This Privacy Policy explains what information Meal Hack (Pty) Ltd, registration number 2026/576843/07, collects, how we use it, who we share it with, and the choices you have. It is aligned with the South African Protection of Personal Information Act (POPIA) and the EU General Data Protection Regulation (GDPR).

1. Information We Collect

1.1 Account Information

Email address
Password (stored as a one-way hash)
Username (optional)
Name, phone number, date of birth, and avatar (all optional, set in your profile)
OAuth identifiers when you sign in with Google or Apple (email, name; Apple may issue a private relay email)

1.2 Preferences and Profile Data

Unit system, currency, weekly budget
Location you enter (country, state/province, city, postal code) — we do not request GPS access
Food preference profiles: cuisines, allergens, dietary restrictions, and dislikes you choose to enter, including any custom free-text entries
Meal plans, recipes, smart meals, shopping lists, and favourites generated for you or saved by you
Free-text feedback you provide when regenerating a meal

1.3 Photos You Upload

If you use the photo features, the images you upload are stored in our cloud storage and sent to vision AI models for ingredient and meal recognition. You can delete images by removing the related smart meal or by deleting your account.

1.4 Device and Diagnostic Data

Device model, operating system version, and app version
A randomly-generated installation identifier used to deliver push notifications
A Firebase app-instance identifier used for mobile analytics and server-side conversion measurement
An advertising identifier (IDFA on iOS, Advertising ID on Android), used only to measure which of our adverts bring people to Meal Hack. On iOS we ask first and collect nothing if you decline. Android has no equivalent prompt, so it is used while the system permits it — you can stop that by deleting the advertising ID or enabling limited ad tracking in your device settings
Push notification tokens issued by Apple, Google, or Expo
Crash reports, error stack traces, and limited session breadcrumbs collected by our error-tracking provider — authentication tokens, passwords, and other secrets are scrubbed automatically

1.5 Usage Data

In-app interactions, screen views, and feature events such as sign-up, login, generate meal plan, add to shopping list
Registration and completed meal-plan conversion events used to measure the effectiveness of our mobile advertising
Real-time generation progress is transmitted to your device over a secured WebSocket connection

1.6 Web Marketing Site (Cookies)

On our marketing website only, and only with your cookie consent, we may collect analytics events via Google Analytics, Meta Pixel, and Google Ads. You can decline or change this consent at any time from the cookie banner.

1.7 What We Do Not Collect

No GPS or background location
No contacts, calendar, microphone, or HealthKit data
No advertising identifier on iOS unless you allow tracking when we ask, and none at all if you decline. On Android the system advertising ID is used for the measurement in section 4 unless you delete it or enable limited ad tracking in your device settings. Either way, nothing else about the app changes
No biometric data
No body metrics, weight, BMI, menstrual-cycle data, or medical-condition data

We do not request, prompt for, or intentionally collect health information. Free-text boxes (for example the note you can add when regenerating a meal) accept whatever you choose to type — please do not enter health details or other sensitive information there. Anything you do enter is treated as ordinary personal information under this policy, is never used to infer or record health status, and is never shared with third parties in identifiable form.

1.8 Records of Your Choices

So that we can tell how well our suggestions work and improve them, we keep a record of certain decisions you make in the app:

Items you remove from a shopping list
When you replace a suggested product with a different one, including which product you replaced and the prices of both
When you replace or regenerate a planned meal, which meal it replaced, and any note you added
Snapshots of the priced baskets we calculate for your meal plans

These records are linked to your account. They cover your choices and the products and prices involved. They contain no payment details and no location beyond the metro area you select.

2. How We Use Your Data

We use your data to:

Create and manage your account
Generate meal plans, recipes, smart meals, and shopping lists
Personalise recommendations based on your stated preferences
Administer legacy subscriptions and any optional paid plan you choose in future
Send you transactional and product notifications
Diagnose errors, improve reliability, and develop the platform
Understand how our meal, product, and price suggestions perform, and improve them
Produce aggregated, non-identifying insights about how people plan meals and shop for groceries, which we may publish or provide to third parties in that aggregated form
Measure registrations and completed meal plans to improve our advertising campaigns
Comply with legal obligations

3. AI and Automated Processing

Meal Hack uses artificial intelligence to generate meal plans, recipes, images, ingredient lists, and other content. Inputs are processed via AWS Bedrock and related providers, using models from Anthropic, Meta, Mistral, Amazon, Qwen (Alibaba), and Stability AI. Photos you upload are sent to vision-capable models for ingredient extraction.

Free-text feedback you provide when regenerating meals is retained. Where you ask us to remember it, we use it to influence future generations for your account — the in-app “remember this preference” option controls that personalisation, not whether the note is stored. We also analyse this feedback, together with the records described in section 1.8, to improve the service and to produce the aggregated insights described in section 2.

You should be aware that:

Recommendations are generated automatically without human review
Outputs depend on the inputs you provide
Results may vary and may contain inaccuracies

You always retain the ability to ignore, edit, or regenerate AI outputs.

4. Advertising and Recommendations

We do not sell your personal information. In-app recipe and product recommendations use your stated preferences, not an advertising profile. On our website, Google Analytics, Meta Pixel and Google Ads are gated by cookie consent.

In the mobile app, we use the Meta SDK to measure installs and app activation, and the Meta SDK and Conversions API to measure successful registrations and completed meal plans for advertising measurement, optimisation and audiences. Depending on the channel, this includes app/device details, SDK or Firebase app-instance identifiers, an available advertising identifier, and the IP address and user agent observed by our server. Our server transforms your normalized email with SHA-256 before sharing it with Meta. This is pseudonymised matching data, not anonymous data. We do not send Meta your plaintext email, phone number, meal contents or dietary preferences. We do not log subscription or purchase conversions.

