Privacy Policy

Last updated: 15 October 2026

MealFuel plans your lunches and dinners. This policy explains, in plain words, what data the app uses, why, where it goes and how long it stays. The short version: there is no account, most of your data never leaves your phone, and nothing about your health is sent unless you say yes.

1. Who is responsible

The data controller is Luciano Carallo, Via della Rinascita 10, 61029 Urbino (PU), Italy. Contact for anything about your data: support@mealfuel.app. We have not appointed a data protection officer, because the law doesn't require one for a service of our size; write to the address above.

2. Data that stays on your phone

Everything you tell MealFuel is saved in a local database on your phone: your answers to the setup questions (the name you'd like to be called, people at the table, training days, diet, allergies, foods you refuse, cuisines and dishes you like, your week and cooking time, budget), your pantry, your plans and shopping list, your cooking history and ratings, and the tastes you tell Mealy (“Something I don't like”). If you allow it, the app also reads which evenings are busy in your calendar to shorten those dinners; calendar events are read on the phone and are never sent anywhere. Reminders are scheduled on the phone too.

To help us fix faults, the app also keeps on your phone a short list of the last 30 technical errors: in which part of the app it happened, a short code (for example “timeout”) and the time. It is designed to contain only these technical details: it does not include what you wrote, your plans, your answers or your health data.

We don't receive any of this unless it is sent as described below. You can delete all of it at any time in Me → Delete my data, or by deleting the app.

3. Data sent to write your plan (only with your consent)

When you agree to let AI create your plan, the app sends a planning request to MealFuel's server. It contains: your diet, allergies and the foods you refuse, your cuisine and dish preferences, the tastes you told Mealy (what you don't like and what you'd like more often), a short summary of what the app learned from you (the names of dishes you loved, rejected or cook often, and the cuisines and main ingredients you lean towards), the days and meals to plan with how many people and how much time, your training days (as a protein target), your pantry (ingredients, amounts, where they're stored and their dates), your weekly budget, your country and the app's language. When you ask Mealy to change a dish, it also sends what you wrote about it and the dishes in your plan. If you also agreed to usage statistics, it sends your “Love it” and “Not for me” on dishes created by the AI, as a fingerprint of the dish and the vote, nothing else.

The request does not contain your name, email, phone number, contacts, location, calendar, age, height, weight or any advertising identifier.

Because allergies and diet can reveal information about your health, we process this data only with your explicit consent (GDPR art. 6(1)(a) and 9(2)(a)), which you give with the button “Let AI create my plan”. If you choose Not now, or later withdraw your consent in Me → AI and your data, nothing more is sent: your weeks are built on your phone from MealFuel's own recipe library. Withdrawing doesn't affect what was done before.

4. Who receives data, and why

These companies act as our processors, under data processing agreements that oblige them to use the data only for us. Vercel, OpenAI and Superwall are based in the United States, and some data may be accessed from there: those transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards at the address in section 1.

5. How long data stays

• The plan request itself is not stored. We keep a one-way fingerprint of it with its cost and outcome for up to 12 months, to count use against your limits and to find faults; then it is deleted.
• The finished plan is kept encrypted for 15 minutes, only so we can resend it if your connection drops; then it is deleted.
• New dishes join a shared recipe library. When the AI creates a new dish that passes our checks, we keep the dish itself — its name, ingredients, steps and translation — in a recipe library shared by everyone, and we may suggest it to other people (checked again against their diet and allergies). We keep nothing about you with it: not the reason it was chosen for you, not your request, not your phone. Dishes whose text could refer to a person (dates, contacts, doctors or health) are not kept. Dishes stay in the library as long as the service runs.
• OpenAI may keep requests for up to 30 days to detect abuse, then deletes them.
• The public part of your phone's App Attest key and its usage counters stay while the key is valid (one year) and are deleted 30 days after it expires.
• To protect the service from abuse we count requests per network address. We never store the address: only a keyed fingerprint of it, deleted after one day.
• Subscription records are kept by Apple and Superwall for as long as the law on accounting and taxes requires.
• Usage statistics, if you allowed them, are kept by PostHog for up to 12 months.
• Emails you send us, such as a problem report, are kept as long as needed to fix the problem and answer you, and at most two years after we close the request (section 9).

6. Usage statistics (optional)

Usage statistics are optional and separate from your choice about AI. During setup, right after the question about your age, the app asks adults whether they want to share usage statistics. There are two choices, allow or not now, and neither is selected for you; the app works the same whichever you pick. Before that point, nothing is sent to PostHog. If you finished the setup before this question existed, you can turn statistics on in Me. If you tell the app you are under 18, it doesn't show this question and sends nothing. You can change your mind at any time in Me. The same choice also covers your “Love it” and “Not for me” on dishes from the shared recipe library (see the end of this section). This is not Apple's “App Tracking Transparency” prompt: MealFuel doesn't track you across apps or websites of other companies and doesn't use the advertising identifier.

