Privacy Policy

Last updated: October 14, 2026

Xtra Plot helps you track food, workouts, and body metrics. This policy explains what the Xtra Plot app and xtraplot.com collect, how it is used, who can see it, and the choices you have. We wrote it in plain language on purpose.

1. Who we are

Xtra Plot is made by Marks Enterprises, LLC, a Virginia limited liability company ("Xtra Plot," "we," or "us"). This policy covers the Xtra Plot mobile app and the website at xtraplot.com. Questions about it can go to info@xtraplot.com.

2. Information we collect

Information you give us

• Account. Your email address and a password. If you register on xtraplot.com, you also give your first name (required) and, if you like, your last name; we use your first name to greet you in our emails. Your password is stored in scrambled (hashed) form by our sign-in provider; we cannot read it.
• Profile and goals. A username (plus an automatic four-digit tag, like name#1234) and any of these you choose to enter: target weight, height, age, sex, activity level, goal, and your calorie, macro, and daily-step targets. Your light/dark and color-scheme choices are saved too.
• What you log. Meals and foods with their nutrition, groceries and what you have at home, body weight and other body metrics, workouts (exercises, weights, reps, sets), training programs, supplements and their schedule, and the saved charts and timelines you create. The app also records the streaks and badges you earn.
• Nutrition label photos. If you scan a nutrition label, the picture you take is uploaded to a private folder tied to your account, and our server sends it to an AI service that reads the numbers off it (see Who else handles your information). You check and fix the numbers, and you choose whether to send the food in for our team to check. If you cancel, retake the picture, or choose not to send the food in, the app deletes the picture. If you do send it in, we keep the picture while our team checks it, and we delete it if the team cannot use it. If the team adds the food to the shared food list, we keep the picture as the record of what was checked, until the food is removed or you delete your account. A picture that never gets sent in (for example, because the app closed first) is cleared out by a regular clean-up, and every picture we are throwing away is deleted within 30 days, usually much sooner. We also keep a short note of each scan (when it happened, the numbers it read, and any error, never the picture) for 30 days, to apply the daily limit and fix problems.
• Social features. Friend requests and friendships, people you block, coaching links and what you share with a coach, programs you send or receive, competitions you host or join, and any reports you file about another user.
• Messages to us. If you email us, use the contact form on xtraplot.com, the support form on our Help page, the bug report or feature request form, or send a feature idea from the app, we receive your message and the details you provide, such as your email address, name, topic and, on the bug report form, your phone model and iOS version if you add them. We use your email address only to reply.
• Contributions on the website. If you support Xtra Plot through the payment page on xtraplot.com, our payment processor (Stripe) collects your payment details. We receive your name, email address, and the amount, so we can thank you and add a Donor badge. Contributing does not decide whether you get into the beta.
• Beta sign-up. If you join the beta (on xtraplot.com or in the app), we save that you signed up, with the email address on your account, a personal access code made for you, and the time. On the website we also save which phone you said you use (iPhone, Android or something else) and, if the link you came from had a short tag (for example "ig" in xtraplot.com/beta?s=ig), that tag. We use them only to plan who to invite first and to see which posts bring people in. Your browser keeps the tag for up to 30 days, on your device only, until you sign up. We send your email address, your name if you gave one, your phone choice, the tag and that code to GoHighLevel, our email tool, so it can email you the code and a link to install the app when it's your turn. The code is never shown on a screen. It only reaches you by email, and you type it into the app.

Information from using the app

• Plan status. Whether your account is on the free plan, a trial, or Plot Premium, and when a trial ends.
• Where you are with us. We keep a simple label for each account, so we can see how Xtra Plot is growing and send you the right messages. The label is one of: signed up for the beta, in the beta, using the live app, on Premium, or inactive (nothing logged for 14 days). We work it out from our own database, from whether you have an account, a beta access code or a Premium plan, and whether you logged anything recently. It never includes what you logged: no foods, weights, workouts, or numbers. We also keep a second label for each account: whether you use an iPhone or an Android phone, so we can tell each group when an update is ready for their phone. We work it out from the kind of phone your sign-ins come from (the app, or your browser on the website) and, if you gave one, the phone you picked on the website. We keep only that one word, not the technical details of your phone. Both labels and your email address are sent to GoHighLevel, our email tool.
• Website sign-in. If you register or log in on xtraplot.com, it is the same account as in the app. Your browser keeps a sign-in token in its local storage so you stay logged in, and removes it when you log out. We do not use cookies or browser storage for analytics or advertising.
• Basic technical logs. Like most online services, our hosting providers keep standard server logs (such as IP address, device type, and request time) for security and troubleshooting. We do not use these to build advertising profiles.

