Privacy Policy

1. Who we are

MealWise ("MealWise", "we", "us", "our") is published by MealWise LLC. This Privacy Policy explains how we collect, use, share with service providers, retain, and protect your information when you use the MealWise website, web app, and installable application (collectively, the "Service"). It applies to information we process as the data controller.

2. Information we collect

Account & authentication

• Email address, password (stored hashed by our authentication provider), display name.
• Optional Google or Apple sign-in identifiers if you use social login.

Subscription & payment metadata

• Plan, billing period, subscription and customer identifiers from Stripe, subscription status, trial start/end, cancellation reason.
• We do not store card numbers or full payment credentials — Stripe processes payments directly.

Health, wellness & meal-planning data

• Weight, height, BMI inputs, age, sex, activity level.
• Primary goal (weight loss, maintenance, muscle gain, athletic performance).
• Dietary pattern, allergies, dislikes, food preferences and cuisines.
• Health conditions you enter (e.g. hypertension, diabetes, cholesterol) used to tailor meal guidance.
• Meal plans, planned meals, favorites, liked meals, shopping-cart items, grocery lists, meal completions, adherence logs, training-day toggle.
• Food journal entries and optional journal photos.
• Weigh-ins over time.

Household / family-member profiles

• Family member names, ages, and per-member allergies, dislikes, dietary pattern, and personal goal that you enter — including information entered by an adult account holder on behalf of a minor. Only the adult account holder can add or edit these records.

Communications

• Transactional and service emails (sign-up, password reset, subscription confirmations, trial reminders, payment failures, cancellation notices).
• Newsletter subscriptions when you opt in.
• Support messages you send us.

Automatically collected technical data

• Device, browser, operating system, and IP address in server request logs (Cloudflare hosting) for security, abuse prevention, and reliability.
• Affiliate click events (product, retailer, timestamp) when you click an Amazon or other affiliate link inside MealWise.
• App activity such as feature use, generation requests, and page views used to operate the Service.

3. How we use your information

• Create and manage your account and household.
• Generate personalized meal plans, "cook this now" suggestions, holiday menus, and goal-aware feedback using the profile, dietary, household, meal, and wellness context you provide.
• Process subscriptions and payments through Stripe.
• Send transactional and service emails, and (if you opted in) marketing/newsletter emails.
• Provide, secure, monitor, debug, and improve the Service.
• Attribute affiliate revenue when you make qualifying purchases through outbound links.
• Comply with legal, tax, accounting, and fraud-prevention obligations.

4. Service providers and processors we share data with

We do not sell your personal information. To operate MealWise we share limited information with the following service providers who process it on our behalf under contractual confidentiality and security obligations:

• Supabase — authentication, database, and file storage (journal photos). Hosts your account, profile, meal, wellness, and household data.
• Stripe — subscription billing and payment processing. Receives payment method, billing email, and subscription metadata directly from you at checkout.
• Lovable Cloud (including the Lovable AI Gateway) — provides our application backend and routes AI meal-generation requests to third-party model providers. When you generate a plan, recipe, or holiday menu, we transmit the profile, dietary, household, meal, and wellness context needed to produce the response. We do not use these requests to train third-party models; requests are processed to return the response and standard operational logs may be retained by the model provider or gateway for a limited period.
• Cloudflare — hosting, edge delivery, DDoS/WAF protection, and infrastructure logs (IP address, request metadata).
• Amazon Associates — when you click an affiliate link we redirect you to Amazon with our Associate tag. Amazon then applies its own privacy policy; we receive aggregate commission reporting, not your Amazon account.
• Email delivery — our transactional email provider delivers auth and service emails.

We may also share information (a) with your consent, (b) to comply with law, legal process, or lawful government requests, (c) to protect the rights, safety, or property of MealWise, our users, or others, or (d) in connection with a merger, acquisition, or sale of assets, with continued protection of your data.

Sharing with these service providers/processors is not a sale of personal information.

5. AI meal generation

MealWise uses automated meal-generation models routed through the Lovable AI Gateway. To produce personalized output we transmit relevant fields from your profile and household — including weight, BMI, primary goal, dietary pattern, allergies, dislikes, cuisines, health conditions, per-member overrides, adherence signals, and the current meal request. We do not transmit your Stripe payment data, password, or journal photos to these models. Output is generated per request; no third-party AI provider is authorized by us to train models on your inputs.

6. Cookies and similar technologies

MealWise uses first-party browser storage to keep you signed in (Supabase auth session) and to remember lightweight preferences such as the training-day toggle. We do not use third-party advertising cookies.

7. Data retention

• Account, household, meal, wellness, and journal data are retained for as long as your account is active.
• When you delete your account we remove your personal data as described in Section 9. Anonymized cancellation records and Stripe payment/webhook logs may be retained for tax, accounting, and fraud-prevention obligations.
• Server request logs are retained for a limited period for security and reliability, then rotated out.

8. Data security

Data is encrypted in transit (HTTPS) and at rest by our infrastructure providers. We use row-level security policies, least-privilege server functions, and modern access controls. No system is 100% secure, but we work continuously to protect your information.

9. Your rights and account deletion

Depending on where you live, you may have the right to access, correct, export, restrict, object to, or delete your personal data, and to withdraw consent. To exercise these rights:

• Delete your account in-app: sign in and visit joinmealwise.com/account/delete.
• Public deletion instructions: see joinmealwise.com/delete-account.
• Other privacy requests: email support@joinmealwise.com.

10. Children's privacy

MealWise is not directed to children under 13, and children under 13 may not create an account. Household and family-member records for minors must be created and managed by a parent or legal guardian who is the account holder.

11. International transfers

MealWise and its service providers may process your data in the United States and other countries where they operate. Where required, we rely on appropriate transfer mechanisms.

12. Health & wellness disclaimer

MealWise provides meal-planning and general wellness information for educational purposes only and is not a medical service. See our full Health & Wellness Disclaimer.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated via the app or email.

14. Contact us

Questions or privacy requests: support@joinmealwise.com.