Privacy Policy

1. Who is responsible

MealStack (the app on iOS and Android, the web app at my.mealstack.app and the website at www.mealstack.app) is run by:

He is the controller under the EU General Data Protection Regulation (GDPR). For any question about your data or to exercise your rights, write to the address above.

2. In short

• We collect what MealStack needs to work: your email address, your name, and the recipes, meal plans and photos you add.
• We don't sell your data and use no advertising trackers. To see how MealStack is used, our servers record usage statistics under your technical user ID, without your name or email address. You can object at any time (see section 3, "Usage statistics").
• People in your circle see what you share with the circle. Nobody else does, except recipe photos, which anyone with the photo's link can open (see section 5).
• Some features use service providers, for example Anthropic's Claude to read a recipe you import. Section 6 lists each one and what it receives.
• You can delete your account in the app at any time.

3. What we collect and why

Your account

To sign in you give us your email address. We send a one-time code to it; for a few review accounts we use a password instead. We store your first and last name if you enter them, and a technical user ID. We need this to run your account (Art. 6(1)(b) GDPR, performance of our contract with you).

Circles, recipes and meal plans

MealStack stores the circles you create or join, and the recipes (name, ingredients, steps, cooking time, source link), meal plans and recipe photos you or your circle members add. This is the service itself (Art. 6(1)(b) GDPR). The app keeps a copy on your device so it works offline.

Importing recipes

When you import a recipe, we use Anthropic's Claude to turn it into a structured recipe:

• From a link: our server downloads the page and sends its text to Claude.
• From the in-app browser: the app sends the content of the page you have open. If you are signed in to that website, the page may contain your details there, so only import from pages you're comfortable sharing.
• From a photo: the photo you take or pick is sent to Claude.

We send this content, not your name or email address. Legal basis: Art. 6(1)(b) GDPR, because you asked for the import.

Searching for recipes on the web

Your search terms, language and country are sent to the Brave Search API, without your name, email address or user ID. The app then shows images and pages directly from the websites in the results, so those websites see your IP address, as with any website you visit (Art. 6(1)(b) GDPR).

Emails from us

Sign-in codes are sent through our email provider Resend, which receives your email address, your first name and the code (Art. 6(1)(b) GDPR). We don't send newsletters or marketing email.

Crash reports

When the app crashes or hits an error, it sends a report to Sentry: the error and where it happened in the code, the app version, the device model and operating system. The report does not contain your name, email address or IP address. We use it to find and fix bugs, which is our legitimate interest (Art. 6(1)(f) GDPR).

Usage statistics

To know how many people use MealStack and which features they use, our servers record an event when you:

• confirm your email address when signing up;
• use the app on a given day (we notice this when the app renews your sign-in);
• add a recipe or plan a meal;
• create or join a circle, or create an invite link;
• import a recipe, search for recipes on the web, or use the planning assistant.

Each event contains your technical user ID, the time and a few details about the action, for example the meal type, whether a recipe has a source link or a photo, how many search results there were, or whether an import worked. It does not contain your name, email address, IP address, recipe contents, links or search terms. The events are created on our servers from what the app sends anyway; nothing is stored on or read from your device for this. They are sent to PostHog (section 6) and stored in the EU (Frankfurt, Germany).

We use them to count active users, see which features are used and where people get stuck, and improve MealStack. That is our legitimate interest (Art. 6(1)(f) GDPR); we don't use the events for advertising, don't combine them with other data about you and don't pass them on. You can object at any time: in the app, open Profile, tap the gear on your profile card and turn off "Share usage statistics", or email contact@mealstack.app from the address you sign in with. From then on we no longer record events for you, and on request we delete those already recorded.

Server logs

Our hosting providers (section 6) keep technical logs of requests, which include IP addresses, times and the requested address, and our server functions log technical details such as your user ID and the link of an imported recipe. We use them to run the service securely and to find errors (Art. 6(1)(f) GDPR).

Visiting the website

The website www.mealstack.app currently sets no cookies and uses no analytics (see section 9). Our host Cloudflare logs requests as described above. Fonts are served from our own domain, so loading a page contacts no one else.

When you contact us

If you email us, we use your email address and message to answer you (Art. 6(1)(b) or (f) GDPR).

4. Device permissions

The app asks for access to your camera and photo library only when you add a recipe photo or import a recipe from a photo. It does not use your location, contacts, calendar or microphone. You can change permissions at any time in your device settings.

Push notifications: the app asks for your permission before it sends any. If you allow them, a technical address for your device (a push token) is stored with your account and used to deliver notifications through Apple's or Google's push service. We use them for things related to your account and circle, not for advertising (Art. 6(1)(a) GDPR, your consent). You can turn them off at any time in the app or in your device settings.

