Privacy Policy

Data we collect

• Account and support: your email address, authentication and session records, and anything you send us when you ask for support. If you choose Sign in with Google (Android and iPhone) or Sign in with Apple (iPhone), Google or Apple confirms your identity to us and shares your email address and name, or the private relay address Apple offers. We never receive your Google or Apple password.
• Household & taste profile: household name and members, dietary flags and allergies/intolerances, disliked ingredients, preferred cuisines, appetite/portion and protein settings, weekly budget, and preferred store. This can include health-related data (allergies), which we process only to keep your meal plans safe and relevant, on the basis of your explicit consent.
• Content and service activity: recipes and notes you add, meal plans and attendance, pantry and shopping-list items, favourites, ratings, swaps, store check-offs, receipts you scan or import (the items and totals read from them), and AI usage counts.
• Receipt scanning on Android: the text on a receipt photo is read on your device by Google’s ML Kit text recognition, which works offline. The photo is not sent to Google to be read. We keep the parsed items and totals in your account so the app can show your spending; the original image stays on your device.
• Recipe imports: when you import from a link, we read the public page the link points to and keep the recipe draft we build from it. For a YouTube link we use YouTube API Services to read the video’s public title, description and links; by using that import you also agree to the YouTube Terms of Service, and Google handles that data under the Google Privacy Policy. For some Instagram links your own phone opens the public post page and sends us that page so we can read the caption; our servers do not request Instagram. When a recipe is written on screen, your phone may also download the public reel temporarily to read it. We do not upload the video.
• Shared videos and screenshots: when you share a video, screen recording or screenshots to the app, your phone reads them on the device and sends us only text: the speech turned into words and the words visible on screen, plus up to three small screenshots when the text alone is not enough to read the recipe. The video itself is never uploaded to or stored on our servers. If your phone cannot turn speech into text itself, the app sends just the audio track to our server to be transcribed; we delete it as soon as the text is returned. We use the text and any screenshots to build your recipe draft. We may temporarily keep import evidence to complete an import or avoid repeated processing. Cached recipe drafts expire after 30 days and are removed by scheduled cleanup. Recipes you save remain in your account until you delete them.
• Subscriptions: Apple processes purchases made through the iOS App Store, Google processes purchases made through Google Play on Android (Google Play manages those subscriptions, including renewal, cancellation and refunds), and Stripe processes direct web purchases. We receive the product, provider, subscription status, renewal/expiry state, and provider transaction identifiers (for Google Play, the purchase token and order identifier) needed to grant access, restore purchases, prevent duplicate claims, and answer support requests. We do not receive your complete card, Apple or Google payment credentials.
• Push notifications: only after you turn notifications on. We then store a push token for your device (from Apple’s push service on iPhone, or Google’s Firebase Cloud Messaging on Android), the app version, your language and your time zone, together with the reminders you chose, so we can send them. Nothing is registered before you opt in. Turn them off under You → Notifications or in your phone’s settings, and we stop sending. We remove the token when you sign out or delete your account.
• Install source (Android): when you install from Google Play, Play can tell the app once which of our links led to the install (the Play Install Referrer). We keep only a short campaign label from it and ignore everything else in it. It is used only to learn which of our links bring people to the app.
• Launch waitlist: if you leave your email in the note for an iPhone whose App Store does not carry the app yet, we store that email address, which platform you asked about, your language, the page or campaign link you came from, and which consent wording you saw. You do not need an account for this.
• Technical and analytics data: IP address, browser/device information, security and error logs, and, if analytics is on (you accept it on the website; it is on by default in the apps until you turn it off), your account identity (email, display name and signup date), a description of your household, and events about the screens and product actions you use. The analytics section below lists exactly what that includes and what it never includes.

How we use it

To provide the service (plan, shop, cook), personalise AI meal and recipe suggestions to your household’s tastes and constraints, process subscriptions, send the reminders you turn on, provide support, secure and troubleshoot the service, and, with your consent, measure product performance and retention. A waitlist email is used for one purpose only: to tell you when the app becomes available on that platform or in your App Store. We do not use it for marketing or share it with anyone else.

Legal bases (GDPR)

• Contract: creating and securing your account, running the household planning service, processing subscriptions, and providing support you request.
• Explicit consent: allergy/health information you choose to add, optional product analytics, push notifications you turn on, and your email on the launch waitlist. You can withdraw consent at any time by removing the health information, turning off analytics under You → Usage analytics (website) or You → Privacy (apps), or emailing support@planmymeals.ai to leave the waitlist.
• Legitimate interests: preventing fraud and abuse, diagnosing failures, and improving the reliability of the service.
• Legal obligations: records we must keep for tax, accounting, payment, or other legal requirements.

