This Privacy Policy explains what information Meal Hack collects, how we use it, who we share it with, and the choices you have. It is aligned with the South African Protection of Personal Information Act (POPIA) and the EU General Data Protection Regulation (GDPR).

1. Information We Collect

1.1 Account Information

Email address
Password (stored as a one-way hash)
Username (optional)
Name, phone number, date of birth, and avatar (all optional, set in your profile)
OAuth identifiers when you sign in with Google or Apple (email, name; Apple may issue a private relay email)

1.2 Preferences and Profile Data

Unit system, currency, weekly budget
Location you enter (country, state/province, city, postal code) — we do not request GPS access
Food preference profiles: cuisines, allergens, dietary restrictions, and dislikes you choose to enter, including any custom free-text entries
Meal plans, recipes, smart meals, shopping lists, and favourites generated for you or saved by you
Free-text feedback you provide when regenerating a meal

1.3 Photos You Upload

If you use the photo features, the images you upload are stored in our cloud storage and sent to vision AI models for ingredient and meal recognition. You can delete images by removing the related smart meal or by deleting your account.

1.4 Device and Diagnostic Data

Device model, operating system version, and app version
A randomly-generated installation identifier used to deliver push notifications
A Firebase app-instance identifier used for mobile analytics and server-side conversion measurement
An advertising identifier (IDFA on iOS, Advertising ID on Android), used only to measure which of our adverts bring people to Meal Hack. On iOS we ask first and collect nothing if you decline. Android has no equivalent prompt, so it is used from your first meal plan onwards — you can stop that at any time by deleting or resetting the advertising ID in your device settings
Push notification tokens issued by Apple, Google, or Expo
Crash reports, error stack traces, and limited session breadcrumbs collected by our error-tracking provider — authentication tokens, passwords, and other secrets are scrubbed automatically

1.5 Usage Data

In-app interactions, screen views, and feature events such as sign-up, login, generate meal plan, add to shopping list
Registration and completed meal-plan conversion events used to measure the effectiveness of our mobile advertising
Real-time generation progress is transmitted to your device over a secured WebSocket connection

1.6 Web Marketing Site (Cookies)

On our marketing website only, and only with your cookie consent, we may collect analytics events via Google Analytics, Meta Pixel, and Google Ads. You can decline or change this consent at any time from the cookie banner.

1.7 What We Do Not Collect

No GPS or background location
No contacts, calendar, microphone, or HealthKit data
No advertising identifier on iOS unless you allow tracking when we ask, and none at all if you decline. On Android the system advertising ID is used for the measurement in section 4 unless you delete or reset it in your device settings. Either way, nothing else about the app changes
No biometric data
No body metrics, weight, BMI, menstrual-cycle data, or medical-condition data

We do not request, prompt for, or intentionally collect health information. Free-text boxes (for example the note you can add when regenerating a meal) accept whatever you choose to type — please do not enter health details or other sensitive information there. Anything you do enter is treated as ordinary personal information under this policy, is never used to infer or record health status, and is never shared with third parties in identifiable form.

1.8 Records of Your Choices

So that we can tell how well our suggestions work and improve them, we keep a record of certain decisions you make in the app:

Items you remove from a shopping list
When you replace a suggested product with a different one, including which product you replaced and the prices of both
When you replace or regenerate a planned meal, which meal it replaced, and any note you added
Snapshots of the priced baskets we calculate for your meal plans

These records are linked to your account. They cover your choices and the products and prices involved. They contain no payment details and no location beyond the metro area you select.

2. How We Use Your Data

We use your data to:

Create and manage your account
Generate meal plans, recipes, smart meals, and shopping lists
Personalise recommendations based on your stated preferences
Process payments and manage your subscription
Send you transactional and product notifications
Diagnose errors, improve reliability, and develop the platform
Understand how our meal, product, and price suggestions perform, and improve them
Produce aggregated, non-identifying insights about how people plan meals and shop for groceries, which we may publish or provide to third parties in that aggregated form
Measure registrations and completed meal plans to improve our advertising campaigns
Comply with legal obligations

3. AI and Automated Processing

Meal Hack uses artificial intelligence to generate meal plans, recipes, images, ingredient lists, and other content. Inputs are processed via AWS Bedrock and related providers, using models from Anthropic, Meta, Mistral, Amazon, Qwen (Alibaba), and Stability AI. Photos you upload are sent to vision-capable models for ingredient extraction.

Free-text feedback you provide when regenerating meals is retained. Where you ask us to remember it, we use it to influence future generations for your account — the in-app “remember this preference” option controls that personalisation, not whether the note is stored. We also analyse this feedback, together with the records described in section 1.8, to improve the service and to produce the aggregated insights described in section 2.

You should be aware that:

Recommendations are generated automatically without human review
Outputs depend on the inputs you provide
Results may vary and may contain inaccuracies

You always retain the ability to ignore, edit, or regenerate AI outputs.

