Mealuna Privacy Policy

Who we are

Mealuna is an app for iOS and Android, operated by Varres Solutions OÜ, a company registered in Estonia. We are the data controller for the personal data described in this policy.

Our processing is governed by the laws of Estonia and the European Union, including the GDPR.

If you have a question about your data or this policy, contact us at mealuna.app@gmail.com.

• Operator: Varres Solutions OÜ
• Location: Estonia
• App: Mealuna (iOS and Android)
• Applicable law: Estonia / European Union (GDPR)

What data we collect and why

We collect only what the app needs to do its job: helping you plan meals, manage shopping lists, track a shared pantry, and split costs within a group. Below is the full list of data categories the app handles.

Some of this data stays only on your device. Other data is synced to our backend so that members of the same group can share lists, pantry, and costs. The next section explains the split.

• Account identity: email, Apple ID or Google ID, display name, and preferred language. Used to sign you in and identify you within your groups.
• Group data: group name, your role and membership status, appetite, whether a member is a child, and allergens (allergens are stored only if you turn on allergen sharing).
• Shopping lists and items.
• Pantry inventory: item, storage location, expiry date, and whether it has been opened.
• Purchase history and cost splitting: amounts, who paid, how a cost is split, settlements, and reminders.
• Receipt images: stored in private cloud storage so group members can review shared expenses.
• Product and barcode cache: nutriments, ingredients, allergens, and Open Food Facts image links (URLs only). A barcode you scan is looked up both on our own server and at Open Food Facts; the lookup only reads.
• Recipes: imported recipes stay private; recipes you create default to private.
• Recipe pictures: a picture you add in the app or have an assistant add from a link. Stored in private cloud storage at a reduced size, without location or camera details, so the members of your group can see it.
• Menu plans.
• Menu autopilot settings: your group's meal-planning goal (lose, maintain or gain weight), diet and cuisine preference, ingredient exclusions, planning window, and participants — synced so the whole group plans from the same settings.
• Food log / consumption diary: kept on your device and never synced to our servers. Your phone's own backup can include it — see “Device backup” below.
• Subscription entitlement: your tier, product ID, and expiry date.
• Store settings and loyalty cards: which stores you shop in, whether you hold each store's loyalty card, and the card's barcode value. These belong to your account, not to your group — other members cannot see or change them.
• Device sync cursors: an app-generated identifier, the app version, the app platform (iOS or Android), and your device's time zone (for example “Europe/Tallinn”), used to keep your devices in sync. The time zone is only there so that an AI assistant you connect counts days — “expires tomorrow”, “today's menu” — on your calendar rather than the server's; it is replaced each time your device syncs.
• Shopping-list archive snapshots and group invite tokens.
• Global product catalog: shared reference data that is not personal to you.

On your device vs. in the cloud

Most personal processing in Mealuna happens directly on your device. Data leaves your device only when it needs to be shared with other members of your group or to operate features you have chosen.

On iOS, Mealuna uses Apple Foundation Models on your device (on supported hardware) to segment recipe text you paste or import, and Apple Vision on your device to read receipts and nutrition labels. On Android, the same reading is done on your device by Google ML Kit, which is bundled with the app; the Android app does not generate or suggest recipes with AI at all. On both platforms these features run entirely on your device. We do not send your text or images to any external server for them. You always review the output before it is saved.

On iOS, on-device AI language support comes from Apple and currently does not include Estonian, Finnish or Russian. The Android app has no AI generation, and its on-device text recognition does not read Cyrillic script.

We do not use any cloud AI to process your personal interactions. The generic nutrition reference data in the catalog was generated once by us from public USDA and EU reference sources; it is static and is not built from your data.

Your food log stays on your device and is never synced to our servers. Your phone's own backup can include it, and we recommend turning that on — on Android with a screen lock the backup is encrypted with a key that stays on your phone, so neither Google nor Mealuna can read it.