What we do not collect

We do not collect your location, contacts, or advertising identifiers, and the app does not read your photo library. The app does not record audio. When you scan a barcode, the camera is used only on your device: the picture is not saved or uploaded, and only the barcode number is looked up. The one time a picture leaves your phone is when you choose to scan a nutrition label, as described above. Xtra Plot does not currently read from or write to Apple Health or Health Connect. We do not use third-party analytics or advertising trackers in the app or on xtraplot.com.

3. How we use your information

• To run the app: sign you in, save and show your logs, and calculate your totals, charts, streaks, badges, and suggestions.
• To power the sharing features you choose to use: friends, shared programs, coaching, and competitions.
• To read the nutrition labels you scan, check the foods you send in, and keep the shared food list accurate.
• To keep the community safe: review reports, enforce our Terms of Use, and remove accounts or content that break the rules.
• To run the private beta: save your sign-up, email you an access code and an invitation to install the app, and check the code when you type it in.
• To address you by your first name in the emails we send you.
• To follow up with you: use the account label to decide which emails to send you (for example, how to get started, new features, or Plot Premium), and to see how many people are at each stage. Only the developer can open a private page that lists the people at each stage, with the name and email on each account, the day it was made, and the day something was last logged on it (never what was logged).
• To answer your messages, send account or service notices, and (for people who contributed) say thank you.
• To see how the service is doing: we look at totals, such as how many accounts exist and how many entries are logged each day, worked out from our own database. We do not use a third-party analytics or advertising service in the app or on the website.
• To keep the service secure and working, and to fix problems.

We do not sell your personal information, and we do not use it for advertising or share it for cross-context behavioral advertising.

4. What other people can see

Everything you log is private by default. Other people see only what you decide to share.

• Your username. People find you by typing your exact username and tag. There is no public directory or search of users. Your email address is never shown to other users.
• Visibility settings. For each category (lifts and personal records, body weight, other body metrics, nutrition, supplements) you choose None (the default), Friends, or, for lifts and body weight only, Public. Friends see body weight as a percent change rather than the exact number. Changes take effect immediately, and removing a friend ends their access right away.
• Coaches. A coach can see your data only after you accept their invitation, and only the parts you switch on (workout sessions, body metrics, nutrition). You can end coaching at any time.
• Programs. When you send a program to a friend, a copy of it (its name, days, workouts, and exercises) goes to them. They choose whether to accept it.
• Foods you send in. If our team adds a food from a nutrition label you sent in, its details (name, brand, barcode, serving size, and nutrition numbers) go on the shared food list that everyone using Xtra Plot can search, marked with a checkmark. Your name is not shown with it, and the picture is never shown to other people.
• Competitions. Members of a competition see each other's username and progress toward the goal. Weight competitions show percent progress, never exact weights.
• Blocking and reporting. Someone you block cannot find you, send you requests, or see anything you share. A report you file is visible only to you and to us; the person you reported is not shown that you reported them.

5. Who else handles your information

We use a small number of service providers to run Xtra Plot. They may only use your information to provide their service to us, except where noted below.

