Mealnomics Privacy Policy
Draft for lawyer review — not legal advice. This document was written by an engineering session from the project's own data model (see
docs/metrics.mdandsupabase/migrations/). It is not a substitute for review by a licensed attorney in the jurisdictions where Mealnomics operates (at minimum: the state(s) where the company is formed/does business, and EU/UK law for the GDPR section). Replace every[PLACEHOLDER]before publishing.
Effective date: October 6, 2026
1. Who we are
Mealnomics is operated by [COMPANY LEGAL NAME] ("Mealnomics," "we," "us"), located at [COMPANY ADDRESS]. This policy covers the Mealnomics mobile app (iOS and Android) and the mealnomics.com website.
Contact: [email protected]
2. Scope
Mealnomics is built for households in the United States. This policy is written for that audience, with added sections for California residents (Section 8) and users in the EU/UK/EEA (Section 9) in case they use the app.
3. Information we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Account identity | Email address; a unique account ID | Sign in with Apple or Google when you create an account |
| Household profile | Household name, ZIP/store preference, weekly budget, number of dinners per week, kitchen appliances you have | You, during onboarding or in Settings |
| Member profiles | First names of the people you're cooking for — this can include a child's first name if a parent enters it to plan that child's meals — plus each person's diet tags, allergens, and free-text exclusions (e.g., "no cilantro") | You, during onboarding or in Settings |
| Plans & shopping lists | The weekly dinners generated for your household, your shopping list and which items are checked off, which dinners you've marked as cooked | Generated by the app; check-offs and "I cooked this" taps from you |
| Recipe swap requests | Free text you type to ask for a different version of a dinner (e.g., "make it vegetarian," "use the chicken thighs I have") | You, when you request a swap |
| Device & notifications | A push notification token, device ID, platform (iOS/Android/web), and when the device was last seen | Automatically, from your device, to deliver trial-ending and subscription alerts |
| Subscription status | Whether you're in a trial, active, in a billing grace period, or expired, and when it renews | Mirrored from RevenueCat, which gets it from the Apple App Store, Google Play, or Stripe |
| Support messages | Your email, the subject and body of any message you send us | You, through the in-app support form |
| Usage events | App actions such as onboarding_started, preview_seen, paywall_seen, trial_started, plan_generated, meal_swapped, meal_cooked, list_shared, support_ticket (full list in docs/metrics.md) | Automatically, as you use the app |
What we do not collect: payment card numbers, bank details, or government ID numbers. Billing is handled entirely by Apple, Google, and Stripe; we only ever see a subscription status, never your card.
We do not use advertising SDKs, and we do not collect precise location.
4. How we use information
- Build your weekly dinner plan, shopping list, and budget estimate.
- Keep your diet, allergen, and exclusion settings so recipes stay safe and relevant for your household.
- Run the recipe-swap feature: when you request a swap, the text you typed plus your household's diet/allergen/exclusion settings (not your name or email) are sent to Anthropic's Claude API to draft a replacement recipe, which is then checked by our recipe validator before it reaches you.
- Sync your plan, shopping list, and check-offs across up to 3 household devices.
- Send trial-ending and billing-issue notifications.
- Respond to support requests.
- Understand product usage in aggregate (e.g., how many households reach the paywall) so we can improve the app. We do not build advertising profiles from this data.
- Detect fraud and abuse (e.g., the 3-device and 20-swaps-per-day limits).
5. Who we share information with
We share information only with the service providers that help us run Mealnomics, under contracts that limit their use of it to providing that service:
| Provider | What they get | Why |
|---|---|---|
| Supabase | All of the above, as our database/auth/backend host | Hosting, authentication, data storage |
| Apple (Sign in with Apple, App Store, StoreKit) | Email (or a private relay email), subscription purchase events | Login, billing |
| Google (Google Sign-In, Google Play Billing) | Email, subscription purchase events | Login, billing |
| RevenueCat | Subscription/purchase events and a household ID | Subscription status management |
| Stripe | Email and payment details for web checkout (handled entirely by Stripe; we don't see card numbers) | Web subscription billing |
| Resend | Your email, subject, and message body for support tickets | Sending/receiving support email |
| Anthropic (Claude API) | The free text of a recipe-swap request plus diet/allergen/exclusion tags (no name or email) | Generating the recipe-corpus content and swap recipes |
| Expo (push notification service) | Push token | Delivering trial and billing notifications |
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have no advertising or analytics-for-ads SDKs in the app.
