Privacy Policy

Matro — How we collect, use, and protect your data.

Version 1.1 Last updated 10 June 2026 · GDPR compliant

1. Introduction

Matro is a minimalist food tracking app developed and provided by Kolibri Nest AS. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our mobile application and related services.

We are committed to processing your data lawfully, transparently, and only to the extent necessary to provide you with a useful experience. We do not sell your data, and we do not run advertising.

2. Data Controller

The data controller responsible for your personal data is:

Kolibri Nest AS

Org. no.: 925 795 119

Email: hello@matroapp.com

Website: matroapp.com

3. Personal Data We Process

Depending on how you use Matro, we may process the following categories of personal data:

Account data: email address, password (hashed)
Profile data: name (optional), date of birth, gender, height
Body measurements: weight, body weight history, weight goal
Dietary and nutrition data: foods logged, meal times, calorie and macro intake
Saved meals and custom food items you create
Health questionnaire responses (used to calculate calorie targets)
App usage data: feature interactions, session data, crash logs
Device data: device type, operating system version, app version
Images you submit to the AI food recognition feature (not stored after analysis)

4. Data Sources

We obtain personal data directly from you as you create an account and interact with the app. Some technical data (e.g. device type, crash logs) is generated automatically during use. We do not purchase or obtain personal data from third-party data brokers.

5. Purposes and Legal Basis

We process your personal data for the following purposes, on the stated legal basis under GDPR:

5.1 Providing the App and Its Features

Legal basis Performance of a contract (Art. 6(1)(b) GDPR)

Creating and managing your account
Logging food, calculating calories and macros
Generating personalised calorie and nutrition targets
Storing your food diary, saved meals, and custom items
Providing AI-based food recognition via text or image

5.2 Health and Dietary Data

Legal basis Explicit consent (Art. 9(2)(a) GDPR)

Data about what you eat, your body measurements, weight goals, and related health information is considered special category data under GDPR. We process this data only with your explicit consent, which you provide when setting up the app. This data is essential to the core functionality of Matro — without it, we cannot provide food tracking or personalised recommendations.

You may withdraw your consent at any time by deleting your account.

5.3 App Improvement and Debugging

Legal basis Legitimate interests (Art. 6(1)(f) GDPR)

Analysing anonymised usage patterns to improve the app experience
Diagnosing crashes and technical errors

We have assessed that this processing does not override your interests or fundamental rights, given that only anonymised or aggregated data is used.

5.4 Legal Obligations

Legal basis Legal obligation (Art. 6(1)(c) GDPR)

Retaining accounting and transaction records as required by Norwegian bookkeeping law

5.5 No Advertising or Data Selling

We do not use your personal data for advertising, targeted marketing, or profiling for commercial purposes. We do not sell or rent your data to third parties. There is no automated decision-making or profiling with legal or similarly significant effects (Art. 22 GDPR).

7. International Data Transfers

Some of our sub-processors are located outside the European Economic Area (EEA), including in the United States. Where such transfers occur, we ensure appropriate safeguards are in place, including:

EU Standard Contractual Clauses (SCCs) approved by the European Commission
The EU-U.S. Data Privacy Framework, where applicable

8. Data Retention

We retain your personal data only for as long as necessary:

Account and food diary data: Retained for as long as your account is active
Images submitted to AI: Deleted immediately after analysis — never stored
Anonymised usage and crash data: Up to 12 months
Accounting and payment records: As required by law (5 years under Norwegian bookkeeping regulations)

If you delete your account, all personal data associated with it will be permanently deleted within 30 days, except data we are legally required to retain.

We will also delete or anonymise inactive accounts after a period of extended inactivity.

9. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right to be informed: To know how your data is processed (this document)
Right of access: To receive a copy of the personal data we hold about you
Right to rectification: To have inaccurate or incomplete data corrected
Right to erasure: To request deletion of your data (“right to be forgotten”)
Right to restriction: To limit how we process your data in certain situations
Right to data portability: To receive your data in a structured, machine-readable format
Right to object: To object to processing based on legitimate interests
Right to withdraw consent: To withdraw consent for health data processing at any time
Right to lodge a complaint: With your national supervisory authority

To exercise any of these rights, contact us at hello@matroapp.com. We will respond within 30 days. You can also delete your account directly from within the app.

In Norway, the supervisory authority is Datatilsynet (datatilsynet.no). If you are located in another EEA country, you may contact your local data protection authority.

10. Security

We take appropriate technical and organisational measures to protect your personal data, including:

Encryption of data in transit (TLS/HTTPS)
Encryption of data at rest
Role-based access controls
Regular security reviews

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected users without undue delay.

11. Children

Matro is not directed at children under the age of 13, or the applicable age of digital consent in your country if higher. We do not knowingly collect personal data from children below this threshold.

If you become aware that a child has submitted personal data to Matro, please contact us at hello@matroapp.com and we will delete the data promptly.

12. Cookies and Tracking

The Matro app does not use advertising cookies or third-party tracking. Our website (matroapp.com) may use strictly necessary technical cookies to ensure the site functions correctly. We do not use cookies for behavioural tracking or targeted advertising.

13. Changes to This Policy

We may update this Privacy Policy as the app evolves. We will notify you of material changes through the app or by email before they take effect. The current version is always available at matroapp.com/privacy.

Continued use of Matro after changes are notified constitutes acceptance of the updated policy.

14. Contact

For questions about this policy, to exercise your rights, or to raise a concern about how we handle your data, please contact: