Privacy Policy

Effective date: 19 August 2026 · Last updated: 6 September 2026

This Privacy Policy explains how Metric Ton LLC ("Metric Ton," "we," "us") collects, uses, and shares information when you use our apps and websites — Holakare, OpenTill, TodayHurts, PigeonTicket, CookedHere, and SockLedger (each, a "Service"). Where a practice applies to only one app, we say so.

1. Who we are

Metric Ton LLC, 5900 Balcones Drive #20977, Austin, TX 78731, United States. Questions: [email protected].

2. Information we collect

We collect only what a Service needs to work. Depending on the app, that includes:

• Account & contact — name/handle, email, and authentication identifiers.
• Content you create — e.g. PigeonTicket trip ideas, itineraries, journals and uploaded photos; Holakare care entries, notes and photos; TodayHurts workouts; CookedHere meal photos, captions and cook notes.
• Health & fitness data — Holakare: medications, doses, observations and care summaries you enter, including information about other people in your household. TodayHurts: heart rate, HRV, sleep, readiness and activity, including from Apple Health / connected services where you allow it.
• Operational & financial records — SockLedger: the projects, expenses, allocations, providers and uploaded receipts you enter to track what your own products cost. This is your business/operational data; it is not payment-card data.
• Purchase data — subscription or purchase status. Where an app is distributed through a store, billing runs through that store — Holakare bills through the Apple App Store. PigeonTicket is bought directly on the web and bills through Stripe; OpenTill is a one-time purchase billed through Gumroad. We never see or store card numbers.
• Device & usage — app version, device type, diagnostics/crash data, and usage events. Analytics run on GoodDay, our own self-hosted, cookieless analytics, across both our apps and our websites: it stores no cookies and no device identifiers, counts a visitor with a hash whose key is destroyed every 24 hours, and never leaves our servers. We use no third-party analytics.

3. How we use information

• To provide and operate the Service and your account.
• To sync your data across your devices and, where you choose, share it with people you invite (household caregivers, trip members).
• To turn what you capture into a structured record — CookedHere sends your meal photo and caption to Anthropic's Claude to fill in fields you can edit or ignore. This runs on an API key you supply and control, so the request is made under your own account with Anthropic and is governed by your agreement with them, not ours. Anthropic does not train models on API inputs. We do not use your content to train any model.
• To keep the Service secure, debug problems, and improve it.
• To communicate with you about the Service — account, security and transactional messages. We do not send unsolicited marketing. There are two exceptions, both opt-in and both started by you. First: if you join the Holakare waitlist, we email you when Holakare reaches the App Store, and send a TestFlight beta invitation if you asked for one. It is not a newsletter, we do not use it to advertise anything else, and every message carries an unsubscribe link. We collect the email address you type and, if you tick it, your interest in the beta — no health data is ever attached to it. Second, a separate list works the same way: from ametricton.com you can ask to be told if GoodDay, SockLedger or TodayHurts ever open to new accounts. These are personal projects and may never open; the list exists so we can gauge interest and tell you if that changes. Joining it does not add you to the Holakare waitlist, or the reverse.

4. When we share information

We share information only as described here:

• People you choose — e.g. caregivers you invite (Holakare) or trip members and read-only link recipients (PigeonTicket).
• Service providers that run the Service on our behalf, under contract. Which ones apply depends on the app:

  Service	Providers
  Holakare	Supabase (database and encrypted photo storage), Railway (hosting), Cloudflare (bot protection), Mailchimp / Intuit (waitlist and launch email only, sent from its us2 region — your browser posts the form to Mailchimp directly, so it receives the address, the beta preference, and the technical request data any web request carries; never household or health data)
  TodayHurts	Supabase (database), Sentry (crash diagnostics)
  PigeonTicket	Supabase (database), Sentry (crash diagnostics), Stripe (payment processing — Metric Ton is the seller of record, so this is a processor, not the independent controller below)
  SockLedger	Neon (database)
  CookedHere	Clerk (sign-in), Neon (database), Cloudflare R2 (photo storage)
  ametricton.com (this site)	Mailchimp / Intuit (launch-notification list for GoodDay, SockLedger and TodayHurts only, sent from its us2 region — the link takes you to a form hosted by Mailchimp, so it receives the name, email address and free-text comment you choose to type there, plus the technical request data any web request carries. We never attach anything from the apps to it — no health, household or usage data — and we do not ask for any; but the comment box is free text, so please do not type anything there you would not want Mailchimp to hold). This list is separate from the Holakare waitlist above, and joining one does not add you to the other