Apple Health and Health Connect (optional, Premium): if you turn on Health sync, Mealuna reads data such as weight, body composition, height, and energy burned — from Apple Health on iOS, or from Health Connect on Android — and writes the body measurements you log back to it. On iOS it also writes the nutrition of the meals you log; the Android app does not write nutrition. This exchange happens entirely on your device, through Apple’s HealthKit or Android’s Health Connect. Health data is never sent to Mealuna’s servers, never shared with third parties, and never used for advertising.

• On-device (iOS): recipe-text segmentation (Apple Foundation Models).
• On-device (iOS): receipt and nutrition-label reading (Apple Vision). On Android all of the above reading is done by Google ML Kit; there is no AI generation.
• On-device only, never synced: your food log / consumption diary.
• Cloud: group sync (lists, pantry, costs, recipes, menu plans) so members can share.
• Mealuna never sends your data to a cloud AI. An AI assistant you connect yourself reads only your lists, pantry, menu plan and recipes from Mealuna — never your food log, your health data, or your purchases and cost splits — and can change nothing but meal drafts in your menu plan, which recipes you marked as favourites, your group's own recipes, your shopping lists and your pantry, and only after you allow it — when you connect, or later in the app.
• Optional Health sync (Premium) via Apple Health or Health Connect: reads and writes health data on-device; never sent to our servers, shared, or used for ads.

Legal bases for processing

Under the GDPR, we rely on the following legal bases.

Performance of a contract (Article 6(1)(b)): processing your account, groups, lists, pantry, purchases, cost splits, recipes, and menu plans so the app works as described, and managing your subscription entitlement.

Consent (Article 6(1)(a)): optional features you switch on, such as sharing your allergens with your group and contributing scanned product data to Open Food Facts. You can withdraw consent at any time.

Legitimate interests (Article 6(1)(f)): keeping the service secure and reliable, and retaining shared financial history so co-members' balances stay accurate after a member leaves.

Legal obligation (Article 6(1)(c)): where we must keep certain records to comply with applicable law.

• Contract: core app features and subscription entitlement.
• Consent: allergen sharing and Open Food Facts contributions (both opt-in).
• Legitimate interests: security and accurate shared balances.
• Legal obligation: where the law requires retention.

How you sign in

You can create an account using one of two methods. You choose which one.

With Sign in with Apple, Apple passes an identity token to our backend (Supabase) to confirm who you are.

With Google Sign-In, an OAuth token is exchanged with our backend, and your Google email and user ID are stored in our authentication records. Google Sign-In is used only if you choose it.

On iOS, the Google Sign-In SDK bundles additional Google libraries into the app, including App Check and GoogleUtilities. These transitive libraries may collect device or diagnostic signals as part of their normal operation. On Android, signing in uses the system Credential Manager together with Google Play services, and none of those libraries are bundled. We disclose this for transparency.

• Sign in with Apple
• Google Sign-In (optional). On iOS it brings transitive Google libraries (App Check, GoogleUtilities, AppAuth); on Android it uses the system Credential Manager and bundles none of them.

Third parties and processors

We keep the number of third parties small. Here is everyone who may receive or process data, and why.

Supabase is our backend provider. It hosts our database, authentication, realtime sync, file storage, and server functions. All synced user data passes through Supabase, including account identity, groups, lists, pantry, purchase and cost-split data, receipt images, recipes, recipe pictures, menu plans, subscription entitlement, and device sync cursors. Supabase acts as our processor. A barcode you scan is also looked up there, against Mealuna's own product data. That request is authenticated like any other request from the app, and it only reads: nothing is written to your account or your group, and the barcode is not added to your profile.

Apple provides Sign in with Apple, and processes subscription purchases made in the iOS app through the App Store. Apple receives your authentication identity token (passed to our backend) and, for iOS purchases, handles billing. See the Subscriptions section for what we store.

Google Play processes subscription purchases made in the Android app. Google Play handles the payment and issues a purchase token; the app sends only that token to our backend, which confirms the purchase directly with the Google Play Developer API. We never see or store your payment details.

Google provides Google Sign-In, used only if you choose it. An OAuth token is exchanged with our backend, and your Google email and user ID are stored in our authentication records. The transitive Google SDKs bundled with Google Sign-In may collect device or diagnostic signals.

