Privacy Policy

1. Information We Collect

We may collect account information such as your name, email address, Google or Apple account identifier, profile photo, newsletter preference, and accepted consent records. If you use Sign in with Apple, Apple may provide a private relay email address instead of your personal email address.

We may also collect meal plan data, settings, saved recipes, favorite recipes, allergies, foods to avoid, diet preferences, cuisine preferences, calorie targets, selected country, shopping lists, generated recipes, recipe photos you submit for review, and account settings you choose to save.

2. Authentication

We use Supabase Auth together with Google Sign-In and Sign in with Apple to create and access your account. Google may provide your email, name, profile photo, and account identifier. Apple may provide your name, email or private relay email, and Apple account identifier. We use this information to identify and secure your account. Apple may provide your name only when you first authorize the Service.

When you enter an email address to request a sign-in link, our Supabase authentication database stores the address and its verification status so that we can send and verify the link and protect the registration process from abuse. This happens before registration is complete. If the address is not verified, we automatically delete the unconfirmed authentication record after seven days. We do not subscribe an unconfirmed address to the newsletter or use it for marketing.

To prevent and investigate registration abuse, we keep a limited security record for no more than 24 hours. It contains the request time, IP address, browser or app User-Agent, email domain, referring website origin, verification status, and a secret-keyed hash of the normalized email address rather than the email address itself. The complete referring URL is not stored. These records are restricted to server-side administrative access, are automatically deleted, and are not used for marketing, advertising, or analytics.

3. Payments and Subscriptions

Website payments, invoices, checkout, billing details, and payment method handling are processed by Stripe. Purchases made in the iOS application are processed by Apple through the App Store, and purchases made in the Android application are processed by Google through Google Play. We do not store full payment card numbers, CVC codes, or complete bank account details on our servers.

We may store Stripe customer, subscription, and checkout session identifiers for website purchases. For Apple App Store and Google Play purchases, we may store product and transaction identifiers, purchase tokens, subscription status, purchase, expiration, and revocation dates, and other limited purchase metadata supplied or verified by the applicable store. We use this data to activate, renew, restore, or disable paid features.

Stripe may collect and process payment information, billing address, tax information, device information, fraud-prevention signals, and transaction records according to Stripe's own privacy policy and legal obligations.

Apple and Google process their respective app-store payment and billing information according to their own privacy policies and legal obligations. We receive only the purchase information needed to verify and manage access to paid features, not your full app-store payment method details.

4. Meal Plan Generation and Nutrition Data

We may process your selected preferences and saved meal plan content to generate, regenerate, save, print, and display meal plans, shopping lists, recipes, macros, and calorie estimates.

The service may use external providers and data sources, including OpenAI for generated content and USDA FoodData Central for food and nutrition data.

5. Analytics, Local Storage, and Cookies

The website uses cookies, local storage, and session storage for account, security, preference, subscription, and meal plan functionality. Some storage is essential for the website to work.

Essential storage may include authentication sessions, CSRF or security-related values, consent records, saved meal plan state, shopping list selections, UI preferences, and subscription access state. Stripe, Supabase, Google, and Apple may also use cookies, local storage, or similar technologies when you use the Service, authenticate, or make a payment.

We use Zenovay analytics on our website to understand traffic and improve the Service. Depending on the tracker configuration and the page you visit, Zenovay may process page URLs and titles, referrers, visit and session times, device type, browser, operating system, display information, approximate location derived from an IP address, campaign or conversion information, and engagement data such as scroll depth, clicks, and form interactions. We do not intentionally send passwords, payment-card details, or the contents of sensitive form fields to Zenovay.

Zenovay is configured in cookieless mode and is loaded only after you accept analytics in our cookie banner. In this mode, Zenovay does not store cookies or analytics identifiers in local storage on your device. Zenovay processes an IP address for functions such as routing, security, and approximate geolocation and states that the plain IP address is not retained in its analytics database. Zenovay processes this information on our behalf as an analytics provider.

If you accept optional tracking, we also load the Google tag for Google Ads conversion measurement. Google may process page URLs, referrers, device and browser information, IP-derived location, advertising click identifiers, purchase-success page visits, and cookies such as _gcl_*. We use this information to measure purchases and campaign performance. Google Consent Mode v2 is denied by default. The Google tag loads in this denied state and may send cookieless measurement signals. If you accept optional tracking, consent is updated to granted. If you reject tracking, Google Ads cookies and personalised advertising signals remain disabled.

We do not sell personal information. Analytics and advertising measurement information is used to measure and improve the Service, diagnose problems, understand feature usage, and assess advertising campaign performance.