Cookies and analytics

On the website, product analytics (PostHog, EU-hosted) only starts if you accept it in the banner shown on your first visit — decline, or ignore it, and no analytics is loaded or stored.

In the iPhone and Android apps, usage analytics is on by default once you have signed in, and you can turn it off at any time under You → Privacy → Help improve the app. Turning it off stops collection immediately on that device.

When analytics is on, we record which screens are used and which actions succeed. Those records are tied to your account, not to an anonymous identifier: we send PostHog your email address, your display name, the date you signed up, your answer to “how did you hear about us?” if you gave one, and whether you are a member of our own team. We also send a description of your household — its plan (free or Plus), how many people it plans for, its cooking rhythm and planned meal types, its chosen supermarket chain, its language and currency, and a band for its weekly budget rather than the amount — identified by an opaque household code. We do this so we can recognise you when you contact support and understand how households actually use the service.

We do not record your screen, and we never send your recipes, your allergies, your dietary preferences or notes, your disliked ingredients, or the name you gave your household to our analytics processor. PostHog is hosted in the European Union and processes this data under a data processing agreement. On the website it stores an analytics identifier in local storage and a cookie only after you accept; in the apps it keeps an analytics identifier on your device while analytics is on. We use no advertising cookies.

To change your mind, open You → Usage analytics on the website or You → Privacy in the apps. Turning it off stops collection immediately and clears what was stored on that device. We store your analytics choice, signed-in session, and language preference in your browser’s local storage so the service can honour them. To ask us to erase analytics data already sent, contact support@planmymeals.ai.

Processors we share data with

We use processors to run the service: Supabase (database, authentication, storage, and server functions), Vercel (web hosting and delivery), OpenAI (generating meal and recipe suggestions from the relevant household preferences and recipe/plan context, structuring imported recipes, and transcribing the audio of a shared video when your phone cannot), Apple (App Store purchases, subscription status, refunds, server notifications, push delivery on iPhone, and Sign in with Apple), Google (Sign in with Google; Google Play purchases, subscription status and refunds; Firebase Cloud Messaging push delivery on Android; YouTube API Services and, for a YouTube video whose description holds no recipe, Google’s Gemini model reading the public video, both under the Google Privacy Policy; the Play Install Referrer; Google Play’s in-app review prompt; and ML Kit, which reads receipts and text in recipe videos and screenshots on your device and, like Google Play services, may send basic technical and diagnostic information to Google), Stripe (direct web subscription payments), and, only after you consent, PostHog (EU-hosted product analytics). Our email provider also processes messages you send to support. If the Android app offers you a review prompt, Google Play shows and handles it; we do not receive your rating or review through it. We share only what each processor needs for that purpose, and we do not sell your personal data.

International transfers

Some processors may handle personal data outside the EEA, including in the United States. Where required, those transfers rely on a European Commission adequacy decision or safeguards such as the EU Standard Contractual Clauses.

Retention

We keep your account and household data while your account is active. To see exactly what deleting your account removes and what we may keep, read how to delete your account. If you delete your account as the household’s only member, we delete that household and its plans, recipes, and shopping data. If other members remain, shared household content may remain available to them, but we remove your account and membership and transfer ownership of shared plans and recipes to a remaining member.

A launch waitlist email is kept until we have sent you the launch notice for that platform, or until you ask us to remove it, and in any case it is deleted automatically 24 months after you joined.

Some records may remain for only as long as required by tax, accounting, fraud-prevention, security, backup, subscription reconciliation, or dispute-resolution obligations. Apple, Google and Stripe keep payment records under their own policies and legal obligations. Turning off analytics clears the analytics identifiers on that device; contact us if you also want previously sent analytics data erased.

Your rights

Subject to the GDPR’s conditions and exceptions, you can access, correct, receive a portable copy of, erase, or restrict your data; object to certain processing; and withdraw consent. You can correct profile details in the app, and delete your account in the app under You → Privacy and data → Delete my account (iPhone and Android), or by following the steps, or the email route for people without the app, on our account deletion page. For a copy of your data or any other request, email support@planmymeals.ai. You may also lodge a complaint with the Portuguese supervisory authority, the CNPD.

Children

PlanMyMeals is intended for adults — our Terms require account holders to be at least 18. It is not directed at children, and we do not knowingly collect their data.

Changes

We may update this policy; we’ll change the “last updated” date and, for material changes, notify you in the app.