Privacy Policy

The controller of the personal data described in this policy is the website owner.

Basic Google profile data and the required planning choices are necessary to create an account and provide the service. Other preference fields are optional. Billing data is required only if you choose a paid subscription.

Meal Planner uses the OpenAI API to create meal plans, replacement meals and meal images. Text-generation requests include the preferences needed to fulfil your request, such as budget, household size, diet, ingredient exclusions, favourite ingredients, pantry items, stores, schedule and available kitchen equipment. Image-generation requests include the meal title or image description.

We do not send your name or email address to OpenAI. Requests include a salted, one-way-derived identifier for abuse prevention. OpenAI states that API inputs and outputs are not used to train its models unless the API customer explicitly opts in, and that standard API abuse-monitoring data may be retained for up to 30 days.

AI output may be wrong. It is a suggestion, not medical, nutritional or allergy advice. The app does not use AI to make decisions that produce legal or similarly significant effects about you.

We disclose data only as needed to operate the service:

• Google — authentication and the basic profile you choose to share. Google also processes the sign-in interaction under its own privacy terms.
• Supabase — authentication, database, private file storage, server functions, queues and real-time updates.
• OpenAI — meal-plan and image generation as described above.
• Polar and its payment processors — checkout, payments, invoices, taxes, subscription management and fraud prevention. Polar may act as an independent controller for payment and compliance activities.
• Vercel — web hosting, delivery, security logs and privacy-focused web analytics.
• Professional advisers, authorities or another party to a business transaction, but only when reasonably necessary and permitted by law.

You can read the providers' notices at Google, Supabase, OpenAI, Polar and Vercel.

We do not sell personal data, rent it to data brokers or use it for targeted ads.

Some providers or their subprocessors may process data outside Poland, the European Economic Area or the United Kingdom, including in the United States. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism, together with appropriate safeguards. You may contact us for more information about the safeguards relevant to your data.

• Account, profile, preferences, generated plans, shopping lists, favourites and stored images are generally kept while your account is active.
• Generation, security and diagnostic records are kept only as long as reasonably needed for reliability, abuse prevention and dispute handling.
• Subscription and transaction records may be retained after account closure when required for tax, accounting, fraud prevention or legal claims. Polar separately retains payment records under its own policy and legal duties.
• OpenAI's standard API abuse-monitoring retention may be up to 30 days. Infrastructure logs and backups may persist for a limited period after primary data is deleted.

You can permanently delete your account from the Danger zone in Profile. For security, you may be asked to sign out and sign in again first. Deletion removes your account data and stored meal images, cancels any active Polar subscription, and asks Polar to anonymize its customer profile. It does not delete your Google account. Polar and other providers may retain transaction, security or backup records where the law requires it.

Product records are linked to your account and protected with database row-level access controls. Meal images are stored in a private bucket and delivered using short-lived signed links. Access to server-side providers is protected by credentials that are not exposed to the browser. No system is completely secure, so these controls reduce risk but cannot eliminate it.

We use essential cookies for authentication and session security. Rejecting or deleting them prevents sign-in. The onboarding draft uses browser local storage as described in section 2. Vercel Web Analytics does not use third-party analytics cookies, and Meal Planner does not use advertising cookies.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, receive portable data, and withdraw consent. Withdrawal does not affect processing that was lawful before it.

Use the account controls in Profile to delete your data, or contact the website owner to make another privacy request. We may ask for information needed to verify that the account is yours. If you are in the EEA, you may also complain to your local supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

Meal Planner is not directed to children under 16, and we do not knowingly create accounts for them. If you believe a child has provided data without the authorization required by local law, contact us so we can investigate and delete it where appropriate.

We may update this policy when the product, providers or legal requirements change. The date at the top shows the latest revision. If a change materially affects how existing account data is used, we will provide a prominent notice in the app or another appropriate notification before the change takes effect.