Privacy policy.
The short version: we collect what the fueling maths needs, we never sell it, nothing you enter about your body or your race is used to advertise to you, and you can delete the whole account yourself from inside the app.
1. Who we are
CarbRate is a race-fueling app and website operated by Jeff Gaudette. In this policy “CarbRate”, “we” and “us” mean that operator, and “you” means the person using the app or the site. You can reach a human at support@carbrate.com.
This policy covers the CarbRate iOS app and the carbrate.com website. It does not cover RunnersConnect, which is a separate service with its own policy, or any third-party site you reach by following a link from ours.
2. What we collect, and why
CarbRate is a calculator with a memory. Almost everything below exists because the fueling engine needs it as an input — not because we wanted a profile of you.
| What | Why we need it |
|---|---|
| Email address and password | To create your account and sign you back in. Passwords are hashed by our authentication provider; we never see or store the plain text. |
| Body data — weight, height, age, sex | Direct inputs to the sweat-rate, carbohydrate and fluid models. Sex and body mass change the heat-balance calculation materially; without them the plan is guesswork. |
| Training and fueling inputs — recent race results, gut tolerance, fat-adaptation level, sweat-test results, sweat sodium concentration | These personalise the plan and let us re-compute your calibration factor when you run another test. |
| Your races, plans, products and course notes | So your plan is there on your phone when you come back to it, and so we can place feeds against a real course. |
| Course progress and saved lessons | To remember where you got to in the Learn tab. |
| Subscription status | To know whether to unlock Pro features. We store an entitlement flag, not your payment details. |
What we do not collect
- No ad network in the app. The iOS app carries no advertising SDK and no advertising identifier, and nothing you enter in it — your weight, your sweat rate, your race, your plan — is ever used to target an advertisement, anywhere. The app does carry two engineering tools, and the website carries two marketing ones; all four are named in the next section rather than buried.
- No location tracking. The app never asks for your device location and has no GPS permission. When it fetches a race-day forecast, it geocodes the place name you typed — nothing about where your phone actually is.
- No card numbers. Payment is handled entirely by Stripe, in Stripe’s own secure fields. Card details never touch our servers and we never see them.
- No contacts, photos, microphone or camera access.
How we measure the app and the site
Four tools, and they do not have the same job. The two in the app exist so we can fix what is broken; the two on the website exist so we can tell which ad or article brought someone who bought. None of them ever receives your body data, your fueling plan, or anything you typed into the interview.
- In the iOS app and the web app: PostHog and Sentry. PostHog records which screens you open and which features you use, so we can see where people get stuck. Sentry records crashes. Both label the record with your CarbRate account identifier — never your email address or your name — and neither is an advertising tool. Nothing either one collects goes to an ad platform.
- On carbrate.com and the web app at app.carbrate.com: Google Analytics and the Meta Pixel. These set cookies in your browser. They record which pages or app screens you viewed, roughly where in the world you are, what browser you used, and whether you subscribed to emails or bought a plan — including the amount. Meta and Google also receive your IP address as part of any request your browser makes to them. We do not send them your email address or your name: Meta’s “advanced matching” is deliberately switched off, and no personal identifier is attached to these events.
Turning them off. Any browser setting or extension that blocks tracking cookies will stop both, and the site works normally without them — nothing here gates a feature. You can also switch off ad personalisation in Meta’s ad settings or install Google’s analytics opt-out. The two tools inside the app are not advertising tools and cannot be used to target you, so there is no separate opt-out for them.
Using CarbRate without an account
You can go through the whole fueling interview as a guest. A guest session is a random identifier with no email attached to it. If you later create a real account, your guest data carries across to it rather than being duplicated.
