How MealLoop handles your personal data

MealLoop is provided by Stian Hansen, a private individual based in Norway, who is responsible for (the "controller" of) the personal data described in this policy. You can reach us about anything privacy-related at kontakt@mealloop.me.

The information we collect depends on how you use MealLoop.

• Account and sign-in data. When you sign in with Google we receive your name, email address, whether Google has verified that address, your Google account ID, and your profile image. We also store the sign-in tokens Google issues for your account. Your name and image are refreshed from Google each time you sign in.
• Profile and health-related data. Only if you choose to set up personal nutrition targets, during sign-up or later from your profile, we ask for your date of birth, sex, weight, height, and activity level, and store your nutrition goal (for example weight loss or maintenance) with your calorie and macronutrient targets. This is optional: you can skip it and use MealLoop for planning, shopping, and cooking without it. You can change these details at any time from your profile.
• Preferences. Your language, preferred food database, dashboard layout, and any custom instructions you write for recipe imports, such as dietary needs or allergies.
• Content you create. Meal baskets and their meals, shopping, and cooking progress; recipes, including imported recipe content, photos, translations, and ingredient mappings; custom foods and any barcodes you add to them; diary entries and custom diary sections; favorite recipes and meals; pantry items; shopping lists; meal plans, including public meal plans you save as a basket; and your group memberships.
• Meal-photo estimates. If you use this feature in the Android app, the photo you select is processed for that request but is not stored by MealLoop. If you review and save the result, we store only the food names, estimated amounts, assumptions, confidence levels, and nutrition values that make up the diary entry. We also count your requests each day to apply the daily limit.
• Recipe import records. When you import a recipe we record the link you imported, the outcome, how long processing took, and which AI model was used. We use this to apply import limits and to improve import quality.
• How you found MealLoop. Only if you accept the optional cookie when we ask, we record the campaign parameters in the link you used (such as utm_source or ref), the domain of the site that referred you, and the page you landed on. If you create an account within 30 days, this is stored with your account. We also note whether you signed up on the web or in the app. This information is deleted with your account.
• Billing and subscription data. MealLoop is currently free. If we offer paid plans and you subscribe, Stripe receives your name, email address, and MealLoop account ID, and we store your Stripe customer and subscription IDs, plan, status, and billing period. Payment card details are handled by Stripe and never reach MealLoop.
• Technical and security data. For each signed-in session we store the IP address and browser or device details. We keep a security log of important actions — such as sharing, publishing, and group changes, as well as rejected requests that are not signed in — with the time, the account involved, the IP address, and browser details. Our servers also write short-lived error logs that can include account IDs.
• Mobile testing interest. If you join the mobile testing list, we store your email address, selected platform, page language, consent time, and, when applicable, the public recipe page that led you to the form. Your IP address is used briefly to prevent abuse of the form but is not stored. The registration is deleted with a MealLoop account that uses the same email address.
• Messages to us. If you email us, we keep the conversation so we can help you and follow up.

We use personal data only for the purposes below, each with a legal basis:

• To provide MealLoop to you (performance of our agreement with you): creating and securing your account, syncing your data between the web and the Android app, calculating nutrition and targets, building shopping lists, sharing with your group, and running the AI features you use.
• Our legitimate interests: keeping MealLoop secure, preventing fraud and misuse, enforcing plan and feature limits, fixing problems, and improving recipe import and ingredient matching. You can object to this processing at any time.
• Your consent: the optional cookie that records how you found MealLoop, joining the mobile testing list, and accepting the meal-photo disclosure before first use. You can withdraw consent at any time without affecting earlier processing.
• Legal obligations: keeping accounting records if you buy a paid plan, and responding to lawful requests from authorities.

We don’t sell personal data, use it for advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects.

• Sign-in session (better-auth.session_token): keeps you signed in. Lasts 7 days and is renewed while you use MealLoop.
• Sign-in state (better-auth.state): protects the Google sign-in step against forged requests. Lasts a few minutes.
• Acquisition (ml_attribution, optional): remembers how you first found MealLoop, as described above. Only set if you accept it. Lasts 30 days.
• Cookie choice (ml_consent): remembers whether you accepted or declined the optional cookie, so we don’t ask on every page. Lasts 180 days.
• Sidebar (sidebar_state): remembers whether the dashboard sidebar is open. Lasts 7 days.
• Browser storage: the web app keeps a copy of your sign-in token and small conveniences, such as the last planner range you viewed, a dismissed banner, and a temporary preview of a recipe you are importing. The Android app keeps your sign-in token in the device’s secure storage.