4. Advertising and Recommendations

We do not sell your personal information and we do not build behavioural advertising profiles about you. Within the app you may see contextual product or recipe recommendations based on your stated preferences. On our marketing website, with your cookie consent, we run conversion-tracking pixels (Google Ads, Meta Pixel) and analytics (Google Analytics). For the mobile app, our backend sends registration and completed meal-plan events to Meta through its Conversions API for campaign measurement and optimisation. This includes a Firebase app-instance identifier, app/device details, and a normalized email address transformed with one-way SHA-256 before transmission. Registration events also include the IP address and user agent observed by our server. We do not send your plaintext email address or phone number.

On iOS, after your first meal plan is ready, we ask permission to use your device's advertising identifier through Apple's App Tracking Transparency prompt. If you allow it, we include that identifier with the two events above so Meta can match them more accurately. If you decline, or before you are asked, none is collected or sent. Android has no equivalent prompt, so on Android the system advertising ID is used for the same measurement from your first meal plan onwards; you can stop this at any time by deleting or resetting the advertising ID in your device's privacy settings. On neither platform does any feature of the app behave differently either way. Separately, Apple's SKAdNetwork reports how our advert campaigns perform in an aggregate form that does not identify you.

5. Who We Share Data With

We rely on a small number of trusted service providers to run Meal Hack. Each processes only the data necessary for its role:

Stripe — subscription billing, payment processing, customer portal
AWS Cognito, Google, Apple — sign-in and identity
Amazon Web Services — application hosting, file storage (S3), database infrastructure, content delivery, real-time messaging
Supabase — primary application database
AWS Bedrock and the underlying model providers (Anthropic, Meta, Mistral, Amazon, Qwen, Stability AI) — AI inference
Firebase Analytics — mobile in-app event analytics
Meta Conversions API — server-side measurement of mobile registrations and completed meal plans using the identifiers and request data described above
Google Analytics, Meta Pixel, Google Ads — marketing analytics on our website only, gated by cookie consent
Sentry — crash and error diagnostics
Expo — push notification delivery
GitHub — feedback you submit may be turned into engineering issues

We may also share fully anonymised, aggregated data that cannot reasonably be used to identify you.

6. Legal Basis (POPIA & GDPR)

We process personal information on the following bases:

Your consent (e.g. optional profile fields, photo upload, marketing analytics on web, and use of your advertising identifier where you allow tracking)
Performance of our contract with you (delivering the service you signed up for)
Our legitimate business interests (security, fraud prevention, product improvement, and measuring advertising effectiveness)
Compliance with legal obligations

7. Your Rights

You have the right to:

Access the personal information we hold about you
Correct or update inaccurate information
Delete your personal information
Receive a copy of your data in a portable format
Withdraw consent or object to processing
Lodge a complaint with the South African Information Regulator or your local data-protection authority

To exercise any of these rights, email our Information Officer at reganvanh@gmail.com or admin@meal-hack.com. We will acknowledge your request and respond within 30 days.

8. Data Retention

We retain your personal information for as long as is necessary to provide the service to you and to meet our legal, accounting, and reporting obligations. You may request deletion of your account at any time from in-app Settings or by emailing us.

The records of your choices described in section 1.8, and the priced-basket snapshots we calculate, are retained for as long as your account exists — their usefulness to us is the long-run picture they build over time. They are deleted when you delete your account.

Some of our service providers (for example Stripe and AWS) may retain transactional or technical records under their own retention policies and legal obligations after your account has been deleted. Anonymised, aggregated data may be retained indefinitely.

9. Security

We use industry-standard safeguards including HTTPS in transit, encrypted secrets management, scoped database access, hashed passwords, secure on-device storage of authentication tokens (iOS Keychain / Android Keystore), and Stripe (PCI-DSS) for payment-card handling. No card number ever reaches our servers. No system is completely secure, however, and we cannot guarantee absolute security.

10. Breach Notification

If we become aware of a security incident that compromises your personal information, we will notify you and, where required, the South African Information Regulator as soon as reasonably possible, in accordance with POPIA Section 22.

11. Children's Privacy

Meal Hack is intended for users 18 years and older. Users under 18 may use the Platform only with verified parental or guardian consent. We do not knowingly collect personal information from children under 13.

12. International Transfers

Your information may be processed and stored outside South Africa, including in the United States and the European Union, by the service providers listed above. We rely on each provider's contractual safeguards (such as the EU Standard Contractual Clauses) to ensure your data continues to be protected.

13. Cookies and Local Storage

On the mobile app we use:

Secure on-device storage (Keychain / Keystore) for your authentication tokens
Local app storage for cached content, draft inputs, and an installation identifier used for push notifications

On the web marketing site we use cookies for:

Functionality (remembering your consent choice)
Analytics and conversion tracking — only with your consent, which you can change from the cookie banner

You can revoke camera, photo-library, notification, and tracking permissions at any time from your device settings.

14. Updates to This Policy

We may update this Privacy Policy from time to time. The version number and date at the top of this page will change when we do. Material changes will be communicated in-app and may require renewed acceptance.

15. Contact and Information Officer

Information Officer (POPIA): Regan van Heerden
Email: reganvanh@gmail.com
Phone: +27 64 685 9637

General queries: admin@meal-hack.com

View Terms and Conditions