On your device, the app stores your sign-in session in the secure storage of the operating system (Keychain on iOS, Keystore-protected storage on Android) and keeps an offline copy of your circle's data. On Android this data is excluded from device backups.

5. Who can see your data

• Your circle: everyone in a circle sees and can edit its recipes and meal plan, and sees the circle's name and the first and last names of its members. Other members don't see your email address.
• Invite links: anyone who has an invite link to your circle can join it for 30 days after it was created, and before joining sees the circle's name and the inviting member's first name. Only share invite links with people you want in your circle.
• Recipe photos: photos are stored with a long, random web address. Anyone who has that address can open the photo without signing in.
• Service providers process data for us as listed in section 6.
• Authorities: we disclose data only where we are legally required to.

We don't sell or rent personal data, and we don't share it for advertising.

6. Service providers and transfers outside the EU

These providers process personal data on our behalf, under data processing agreements (Art. 28 GDPR). Where data leaves the EU or the European Economic Area, it is protected by an adequacy decision of the European Commission (for the UK and for companies certified under the EU-U.S. Data Privacy Framework) or by the Commission's Standard Contractual Clauses.

• Supabase (Supabase Inc., USA): database, sign-in and file storage for all app data, and our server functions. Data is stored in London, United Kingdom.
• Anthropic (Anthropic Ireland Limited, Ireland; processing in the USA by Anthropic, PBC): reads recipes you import (links, page content, photos). Anthropic does not use this data to train its models.
• Brave Search (Brave Software, Inc., USA): web recipe search; it receives your search terms, language and country only.
• Resend (USA): sends sign-in emails.
• Sentry (Functional Software, Inc., USA): crash reports, stored in the EU (Germany).
• Cloudflare (Cloudflare, Inc., USA): hosts the website and the web app, and runs the DNS for mealstack.app.
• PostHog (PostHog Inc., USA): usage statistics (section 3); it receives the events described there, stored in the EU (Frankfurt, Germany).

7. How long we keep data

• Account and content: until you delete your account (section 8).
• Sign-in codes expire after one hour.
• Invite links stop working after 30 days.
• Crash reports and server logs are deleted automatically by the providers after their retention period, at most 90 days.
• Usage statistics are deleted after at most 13 months. If you delete your account, the events already recorded stay linked only to a user ID that no longer exists anywhere else, and are deleted at the end of that period.
• Backups: we currently keep no backups of the database, so deleted data is gone as soon as it is deleted. If we start keeping backups, deleted data will disappear from them within their retention period of at most 30 days.
• Emails to us are kept as long as needed to answer them and for any legal retention period.

8. Your rights

Under the GDPR you have the right to:

• access your data and get a copy of it (Art. 15), also in a machine-readable format (Art. 20);
• have it corrected (Art. 16) or deleted (Art. 17);
• restrict its processing (Art. 18);
• object to processing based on our legitimate interests (Art. 21), for example to the usage statistics in section 3;
• withdraw consent at any time, for example for push notifications, with effect for the future (Art. 7(3)).

Deleting your account: in the app, open Profile, tap the gear on your profile card and choose "Delete account". This deletes your profile and sign-in data, and circles where you are the only member together with their recipes, meal plans and photos. Recipes and meal plan entries you added to a circle you share stay in that circle for its other members, and circles you own pass to the member who joined first. Photos that no recipe uses any more are removed from our storage automatically. You can also ask us to delete your account by email; see our account deletion page.

Getting a copy of your data: email us at contact@mealstack.app from the address you use to sign in, and we'll send you your data within one month.

You also have the right to complain to a data protection authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), but you can also contact the authority where you live.

9. Cookies and tracking

The web app stores your sign-in session and an offline copy of your data in your browser's local storage. This is strictly necessary for it to work, so it needs no consent.

Neither the website nor the app uses cookies or other tools that store or read information on your device for analytics or tracking. The usage statistics in section 3 are created on our servers only. If we ever add analytics that store or read information on your device, we will only use them after you have agreed (Art. 6(1)(a) GDPR and § 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG), you can withdraw that consent at any time, and we will name each tool, what it collects and who provides it in this policy before it goes live.

10. Children

MealStack is meant for people aged 16 and over and is not directed at children. If you believe a child under 16 has given us personal data, contact us and we'll delete it.

11. Security

All connections are encrypted (HTTPS/TLS). Access to data in the database is limited to the members of the circle it belongs to. No system is perfectly secure, but we review and improve these measures regularly.

12. Changes to this policy

We update this policy when MealStack or the providers we use change. The date at the top shows the latest version. We'll point out important changes in the app.

This policy is also available in German.