Privacy Policy

1. Who we are

MealWise ("MealWise", "we", "us", "our") is published by Meal Wise, LLC. This Privacy Policy explains how we collect, use, share with service providers, retain, and protect your information when you use the MealWise website, web app, and installable application (collectively, the "Service"). It applies to information we process as the data controller.

2. Information we collect

Account & authentication

• Email address, password (stored hashed by our authentication provider), display name.

Subscription & payment metadata

• Plan, billing period, subscription status, trial start/end, and cancellation reason; Stripe subscription/customer identifiers for web subscriptions and Apple transaction identifiers for iOS App Store subscriptions, used to manage access.
• Stripe handles web payments; Apple handles payments for iOS App Store subscriptions. We do not store card numbers or full payment credentials, and we do not receive your Apple payment credentials.

Health, wellness & meal-planning data

• Weight, height, BMI inputs, age, sex, activity level.
• Primary goal (weight loss, maintenance, muscle gain, athletic performance).
• Dietary pattern, allergies, dislikes, food preferences and cuisines.
• Health conditions you enter (e.g. hypertension, diabetes, cholesterol) used to tailor meal guidance.
• Meal plans, planned meals, favorites, liked meals, shopping-cart items, grocery lists, meal completions, adherence logs, training-day toggle.
• Food journal entries and optional journal photos.
• Weigh-ins over time.

Household / family-member profiles

• Family member names, ages, and per-member allergies, dislikes, dietary pattern, and personal goal that you enter — including information entered by an adult account holder on behalf of a minor. Only the adult account holder can add or edit these records.

Communications

• Transactional and service emails (sign-up, password reset, subscription confirmations, trial reminders, payment failures, cancellation notices).
• Support messages you send us.

Optional Kroger connection

• When you choose to connect Kroger, we store connection information (authorization tokens, connection status and expiry) and your selected store information (store identifier, name, address and ZIP code).
• When you use Kroger store lookup, the ZIP code you enter is sent to Kroger’s store-lookup service and stored with your selected/preferred store information to support store matching. MealWise does not ask for your home or physical address.
• Cart transfer is user initiated. We send customer-approved product codes (UPCs) and quantities to your Kroger cart. Kroger handles checkout, pickup and delivery. MealWise does not screen Kroger products for allergens; check product labels and ingredients yourself.

Automatically collected technical data

• Device, browser, operating system, and IP address in server request logs (Cloudflare hosting) for security, abuse prevention, and reliability.
• Hashed representations of IP addresses, stored by MealWise for rate limiting, abuse prevention and service security/reliability. This is separate from the request logs kept by our infrastructure providers.
• Pantry-staple affiliate shopping clicks: retailer, item/product, page context, browser user-agent and timestamp. These click records are not linked to your MealWise account. Clicks on other Marketplace product links are not currently recorded by MealWise.
• Subscription lifecycle records (for example trial started, trial converted or subscription canceled) linked to your account, used to manage billing and access. MealWise does not currently collect page-view or general feature-use analytics.

3. How we use your information

• Create and manage your account and household.
• Generate personalized meal plans, "cook this now" suggestions, holiday menus, and goal-aware feedback using the profile, dietary, household, meal, and wellness context you provide.
• Manage subscription access using Stripe for web billing and Apple for iOS App Store billing.
• Connect to Kroger and transfer approved grocery products to your cart when you request it.
• Send transactional and service emails. MealWise does not currently send newsletter or marketing emails.
• Provide, secure, monitor, debug, and improve the Service.
• Attribute affiliate revenue when you make qualifying purchases through outbound links.
• Comply with legal, tax, accounting, and fraud-prevention obligations.

4. Service providers and processors we share data with

We do not sell your personal information. To operate MealWise we share limited information with the following service providers who process it on our behalf under contractual confidentiality and security obligations:

• Supabase — authentication, database, and file storage (journal photos). Hosts your account, profile, meal, wellness, and household data.
• Stripe — web subscription billing and payment processing. Receives payment method, billing email, and subscription metadata directly from you at checkout.
• Apple — iOS App Store subscription billing. Apple handles payment through your Apple account; MealWise receives subscription status and transaction identifiers needed to manage access, not your Apple payment credentials.
• Kroger — optional, user-initiated account connection and cart transfer. Receives approved product codes and quantities for your cart and handles checkout, pickup and delivery.
• Lovable Cloud (including the Lovable AI Gateway) — provides our application backend and routes AI meal-generation requests to third-party model providers. When you generate a plan, recipe, or holiday menu, we transmit the profile, dietary, household, meal, and wellness context needed to produce the response.
• Cloudflare — hosting, edge delivery, DDoS/WAF protection, and infrastructure logs (IP address, request metadata).
• Amazon Associates — when you open an affiliate link, the retailer (Amazon or another partner) receives the link, search or product request you open, including our affiliate tag where present. The retailer then applies its own privacy policy; we receive aggregate commission reporting, not your Amazon account.
• Email delivery — our transactional email provider delivers auth and service emails.

