EnergyMatch is a personalised nutrition planning app designed to help parents and guardians fuel their young competitive athletes. The app provides meal timing guidance, food suggestions, and nutrition targets based on each child's age, weight, sport, and training schedule.
EnergyMatch is operated by Mackay Advisory, a business registered in Australia (ABN: 68 453 218 868). When we say "we", "us", or "EnergyMatch" in this policy, we mean that company.
We take our responsibilities as custodians of your family's health data seriously. This privacy policy explains clearly and honestly what data we collect, why we collect it, who we share it with, and how you can control it.
EnergyMatch is available to users in Australia, Canada, the United Kingdom, and the United States. Each jurisdiction has specific privacy rights, and we've addressed each one in this policy.
When you create an account, we collect:
EnergyMatch accounts are created by parents or guardians. When you add a child athlete to your account, we collect:
This is sensitive information about a child. See Section 5 (Children's Privacy) for how we handle and protect this data.
For each training day, we collect:
When you log meals for your child, we collect:
After sessions, you can log how your child felt:
If you use the barcode scanner to look up a packaged food, the barcode number is sent to Open Food Facts (a French non-profit food database). The product information returned is cached in our database to improve future lookup performance. No personal information about you or your child is sent with this request.
To scan barcodes, the app requests access to your device's camera. The camera is used solely to read barcode numbers — no images or video are captured, recorded, or stored. Camera access is only requested when you initiate a barcode scan and is not used for any other purpose.
We use Umami Analytics, a privacy-focused, cookieless analytics tool, to understand how the app is used. Umami collects:
Umami does not set cookies and does not track you across other websites. For users in the UK or EU, this tracking requires your consent — see Section 9 (Cookies & Analytics).
Our hosting provider, Vercel, may collect standard server access logs including your IP address for security, debugging, and performance purposes. This is not data we actively collect or process beyond infrastructure operation.
We only collect data for specific, legitimate purposes. Here is how each data type is justified under applicable law:
| Data Type | Purpose | AU Lawful Basis (Privacy Act) | UK/EU Lawful Basis (GDPR Art. 6) |
|---|---|---|---|
| Email & password | Account authentication | Necessary for service | Art. 6(1)(b) — Performance of contract |
| Child profile (name, age, sex, weight) | Personalised nutrition calculations | Necessary for service / consent | Art. 6(1)(b) — Performance of contract; Art. 9 (special category health data) — Art. 9(2)(a) explicit consent |
| Dietary requirements & allergies | Personalise food suggestions, safety | Consent | Art. 9(2)(a) — Explicit consent (health/allergy data) |
| Training sessions | Calculate fuel plan timing and amounts | Necessary for service | Art. 6(1)(b) — Performance of contract |
| Meal logs | Track nutrition, improve recommendations | Necessary for service / consent | Art. 6(1)(b) — Performance of contract |
| Training feedback | Personalise future recommendations | Consent | Art. 6(1)(a) — Consent |
| Usage analytics (Umami) | Understand how the app is used, identify bugs | Legitimate interests (opt-out available) | Art. 6(1)(a) — Consent (opt-in required for UK/EU) |
We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 6 of this policy.
This section is especially important. EnergyMatch collects detailed health data about children. We take that responsibility seriously.
Only parents and guardians aged 18 and over may create an EnergyMatch account. Child athletes do not create their own accounts and are not direct users of the service. Children's data is entered and managed entirely by the parent or guardian account holder.
As described in Section 2.2, we collect each child athlete's nickname, age, biological sex (optional), weight, and dietary requirements. We also store their training schedule, meal logs, and training feedback — all entered by the parent.
Consent for health and dietary data processing is obtained explicitly at account creation, before any child data is entered. During sign-up, the parent or guardian must tick two mandatory checkboxes — the account cannot be created without both:
Both consent signals, along with a policy version number, are recorded in the user's account at the time of sign-up. Child health data (age, biological sex, weight, dietary requirements, and allergies) is entered on a separate screen after this consent has been recorded.
For users in the UK, this approach aligns with GDPR Article 8 (processing children's data) and satisfies the Article 9(2)(a) explicit consent requirement for special category data. The parent account holder provides consent on behalf of the child. We do not permit children to create their own accounts or provide consent independently.
EnergyMatch is aware of the UK's Age Appropriate Design Code (also known as the Children's Code). As an app used by families with children, we commit to:
We recommend using a nickname rather than your child's full legal name. The app does not require a legal name and works equally well with any identifier you choose.
For users in the United States, the Children's Online Privacy Protection Act (COPPA) applies where an online service collects personal information from or about children under 13. EnergyMatch is designed exclusively for use by parents and guardians — children do not create accounts or interact with the service directly. However, because the app collects health and athletic data about children (including those under 13), we address COPPA as follows:
If you believe a child has provided information to EnergyMatch without appropriate parental authority, please contact us immediately at hello@energymatch.app and we will delete that information promptly.
We use a small number of carefully selected third-party services. Each is listed below with their role and privacy information.
| Service | What They Do | Data They Receive | Privacy Policy |
|---|---|---|---|
| Supabase | Database and authentication (Data Processor). Stores your account data, child profiles, and meal logs on our behalf. | Email, hashed password, child profiles, meal logs, training data | supabase.com/privacy |
| Open Food Facts | Public food database used for barcode scanning lookups | Barcode number only — no personal data | openfoodfacts.org/privacy |
| Umami Analytics | Cookieless, privacy-focused usage analytics | Page views, browser/device type, approximate country | umami.is/privacy |
| Vercel | Web hosting and content delivery (Data Processor) | IP address (server logs only, not stored by us) | vercel.com/legal/privacy-policy |
We do not use advertising networks, data brokers, or marketing platforms. We do not sell data to any third party.
EnergyMatch is operated from Australia. Your data may be stored and processed in other countries, primarily the United States, where our infrastructure providers are based.
Under the Australian Privacy Act (APP 8), we take reasonable steps to ensure that overseas recipients of personal information handle it with protections equivalent to Australian law. Supabase and Vercel both operate under enterprise-grade security and comply with international data protection standards.
Transfers of your personal data outside the UK/EEA are governed by appropriate safeguards. Specifically:
Under PIPEDA, transfers of personal information to service providers in other countries are permitted where we have contractual protections in place. Our service providers (Supabase, Vercel) operate under their own privacy programmes and we rely on their contractual commitments to protect your data.
Your data is stored in two places:
You can delete your account and all associated data at any time directly in the app via Account Settings → Delete Account. You may also request deletion by emailing hello@energymatch.app. In both cases, your data will be removed from our database within 30 days.
Your rights depend on where you are located. Find your jurisdiction below.
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you have the right to:
Under the UK GDPR (and EU GDPR where applicable), you have the right to:
Under PIPEDA (and Quebec's Law 25 / Bill 64 where applicable), you have the right to:
Quebec residents have additional rights under Law 25, including the right to data portability and to request anonymisation rather than deletion.
There is no single federal privacy law equivalent to GDPR in the United States. However, under COPPA (where applicable) and applicable state laws, parents have the right to:
To exercise any of these rights, contact us at hello@energymatch.app. We will respond within 30 days (or within the timeframes required by your local law, if shorter).
EnergyMatch does not set cookies via the application code. Our authentication provider, Supabase, may use browser local storage for session tokens, but does not set traditional HTTP cookies.
We use localStorage (not cookies) to store app data on your device. All items in the table below are classified as Essential / Strictly Necessary under UK PECR Regulation 6(4) and the equivalent EU ePrivacy rules: they are stored solely on your own device, contain no tracking data, are never shared with third parties, and are technically required to provide the service you have explicitly requested. No consent is required for strictly necessary storage.
| Storage Key | Purpose | Category | Expiry |
|---|---|---|---|
sb-* |
Supabase authentication session token | Essential | Until sign-out |
energymatch-children |
Child athlete profiles | Essential | Until manually deleted |
energymatch-daily-logs-* |
Meal logs per child per date | Essential | Until manually deleted |
energymatch-sessions-* |
Training session data per child | Essential | Until manually deleted |
energymatch-training-feedback-* |
Training feedback per child | Essential | Until manually deleted |
energymatch-meal-history-* |
Stores meal names previously entered by the user to power in-app autocomplete — purely a local cache of data the user has already provided; never transmitted | Essential | Until manually deleted |
energymatch-last-screen |
Restores the user's last active screen within a 4-hour session window; without this, users must navigate from the start on every visit | Essential | 4 hours |
energymatch-active-child-id |
Records which child profile is currently selected; required for the app to display the correct child's nutrition data — the service cannot function without knowing which child is active | Essential | Until manually deleted |
em_cookie_consent |
Records your analytics consent choice | Essential | 12 months |
We use Umami Analytics, which is cookieless. It does not set any cookies and does not track you across other websites.
You can change your analytics preference at any time using the cookie settings link in the app, or by contacting us at hello@energymatch.app.
We take reasonable steps to protect your data from unauthorised access, disclosure, or loss:
While we take security seriously, no online service is 100% secure. If you believe your account has been compromised, please contact us immediately at hello@energymatch.app.
We may update this privacy policy from time to time. When we make material changes, we will:
Your continued use of EnergyMatch after changes are published constitutes acceptance of the updated policy. If you do not agree to the changes, you may delete your account at any time via Account Settings → Delete Account in the app.
Privacy enquiries and data requests:
Email: hello@energymatch.app
Mackay Advisory
c/- PG Hely Chambers, Level 9, 75 Elizabeth St
Sydney NSW 2000
Australia
We aim to respond to all privacy requests within 30 days. For urgent matters (such as a suspected data breach), please mark your email "URGENT — Privacy".
Under UK GDPR Article 37 and EU GDPR Article 37, appointment of a Data Protection Officer is mandatory where an organisation processes special category data (including children's health and dietary data) at large scale. We have assessed our processing activities and determined that a DPO is not required at this stage: EnergyMatch is an early-stage product with a small user base, and the volume of special category data processed does not meet the large-scale threshold as interpreted by the ICO and the European Data Protection Board. We keep this determination under review and will appoint a DPO if our processing activities change in scale or nature.
All privacy and data protection enquiries for UK/EU users should be directed to: hello@energymatch.app.
If you are unsatisfied with our response to a privacy complaint, you may contact the relevant supervisory authority for your jurisdiction:
EnergyMatch Privacy Policy · Version 1.1 · Last updated 8 April 2026 · Terms of Service