed on this phone with a key Metrisi never has, so we cannot read it. It is never sent to us, or to anyone else, in a form anyone but you can read, and it is never used for advertising or sold.

Log backup — on unless you turn it off in Settings → Log backup. A copy of your whole log — everything listed under “What is stored on this phone”, photos, check-ins, Apple Health data, lab results and the list of substances you hid included — is compressed, encrypted on this iPhone (AES-GCM, 256-bit key) and sent to our account server a little after you change something and when you leave the app. The key never reaches us, so neither we nor Railway, who hosts it, can open it. What we can see: that your account has a backup, its size, when it was last updated, the kind of device that sent it (“iPhone”), and a 16-character fingerprint of the key — which tells a right recovery key from a wrong one and cannot be used to open anything. Turning backup off stops new backups; the last one stays until you delete it (same screen). Signing in on a new phone offers to restore it, or to start fresh and replace it.

The product catalog — when you scan or type a barcode the app doesn't already know, its digits go to our catalog server, which answers with that product's public label facts from the NIH Dietary Supplement Label Database, plus public FDA enforcement records and third-party certification listings for the brand — or, for a medicine, its listing in FDA's drug directory and its DailyMed label. Searching sends your search text there too, from Discover and from the search you use to log a dose, and opening a product or a medicine from the results sends its id. To match a product in your cabinet to its label and its picture, the app may ask again, with the barcode's digits only. In every case that is the entire message: no photo, no account, no session, nothing from your log. The catalog server is never told who is asking, and our own code keeps no record of who looked up what; but like every request to our servers, each one is written into Railway's request log with the network address it came from, as “Who else is involved” describes. If a barcode has no match, you photograph the label instead, and that photo is read on this iPhone.

Product pictures — the picture of a product in your cabinet is the front of its label, fetched once, by the label's public id, straight from the public source: the NIH Dietary Supplement Label Database (api.ods.od.nih.gov) for a supplement, DailyMed (dailymed.nlm.nih.gov) for a medicine. That request carries the label's id and your phone's network address, as any download does, and no account or search text. The picture is then kept on your phone with the product.

Offering a label to the catalog — when you photograph a label the catalog didn't know, the confirm screen shows a switch, on to start with, that offers it to the shared catalog: the barcode digits, the product name you confirmed and the brand as read, the serving you confirmed, and the label lines the camera read. Turn the switch off before saving and nothing is sent. What is sent is facts about the product: never the photo, no account, no session and nothing from your log. It goes into a review queue, and nothing from it enters the shared catalog until a person at Metrisi accepts it. To limit how many submissions can arrive, the catalog server counts them per hour under a scrambled form of the network address each one comes from, made with a secret key; the address itself is never stored, and past hours' counts are deleted.

Search and substance pages — the text you type in Discover's search, and the id of any substance page you open, go to our account server so it can find people and tell you how many people list that substance. The search you use to log a dose is not sent to this server, and the search for something to hide (Settings → Publishing → Private substances) is sent nowhere: it reads the lists built into the app. Because the app requires an account, these requests carry your session, so they are attributable to you. We do not store them, beyond the request logs described under “Who else is involved”.

Publishing, posts and communities — what you publish, post, reply and like, who you follow and which communities you join are sent to our account server and stored there; “What is published, and to whom”, below, says exactly what and who sees it. Reading a feed, a profile or a community asks our account server for it, with your session, and sends nothing from your log.

Community activity — a few times a day, when iOS allows, the app asks our account server how many new posts there are in the communities you joined, so it can show a notification. The request carries your session and a time; the answer is counts only, never post text. Turning that notification off in Settings → Notifications stops this background check. Separately, each time you open or return to the app it asks for the same counts, with your session, to draw the unread dots on Groups, and that happens whether or not the notification is on.

Reports and blocks — what they send is under “Reports, blocking and moderation”, below.

Reminders — dose reminders are scheduled by iOS on this phone. Nothing about them is sent anywhere.

Links you open — a source the app cites (an NIH, FDA, CDC or PubMed page, for instance) opens in your browser, and that site sees your visit as it would any other.

Location — the app does not ask for your location and does not use it.

What is published, and to whom

Only what you deliberately put out, only after you claim a handle, and only ever about three kinds of thing: supplements, over-the-counter medicines and caffeine. Nothing about a prescription, a hormone, a peptide, alcohol or nicotine, or anything you typed in yourself, is ever published, whatever any switch says: it stays in your private log, and so does a stack or protocol with one of them in it.

Your page — app.metrisi.app/p/yourhandle on the web, and the same page in the app. Its header shows your name, handle and bio, how many people follow you and you follow, when you joined, your streak, how many days you logged and when you first published. Once you put the page up (You → More → Public page) and press Publish, it also shows:

Posts on the Feed tab — what you write, its kind (note, result, null result or question), the substances you tagged (only supplements, over-the-counter medicines and caffeine can be tagged), a disclosure line if you wrote one, and, if you switched on “Back it with your log”, three numbers worked out on this iPhone: when the window started, when it ended, and how many doses of the tagged substances you logged in it. Nothing else from your log goes with a post, and a post never carries a dose. A reply is stored as your handle, the words and the time; a like as your account and the post.

