Privacy Policy
Last updated: 21 August 2026
This policy explains what personal data Mealione collects, why we need it, who else touches it, how long we keep it and what you can ask us to do with it. It covers the Mealione mobile app, our website at mealione.com and the pages we serve at app.mealione.com.
The short version, before the detail:
- We ask health questions (body measurements, goal, diet, allergies) because a weekly meal plan is calculated from the answers. They are used for your plan and for nothing else.
- We never sell your data and we run no advertising in the app. No advertising network receives anything about you from us.
- You can delete your account, and everything attached to it, from inside the app — without writing to us and without waiting. If you cannot open the app, email support@mealione.com and we will do it for you.
1. Who is responsible for your data
HG POINT LIMITED, a company registered in the Republic of Cyprus ("Mealione", "we", "us"), is the controller of the personal data described here. Our registered address is Spyrou Kyprianou 78, Limassol 3076, Cyprus. You can reach us about anything in this policy at support@mealione.com.
2. What we collect and why
We only collect what a meal plan and a paid account need. We do not buy personal data from data brokers, and we do not build profiles about you for anyone else.
| What | Examples | Why we need it | Legal basis (GDPR) |
|---|---|---|---|
| Email address | the address you give us at checkout, or one you choose to connect to your account later | it is where we send your sign-in link or code, and it is what lets you open the same account on another device or after a reinstall | performance of our contract with you, Art. 6(1)(b) |
| Health answers from the quiz | sex, age, height, current and goal weight, how active you are, how fast you want to move, your diet, allergies and foods you do not want to see | the calorie target, the macros and the recipes we pick for you are calculated from these answers | your explicit consent, Art. 9(2)(a), together with Art. 6(1)(a) |
| What you do with your plan | meals you mark as eaten, items you tick off the shopping list, plans generated for you, swaps you make | it drives the app itself: the next week is built around what you already had, and the shopping list remembers what you already bought | performance of our contract, Art. 6(1)(b) |
| Account and session identifiers | your internal user ID, session records, one-time sign-in tokens | they keep you signed in and stop anyone else from using your account | performance of our contract, Art. 6(1)(b) |
| Push token and platform | the notification token your phone hands to the app, and whether it is iOS or Android | it is the address a push notification is delivered to; without it the phone cannot be reached | your consent to notifications, given in the system dialog, Art. 6(1)(a) |
| Time zone | the IANA time zone of your device, for example America/New_York | the week has to start on your Monday, and reminders must not arrive at night | performance of our contract, Art. 6(1)(b) |
| Subscription records | which subscription you hold, when the paid period ends, whether renewal is on, the events the store or the payment provider sends us | it is how the app knows you have paid access, and how we handle renewals, cancellations and refunds | performance of our contract, Art. 6(1)(b); for accounting records, our legal obligations, Art. 6(1)(c) |
| Purchase identifiers from the app store | the profile identifier our subscription provider creates for your device, the identifier the store gives the transaction, and the technical facts your device sends with them: its model, its operating system and its language | it is how a subscription bought in your App Store or Google Play account is matched to your Mealione account, and how we find it again when you ask us to restore a purchase | performance of our contract with you, Art. 6(1)(b) |
| Your answer to the cancellation question | the reason you pick from the list and the comment you may write | it tells us why people leave, which is the only way we can fix it | our legitimate interest in improving the service, Art. 6(1)(f) |
| Crash and performance reports | when the app crashes or misbehaves: the error and its stack trace, the app version, and the model, operating system and language of the device it happened on | an app that crashes silently stays broken; these reports are how we find and fix it | our legitimate interest in keeping the service working, Art. 6(1)(f) |
| Product analytics events | a fixed set of seven events, each tied to your internal user ID: an account was created from a purchase, you signed in (and by which route), you connected an email address to an account that started on your device (and whether the address was free or already had an account of its own), a plan was built for a given week, a payment happened (with the plan and the amount), a cancellation was started (with the reason you picked from the list) or finished (whether you left or stayed) | we need to know whether the product works before we spend more on it | our legitimate interest in understanding and improving the service, Art. 6(1)(f) |
What we do not collect. We do not collect your name, your postal address, your phone number, your precise or approximate location, your contacts, your photos, your card details, or any advertising identifier such as IDFA or GAID — the SDK that handles subscriptions is able to read one, and we have that switched off. Mealione does not read Apple Health, Health Connect or any other health tracker. The app contains no advertising SDK and no attribution SDK, and shows no ads.