• Supabase hosts our database, sign-in system, and the server functions the app uses.
• Expo delivers updates to the app, so we can fix a problem without waiting for a new version from the App Store or Google Play. Each time the app opens, it asks Expo whether a newer version of the app's screens and text is ready. That request carries your phone's operating system, which version of the app you have, the ID of our Xtra Plot project, and a random code that Expo uses to tell whether your phone already has the update. We do not link that code to your account, and nothing you log or type goes with it. As with any internet request, Expo can see your IP address. How Expo handles data is set out in its privacy policy.
• Resend delivers the account emails our sign-in system sends, such as your sign-up confirmation and password-reset messages, so it receives your email address and the message (which can include your first name as a greeting).
• USDA FoodData Central and Open Food Facts supply food and barcode data. When you search for a food or scan a barcode, the search text or barcode number is sent through our servers to these services. It is not linked to your account.
• Anthropic runs the AI service (Claude) that reads nutrition label pictures. When you scan a label, our server sends the picture to Anthropic and gets the numbers back. Nothing else goes with it: not your name, your email address, or anything you have logged. How Anthropic handles data is set out in its privacy policy.
• Apple and Google process purchases if you buy Plot Premium through the App Store or Google Play. We do not see or store your card details; we only learn whether your plan is active.
• Stripe processes contributions made on xtraplot.com.
• Netlify hosts xtraplot.com. It receives the messages you send through our contact, support, bug report, and feature request forms, keeps a copy until it is deleted, emails them to us, and passes a copy to GoHighLevel so we get an alert when one arrives.
• GoHighLevel is the email and contact-management tool we use to send thank-you emails, beta access codes and invitations, to reply to messages, to alert us when someone sends a message through a form on xtraplot.com, and to follow up with account holders. It holds the email address of every Xtra Plot account and, if you gave them, your first and last name, along with the account labels described above (for example, “using the live app” or “inactive”, and iPhone or Android). It does not receive anything you log. The alert for a form message includes the message you sent.
• Cloudflare runs the “are you a person?” check (Cloudflare Turnstile) on the log in, sign-up, and password-reset forms on xtraplot.com, to stop automated programs. When one of those forms is shown, your browser contacts Cloudflare, which looks at information such as your IP address and browser details to tell a person from a program, and gives our sign-in system a one-time pass. We do not receive that information. Cloudflare also uses it to improve its bot detection, as its privacy policy explains.

We may also disclose information if the law requires it, to protect people's safety or rights (including responding to reports of abuse), or to enforce our Terms. If Xtra Plot is ever sold or merged, your information may transfer to the new owner, who must honor this policy. Our service providers may process information in the United States and other countries.

6. Health-related information

The nutrition, body, and workout details you log are personal health-related information. We use it to provide Xtra Plot to you and the features you turn on, and in totals that do not identify you (for example, how many people logged a meal today). Xtra Plot is a tracking tool, not a medical device, and does not give medical advice. See our Terms of Use.

7. Keeping and deleting your data

We keep your information while your account exists. You can delete your account and all of your data yourself, at any time: open the menu (the three lines at the top left), tap Settings, scroll to the bottom, tap Delete Account, and type DELETE to confirm. You can also do this on the website: log in at xtraplot.com, open your Account page, and use Delete your account. This permanently removes your meals, weight and body metrics, lifts, workouts and programs, groceries and supplements, targets and profile, username, friends, coaching links, shared programs, badges, saved timelines, competition entries, and your login. It cannot be undone. Step-by-step instructions are on our Delete your account page.

Deleting your account also removes your contact from GoHighLevel, our email tool, shortly afterward.

Deleting your account also deletes every nutrition label picture you uploaded. A food that our team already added to the shared food list stays on the list for everyone; it is no longer linked to you.

You can also email info@xtraplot.com from the address on your account and ask us to delete it. Deleted data may remain in routine backups for a short time before it is overwritten. Support messages and records of contributions are kept as long as needed to help you and for accounting, tax, and legal reasons.

If you pay for Plot Premium through the App Store or Google Play, cancel that in your store account too; deleting your Xtra Plot account does not cancel a store subscription.

8. Security

Data travels over encrypted (HTTPS) connections and is stored with access controls so that each account can read only its own logs unless you have chosen to share something. Passwords are stored hashed. No system is perfectly secure, so please use a strong, unique password and tell us right away if you think your account has been accessed by someone else.

9. Your rights and choices

• See and fix your information. Most of it is visible and editable in the app. You can also ask us for a copy of the information we hold about you, or to correct your name.
• Delete your information. Use Delete Account in the app or on your Account page at xtraplot.com, or email us.
• Control sharing. Change your visibility settings, end coaching, remove friends, or block people whenever you like.
• Emails. Account and safety messages are sent as needed. Other emails, such as tips, news, or offers for Plot Premium, include an unsubscribe link, and you can also tell us at any time to stop and we will. If you contributed and no longer want updates, tell us and we will stop.

Depending on where you live (for example California, Virginia, the European Economic Area, or the United Kingdom), you may have additional legal rights over your personal information, such as access, correction, deletion, and objection. We honor these requests for everyone, wherever you live. We do not sell or "share" personal information as those terms are defined by California law. To make a request, email info@xtraplot.com.

10. Children

Xtra Plot is not directed to children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, email us and we will delete it.

11. Changes to this policy

If we change this policy, we will post the new version here and update the date above. For significant changes, we will also let you know in the app or by email.

12. Contact us

Marks Enterprises, LLC
2807 N Parham Rd, Ste 320 #7862, Henrico, VA 23294, USA
Email: info@xtraplot.com