Privacy Policy

1. Controller

Enactus Mannheim e. V., L1, 1, 68161 Mannheim, Germany. The current board members are listed at enactus-mannheim.com/impressum. Direct contact for the Mealyo team: team@mealyo.de.

2. Minimum age

Mealyo is intended for users aged 16 and over. If you are younger, you may only use Mealyo with the consent of your parent or guardian. If we learn that we have collected personal data from a child under 16 without that consent, we will delete it without delay. If you believe we may have data about a child, please contact us at team@mealyo.de.

3. What we process

This policy covers both the website (mealyo.de) and the mobile app.

• Account data — email address, display name, profile picture (when logging in with Google or Apple), birthday (optional), sign-in method, internal user ID. Legal basis: Art. 6(1)(b) GDPR.
• Preferences — diet (e.g. vegetarian or halal), allergies and intolerances, dislikes and likes, favourite supermarket, postcode, and — if you use the body profile — sex, age, height, weight, activity level, weight and calorie goals. Always optional, editable any time.
• Special categories (Art. 9 GDPR) — allergies and body data can be health data; a diet such as halal or kosher can reveal religious beliefs. We process these only with your explicit consent under Art. 9(2)(a) GDPR. The explicit consent request in the app arrives with the next app version; until then it is up to you whether you enter these details, and you can delete them in your profile at any time — they are then no longer sent to the AI services in section 4.
• Content and household — your inventory, shopping lists, weekly plans, cooking history, recipes, recipe images and conversations with the assistant, accessible only to you and any household members you invite. In a household, the diet details of all members are merged into one profile for joint planning, and connected calendars of all members feed into the plan.
• Receipt scans and barcodes — receipt images are sent to our servers, where Google Cloud Vision reads the text and an AI (OpenAI) matches the lines to food items. A receipt can show the shop, branch, date, time, items and prices. We keep the image only as long as needed for processing. Barcodes are looked up in Open Food Facts.
• Calendar — optionally you can connect Google Calendar (read-only) or your device calendar. Mealyo reads upcoming appointments (title and time) to fit the weekly plan to your days and can add planned meals as events. A summary is stored in your account, used for your household's planning and sent to OpenAI (weekly plan) and Anthropic (assistant). Appointment titles may contain other people's names or personal notes. Legal basis: Art. 6(1)(b) GDPR; for data about other people Art. 6(1)(f) GDPR.
• Voice input — dictation uses your operating system's speech recognition (Apple or Google), which may run on the device or on the provider's servers. Audio you record for a recipe is sent to OpenAI for transcription.
• Server log files — our hosting and server services (Google Cloud: Firebase App Hosting for this website, Cloud Functions for the app) log IP address, timestamp, requested URL and HTTP status, user-agent and referrer. Logs are kept for up to 30 days and used only for operations, error analysis and abuse prevention. Legal basis: Art. 6(1)(f) GDPR.
• Waitlist — your email address is saved in our own database hosted by Cloudflare (see section 4) so we can write to you about Mealyo: the launch, new features and occasional offers, as stated in the consent text of the form. Double opt-in: only your click in the confirmation email completes the sign-up. We store the email address, the time of sign-up and confirmation, the consent text and its version, the language and the page you signed up on — no IP address and no user-agent. Unconfirmed sign-ups are deleted after 30 days; after you unsubscribe we keep the proof of consent for three years. Every email has an unsubscribe link. Emails are sent via Resend. Legal basis: Art. 6(1)(a) GDPR; for the proof Art. 6(1)(c) with Art. 7(1) GDPR.
• Emails to account holders — a welcome email after sign-up (Art. 6(1)(b) GDPR); tips, reminders and news only if you agreed to "news by email" (Art. 6(1)(a) GDPR), each with an unsubscribe link. Emails are sent via Resend, which reports whether an email was delivered, bounced or marked as spam and — where measurement is switched on — whether it was opened or a link clicked. We store these events in PostHog together with your email address to monitor delivery.

4. Processors and third-party services

We use the following providers under data processing agreements (Art. 28 GDPR) where they act on our behalf. Some services — map tiles and the product database — are called directly by the app; those providers process the resulting data as independent controllers.