On iOS, after your first meal plan is ready, we ask for permission through Apple's App Tracking Transparency prompt. Before permission, or if you decline, we do not submit these mobile Meta conversions or matching identifiers. Hashing your email does not bypass that choice. If you allow tracking, we may send successful actions from the preceding 24 hours, retaining their original action times. Pending actions are eligible for replay for 24 hours and expired actions are discarded on the next app refresh; limited local sent-event markers prevent duplicates until sign-out or eviction. Denial discards pending actions. On Android, measurement uses the system advertising ID while available; deleting it or enabling limited ad tracking stops new matching. Resetting the ID changes it but does not opt you out.

You can change tracking permission in your device settings. The app's features and prices do not depend on your answer. Meta processes the permitted data for advertising measurement and may match it to its own account data, including outside South Africa as described in section 7. Aggregate attribution and audience availability depend on platform restrictions; we do not promise that every install or action can be attributed.

5. Who We Share Data With

We rely on a small number of trusted service providers to run Meal Hack. Each processes only the data necessary for its role:

Stripe — subscription billing, payment processing, and customer portal
AWS Cognito, Google, Apple — sign-in and identity
Amazon Web Services — application hosting, file storage (S3), database infrastructure, content delivery, real-time messaging
Supabase — primary application database
AWS Bedrock and the underlying model providers (Anthropic, Meta, Mistral, Amazon, Qwen, Stability AI) — AI inference
Firebase Analytics — mobile in-app event analytics
Meta SDK and Conversions API — advertising measurement of mobile registrations and completed meal plans using the identifiers and request data described above
Google Analytics, Meta Pixel, Google Ads — marketing analytics on our website only, gated by cookie consent
Sentry — crash and error diagnostics
Expo — push notification delivery
GitHub — feedback you submit may be turned into engineering issues
RevenueCat, Inc. (US-based) — unified subscription management for legacy subscriptions and any optional paid plan offered in future. RevenueCat receives purchase and subscription-event data from Apple, Google Play, and our backend (Stripe) so we can resolve entitlement state across platforms. RevenueCat may also provide aggregated subscription-performance analytics.
Apple — payment processing and subscription management for legacy iOS subscriptions and any future iOS paid plan. Apple may share transaction identifiers with us through RevenueCat.
Google — payment processing and subscription management for legacy Android subscriptions and any future Android paid plan. Google may share transaction identifiers with us through RevenueCat.

We may also share fully anonymised, aggregated data that cannot reasonably be used to identify you.

6. Legal Basis (POPIA & GDPR)

We process personal information on the following bases:

Your consent (e.g. optional profile fields, photo upload, marketing analytics on web, and mobile Meta advertising measurement where you allow tracking)
Performance of our contract with you (delivering the service you signed up for)
Our legitimate business interests (security, fraud prevention, product improvement, and aggregate advertising reporting)
Compliance with legal obligations

7. Your Rights

You have the right to:

Access the personal information we hold about you
Correct or update inaccurate information
Delete your personal information
Receive a copy of your data in a portable format
Withdraw consent or object to processing
Lodge a complaint with the South African Information Regulator or your local data-protection authority

To exercise any of these rights, email our Information Officer at admin@meal-hack.com. We will acknowledge your request and respond within 30 days.

8. Data Retention

We retain your personal information for as long as is necessary to provide the service to you and to meet our legal, accounting, and reporting obligations. You may request deletion of your account at any time from in-app Settings or by emailing us.

The records of your choices described in section 1.8, and the priced-basket snapshots we calculate, are retained for as long as your account exists — their usefulness to us is the long-run picture they build over time. They are deleted when you delete your account.

Some of our service providers (for example Stripe and AWS) may retain transactional or technical records under their own retention policies and legal obligations after your account has been deleted. Anonymised, aggregated data may be retained indefinitely.

9. Security

We use industry-standard safeguards including HTTPS in transit, encrypted secrets management, scoped database access, hashed passwords, secure on-device storage of authentication tokens (iOS Keychain / Android Keystore), and Stripe (PCI-DSS) for payment-card handling. No card number ever reaches our servers. No system is completely secure, however, and we cannot guarantee absolute security.

10. Breach Notification

If we become aware of a security incident that compromises your personal information, we will notify you and, where required, the South African Information Regulator as soon as reasonably possible, in accordance with POPIA Section 22.

11. Children's Privacy

Meal Hack is intended for users 18 years and older. Users under 18 may use the Platform only with verified parental or guardian consent. We do not knowingly collect personal information from children under 13.

12. International Transfers

Your information may be processed and stored outside South Africa, including in the United States and the European Union, by the service providers listed above. We rely on each provider's contractual safeguards (such as the EU Standard Contractual Clauses) to ensure your data continues to be protected.

13. Cookies and Local Storage

On the mobile app we use:

Secure on-device storage (Keychain / Keystore) for your authentication tokens
Local app storage for cached content, draft inputs, and an installation identifier used for push notifications

On the web marketing site we use cookies for:

Functionality (remembering your consent choice)
Analytics and conversion tracking — only with your consent, which you can change from the cookie banner

You can revoke camera, photo-library, notification, and tracking permissions at any time from your device settings.

14. Updates to This Policy

We may update this Privacy Policy from time to time. The version number and date at the top of this page will change when we do. Material changes will be communicated in-app and may require renewed acceptance.

15. Contact and Information Officer

Information Officer (POPIA): Regan van Heerden
Email: admin@meal-hack.com
Phone: +27 64 685 9637

General queries: admin@meal-hack.com

View Terms and Conditions