Community posts — joining one of the built-in communities under Groups stores that you are a member, and when you joined. What you post there is stored with your handle and shown to its members, and anyone signed in can join. A community's members can see who else is in it, apart from private accounts, which are counted but not named, and our server tells signed-in people who can see your profile which communities you are in.

Follows — who you follow, and who follows you, is stored, and shown as counts on your page.

Who sees it. If your account is public, anyone can read your page, on the web without an account too. Your posts, replies and published entries are shown to people signed in to Metrisi: on your profile, in feeds, and, for supplements and over-the-counter medicines, beside your name on that substance's page and in its count in search. If your account is private (Settings → Account), only the followers you approve see any of it. Everyone else, on the web or in the app, gets your name, handle and bio, how many people follow you and how many you follow, when you joined, your streak, how many days you logged and, if you have ever published, the date you first did — and nothing more. In the app, someone you block, or who blocks you, sees none of it; a web page cannot tell who is reading it.

Never published, and never reaching us in a form we can read — only inside your encrypted log backup: your birth date, sex, height, weight, body fat, waist, blood pressure, blood type, conditions and allergies, your daily check-ins, your Apple Health data, your lab results, your doses apart from the one a start entry carries, your search history, your interests, the list of substances you hid, your profile photo and your bottle photos.

Private substances. Anything you hide under Settings → Publishing → Private substances is left out of everything the app puts together to publish — its shelf row, its start and stop entries, its dates in your logged days and streak, and any stack or protocol that contains it — and cannot be tagged in a new post. Hiding reaches your page the next time you publish, and it does not change a post you already made. The list is part of your log: it stays on this phone and inside your encrypted backup, and is never sent to us in a form we can read, so our server cannot enforce it — another phone signed in to your account without the list could still publish the substance.

Identity and published content are kept in two separate databases, and encrypted log backups in a third. The one with your email address in it holds nothing from anyone's log, apart from the copies of reported content kept with reports (see the next section): the copy of a reported post keeps its words and the substances it tagged, and the copy of a reported entry keeps what it was published with — the substance's name, the dose or the reason for stopping, and the note.

Reports, blocking and moderation

Reporting a post, a reply, a community post, a published entry or a person sends our account server their handle, the reason you picked, anything you typed in the box, and which post or entry it is about. A copy of the reported content is stored with the report, so the report still makes sense if the content is edited or deleted; if the content mentioned a substance, the copy does too. It is the reported person's already-published words, never anything from your log. The person is not told who reported them. A post, reply, community post or published entry you report is taken out of what you see on this phone straight away.

Every report is reviewed by a person at Metrisi within 24 hours. So that none waits, each new report also sends an email alert to our moderators, delivered by Resend: what kind of thing was reported and why, the reported account's handle, the report's id and when it was filed, and up to 200 characters of the reported content — never who reported it, or what they wrote in the box. A reviewer can dismiss a report, remove the reported content, take down everything an account published, or suspend the account. Each decision on a report, and each suspension and each lifting of one, is recorded with who made it and when; a suspension also keeps the reviewer's note on why, which only our moderators see. A suspended account can still sign in, read, report, block, keep its encrypted backup, take its own things down and delete itself, but cannot post, publish, follow or otherwise add anything other people would see, and everything it published is hidden from everyone else until the suspension is lifted (likes it gave before are still counted in a post's total).

Blocking someone sends our account server their handle. You stop seeing each other's posts, replies, community posts and pages in the app, any follow between you is removed both ways, and neither of you can follow the other. They are not told. Settings → Blocked lists who you blocked, and you can unblock them there.

Software checks every post, reply and community post at the moment it is sent, and refuses one that uses language we do not allow, carries a link, reads as buying, selling or sourcing, or names certain restricted substances. That check is a list of words and patterns run by our server; no person reads your post for it.

Who else is involved

Railway hosts our three servers, described above, on machines in the United States, and stores your account, everything published and your encrypted log backup there (which they cannot open either). Like any host, Railway sees the network address and headers of every request. It also keeps its own log of every request to our servers: when it came, the network address it came from, the address it asked for (which can show a barcode's digits, a substance's id, a handle or a post's id, and may show what was searched for), the result, how long it took, its size, and the user agent it carried, which for the app gives its build number and the version of iOS.