You can change your choice at any time with the Cookie settings link at the bottom of our public pages. You can also remove cookies and stored data through your browser settings; if you remove the sign-in cookie or token, you will be signed out.

MealLoop uses AI for the following features:

• Recipe import: the link you paste (a website, YouTube, Instagram, or TikTok) is read and turned into a recipe, translated into your language when needed. Your custom import instructions are included.
• Ingredient matching: when you save or edit a recipe, or plan or log a recipe that has not been matched yet, its ingredients are matched to foods in our database. The request includes the ingredient text, the names of your custom foods, and your custom instructions.
• Recipe translation: when you ask for a recipe in another language, the recipe text is translated.
• Meal-photo estimates (Android app): the photo you select is analysed to estimate the foods and portions it shows. The request is tagged with your MealLoop account ID for usage monitoring. MealLoop processes the photo in memory and does not save it.

AI output can contain mistakes, so MealLoop always lets you review imported recipes, matched ingredients, and photo estimates before you rely on them.

You choose what to share, item by item. While you are in a group, new recipes, imported recipes, and shopping lists are shared with the group by default, which you can switch off before saving; meal baskets are private by default. Group admins can edit shared items, and custom foods used in a shared recipe become visible to the group.

If you publish a recipe, its page becomes available to anyone and may appear in the public recipe directory, collections, and public meal plans, and in search engines. The page shows the recipe content, photo, nutrition summary, any translations you have, and the original source link when present, but does not show your name or profile. You can unpublish it to revoke the public page; search-engine caches may take additional time to disappear.

Signed-in MealLoop users can save an independent copy of a public recipe, including its photo. That copy belongs to their account and is not removed when you later edit or unpublish the public version. Recipe photos are stored as web files that anyone with the direct link can open.

We share personal data only with the service providers that run MealLoop on our behalf, and only as needed for the feature involved:

• Vercel hosts MealLoop, stores recipe photos, and routes AI requests through its AI Gateway.
• Neon hosts our database.
• Google provides sign-in, provides the Gemini AI models behind our AI features, and fetches website and YouTube links you import.
• RapidAPI download services fetch Instagram and TikTok links you import. They receive only the link.
• Open Food Facts receives barcodes you scan in the Android app to look up the product. It does not receive your account details.
• Stripe processes payments, invoices, and subscriptions if you buy a paid plan.
• Members of your group see the items you share with the group, as well as your name and email address.
• Authorities or other parties when required by law, or to protect the rights, safety, and security of MealLoop, our users, or others.

Our service providers may use personal data only to provide their services to us.

We keep your account data and content for as long as you have a MealLoop account. When you delete your account, we delete it immediately, as described on our account & data deletion page.

• The acquisition cookie expires after 30 days, and your cookie choice after 180 days.
• Sign-in sessions expire after 7 days without use, and expired sessions are deleted every day.
• IP addresses and browser details in the security log are removed after 90 days, and log entries are deleted after 12 months. When you delete your account, entries about you are anonymised straight away.
• Server error logs are kept for a short period by our hosting provider.
• Residual copies in database backups are overwritten within 90 days.
• Mobile testing registrations are deleted 12 months after you last signed up, when you delete a MealLoop account with the same email address, or sooner if you ask us to remove yours.
• If you buy a paid plan, Stripe keeps payment and invoice records for as long as it is legally required to.

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, and alteration, including encrypted connections and access controls. No system can guarantee absolute security, so please also protect the Google account you use to sign in to MealLoop.

Depending on where you live, including in Norway, the EU, and the EEA, you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Correct inaccurate data. Most of it you can edit directly in MealLoop.
• Delete your account and personal data.
• Restrict or object to processing based on our legitimate interests.
• Receive data you gave us in a portable format. Recipes, meal plans, shopping lists, and nutrition summaries can also be exported as CSV files inside MealLoop.
• Withdraw consent you have given, at any time.

You can delete your account and all associated data directly in MealLoop at any time from your profile (on the web: My Profile → Danger zone → Delete account; in the Android app: More → Profile → Delete account). For anything else, email us and we will respond within one month.

If you believe we handle your data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the data protection authority where you live.

Our service providers process personal data in countries outside Norway and the EEA, including the United States, where our database is hosted. When data is transferred, we rely on the safeguards these providers offer, such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

MealLoop is not intended for children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to MealLoop, please contact us so we can review and remove it.

We update this Privacy Policy as MealLoop evolves, for example when we add features or change providers. We always update the date at the top of this page, and we take reasonable steps to let you know about material changes in advance.

For privacy questions, access requests, or deletion help, email kontakt@mealloop.me. Deletion requests can also be made through our account & data deletion page.