3. Who else touches your data
We use a small number of service providers to run CarbRate. Each one gets only what it needs to do its job, and none of them is permitted to use your data for their own marketing.
| Provider | What it handles |
|---|---|
| Supabase | Our database and sign-in system. Your account and all the fueling data above live here, hosted in the United States. |
| Stripe | Subscription payments and billing. Stripe collects your payment details directly under their privacy policy; we receive only a customer reference and whether the subscription is active. |
| Superwall | Presents the upgrade screen inside the iOS app and tells us which subscription you hold. It receives an anonymous app-install identifier and standard device attributes, including your App Store storefront country — we use that last one to show the correct screen for your region. |
| Lindris | Sends the emails you ask for, such as a plan sheet mailed to yourself, and any newsletter you opt into. Only used if you give us an email for that purpose, and every message has an unsubscribe link. |
| PostHog | Product analytics inside the iOS app — which screens and features get used. Receives your CarbRate account identifier and the event, never your email, your name or your fueling data. Not an advertising tool. |
| Sentry | Crash and error reports from the iOS app, so a bug can be found and fixed. Receives the technical detail of the failure plus your account identifier. |
| Google Analytics | Aggregate website traffic on carbrate.com — which pages get read, and which ones lead to a signup or a purchase. Sets a cookie. No name or email is sent. |
| Meta (Facebook and Instagram) | The advertising pixel on carbrate.com and app.carbrate.com. It tells us which ads and posts lead to a signup or a purchase, and Meta can use what it reports to build advertising audiences. Sets a cookie. No name or email is sent. See the paragraph below on what that means under California law. |
| Open-Meteo | Race-day weather forecasts. Receives the place name you typed and its coordinates. No account identifier and nothing about your device is sent. |
| Cloudflare | Hosts and serves carbrate.com. |
We do not sell your personal information, and we never have. No money has ever changed hands over your data and none ever will.
We do have to be precise about one thing, because California law is. The Meta Pixel on carbrate.com and app.carbrate.com counts as sharing for cross-context behavioural advertising, since Meta can use what it reports to build advertising audiences. That sharing is limited to which pages and app screens you looked at in a browser and whether you signed up or bought — it does not include your account, your body data, your race, or anything in your fueling plan, none of which the pixel can see. To stop it, block tracking cookies in your browser or use the opt-out links in section 2; you can also email support@carbrate.com and ask us to, and we will confirm when it is done. Nothing on the site is withheld from you either way.
The only other circumstances in which we would disclose data are where the law requires it, or where a business transfer occurs — in which case we would tell you first and this policy would travel with the data.
Affiliate links
Some outbound product links are affiliate links, and clicking one records that the click happened so we can reconcile it later. Product rankings and Science Scores are computed from verified product data and are never influenced by affiliate relationships. Sponsored placements are always labelled as such.
4. Keeping, deleting, and getting your data
Deleting your account
You can delete your account and everything in it from inside the app: open the You tab and choose Delete account. This is permanent. It removes your profile, races, plans, sweat tests, saved products, course progress and sign-in credentials, and it cancels any active subscription immediately. We cannot undo it, and we cannot recover the data afterwards.
If you would rather we did it for you, email support@carbrate.com from your account address and we will action it within 30 days.
How long we keep things
Your account data is kept for as long as your account exists. Once you delete it, it is removed from our live systems immediately and ages out of encrypted backups within 30 days. Records we are legally required to keep — payment and tax records, held by Stripe — are retained for as long as the law requires.
Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, object to how we use it, or ask us to send it somewhere else. You can exercise any of these by emailing support@carbrate.com. We will not charge you for it, and we will not treat you differently for asking. If you are in California, note that we do not sell or share personal information as those terms are defined under the CCPA.
6. Security
Data is encrypted in transit and at rest. Access to the database is governed by row-level security, so one account cannot read another’s rows even if a client were compromised. No system is perfectly secure, but we keep the number of places your data lives deliberately small.
7. Children
CarbRate is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us data, email us and we will delete it.
8. Changes to this policy
If we change how we handle your data, we will update this page and move the effective date at the top. Material changes get an email to account holders as well — we will not quietly broaden what we collect.
See also our terms of service and support page.