What you do inside your plan stays inside it. The meals you mark as eaten and the items you tick off your shopping list are not sent to our analytics provider — not their contents, and not even the bare fact that you ticked something. What you eat is health data, and health data has no business leaving for measurement.
Your device's IP address reaches our servers, our image delivery network and our mail provider as an unavoidable part of how the internet works. We do not record it in our database, we do not use it to work out where you are, and it never reaches our analytics: those events are sent by our own backend with IP resolution switched off. Our subscription provider is the one exception: it keeps your IP address alongside the purchase, and section 4 says what else it sees.
Your account does not need an email address. The app creates an account on your device the first time you open it, and that account has no address attached to it. It does not need one: the quiz, the plan built from it and a subscription bought in the app all work without you telling us who you are. Connecting an address later is your choice — it is what lets you open the same account on another device, or find it again after a reinstall.
Where your quiz answers go. You can answer the quiz before any account of yours exists. The answers are stored against an anonymous quiz session first, so that a plan can be built the moment you pay, and in the app they are attached to the account on your device as soon as you finish the quiz. If you answered on our website instead, they stay with the anonymous session — together with the address you gave at checkout — until you open the account by using a sign-in link. Answers that never reach an account are erased on the schedule in section 6.
3. Health data and your consent
Your answers about your body, your goal, your diet and your allergies are special category data under Art. 9 GDPR. We ask for them on a separate screen, before the first question of the quiz, with a checkbox that does nothing else — it is not bundled with accepting these documents, and it is not implied by continuing.
We keep a record of that consent — the version of the text you were shown and the moment you gave it — and you can see it in the app's settings.
You can take that consent back whenever you like: delete your account (section 7), and the answers go with it. Taking it back does not undo what we did while it was in force. Because the health answers are the plan, withdrawing consent means we can no longer build one for you — this is a service that cannot exist without them, not a condition we attached to something unrelated.
4. Who else processes your data
We use a small number of companies to run the service. Each of them acts on our instructions under a written data processing agreement, and none of them may use your data for their own purposes.
| Who | What they do for us | What they see |
|---|---|---|
| Railway | hosting for our backend and our database | everything stored in the database, as the infrastructure it runs on |
| Resend | delivers our transactional email — the sign-in link and the sign-in code | your email address and the contents of those messages |
| Expo (push service, then Apple Push Notification service or Firebase Cloud Messaging) | delivers push notifications to your device | your push token and the text of the notification |
| Mixpanel (EU data residency) | product analytics | the seven events listed in section 2 with the properties named there, tied to your internal user ID. Nothing else reaches them: not your email, not a single health answer, not what you marked as eaten or ticked off, not the free text you write, not your IP address |
| Sentry | collects the crash and performance reports described in section 2 | the error and its stack trace, the app version, and the model, operating system and language of your device. It is not told who you are: we never attach your user ID or your email, and the lines the app writes to its own log are dropped before an event leaves the device |
| Cloudflare | stores and delivers the recipe photographs | the IP address of the device requesting a picture; recipe photographs are our own catalogue content and carry nothing about you |
| Adapty | runs the subscriptions bought inside the app: it fetches the prices we show you, asks the App Store or Google Play to take the payment, and tells our servers when a purchase, a renewal or a cancellation happens | the purchase itself — which subscription, when, in which store, and the identifiers the store and Adapty give it — tied to your internal user ID, together with your IP address and the model, operating system and language of your device. It never receives your email address, a single health answer, or anything from your plan |
Apple and Google. If you buy a subscription in the app, Apple or Google take the payment and act on their own account, not on ours. We receive the fact of the purchase, its renewal status and the identifiers needed to match it to your account — never your card number. Their handling of your payment is governed by their own privacy policies.
Everyone else. We do not share your data with anyone else, other than where we are legally obliged to (a valid order from a court or an authority), or where it is necessary to establish or defend a legal claim. If the business is ever sold or merged, the data may pass to the buyer, who would remain bound by this policy or tell you in advance what changes.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We have never done so.
5. Where your data is processed
Our backend and our database run on servers in the United States (Railway, US West). Our analytics project is held on Mixpanel's European infrastructure. Adapty, which runs subscriptions bought in the app, processes and stores what it holds in the United States. Our other providers are companies established in the United States and may process data there or elsewhere.
If you live in the European Economic Area or in the United Kingdom, that means your data travels outside it. Every such transfer is covered by the European Commission's standard contractual clauses, agreed with the provider concerned and read together with the technical measures in section 8. You can ask us for a copy of those clauses at support@mealione.com and we will send it to you.