We may also share information (a) with your consent, (b) to comply with law, legal process, or lawful government requests, (c) to protect the rights, safety, or property of MealWise, our users, or others, or (d) in connection with a merger, acquisition, or sale of assets, with continued protection of your data.

Sharing with these service providers/processors is not a sale of personal information.

5. Automated meal generation

MealWise sends relevant information from your profile and household for automated meal generation. This may include dietary preferences, allergies, health conditions, goals, age, sex, activity level, body measurements such as height and weight, information about household members you add (including children), recent meal history, Food Journal text notes, and other meal-planning context. MealWise identifies individual household members generically rather than by first name in the household information it prepares. The household name you choose and text you enter may be included. We do not send your password, payment information, or journal photos for meal generation. These providers process the information needed to provide the requested response and may retain request data according to their applicable terms and policies.

MealWise uses external AI services through the Lovable AI Gateway, which routes requests to external model providers. When you request personalized generation, the relevant information described above is sent to those services with your permission.

6. Cookies and similar technologies

MealWise uses first-party browser storage to keep you signed in (Supabase auth session) and to remember lightweight preferences such as the training-day toggle. We do not use third-party advertising cookies.

7. Data retention

• Account, household, meal, wellness, and journal data are retained for as long as your account is active.
• When you delete your account we remove your personal data as described in Section 9. The records described there as remaining may be kept for billing, tax, accounting, email-delivery and fraud-prevention purposes. Stripe and Apple keep their own payment records under their own policies.
• Server request logs are retained for a limited period for security and reliability, then rotated out.

8. Data security

Data is encrypted in transit (HTTPS) and at rest by our infrastructure providers. We use row-level security policies, least-privilege server functions, and modern access controls. No system is 100% secure, but we work continuously to protect your information.

9. Your rights and account deletion

Before anything is deleted, in-app account deletion resolves every Stripe web subscription on your account: it cancels an active subscription and confirms with Stripe that it has ended. If billing cannot be safely resolved, deletion stops and your MealWise account stays active so you can try again or contact support. Deleting your MealWise account does not cancel Apple billing; manage or cancel an App Store subscription in your Apple account settings (Settings → your name → Subscriptions → MealWise).

When deletion completes, MealWise deletes your sign-in account; your profile, household and family-member records; meal plans, planned meals, favorites, liked meals, meal completions and saved meal recommendations; shopping-cart and grocery items; food journal entries and journal photos; weigh-ins, weight-history and adherence logs; Kroger connection records; subscription and subscription-lifecycle records; cancellation requests; and checkout records tied to your own Stripe subscription.

Records that may remain after account deletion include:

• Billing and transaction records kept by MealWise, such as billing-issue records that may include your account ID or email, records acknowledging a move from App Store to web billing, unclaimed checkout records associated with your email address, and Stripe and Apple billing-notification event records with provider transaction identifiers — kept to reconcile billing, resolve disputes and support accounting.
• Account-creation authorization records keyed by email address, kept for security and to prevent misuse of sign-up.
• Hashed representations of IP addresses used for rate limiting, kept for abuse prevention and security.
• Email-delivery logs, unsubscribe records and email suppression entries keyed by email address, kept so we can show emails were sent and honor unsubscribe and bounce/complaint suppression.

Stripe and Apple keep their own payment and billing records independently, under their own requirements and policies. See the public deletion instructions for details.

Depending on where you live, you may have the right to access, correct, export, restrict, object to, or delete your personal data, and to withdraw consent. To exercise these rights:

• Delete your account in-app: sign in and visit joinmealwise.com/account/delete.
• Public deletion instructions: see joinmealwise.com/delete-account.
• Other privacy requests: email support@joinmealwise.com.

10. Children's privacy

MealWise is not directed to children under 13, and children under 13 may not create an account. Household and family-member records for minors must be created and managed by a parent or legal guardian who is the account holder.

11. International transfers

MealWise and its service providers may process your data in the United States and other countries where they operate. Where required, we rely on appropriate transfer mechanisms.

12. Health & wellness disclaimer

MealWise provides meal-planning and general wellness information for educational purposes only and is not a medical service. See our full Health & Wellness Disclaimer.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated via the app or email.

14. Contact us

Questions or privacy requests: support@joinmealwise.com.