Privacy Policy

This Privacy Policy is designed to comply with Apple's App Store Review Guidelines (including Section 5.1 — Privacy), Google Play's Developer Program Policies, the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the Children's Online Privacy Protection Act (COPPA), and other applicable data-protection laws.

We collect only the information necessary to deliver the features of MealLens. The categories of information we collect are listed below.

1.1 Account information

When you create an account, we collect:

• Email address — used for authentication, account recovery and important service communications.
• Display name — used to personalise your in-app experience.
• Password — stored only in hashed (irreversible) form by our authentication provider. We never see or store your password in plain text.
• Authentication identifiers — if you sign in with Apple, Google or another provider, we receive a unique identifier from that provider and, where you permit it, your name and email.

1.2 Health, dietary and profile data

To provide nutrition tracking and personalised recommendations, you may voluntarily provide:

• Age, gender, height, weight and activity level
• Dietary preferences (for example vegetarian, vegan, keto, halal)
• Food allergies, intolerances and medical conditions you choose to share
• Nutritional goals (calorie targets, macronutrient targets, weight goals)
• Meal logs, food entries, scanned items and consumption history
• Notes or comments you attach to meal entries

This information is sensitive personal data under GDPR Article 9 and applicable U.S. state laws. We process it only with your explicit consent and only for the purposes described in Section 2.

1.3 Camera and photo data

MealLens uses your device's camera and/or photo library to scan and identify food items. When you use this feature:

• Photos you capture or select are sent to our food-recognition service for processing.
• We retain food images only as long as needed to return a recognition result, unless you explicitly save a meal to your history — in which case the image is stored in your account so you can revisit it.
• You may delete saved images at any time from within the App.
• We never access your camera or photo library in the background or without your initiation.

You can revoke camera and photo access at any time through your device's system settings.

1.4 Device and usage analytics

We automatically collect limited diagnostic and analytics data to operate, secure and improve the App:

• Device model, operating system and OS version
• App version, language, region and time zone
• Crash logs, error reports and performance metrics
• Aggregated, non-identifying usage events (for example, "user opened scan screen")
• IP address — used transiently for security and approximate region, not stored long-term in identifiable form

We do not use third-party advertising SDKs, behavioural ad tracking, or cross-app/cross-website tracking. MealLens does not implement Apple's App Tracking Transparency (ATT) prompt because we do not engage in tracking as defined by Apple.

1.5 Health platform integrations (optional)

If you choose to enable integration with Apple HealthKit or Google Fit, we may read from and write to those platforms:

• Read: weight, height, activity and other metrics you authorise.
• Write: nutrition data (calories, macros) corresponding to meals you log.

HealthKit data is never used for advertising, never shared with third parties, and never written to cloud storage without your explicit per-feature consent, in compliance with Apple's HealthKit guidelines.

1.6 Payment and subscription information

If MealLens offers paid features:

• Purchases are processed exclusively through Apple In-App Purchase or Google Play Billing.
• We do not receive, store or process your credit card number, CVV or full billing details.
• We receive only a transaction identifier, subscription status and purchase date from Apple or Google in order to grant access to paid features.

1.7 Communications

If you contact our support email, we receive your message, email address and any information you choose to include. We retain support correspondence only as long as needed to resolve your inquiry and comply with legal obligations.

We use the information we collect for the following purposes:

We do not use your personal information for:

• Targeted advertising
• Sale of data to third parties
• Profiling that produces legal or similarly significant effects
• Training third-party AI models on your identifiable data

We do not sell your personal information. We share data only with the limited service providers necessary to operate the App, each bound by contractual confidentiality and data-protection obligations.

3.1 Service providers (data processors)

• Firebase / Google Cloud (Google LLC) — authentication, database (Firestore), cloud functions, crash reporting (Crashlytics), analytics and push notifications (FCM).
• AI food-recognition provider — receives meal images for the sole purpose of returning a recognition result. We use providers that contractually prohibit using submitted content to train their models.
• Apple / Google — process in-app purchases, deliver push notifications and, if enabled, sync data with HealthKit or Google Fit.
• Email / support provider — handles outbound transactional emails and inbound support requests.

A complete, up-to-date list of sub-processors is available on request at support@meallensai.org.

3.2 Legal disclosures

We may disclose information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, court order or governmental request
• Enforce our Terms of Service
• Protect the rights, property or safety of MealLens, our users or the public
• Investigate or prevent fraud, security incidents or technical issues

3.3 Business transfers

If MealLens is involved in a merger, acquisition, asset sale or insolvency, your information may be transferred as part of that transaction. You will be notified before your information becomes subject to a different privacy policy.

3.4 With your consent

We may share information for any other purpose disclosed to you and to which you consent.

Your information may be processed in countries other than your country of residence, including the United States and other jurisdictions where our service providers operate. Where required by GDPR, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms approved by the European Commission.

We retain personal information only as long as needed to provide the Service and meet legal obligations:

• Account data — retained until you delete your account.
• Meal logs and health data — retained until you delete them or your account.
• Crash and diagnostic logs — typically 90 days, then deleted or anonymised.
• Support correspondence — up to 24 months after resolution.
• Payment records — retained as required by tax and accounting laws (typically 7 years).

When data is no longer needed, it is securely deleted or irreversibly anonymised.

Depending on your jurisdiction, you have the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

California residents additionally have rights under the CCPA/CPRA, including the right to know, delete, correct and limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights.

How to exercise your rights

• In-app: Settings → Account → Delete Account / Export Data
• By email: support@meallensai.org, with the subject line "Privacy Request"

We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling a request.

In compliance with Apple App Store Guideline 5.1.1(v) and Google Play policy, you can delete your account and all associated data:

• Open MealLens
• Go to Settings → Account → Delete Account
• Confirm deletion

All your account data, meal logs, scanned images and health profile will be permanently deleted within 30 days. Some data may be retained in encrypted backups for a limited period before being overwritten, and some data may be retained where legally required (for example, transaction records).

You may also request deletion by emailing support@meallensai.org.

We implement industry-standard administrative, technical and physical safeguards to protect your information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Hashed and salted password storage handled by our authentication provider
• Principle of least privilege for access to production systems
• Regular security reviews and dependency updates
• Secure secret management

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by law.

MealLens is not directed to children under the age of 13 (or 16 in the European Economic Area, or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children below this age.

If you believe a child has provided us with personal information, please contact support@meallensai.org and we will promptly delete it.

The App may contain links to third-party websites or services (for example, recipe sources and educational content). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing them with any information.

If you enable push notifications, we will send you meal reminders, goal updates and service announcements. You can disable notifications at any time through your device's system settings.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make material changes:

• We will update the "Last updated" date at the top of this policy.
• We will notify you through the App or by email before the changes take effect.
• Your continued use of MealLens after the effective date constitutes acceptance of the updated policy.

In accordance with Apple's App Store privacy requirements:

• Data linked to you: email, name, health & fitness data, user content (meal logs, photos), identifiers, usage data, diagnostics.
• Data not linked to you: aggregated, anonymised analytics.
• Tracking: MealLens does not track you across other apps or websites.
• HealthKit: health data obtained through HealthKit is used solely to provide in-App features and is never used for advertising or shared with third parties for marketing.

If you have questions, concerns or requests regarding this Privacy Policy or your personal data, please contact:

• MealLens Privacy Team
• Developer: Progent Studio
• Email: support@meallensai.org
• Location: Pakistan

For EU/UK users, you may also contact your local data-protection authority. A list is available at https://edpb.europa.eu/about-edpb/board/members_en.

This Privacy Policy was last reviewed on 25 July 2026.