Our servers also write a log of their own, which Railway stores too. For each request it records the path asked for — which can contain a barcode's digits, a substance's id, a handle or a post's id, but never search text, which is not part of the path — with its result and how long it took. Apart from that it records a short scrambled tag of the address a sign-in code was sent to, the first characters of an account's id when that account is suspended or the suspension is lifted, and what went wrong when something fails. Railway keeps both logs for a limited time that it sets; on our plan we can read them for 30 days. We use them only to run the service and keep it secure. Our own code stores no network address, apart from the catalog's scrambled hourly count above.

If you use Metrisi from outside the United States, your information is transferred to and stored in the United States.

Resend delivers our email: sign-in codes, product updates if you asked for them, and our moderators' report alerts. For each email they receive the address it is going to and the whole message, because they are the ones delivering it, and they keep a copy of what they deliver in their own log for a time. Nothing else about you reaches them.

Railway and Resend handle this information on our behalf, under agreements that bind them to use it only to provide their service to us and to protect it.

NIH and the US National Library of Medicine receive a label's id and your phone's network address when the app fetches a product's picture from the Dietary Supplement Label Database or DailyMed, as described above. They are told nothing else.

Apple — Apple Health and Health Records are read on the device. Your backup key is kept in iCloud Keychain, which Apple end-to-end encrypts, and your phone's own iCloud Backup contains the log file, sealed as described above. App Store distribution has its own analytics, which Apple controls.

The law. We disclose information about an account only when the law requires it, and only what it requires.

Nobody else. No analytics company, no advertiser, no data broker. We do not sell anything about you and there is no mechanism in the app by which we could.

The website

app.metrisi.app has no analytics, sets no cookies, runs no scripts and has no forms. A public page there is drawn by our web server from what our account server shows to anyone, asked without any session.

Your choices

Marketing email is opt-in. The box on the sign-up screen starts unticked, and Settings → Account turns product updates on or off at any time. Sign-in codes are not marketing and arrive either way.

Log backup can be turned off, and the backup deleted, in Settings → Log backup.

Apple Health access is yours to give or take back at any time in iOS Settings → Health → Data Access & Devices → Metrisi. The app works without it.

Notifications — dose reminders and community activity — are switched on and off in Settings → Notifications, and in iOS Settings.

What you publish is up to you: nothing goes out until you put a page up and press Publish. You can make your account private (Settings → Account), hide a substance from everything you publish (Settings → Publishing → Private substances), hide your page, or take everything down (You → More → Public page).

Your information. Export everything (Settings → Your data) gives you your whole log as one file, at any time. The file is not encrypted: where it goes, and who can read it there, is up to you. The app writes it to its own temporary storage to hand it to you, and deletes it from there when the share sheet closes. You can ask us for a copy of what we hold about you, or to correct or delete it, at support@metrisi.app; depending on where you live, you may have further rights under your local law, which you can use the same way.

Deleting your account is in the app: Settings → Delete account. “Deleting”, next, says exactly what goes.

Deleting

Delete account (at the bottom of Settings, and in Settings → Account) deletes from our servers your account and email address, your handle, name and bio, your published page, shelf and timeline, your posts with the likes and replies on them, your likes and replies on other people's posts, your community posts and memberships, who you follow and who follows you, the record of who you blocked and who blocked you, and your encrypted log backup. Because the app needs an account, it also signs you out and returns you to the start. What you logged stays on this phone, untouched: to delete it too, use Delete everything (below) first, or delete the app.

Take everything down (You → More → Public page) deletes your published page, shelf, timeline and followers, your posts with the likes and replies on them, your likes and replies on other people's posts, and your community posts. Your account, your memberships and who you follow stay.

Delete what is already out (Settings → Publishing) removes what you already published, and asks first: the posts of yours that tag something you have hidden, the posts that tag something in one category, or, with Delete all, every post you made and your public shelf, timeline, logged days and streak. Your page stays up or hidden, as it was.

Delete everything (Settings → Your data) wipes this phone's log — everything listed under “What is stored on this phone”, including what you entered under About you — together with the other copies of a log the app keeps beside it (one set aside before a restore, or because it could not be read), the app's network cache and the notifications it has already shown, and deletes its backup from our server; if Log backup is on, the now-empty log is then backed up in its place. All the app keeps is that you finished setting it up, which account its backup belongs to, and the small settings kept beside the log. It does not reach your phone's own iCloud or computer backup, an export you saved or sent somewhere, or anything you published.

Delete backup (Settings → Log backup) deletes the backup from our server and leaves this phone's log alone.

Everything else we hold about your account is kept until you delete it. What outlasts a deletion, and why:

Children

Metrisi is for adults only. You must be 18 or older to make an account, and the sign-up screen asks you to confirm it; we record when you did. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has an account, tell us at support@metrisi.app and we will delete it.

Changes

If what the app or its servers send, store or share changes, this policy changes with it in the same release, with a new date at the top. The copy at app.metrisi.app/privacy is generated from this text — the app is the original and the web page is a mirror. If the two ever differ, the page in the app describes the version you are using.