Google AdMob shows ads only on the free plan of older iOS versions (1.0.24 and earlier). From version 1.0.25 the iOS app contains no advertising SDK, so nothing is sent to AdMob. On those older versions, when an ad is shown, Google receives your IP address, basic device information, and data about the ad itself, such as views and taps, and the iOS advertising identifier (IDFA) is used to personalise ads only with your consent. On the paid plans the ad code is never activated, so nothing is sent to AdMob. The Android app contains no advertising SDK at all: no ads are shown on any plan and no advertising identifier is used. You can read how Google uses this data at policies.google.com/technologies/partner-sites.

Open Food Facts is an open food database. When you scan a barcode, the app may look it up (a read query with no account or personal identifier). If you opt in, scanned or manually entered product data may be contributed back: barcode, name, brand, per-100g nutriments, ingredients, allergens, and optional label images. These contributions are made under a single shared Mealuna Open Food Facts account, not a per-user account, and no end-user identifier is sent to Open Food Facts. The credentials for that account are held server-side only. Mealuna's own server also reads Open Food Facts to fill gaps in partner-store nutrition data — for example fibre, when the store does not publish it. That lookup is by product barcode with nothing about you attached, and the app tells you when a value came from Open Food Facts rather than from the store.

Partner stores, where one operates — Selver, Rimi and Barbora in Estonia today. Mealuna reads the store's public product catalogue (names, prices, images, availability) so your list can be matched to real products; that read involves nothing about you. When you choose to hand your basket over, one of two things happens, depending on the store: Mealuna either opens the store's own website with the products and quantities you picked, or it adds those same lines to your basket on the store's own site from inside the app, in your own session with that store. Some stores ask you to sign in to them first; that login page belongs to the store and Mealuna never sees or stores your store password. No Mealuna account identifier, name, or email travels with any of it. Everything after that — your store account, the order, the payment — is between you and the store, under the store's own terms and privacy policy.

An AI assistant, if you connect one yourself. You can connect Mealuna to an assistant that speaks MCP — Claude, ChatGPT, or any other client that supports MCP connectors — so you can ask what is in your pantry or what is about to expire without opening the app. This is off until you set it up, and you authorise it with Sign in with Apple or Google, exactly as you sign in to Mealuna. Using Mealuna this way is part of Premium. While a connection exists, the assistant can read your shopping lists and what Mealuna suggests you may need, your pantry, your menu plan including which recipes were on it recently and whether your group set menu exclusions (never which), your recipes, how many members of each of your groups marked a recipe as a favourite and whether you did (a count, never who), and the names and plans of the groups you belong to. A connection only reads unless you allow changes for it — by ticking Allow changes on the page where you approve it, or later in the Mealuna app. Only then can it change anything, and then only these five things: it can put recipes into a group's menu plan as drafts and take drafts out again, starting that plan or extending it to the coming days when needed; it can mark a recipe as your favourite or take that mark off; it can save a recipe into a group — as your own, or as imported when you give it a link — and change or delete that group's own recipes, but never a published recipe or one of Mealuna's; it can add items to a group's shopping lists, tick them into the cart or back out, and remove them; and in a group's pantry it can add what you bought, also from a receipt you show it, and take stock of one place, such as the fridge, from a photo, after showing you what it will do; record what ran out or how much is left; move an item or set or clear its best-before date; and remove an item. On your group's own recipes it can also set a picture from a link you give or agree to, and take it away. Mealuna's server downloads the picture once and does not keep the link; whoever runs that address sees a request from Mealuna's server, not from your device. A receipt or fridge photo stays with the assistant — Mealuna receives only the lines it read (names, amounts, best-before dates; for a receipt also the shop, date and time and total), never the image, unlike a receipt scanned in the app. When a recipe or a food list names something Mealuna does not know, it is added to that group's products, as it would be if you typed it in the app. From a receipt or a photo, a new product is added only when you agree. The other members of a group see those drafts, recipes, list and pantry changes and products, and your favourite marks on recipes they can see, in their app, just as if you had made the change yourself. It cannot read your food log, your body measurements or any health data including allergens, or your purchases and cost splits. If you start a recipe from the app, the ready message it opens in your assistant includes the diet and allergies you set in Mealuna. What you send to that assistant is then handled by whoever operates it, under their own terms and privacy policy. You can see, restrict and disconnect your connections in the Mealuna app under Settings → AI assistants; removing the connector in the assistant alone does not end a connection, which ends by itself 30 days after it was last used.