  Web push notifications are delivered by your own browser or operating system vendor; we hold only the subscription endpoint your device gives us.
• Gumroad, our merchant of record for OpenTill — a separate category from the providers above, because Gumroad does not act on our behalf. Gumroad is the seller for the one-time OpenTill purchase and is an independent controller of your purchase and billing information rather than a processor working under our instructions; it collects what it needs to take payment and meet its tax obligations, under its own privacy policy. PigeonTicket is different: Metric Ton is the seller of record there, so Stripe is listed above as a processor, not here. We receive purchase or subscription status and enough to identify the account, never card numbers.
• Connected services you enable — Apple Health, Google Health Connect and Strava in TodayHurts, subject to their own terms. These are off by default and you can disconnect them at any time.
• Legal & safety — when required by law or to protect rights and safety.
• Business transfers — in a merger or acquisition, subject to this policy.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under California and other state laws).

Health data — special handling (Holakare, TodayHurts)

We treat health and fitness data as sensitive. We do not use it for advertising or marketing, do not sell it, and do not disclose it to third parties except to provide the Service or with your permission. Data obtained through Apple HealthKit or Google Health Connect is used only to provide health/fitness features, consistent with those platforms' requirements.

5. Data retention

We keep information for as long as your account is active or as needed to provide the Service, then delete or de-identify it within 30 days, except where longer retention is required by law. Deleted data may persist in encrypted backups for up to a further 90 days before those backups age out.

6. Security

We use reasonable technical and organizational measures to protect your information. All traffic is encrypted in transit over TLS. Passwords are stored only as salted one-way hashes, never in a readable form. In Holakare, care photos are encrypted at rest — the stored objects are ciphertext, not viewable images. Databases enforce per-user access rules at the row level, so one account cannot read another's records even if application code is at fault. No system is perfectly secure, and we do not claim otherwise.

7. Your choices & rights

• Access & deletion — you can request a copy of your data or its deletion at any time, and we will act on it. In TodayHurts and Holakare you can delete your account yourself from Settings. In PigeonTicket, SockLedger and CookedHere self-service deletion is not built yet, so email [email protected] and we will delete the account for you. We are adding self-service deletion to those three.
• Permissions — you control device permissions (Health, notifications, photos) in your OS settings.
• Marketing — the Holakare waitlist and the GoodDay / SockLedger / TodayHurts launch-notification list are the only marketing emails we send. Both are opt-in, they are separate from each other, and you can unsubscribe from any message either one sends. Transactional messages, such as a trip invite you sent or a security alert, are not marketing and cannot be opted out of while you hold an account.
• State privacy rights — depending on where you live, you may have rights to access, delete, correct, or limit use of your data. To exercise them, contact [email protected].

8. Children's privacy

You must be 18 or older to hold an account, as our Terms of Service require. Our Services are not directed to children, and we do not knowingly let anyone under 18 create an account or knowingly collect personal information from them directly.

Adults do enter information about other people, including children, and we handle that as the account holder's content rather than as the child's own account. In Holakare, caregivers record care information about family members of any age; we never ask for a patient's age. In CookedHere, a household record may describe meals for a family. In PigeonTicket, an account holder may name other trip participants, who take part as non-paying participants whose age and relationship we do not ask for or store. In every case the adult account holder controls that information and can delete it.

If you believe someone under 18 has created an account, or that a child has given us personal information directly, contact [email protected] and we will remove it.

9. International users

We are based in the United States, and your information is processed there. Where you use a Service from outside the United States, you are sending your information to the U.S.

Availability differs by app and by territory, and can change; a Service is not offered everywhere. Where the GDPR or UK GDPR applies to you, the terms below apply.

Metric Ton LLC is the controller of your information, and we rely on these lawful bases:

You have the right to access, correct, delete, restrict, or object to our use of your information, and to receive it in a portable form. Withdrawing consent does not affect processing already carried out. To exercise any of these, contact [email protected]. You also have the right to complain to your local supervisory authority — in the UK, the Information Commissioner's Office.

Because we have no establishment in the EU, transfers of your information to the United States rely on the European Commission's Standard Contractual Clauses, and on the UK Addendum for UK transfers.

10. Changes

We may update this policy; we'll post the new date above and, for material changes we will notify you in the app or by email before they take effect.

11. Contact

Metric Ton LLC · 5900 Balcones Drive #20977, Austin, TX 78731, United States · [email protected]