6. Children's privacy
Mealnomics is not directed to children, and you must be at least 13 years old to create an account. Only an adult account holder can add a household member profile; a child does not sign in or interact with Mealnomics directly. If you believe a child created an Mealnomics account on their own, contact [email protected] and we will close it.
7. Your choices
- Access/export/delete: email [email protected] from your account email and we will provide or delete your household's data, subject to what we must keep for legal, tax, or fraud-prevention reasons.
- Correct: update diets, allergens, exclusions, and household details any time in Settings.
- Push notifications: turn these off in your device's OS settings.
- Delete account: request this via support; deleting the owner's account deletes the household, its members, plans, and shopping lists.
- Restore purchases / manage subscription: available in Settings at any time; canceling a subscription does not delete your account data.
8. California privacy rights (CCPA/CPRA)
If you are a California resident, this section applies to you in addition to the rest of this policy.
Categories of personal information we collect, mapped to the CCPA categories: identifiers (email, account ID, device ID, push token); customer records (household member names, diet/allergen/exclusion free text); commercial information (subscription and purchase history); internet/network activity (in-app usage events); and account/household preferences we treat as customer records (budget, store choice, appliances). We do not collect biometric information, precise geolocation, or browsing history outside our own app.
- Right to know what we collect, use, and share, as described in Sections 3–5.
- Right to delete your personal information, subject to legal exceptions (Section 7).
- Right to correct inaccurate personal information.
- Right to opt out of sale/sharing: we do not sell or share personal information as defined by the CCPA/CPRA, so there is nothing to opt out of.
- Right to limit use of sensitive personal information: we treat diet, allergen, and health-adjacent preferences as sensitive and use them only to run the meal-planning feature — never to build an advertising profile.
- Non-discrimination: we will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.
To exercise any of these rights, email [email protected] from your account email, or have an authorized agent contact us with your written permission. We will verify your identity using your account email before responding.
9. EU/UK/EEA users (GDPR)
If you access Mealnomics from the EU, UK, or EEA, the following applies.
- Controller: [COMPANY LEGAL NAME], [COMPANY ADDRESS].
- Legal basis for processing: performance of a contract (running your meal plan and subscription), legitimate interest (product analytics, fraud prevention, keeping the service secure), and consent where we ask for it (e.g., push notifications).
- International transfer: our service providers (Section 5) are based in or process data in the United States. Where required, transfers rely on the EU Standard Contractual Clauses or an equivalent safeguard; contact [email protected] for a copy of the relevant safeguard.
- Retention: we keep household and plan data while your account is active, and support/subscription records for as long as needed for accounting and legal compliance, generally no more than 7 years after account closure.
- Your rights: access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest. Contact [email protected] to exercise any of these; we have not appointed a separate Data Protection Officer at this size.
- Complaints: you may lodge a complaint with your local data protection supervisory authority.
10. Data retention
We keep your data while your account is active. If you delete your account, we delete household, member, plan, and shopping-list data within 30 days, except where we must keep records (e.g., support tickets, subscription/billing records) for accounting, tax, fraud-prevention, or legal reasons.
11. Security
We use industry-standard safeguards (encryption in transit, database row-level security that restricts each household's data to its own members, access limited to service roles for backend jobs) to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
12. Changes to this policy
We'll update the effective date above when we make changes and, for material changes, notify you in the app or by email before they take effect.
13. Contact
[COMPANY LEGAL NAME] [COMPANY ADDRESS] [email protected] mealnomics.com