Zone Media, our web host in Tallinn, Estonia, hosts this website — including the page where you approve an assistant — and relays the connection of an assistant you connect through mcp.mealuna.eu to our backend. Those requests and answers carry the data listed above and the assistant's access token; they pass through Zone's server over encrypted connections and are not stored there. Its web server logs record the time, address, path and browser of each request and are deleted within seven days. Zone acts as our processor. A connection made with our older connector address goes to our backend directly and does not pass through Zone.

• Supabase (processor): backend database, auth, realtime sync, storage, server functions, and barcode lookups.
• Apple: Sign in with Apple, and App Store billing for purchases made on iOS.
• Google Play: billing for purchases made on Android; our backend verifies the purchase token with the Google Play Developer API.
• Google: Google Sign-In OAuth (optional) plus transitive Google SDKs.
• Google AdMob (free plan of iOS versions 1.0.24 and earlier only): serves ads; receives IP address, device info, and ad-interaction data; IDFA only with your consent. Not present from iOS version 1.0.25 on, or in the Android app.
• Open Food Facts: barcode lookups (read) and opt-in contributions under one shared Mealuna account (no end-user identifier sent).
• Partner stores (Selver, Rimi and Barbora in Estonia today): receive the products and quantities in a basket you choose to hand over; no Mealuna account identifier is sent. Where a store fills the basket inside the app, the request is made in your own session with that store — Mealuna never sees or stores your store password.
• An AI assistant you connect yourself (optional, Premium): reads your lists, pantry, menu plan and recipes on request, and with your permission in the app puts meal drafts into a menu plan, marks or unmarks your favourite recipes, saves, changes and deletes your group's own recipes, and changes your group's shopping lists and pantry. It cannot change anything else, and never receives your food log, your health data, or your purchases and cost splits.
• Zone Media (processor): hosts this website in Estonia and relays assistant connections made through mcp.mealuna.eu to Supabase; keeps nothing from them except web server logs, deleted within seven days.

No analytics of our own — and no ads in the current app

We run no analytics of our own and never build a profile of you. That is a deliberate choice and one of Mealuna's strengths.

Mealuna contains no analytics and no crash-reporting SDKs on either platform. From version 1.0.25 the iOS app contains no advertising SDK, shows no ads and does not show the App Tracking Transparency prompt. Older iOS versions (1.0.24 and earlier) show ads through Google AdMob on the free tier; the paid plans remove ads entirely, and for those plans the ad code is never activated. Those versions show the App Tracking Transparency prompt once to every user, including on the ad-free plans. The Android app ships no advertising SDK, so every Android plan, including Free, is ad-free.

On the free tier of older iOS versions (1.0.24 and earlier), ads may be personalised using the advertising identifier (IDFA). Before any personalised ad is shown we ask for your consent — through Google's consent form and iOS's App Tracking Transparency prompt. If you decline, you still see ads, just non-personalised ones; you never lose any functionality by declining. In those versions you can change your ad-consent choice later under Settings › Privacy › Privacy options in the app, and your tracking permission under iOS Settings › Privacy & Security › Tracking. None of this applies from iOS version 1.0.25 on, or on Android, where there are no ads and no advertising identifier.

The other third-party components are Supabase and the sign-in libraries; on Android there are also Google Play Billing and Google ML Kit, both used on device for the purposes described above. The app requests camera permission (for scanning barcodes, receipts, and labels) and — only if you enable Health sync — read/write permission for Apple Health on iOS or Health Connect on Android. We never use health data or your app content for ad targeting, and the app does not request photo-library access.

