Nutrition by Pack4Back

Privacy Policy

Last updated 17 September 2026. This policy applies to the Nutrition service at https://nutrition.pack4back.com (“Nutrition”), operated as a Pack4Back product. The main Pack4Back site at https://pack4back.com has its own policy.

Who we are

Nutrition is provided by Pack4Back. Contact: privacy@pack4back.com.

Data we process

  • Account: email, password hash (if you set a password), Google or Facebook account id when you use those buttons, display name, timestamps for terms acceptance.
  • Garmin connection: encrypted Garmin session material. Garmin email/password are used only during connect and are not stored.
  • Sharing: invites, grants, aliases, roles, and access requests you create or accept.
  • MCP activity: tool name, actor, destination, success or error type, and a timestamp. We write this for every MCP call so we can operate the service and investigate failures. Meal prompt text and image refs from the model are stored only if you opt in under Settings.
  • Anonymous totals: summed calories, macros, and meal counts written through MCP. Not tied to an account. Individual meals are never shown.
  • Nutrition payloads you ask us to send to Garmin (meals, water, body mass, goals). Garmin is the system of record for the diary.
  • Optional improvement data: only if you opt in under Settings. This may include the original user query text and meal photo refs the model forwards. It does not include Garmin passwords.
  • Cookies: an HTTP-only session cookie (gn_session) to keep you signed in on this host, and a short-lived gn_oauth_nonce cookie during Google or Facebook sign-in.

Why we process it

To provide the service you request (account, Garmin logging, family grants, MCP), to keep the service secure, to measure reliability, to comply with law, and — only with optional consent — to store prompt text so we can improve Nutrition.

Legal bases

Contract (providing the service), legitimate interests (security, abuse prevention, and operational call/error counts), and consent (optional storage of MCP prompt text and photos; marketing if we ever send it — we do not today).

Who we share with

  • Garmin: diary writes and reads you initiate. Garmin’s terms and privacy policy apply to that account.
  • Google and Facebook: if you continue with those buttons, we receive your account id, email, and name from that provider so we can create or sign in to your Nutrition account. Their own policies apply to that login.
  • AI clients you connect: ChatGPT, Claude, or other MCP clients you authorize. Those companies process prompts under their own policies. We do not send your Garmin password to them.
  • We do not sell personal data.

Retention

Account and grant data last until you delete the account or we close the service. Encrypted Garmin sessions last until you disconnect Garmin. Audit rows are kept only as long as needed for security and support. You can delete your account in Settings; we then remove account records we control and drop stored refresh tokens.

Your choices

  • Access and correct account email via support if you cannot sign in.
  • Revoke family/coach grants and leave destinations you were invited to.
  • Disconnect Garmin without deleting the Nutrition account.
  • Toggle “Store prompts to improve Nutrition” at any time. Turning it off stops new prompt storage; operational logs and counters continue.
  • Delete the account. This disconnects Garmin destinations you own, revokes grants, and signs out all sessions.

Children

Nutrition is not directed at children under 16. Do not create an account for a child without a parent or guardian managing the Garmin destination and consents.

International transfers

Data may be processed in the EU and other regions where our processors operate. We use contractual and technical safeguards appropriate to the transfer.

Changes

We will post updates on this page and change the date above. Material changes to optional analytics will require a new opt-in.