Effective date: 19 October 2026.
Setpoint: Food & Lifts ("Setpoint", "the app") is made by The Boring Layer, a trade name of Meridian Cornerstone Holdings LLC ("we", "us"). This policy answers, in order: what the app collects, what it does with Apple Health, who else receives anything, how long data is kept and how it is deleted, how you withdraw consent, how backups work, and how to reach us. Where the answer is "nothing" or "no one", it says so rather than leaving the question out.
Nothing you log is transmitted to us. There is no account, no sign-in, and no server of ours that holds your data. We have no database of users. The app contains no analytics, no advertising, and no crash reporting, from us or from anyone else.
Everything you enter is stored in the app's own container on your iPhone and used only to show it back to you:
Nothing in that list is sold, shared, or used for any purpose other than the app's own features.
The app works with the network off. The requests below are the only ones it can make. None carries your diary, your Health data, or anything that identifies you beyond what every web request carries: your device's IP address and the request itself.
https://theboringlayer.com/setpoint/fooddata.json,
to see whether a newer database exists. If one does, the app says so and
offers a button in Settings; nothing is downloaded or installed until you
tap Check for Updates there. You can point the app at your own
server in Settings, and it is fully functional without any server. The
server keeps ordinary access logs (IP address, date and time, file
requested) for six months and then deletes them. We record nothing
else.The barcode and pasted-link requests happen only when you start them, and all three fail quietly when the network is unavailable. Each request carries a User-Agent string naming the app and a contact address, and nothing else about you or your data.
Setpoint can connect to Apple Health. Each connection is a separate permission, off until you turn it on from the screen that uses it, and controlled afterwards in iOS Settings. The types it asks for, and what each is for:
| Health type | Read or write | What it is used for |
|---|---|---|
| Weight (body mass) | Read and write | Your weight trend, one weigh-in per day. A weigh-in you type here can be written to Health when you connect weight. |
| Body fat percentage | Read | Your body composition trend, shown as a 14-day median. |
| Lean body mass | Read | Kept for the record beside each composition reading; the shown lean mass is derived from weight and body fat percentage. |
| Active energy | Read | Half of the day's measured movement is added to your calorie budget. |
| Step count | Read | The steps habit ticks itself when your steps pass the mark. |
| Sleep analysis | Read | The steady-wake-time habit checks itself, and the sleep schedule card. |
| Workouts, with their average heart rate and active energy | Read | Strength workouts from Apple Watch appear in your training history beside the sets you logged. |
| Waist circumference | Read and write | The waist measurement syncs both ways with the Health app. |
| Dietary energy, protein, carbohydrates, total fat, dietary fiber | Write only | Your food diary, as per-meal samples, only when you turn on "Share food log with Apple Health" in Settings. It is off by default. The app never reads dietary data back from Health. |
Health data is used only to show you your own numbers on your own device. It is never shared with third parties, never sold, never used for advertising or marketing, never used for research or any purpose beyond the app's own features, and never stored on any server of ours. The full list of connections, and where each is turned on, is on the Apple Health page.
No third party receives your data from us. We give no one access to it, because we do not have it. The only other parties that can receive anything are the ones you choose to send a request to, each listed in section 1a: Open Food Facts when a scanned barcode is not in the bundled database, and the website whose address you pasted. Each receives only the barcode or the page request, with your IP address, under its own policy. Apple holds your device backups under Apple's terms (section 6), and Apple Health holds what you write to it under Apple's Health privacy terms. We have no agreement with any party to process your data because no party processes it on our behalf.
Setpoint has no accounts and no server that holds your data. Nothing you log is sent anywhere.
If you use iCloud Backup, your Setpoint data is part of your device's backup, like any other app's. That's Apple's backup of your phone, not a Setpoint service — Setpoint has no access to it.
Standard iCloud Backup is encrypted with keys Apple holds. Turning on Advanced Data Protection in Settings makes your backups end-to-end encrypted, so only your devices can read them. Your Health data is end-to-end encrypted either way.
The same applies to a backup made to a computer with Finder or iTunes: it is yours, made and held under Apple's terms, and we have no access to it.
Setpoint is not directed at children under 13, or under the age that applies in your region. We do not knowingly collect personal data from children; we do not collect personal data from anyone.
Questions about this policy, or any request about your data: privacy@theboringlayer.com. The mailbox is read by one person; expect a reply within a week.
If the app's behaviour changes in a way this policy describes, we update this page and change the effective date at the top. There are no silent changes: the published date is the record of the current version.