• No analytics SDKs.
• No crash-reporting SDKs.
• Paid plans are completely ad-free. From version 1.0.25 the iOS app shows no ads on any plan; older iOS versions (1.0.24 and earlier) show ads on the free tier via Google AdMob; on Android no plan shows ads, because the app contains no ad SDK.
• Personalised ads and the IDFA (only in iOS versions 1.0.24 and earlier) are used solely with your consent, via the consent form and the App Tracking Transparency prompt; decline and you still get non-personalised ads.
• We never use health data (Apple Health or Health Connect) or your app content for ad targeting.
• Camera permission for scanning; Apple Health or Health Connect permission only if you enable Health sync; no photo-library access.

Subscriptions and billing

Mealuna offers optional paid tiers. Purchases made in the iOS app are processed by Apple through the App Store; purchases made in the Android app are processed by Google through Google Play. We never see or store your payment details.

On iOS, your subscription is verified using Apple's cryptographically signed transaction: the app sends the signed transaction (JWS) from your device to our backend, which verifies the signature. On Android, the app sends only the purchase token issued by Google Play, and our backend confirms it directly with the Google Play Developer API — the token is an opaque receipt, not a card or account number. In both cases we store the resulting entitlement: your tier, the product ID, the expiry date, whether you are a founding subscriber, and the store transaction identifier.

We store the verified store transaction identifier so we can validate the subscription and prevent duplicate or forged entitlements. We do not receive or store server-to-server notification payloads from Apple or Google, and we never see or store your payment details.

• Billing is handled by Apple via the App Store for iOS purchases, and by Google via Google Play for Android purchases.
• The signed App Store transaction (iOS) or the Google Play purchase token (Android) is verified by our backend.
• We store: tier, product ID, expiry date, founding-subscriber flag, and the verified store transaction ID.
• We do NOT store Apple or Google notification payloads, or your payment details.

Data retention

We keep your data for as long as your account exists, so the app can work and your group can share. When you delete your account, we remove your personal data as described in the next section.

Mealuna runs automated cleanup routines for several data types. Most of them are active: a nightly job permanently removes the data listed below once its retention period has passed. Where a routine is not yet switched on, we say so explicitly.

Receipt images: automatically removed 30 days after upload.

Recipe pictures: automatically deleted within a few days after the picture is removed or replaced or the recipe is deleted.

Shopping-list archive snapshots: automatically removed after 90 days.

Group invite links: deleted 72 hours after creation.

Pending join requests: removed after 30 days without an answer.

Financial records: once balances are settled, user references are designed to be removed after 180 days. This cleanup is not yet active.

Your food log is stored on your device and is removed when you delete the entries or the app. If you have turned on your phone's backup, a copy may remain in your own Google or Apple account until that backup expires or you delete it there — we have no access to it and cannot delete it for you.

For pantry changes through an assistant, Mealuna keeps a one-way fingerprint (a hash) of every receipt added, made from the shop, its time and its total, or from its date and its lines, and of every confirmed plan. We keep these with the group and when the change was written, so the same receipt or confirmation is not written twice. Fingerprints older than 90 days are deleted the next time that group adds to or takes stock of its pantry through an assistant, not by the nightly cleanup job. All are deleted when the group is deleted.

• Account data: kept while your account exists.
• Receipt images: removed after 30 days.
• Recipe pictures: deleted within a few days after being removed or replaced, or after the recipe is deleted.
• Archive snapshots: removed after 90 days.
• Share links: deleted after 72 hours.
• Pending join requests: removed after 30 days.
• Financial net-null purge: designed for 180 days at zero balance — not yet active.
• Food log: on-device only; removed when you delete entries or the app.
• Assistant pantry fingerprints: older than 90 days are deleted at the group's next pantry addition or stocktake through an assistant, not by the nightly job; all are deleted with the group.

Device backup

Your phone can back itself up to your own Google or Apple account. If you turn that on, the backup includes Mealuna's on-device data — including your food diary, body measurements, custom foods and loyalty cards. That copy belongs to your Google or Apple account, not to Mealuna. We never receive it, we cannot read it, and we cannot restore it for you.

