Privacy Policy

Slab was built so that this page could be short. There is no account to create and no server of ours for your data to sit on, so most of what a privacy policy usually has to explain simply doesn’t happen here. What follows is the whole of it.

The short version

Slab keeps everything on your phone. There is no Slab account to create, no Slab server for your data to sit on, and no analytics of any kind. If you’re signed into iCloud it also syncs through your own private iCloud container, which only your devices can open. Exactly one feature in the app talks to the internet, and it sends nothing about you.

What Slab stores

Everything below lives on your device, and in your own iCloud if you have it switched on:

• Your log — each entry’s food, amount, the protein it contributed, and the day it belongs to.
• Foods you create or save from a barcode scan, and which foods you’ve pinned as regulars.
• Your daily protein target, and the history of targets you’ve set.
• The answers behind that target: your body weight, the unit you prefer to see it in, what you’re training for, how many days a week you train, and whether you told us you’re taking a GLP-1.
• Your preferences — the hour your day rolls over, and whether you’ve finished onboarding.

That’s the complete list. Slab never asks for your name, your email address, your phone number or a password, because it has nothing to attach them to.

Where your data lives

In a database inside the app on your device. If you’re signed into iCloud, it also syncs through a private CloudKit container tied to your own Apple Account, which is how it reaches your other devices and comes back after you reinstall. That container belongs to you, not to us — Apple’s encryption and your Apple Account are what protect it, and we have no way to read it. Turning iCloud off for Slab keeps everything local to that one phone.

Your weight and your GLP-1 answer

Two of the questions Slab asks are health-related: what you weigh, and whether you’re taking a GLP-1. Both exist for one reason — they change the protein target the app calculates — and both are treated like everything else here. They stay on your device and in your own iCloud. They are never sold, never shared, never used for advertising, and never sent to us, to an insurer, to an employer, or to anyone else. Slab does not read from or write to Apple Health.

Barcode scanning — the one networked feature

Scanning is the only thing in Slab that leaves your phone. When you scan a product, the app sends the barcode digits to Open Food Facts to look the product up. The request carries the digits and a fixed line identifying the app (“Slab/1.0 (iOS; protein tracker)”) — no account, no device identifier, nothing about you or what else you’ve logged. The camera work happens entirely on your device using Apple’s built-in scanner: no photo or video frame is ever uploaded, and none is saved.

Analytics

There are none. Slab contains no analytics SDK, records no usage events, and generates no identifier for your device or install. Nobody, including us, can see how you use the app.

Advertising

Slab shows no ads and contains no advertising SDKs. There is no advertising identifier in the app, and there is no profile of you anywhere to target.

Purchases

Subscriptions are handled entirely by Apple through StoreKit. Apple tells the app whether your subscription is currently active, and that’s all we learn. We never see or process your payment details, and there is no third-party purchase, paywall or attribution SDK in the app.

Crash reports

Slab includes no crash-reporting SDK. If you’ve opted in to sharing diagnostics with Apple at the system level, Apple may pass us anonymised crash reports through App Store Connect. Those come from Apple, contain no food entries and nothing personal, and you can switch them off under Privacy & Security in your device settings.

Third-party services

Two, and only two:

• Apple — iCloud (CloudKit) for your private sync, and StoreKit for subscriptions.
• Open Food Facts — queried at the moment you scan a barcode, with the digits only.

There is no other service in the app. No backend of ours, no hosting provider holding your data, no data broker.

Your controls

Because it’s all on your device, you control all of it:

• Delete any single entry from the stack, or any food you’ve saved.
• Settings → Delete all my data erases every entry, food, target and setting from the device and from your iCloud container.
• Turn iCloud off for Slab to keep everything on one phone.
• Delete the app to remove the on-device copy.

Because we hold nothing, there is nothing for us to delete on our side, and no request you need to send us to have it done. Slab has no export feature yet; if you want your log out of the app, email us and we’ll help.

Children

Slab isn’t directed at children and collects no personal information from anyone, children included.

Changes to this policy

We may update this policy from time to time. When we do, we’ll revise the effective date at the top of this page. If a change ever meant Slab started collecting something it doesn’t collect today, we’d say so plainly rather than quietly widening a sentence.

Contact

Questions about privacy? Email admin@onestepforwardventures.com.