What is sent, if you allow it. The app sends PostHog, on servers in the EU, short events from a fixed list. Each event has a name and a few properties with preset values or ranges, never free text. They tell us:

• which screens you open and which buttons you use, and when the app is installed, updated, opened, brought back to the front or sent to the background;
• which page of the setup you reach and whether you go back (setup pages that appear only after certain answers are not recorded);
• whether the subscription screen opens, is closed, doesn't appear, or ends with access being unlocked, and the result of an action such as “Restore purchases”;
• whether writing your week with AI worked, or the app used MealFuel's own recipe library instead, with a short reason;
• whether changing a dish worked;
• whether you cooked an evening's dinner and how you rated it (loved, fine or not again), or that you didn't cook it;
• which kind of change you make to your week or your pantry (for example skipping a meal, eating out, moving a dish, adding or using up an item), and whether you connect your calendar (yes, denied or unavailable, never its contents);
• which kind of setting you changed in Me (for example profile, appearance or AI), but not its value; the only exception is the choice between light and dark appearance;
• when something goes wrong, a short error code, the type of the error and the part of the app where it happened, made only of letters, digits and a few symbols (the same kind of code as in section 2).

About dishes we send only traits of the dish: its cuisine (for example Italian), a range of cooking time (up to 20 minutes, 21 to 40, more than 40) and whether the recipe comes from MealFuel's recipe library or was written by the AI. We never send the recipe's identifier or title, and never an ingredient.

PostHog's library also adds basic technical details to the events: the app's name, identifier, version and build, the system and its version, the phone's manufacturer, model and type, the language (without the region), a random session identifier, the version of the library, and whether the app is running in a simulator. The events do not include your time zone, your screen size or your region.

What is never sent. Your answers to the setup questions (goals, diet, allergies, foods you refuse, weight, budget, your name), anything you write, the values of your settings (apart from the appearance exception above), your location, name, email or the advertising identifier. We don't create a profile of you in the analytics tool, the screen is not recorded and nothing is captured automatically.

Identifier and servers. PostHog gives your phone a random identifier that does not identify you directly: it is not linked to your name, your email or any account. The project is set up not to keep your IP address (addresses are anonymised and location lookup is switched off). The servers are in the EU.

If you withdraw. When you turn statistics off in Me (or tell the app you are under 18), the app stops collecting events. Events collected a moment before may still be sent right afterwards, and the app also clears the statistics identifier it keeps on your phone. Withdrawing doesn't affect what was sent before.

With the same choice, your “Love it” and “Not for me” on dishes from the shared library are added to that dish's anonymous counts, so that dishes people like are suggested more often; we don't record who voted.

7. Subscriptions

MealFuel Pro is sold by Apple through the App Store; Apple handles payment, renewals and refunds under its own terms and privacy policy. To show the subscription screen and unlock the app, we use Superwall. Superwall receives an anonymous identifier it creates for your phone, Apple's identifier for apps from the same developer (not the advertising identifier), your subscription status and purchases, the screens of the subscription flow you see, your device type, system, language and region, and an approximate location (country and city) that it works out from your network address. Superwall also uses this information to work out which link or ad brought you to the app (install attribution), without the advertising identifier. It doesn't receive your name, your answers or your health data. Before the AI writes a plan, the app checks that your trial or subscription is active. If you start a free trial and allow notifications, the app reminds you on your phone the day before the trial ends; the reminder is scheduled on your phone.

8. Our website

On mealfuel.app you can leave your email to hear about the app. We use it only for that, with your consent, and you can ask to be removed at any time, from any of our emails or by writing to us. The list is stored by Neon in Frankfurt and deleted when you ask or when we stop writing about the launch.

9. Reporting a problem

If something goes wrong, the app says sorry and offers a button, “Send us the problem” (also “Report a problem” in Me). The button opens your email app with a message to support@mealfuel.app already written. It contains the app version, your phone model, system version and language, and the last technical errors saved on your phone (section 2). We also receive your email address, the name on your email account and anything you write. You can read, change or delete anything before sending, and nothing is sent unless you press send in your email app.

We use what you send only to understand and fix the fault and to reply to you, based on our legitimate interest in keeping the app working (GDPR art. 6(1)(f)). Your message is handled by the email service that hosts our support address, which acts as our processor. If you describe something about your health in your message, we use it only to reply to you. For how long we keep it, see section 5.

10. Decisions about you

MealFuel's AI writes recipes from your answers. It doesn't take decisions that have legal or similarly significant effects on you, and it doesn't build a profile of you for advertising.

11. What we don't do

• No account, no sign-in.
• No advertising, no tracking across apps or websites, no advertising identifier.
• We never sell or share your data for marketing.

12. Your rights

Under the GDPR you can ask to access, correct or delete your data, to restrict its processing, to receive it in a portable format, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting what was done before. Most of your data is only on your phone, where you control it directly. For anything on our side, write to support@mealfuel.app; because we don't know who you are, we may ask you for details from the app to find the right records. We answer within one month. You can also complain to your data protection authority: in Italy, the Garante per la protezione dei dati personali.

13. Children

MealFuel is not intended for children under 16, and we don't knowingly process their data. If you tell the app you are under 18, it doesn't ask for consent to AI and it doesn't ask about usage statistics: your week is planned on your phone, nothing about your health is sent, and nothing is sent to PostHog.

14. Changes

If we change how data is used, we'll update this page and the date above. If a change needs your consent, the app will ask for it again before it applies.