• Firebase and Google Cloud (Google Ireland Limited) — Authentication, Cloud Firestore (EU), Storage for images such as receipt scans and recipe or profile pictures (located in the USA, us-east1), App Check and Cloud Functions. Part of the Cloud Functions runs in Frankfurt (europe-west3), part in the USA (us-central1), including receipt recognition, chat and recipe features and the weekly plan. Google Cloud Vision reads the text on receipt images.
• Firebase Crashlytics — crash reports from the app: device model, OS and app version, time, stack trace and your user ID. Legal basis: Art. 6(1)(f) GDPR (a working app).
• Firebase Cloud Messaging (FCM) — push notifications you have allowed, via Apple's push service on iPhones. We store a device token in your account; a notification may name a food item that expires soon. Categories can be switched off in your profile, all notifications in your device settings. Legal basis: Art. 6(1)(b) GDPR.
• RevenueCat (USA) — subscription management. Receives your user ID as a pseudonymous identifier, subscription status and purchase data from the stores, plus device and country information. No payment data.
• PostHog (PostHog Inc., USA; data stored in the EU instance) — on this website only after you click "Accept" in the cookie banner. In the app only if you agree in the in-app consent dialog: your user ID, which screens and features you use, sign-in method and household size; change it any time in your profile under "Privacy". Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. On our servers we also record duration and cost of AI requests (without their content and without your user ID) and the email events above (Art. 6(1)(f) GDPR). No cross-app tracking, no advertising IDs.
• OpenAI (USA) — receipt recognition, recipe suggestions and import, recipe chat, weekly plan, translations, audio transcription. Depending on the feature we send receipt text and photos, recipe texts and links, chat questions with your inventory, and for the weekly plan your diet, allergies, dislikes and likes (of all household members), inventory, current offers and connected calendars. Never your name or email. Under OpenAI's terms, API data is not used for training and is kept for up to 30 days for abuse monitoring.
• Anthropic (Claude, USA) — the in-app assistant ("Mealyo agent"), the starter plan and some analysis steps. We send the part of your profile the request needs — diet, allergies, dislikes and likes and, if provided, sex, age, height, weight, activity level and goals — plus inventory, shopping list, household size, a summary of your calendar for the next seven days (if connected), the conversation so far and your question. Never your name or email. At night Mealyo automatically fills empty days in your weekly plan, sending the same data even if you don't open the app that day. Under Anthropic's terms, API data is not used for training. Legal basis: Art. 6(1)(b) GDPR; for special categories see section 3.
• Resend (Plus Five Five, Inc., USA) — sending waitlist and account emails. Receives your email address, your name if given, and the content of the email.
• Google Mobile Ads (AdMob) — only in the free tier and only if you agreed to "personalised ads" in the in-app consent dialog; iOS additionally asks for tracking permission (App Tracking Transparency). Uses device and advertising IDs, IP address and ad interactions. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Mealyo Pro and Family disable ads entirely.
• Google Sign-In / Sign in with Apple — used only for login; we receive only the minimum required info. Connecting Google Calendar additionally asks for read access to it.
• Open Food Facts (France) — barcode lookups directly from the app; receives the barcode, your IP address and app details. Product data © Open Food Facts contributors, ODbL.
• OpenStreetMap and Esri (OpenStreetMap Foundation, UK; Esri, Inc., USA, ArcGIS) — map tiles for the offers map, loaded directly by the app; they receive your IP address, app details and the map area shown, which reveals your approximate location.
• Fonts — on this website Poppins is self-hosted via next/font, with no request to Google. The app loads its fonts from Google Fonts on first use, which gives Google your IP address (Art. 6(1)(f) GDPR).
• Feature requests — no third party is involved. Requests, votes and comments are stored in our own Firebase database. Note that your request, your comment and your display name are visible to every other user: it is a public board, not a private inbox, so don't put anything in there you would not want others to read. Your email address is never shown. You can have your own entries deleted at any time, and deleting your account removes them.
• Email inbox: IONOS (IONOS SE, Montabaur, Germany, processor) — our mealyo.de addresses such as team@mealyo.de are hosted there. When you write to us, IONOS stores your message, your email address and connection data. We delete emails 12 months after your request has been dealt with; requests about your rights (section 10) are kept for three years so we can show that we answered them. Legal basis: Art. 6(1)(b) GDPR for account matters, otherwise Art. 6(1)(f) GDPR.
• Cloudflare (Cloudflare, Inc., San Francisco, USA, processor) — hosts our internal tool that stores the waitlist (Cloudflare Workers and D1 database). New sign-ups trigger an internal Telegram notice with a running number only, without name or email address. Privacy policy: cloudflare.com/privacypolicy.