We use Sentry for essential crash reporting and limited performance diagnostics on the website and mobile application. Diagnostic reports may include the app release, device and operating-system type, error stack trace, coarse operation status, and timing data. We configure Sentry not to receive account identities, email addresses, passwords, authentication or purchase tokens, meal-plan preferences, recipe content, request bodies, or URL query strings. Session replay is not enabled, diagnostic breadcrumbs are limited to technical feature and action names, and performance events are sampled. We use these reports only to investigate failures, security, reliability, and performance.

If you enable push notifications in the mobile application, we use OneSignal to deliver them. OneSignal may process the app's internal account identifier, a OneSignal subscription identifier, the device push token supplied by Apple or Google, notification permission and delivery status, app version, device type, operating system, and interactions with notifications. If you separately enable new recipe alerts, the notification also contains the public recipe's title and internal recipe identifier so the app can open it. We do not provide OneSignal with your email address, name, meal plans, or dietary preferences. You can opt out in the application's Account settings or in your device settings.

We store your analytics choice in local storage so we can respect it on later visits. You can change that choice at any time using the Cookie settings link in the website footer. You can also control cookies through your browser settings. Blocking essential cookies or storage may prevent login, checkout, saved meal plans, shopping list selections, or other features from working.

6. How We Use Information

We use information to provide the Service, authenticate users, manage subscriptions, save meal plans, generate recipes and shopping lists, personalize settings, maintain security, debug problems, prevent abuse, process payments, send service notices, improve the service, and comply with legal obligations.

Where applicable law requires a legal basis, we process information to perform our contract with you, pursue legitimate interests such as security and service improvement, comply with legal obligations, and use consent where required, such as for optional newsletter communications.

7. How We Share Information

We may share information with service providers needed to operate the Service, including Supabase, Google, Apple, Stripe, Resend, Sentry, OneSignal, Zenovay, OpenAI, hosting providers, and nutrition data providers. Resend processes the contributor's email address and approval message when we send a recipe-photo approval notice. These providers may process information only as needed to perform their services for us or as independently required by their terms and legal obligations. We do not sell your personal information.

We may also disclose information if required by law, to protect our rights, to prevent abuse, or to investigate security issues.

8. Newsletter

If you choose to subscribe to the newsletter, we may use your email address to send updates. You can unsubscribe or change this preference where available.

9. Data Retention

We keep account, subscription, meal plan, and preference data for as long as needed to provide the service, comply with legal obligations, resolve disputes, prevent abuse, or maintain business records. Analytics data is retained according to our Zenovay plan and configuration and is deleted or aggregated when no longer needed. Deleted account data may take time to be removed from backups and logs.

An email address entered for passwordless registration is retained as an unconfirmed registration attempt for no more than seven days. If the sign-in link is not verified during that period, the unconfirmed authentication record is automatically deleted.

Recipe photos submitted for review are stored privately with your account identifier, email address, the relevant recipe identifier, and your selected photo credit. If you choose to be credited, we also store the display name and optional social profile link you provide. Rejected submissions are deleted when rejected. Accepted photos and the credit you selected may be retained and published for as long as the recipe remains available, subject to the license in our Terms of Use. If a published photo is reported or removed, we may retain a restricted audit record containing the uploader's internal account identifier and the original upload and consent timestamps for as long as reasonably necessary to investigate the report, prevent abuse, comply with law, or establish, exercise, or defend legal claims. This audit information is not published.

10. Your Choices

You may log out, cancel a subscription, clear the current meal plan, or delete your account from account settings where these features are available. You may also choose not to provide optional meal plan preferences, though some features may work less accurately.

Cancelling a subscription and deleting an account are separate actions. Deleting your account does not automatically cancel an Apple App Store or Google Play subscription; you must manage or cancel it through the applicable store's subscription settings.

If you delete your account, we will delete or de-identify account data where reasonably possible, subject to records we must keep for security, fraud prevention, tax, accounting, payment, dispute, or legal compliance purposes. If you used Sign in with Apple, we also send Apple a request to revoke the sign-in authorization token tied to the deleted account. Pending and rejected recipe-photo submissions are deleted. For accepted photos, we may keep the photo and minimal non-identifying license evidence, but remove the account identifier, email address, display name, and social profile link and replace the public credit with “Anonymous My-diet.ai user.” As a limited exception, a restricted report or removal record may retain the uploader's internal account identifier and original upload and consent timestamps for the legal and safety purposes described above, including after account deletion. You may request removal of a retained or published photo by emailing support@my-diet.ai.

11. Security

We use reasonable technical and organizational measures to protect information. No internet service is completely secure, and we cannot guarantee absolute security.

12. Children

The Service is not intended for children. Do not use the Service or create an account if you are not old enough to consent to these terms under the laws that apply to you.

13. International Use

Your information may be processed in countries other than your own, depending on where our service providers operate. Those countries may have different data protection laws.

14. Contact

For privacy, account, subscription, or data deletion questions, email support@my-diet.ai.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted on this page with a new effective date. Continued use of the Service after changes means you accept the updated policy.