Privacy Policy for Meally

Last updated: November 5, 2026

1. Introduction

Welcome to Meally ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our mobile application.

2. Information We Collect

2.1 Personal Information

When you use our app, we may collect:

• Email address (when you sign in with Google)
• Name and profile picture (from your Google account)
• User ID (automatically generated)

2.2 Data You Provide

• Recipes you create or save
• Meal plans you create
• Shopping lists
• Photos you upload for recipes

2.3 Camera Permission

We request camera permission to allow you to take photos of your meals and recipes. Photos are stored securely in your personal cloud storage and are only accessible by you. We do not access your camera without your explicit permission for each use.

3. How We Use Your Information

We use your information to:

• Provide and maintain the app functionality
• Authenticate your account via Google Sign-In
• Store your recipes, meal plans, and shopping lists
• Sync your data across devices
• Improve app performance and user experience
• Analyze app usage through anonymized analytics
• Process purchases and subscriptions, and unlock Premium on your devices (see 5.1)
• Measure which Apple Ads campaigns lead to installs of our iPhone and iPad app (see 5.2)
• Read the recipes you import, and run AI features such as translation and nutrition estimates (see 5.3)

4. Data Storage and Security

Your data is stored securely using Firebase services (Firestore, Authentication, and Storage), which are provided by Google Cloud Platform. We implement industry-standard security measures including:

• Encrypted data transmission (HTTPS/TLS)
• Secure authentication protocols
• Access controls and user authentication
• Regular security updates

5. Third-Party Services

We use the following third-party services:

• Google Sign-In: For secure authentication
• Firebase (Google): For data storage, authentication, and app infrastructure
• Google Analytics for Firebase: To understand app usage patterns (anonymized data)
• RevenueCat: For purchases and subscriptions (see 5.1)
• Apple AdServices (through RevenueCat): To measure which Apple Ads campaigns lead to installs on iPhone and iPad (see 5.2)
• Google Gemini (through Firebase AI Logic and the Gemini API): To read the recipes you import, and for AI features (see 5.3)

These services have their own privacy policies. We recommend reviewing:

• Google Privacy Policy
• Firebase Privacy Policy
• RevenueCat Privacy Policy
• Apple Advertising & Privacy

5.1 Purchases and subscriptions (RevenueCat)

Meally Premium is sold through Apple's App Store and Google Play. We use RevenueCat, a service of RevenueCat, Inc. (United States), to handle these purchases and subscriptions in our iPhone, iPad and Android apps. RevenueCat does not receive your payment card details; Apple and Google handle the payment.

RevenueCat receives:

• Your Meally user ID, the random ID of your Meally account. We don't give RevenueCat your name or email address.
• Purchase and subscription data from the App Store or Google Play: the plan you bought, its price and currency, the purchase, renewal and expiry dates, the store's transaction IDs, and whether a subscription is active, cancelled or refunded.
• Device and app information that the RevenueCat software in our app sends with each request, such as the device model, the operating system and its version, the app version, your language settings and the country of your App Store or Google Play account. On iPhone and iPad this includes Apple's identifier for vendor (IDFV), an ID that Apple assigns to our app on your device. It is not the advertising identifier (IDFA). Like any server, RevenueCat also sees your IP address.

We use this to complete and restore purchases, to check that they are genuine, to unlock Premium on every device where you sign in, and to see how many people subscribe, renew and cancel. Purchases are made only in the mobile apps, so the web app asks our server, which looks up your Premium status at RevenueCat using your user ID.

RevenueCat stores and processes this data in the United States.

5.2 Apple Ads attribution (iPhone and iPad)

We advertise Meally with Apple Ads, Apple's advertising in the App Store. Since version 1.6.2, our iPhone and iPad app uses Apple's AdServices framework, through RevenueCat, to learn which Apple Ads campaign, ad group and keyword led to an install:

• After you install the app, the RevenueCat software in the app asks your device for an attribution token from Apple and sends it to RevenueCat with your Meally user ID.
• RevenueCat sends the token to Apple. Apple replies whether the install came from an Apple Ads campaign and, if it did, which campaign, ad group and keyword led to it.
• RevenueCat stores Apple's answer with your Meally user ID. This shows us which campaigns bring people who go on to buy Premium, so we can decide where to spend our advertising budget.

This does not use your device's advertising identifier (IDFA). We don't track you across other companies' apps or websites, and the app does not ask for tracking permission (App Tracking Transparency). Our Android app and the web app don't use Apple Ads attribution.

RevenueCat processes this data in the United States. Apple's own handling of advertising data is described in Apple Advertising & Privacy; Apple may process it in the United States.

5.3 Reading recipes with AI (Google Gemini)

Meally uses Google's Gemini AI models to turn the recipes you import into ingredients and steps, and for a few AI features. The app sends the content to Google through Firebase AI Logic. Some imports, for example links you share to Meally from another app and TikTok links, run on our servers (Cloud Functions in the United States), which send the content to Google's Gemini API. Depending on what you do, Google receives:

• When you import from a link: the link and the content of the page. For a website, that is its title, headings, text and any recipe data it contains; for an Instagram, TikTok or Facebook post, its caption. If a website blocks our server, Gemini reads the page through Google Search. If Meally can't recognize some ingredient lines, those lines can be sent to Gemini too.
• When you import from a photo or PDF: the photo or PDF itself, or the text your device recognized in it.
• When you use an AI feature: to translate a recipe, its name, ingredients, steps and notes; for a nutrition estimate, its ingredient list; for category suggestions in the recipe editor, its name, servings, time, ingredients and steps.

We don't send your name, email address or account details with these requests. When the app contacts Google directly, Google also sees your device's IP address. Google sends back the result, such as the recipe's ingredients and steps, and what you save is stored in your account like any other recipe. Google may process this data outside the EU, including in the United States.

6. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Deletion: Delete your account and associated data
• Export: Download your data in a portable format
• Withdraw consent: Stop data processing at any time
• Object: Object to certain types of data processing

7. Data Retention

We retain your data for as long as your account is active. If you delete your account, your data will be permanently deleted from our servers within 30 days, except where we are required to retain it for legal purposes.

8. Children's Privacy

Our app is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

9. International Data Transfers

Your data may be transferred to and stored on servers located outside your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this privacy policy.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of any material changes by updating the "Last updated" date at the top of this policy.

12. GDPR Compliance (EU Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including:

• The right to data portability
• The right to restriction of processing
• The right to lodge a complaint with your local supervisory authority

Our lawful basis for processing your data is based on your consent and the performance of our contract with you (providing the app service).

13. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to opt-out of the sale of personal information. Note: We do not sell your personal information.