We recommend turning it on. It is the only way your diary survives a lost, broken or replaced phone: because we never hold this data, we cannot bring it back for you. On Android, if your phone has a screen lock, the backup is encrypted with a key that stays on your phone — so neither Google nor Mealuna can read it. On iPhone, iCloud Backup is encrypted in transit and on Apple's servers, but it is end-to-end encrypted only if you have turned on Apple's Advanced Data Protection.

Two limits worth knowing, because they are the platform's and not ours. A backup runs on your phone's own schedule — roughly once a day, while it is idle, charging and on Wi-Fi — so the most recent entries may not be in it yet. And Google deletes an Android backup after 57 days without the device being used, which means a phone that is lost and not replaced within about eight weeks loses its backup too.

If more than one person signs in on the same phone, only the account currently signed in is included in the backup. The other accounts' data stays on the device and is never uploaded.

Your rights and choices

Under the GDPR you have rights over your personal data, including access, correction, deletion, restriction, objection, and portability. You can exercise these by contacting us at mealuna.app@gmail.com.

Some controls are built directly into the app.

You can delete your account in the app. Deletion first removes you from all your groups, then deletes your authentication account. This cascades to your profile, memberships, device sync cursors, subscriptions, and entitlement grants. Shared financial history (purchases and settlements) is retained with your references removed, so that co-members' balances remain accurate.

Allergen sharing is opt-in. If you turn it off, your allergens are not stored on the server, and turning it off clears any value stored before.

Contributing scanned product data to Open Food Facts is opt-in.

You can change the app language and edit your display name at any time. Recipes you create default to private.

Note: the app does not yet offer a self-service data-export feature. If you need a copy of your data, contact us.

• Delete your account in-app (cascades profile, memberships, sync cursors, subscriptions, entitlement grants).
• Shared financial history is kept with your references nulled for co-members' accuracy.
• Allergen sharing: opt-in; turning it off clears the stored value.
• Open Food Facts contribution: opt-in.
• Change app language and edit display name anytime.
• Your created recipes default to private.
• No self-service data export yet — contact us for a copy.
• Right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Coming soon

Some capabilities are planned but not yet active. We list them here so this policy stays accurate. If and when these launch, we will update this policy and, where required, ask for your consent.

Sharing AI-generated recipes is planned but not yet active.

• Coming soon: AI recipe sharing.

Children

Mealuna is designed for families and households. The app is not intended for direct use by young children, and we do not knowingly create accounts for them.

A group can mark a member as a child within the group (for example, to adjust portions). This is a group setting and is used only to make shared planning work; it does not create a separate account for that child.

If you believe a child has provided us personal data without appropriate consent, contact us at mealuna.app@gmail.com and we will address it.

• Not intended for direct use by young children.
• A 'child' flag is a group planning setting, not a separate child account.
• Contact us if a child has provided data without proper consent.

International data transfers

Mealuna serves users in the EU, and we work with our processors to keep your data protected to GDPR standards.

Some of our processors (such as Apple and Google) are global companies, and processing may involve transfers outside the European Economic Area. Where that happens, transfers are protected by appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

If you would like more detail on the safeguards in place, contact us at mealuna.app@gmail.com.

• Some processors operate globally; transfers outside the EEA may occur.
• Transfers are protected by GDPR safeguards (e.g. Standard Contractual Clauses or adequacy decisions).

Changes to this policy

We may update this policy as the app evolves, for example when a planned feature becomes active or when we add or change a processor.

When we make a material change, we will update the date at the top and, where appropriate, let you know in the app.

We encourage you to review this policy from time to time.

• We update this policy as features and processors change.
• Material changes are dated and, where appropriate, surfaced in-app.

Contact us

If you have any question about this policy or your personal data, or want to exercise your rights, please get in touch.

Varres Solutions OÜ, Estonia.

Email: mealuna.app@gmail.com

• Controller: Varres Solutions OÜ (Estonia)
• Email: mealuna.app@gmail.com