6. How long we keep it
| What | How long |
|---|---|
| Everything attached to your account | while the account exists; erased when you delete it (section 7) |
| An account created on your device that never got an email address and never had a subscription | deleted in full once it is 90 days old and the device has stopped using it (the session a device holds lasts 30 days and is renewed while you keep using the app) |
| Quiz answers given before an account exists, where no purchase followed | the health answers are erased 90 days after the quiz |
| The email address and consent record from a quiz that never became an account | up to 3 years from the day the quiz was taken, after which the record is deleted in full. We keep it for one purpose only — to be able to show what a person was asked and what they agreed to, if that is ever disputed — and we rely on our legitimate interest in defending ourselves against a claim, Art. 6(1)(f) |
| Paid access recorded for someone who paid but never created an account | until 6 months after the paid period ends |
| Sign-in tokens and codes | deleted 30 days after they are used or expire |
| Your answer to the cancellation question | kept as a statistic after your account is gone, with the link to you removed, the free-text comment erased and the timestamps coarsened to a date |
| Crash and performance reports | held by Sentry for the retention period of our plan and deleted automatically when it expires; we keep no copy of our own |
| Payment records | 10 years from the end of the year of the transaction, because VAT and accounting rules require it |
A job runs on our servers and enforces these periods automatically; deletion is real deletion of the rows, not a hidden flag.
7. Your rights
Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it. If the GDPR applies to you, you also have the right to restrict or object to processing, the right to receive your data in a portable format, and the right to withdraw a consent you have given. If you are in California, you have the right to know what we collect and why, to request deletion or correction, and not to be treated differently for exercising those rights; we sell nothing, so there is nothing to opt out of. Residents of Washington, Nevada and Connecticut have specific rights over consumer health data, described in our Consumer Health Data Privacy Notice.
There are two ways to have your data deleted:
- Delete your account from the app — Profile → Delete account. You can do this yourself, without asking us and without waiting. It removes your plans, your preferences, your shopping list marks, your push tokens, your sessions and your account itself, and it asks our analytics provider to erase what it holds about you. It cannot be undone.
- Ask us. If you cannot open the app, or if you answered the quiz, or paid, but never created an account, write to support@mealione.com and we will find and erase what we hold. We answer within one month.
One thing deletion does not take with it: the record that a payment happened. Tax and accounting law requires us to keep those for ten years (section 6), so they stay after the rest of your data is gone, and they are kept for that purpose alone.
For anything else — a copy of your data, a correction, an objection — write to support@mealione.com. We may need to check that the request comes from the owner of the address. We answer within one month, and tell you if we need longer.
Deleting your account never cancels a subscription, whichever way you bought it, so cancel first and delete after. A subscription bought on our website is cancelled in the app, under Profile → Subscription — once the account is gone you can no longer do it yourself and would have to write to us. A subscription bought through Apple or Google lives in your store account, and only the store can stop it: cancel it in your App Store or Google Play settings.
If you think we have handled your data badly, we would rather hear it first — but you can complain to the data protection authority of the country you live in, and, because we are established in Cyprus, to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.
8. How we protect it
Traffic between the app and our servers is encrypted in transit, and the database credentials are held as secrets, never in our source code. There are no passwords to steal: signing in works through a one-time link or code sent to your email address, valid for fifteen minutes and usable once. Sign-in links are never written into our logs, and neither are the addresses they were sent to. Access to production data is limited to the people who run the service. No system is perfectly secure, and we will tell you and the relevant authority if a breach ever affects you.
9. Age
Mealione is for adults. You must be 18 or older to use it. We do not knowingly collect data from anyone younger, and if we learn that we have, we delete it. If you believe a child has given us their data, write to support@mealione.com.
10. Email and notifications
We send you email you cannot switch off while you have an account, because it is how the service works: the sign-in link or code, and messages about your subscription or your data. Push notifications are optional — the app asks for permission the first time a plan is ready, and you can withdraw it in your phone's settings at any time. If we ever start sending marketing email, it will be to people who agreed to receive it, and every message will carry a one-click unsubscribe.
11. Changes to this policy
We will update this page when the product changes. The date at the top always shows the current version. If a change materially affects your rights or how we use your health data, we will tell you in the app or by email before it takes effect, and where the law requires it, ask for your consent again.
12. Contact
support@mealione.com — for anything in this document, including all data protection requests.
HG POINT LIMITED Spyrou Kyprianou 78, Limassol 3076, Cyprus