5. Use of artificial intelligence

Mealyo uses AI models for several features, including receipt parsing, translations, recipe and weekly-plan suggestions, the in-app assistant and structuring recipes you enter, photograph or dictate. AI-assisted features are labelled inside the app.

How the data flow works: AI requests always go through our backend, never directly from the app to the AI provider. We send the content needed for the specific feature. For the weekly plan and the assistant this includes profile details such as diet, allergies and dislikes and, if connected, your calendar — section 4 lists exactly what goes to OpenAI and to Anthropic. We never send your name or email. The AI's response comes back through our backend and is stored in your account.

AI-generated content may be incorrect or out of date (so-called "hallucinations") and is not a substitute for professional nutritional or medical advice. Please double-check allergy and nutrition information before relying on it. Under the terms of OpenAI and Anthropic, data sent through their APIs is not used to train their models.

6. Transfers to third countries (especially the USA)

Some of our providers are based in or process data in the USA — notably OpenAI, Anthropic, RevenueCat, Resend, Cloudflare, parts of Google's services (including image storage in us-east1 and the Cloud Functions in us-central1) and PostHog as a US company, even though its data is stored in the EU. The USA is not automatically considered a country with an adequate level of data protection. Depending on the recipient we rely on:

• EU-US Data Privacy Framework (DPF) — the European Commission has decided that DPF-certified US companies provide an adequate level of protection. This applies only to certified recipients, such as Google LLC and Cloudflare, Inc. The list is at dataprivacyframework.gov.
• EU Standard Contractual Clauses (SCC) under Art. 46(2)(c) GDPR for all recipients that are not DPF-certified, including OpenAI, Anthropic and RevenueCat. The clauses are part of the data processing agreements; we send you a copy on request to team@mealyo.de.
• Technical and organisational measures such as encryption, minimisation, and pseudonymisation.

Esri map tiles are fetched by the app directly from Esri in the USA, which acts as an independent controller. Despite these safeguards, we cannot rule out that US authorities may access personal data and that data subject rights may not be enforceable in the same way.

7. Cookies and local storage

Strictly necessary (no consent required): your light/dark choice, your cookie choice itself and — while you browse between recipes — the page the back link returns to are kept in your browser's storage. The language is not stored; it is part of the page address. The server also sets a NEXT_LOCALE cookie so the home page opens in the language you last chose. All of this is required to operate the site (§ 25(2)(2) TDDDG).

Only with your consent: if you click "Accept" in the cookie banner, we additionally load PostHog (see section 4), which sets cookies and local-storage entries for pseudonymous usage analytics; we may also remember which of two headline versions you saw. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time; this does not affect the lawfulness of processing done before the withdrawal.

The mobile app stores login tokens, caches and your privacy choices in the OS-protected app sandbox.

8. Push notifications

With your permission, Mealyo sends reminders for items expiring soon or planned meals (see FCM in section 4). You can disable them any time in your profile or your device settings.

9. Retention

We retain personal data only as long as your account is active or legal retention obligations apply. You can delete your account any time from the in-app settings — this irreversibly removes your data from our database and file storage, including inventory, shopping lists, plans and recipes; it disappears from database backups within 14 days. Usage data at PostHog, subscription data at RevenueCat and crash reports at Crashlytics are currently not deleted automatically — email us and we will delete them manually.

10. Your rights

Under the GDPR you have the rights of:

• access (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction (Art. 18)
• data portability (Art. 20)
• objection (Art. 21)
• withdrawing consent at any time, with effect for the future (Art. 7(3))
• lodging a complaint with a supervisory authority (Art. 77)

To exercise any of these rights, just email us at team@mealyo.de.

11. Competent supervisory authority

If you believe that the processing of your personal data violates the GDPR, you can lodge a complaint with our competent supervisory authority:

You may also contact any other EU data protection authority, in particular the one in the EU member state where you live.

12. Security

All connections between the app, website and our servers are TLS-encrypted. Data within Firebase is additionally encrypted at rest. Access to personal data is limited to the small Mealyo team members who need it to do their job.

13. Changes

We update this policy when our services, processors or applicable laws change. The latest version is always available on this page; the date above shows the last update.

This English text is provided for convenience. The legally binding version is the German one at /datenschutz.