Privacy policy
Effective 20 October 2026
This policy explains what the SmartMeal AI app (iOS and Android) and its server do with your data: what is collected, why, who else processes it, how long it is kept and what you can do about it.
1. Who is responsible
The controller of your personal data is Mikołaj Matejko, a sole trader,
ul. Meteorologów 23/24, 40-526 Katowice, Poland, tax ID (NIP) 6462955044.
Contact for anything about your data: privacy@smartmealai.com.
2. What we process and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: the ID of your Apple or email sign-in, your email address (with Sign in with Apple it may be Apple's private relay address), the date you joined; for Sign in with Apple also a token Apple gives us. | To keep your account and your data together on every phone. The Apple token is used only to revoke Sign in with Apple when you delete your account. | Contract, Art. 6(1)(b) |
| Preferences: language, units, diets, allergies, ingredients you never use, cuisine, number of servings. | To suggest recipes that fit you. Allergies and diets can say something about your health; you enter them only if you want, and can remove them at any time in the profile. | Contract, Art. 6(1)(b); for allergies and diets your explicit consent, Art. 9(2)(a) |
| Food photos you take or pick. | To recognise the food in them. A photo is sent to our server and to the AI model, used for that one answer and not stored by us. Please photograph food, not people. | Contract, Art. 6(1)(b) |
| What you type and create: ingredients, requests to change a recipe, the recipes made for you, favourites, your own recipes, shopping lists and their items, when each changed. | To make recipes and keep your lists, also offline and on your other phones. | Contract, Art. 6(1)(b) |
| Sharing: who is on a shared list (shown to the others by email address); recipes you share. | So people you invite can use the list with you. Anyone who has an invite link can see the list in a browser until you turn the link off; a shared recipe can be opened by anyone who has its link. | Contract, Art. 6(1)(b) |
| Premium: which store, the product, the store's purchase ID and when it renews or ends. We never see your card or payment details. | To give you Premium on every phone you sign in on. | Contract, Art. 6(1)(b) |
| AI usage: what kind of AI request it was, when, how long it took, its size and cost. | To count the monthly free and Premium limits and to know what the service costs. | Contract, Art. 6(1)(b); legitimate interest in preventing abuse, Art. 6(1)(f) |
| Crash reports (release versions only): where the app failed, device model, system and app version, a random installation ID. | To find and fix bugs. | Legitimate interest, Art. 6(1)(f) |
| Technical data: your IP address and the requests your phone sends. | To answer them and to limit abuse (too many requests). We do not keep access logs; error logs contain no photos, lists or recipes. | Legitimate interest, Art. 6(1)(f) |
We do not sell your data, do not show ads and do not use your data for advertising or profiling.
On your phone the app keeps a copy of your lists and recipes (so they open offline), changes waiting to be sent, your sign-in in the system's secure storage, and reminders you set (they are local notifications, never sent to us). Signing out removes the copy.
3. Who else processes it
Only providers we need to run the app, under data processing terms with them:
- Hetzner Online GmbH (Germany): the server, the database and encrypted backups, all in Germany.
- Google Cloud, Vertex AI (Google Ireland / Google LLC): the AI model that reads your photos and writes recipes. It gets the photo or text of the request and your preferences that matter for it (including allergies and diets). Requests are processed in data centres in the EU. Under Google Cloud's terms Google does not use them to train its models.
- Google Firebase (Google LLC, USA): sign-in with email and password (Firebase Authentication) and crash reports (Crashlytics, kept by Google for 90 days).
- Apple: Sign in with Apple, App Store purchases, the rating window and notifications on iPhone.
- Google Play: purchases and the rating window on Android.
- Unsplash: dish photos. Our server searches them by the dish name only; your phone then downloads the picture from Unsplash, which therefore sees your IP address.
- Cloudflare: the domain's name servers and forwarding of email sent to privacy@smartmealai.com.
Some of them (Google LLC, Apple, Unsplash, Cloudflare) may process data outside the European Economic Area, mainly in the USA. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
4. How long it is kept
- Your account, preferences, recipes and lists: until you delete them or your account.
- Deleting your account (Profile → Delete account) erases it from the database at once, with your recipes and lists, deletes your email sign-in account in Firebase and revokes Sign in with Apple. A list you shared with others stays theirs: it passes to another member.
- Backups: daily copies on the server for 14 days; encrypted copies off the server, daily for 30 days and monthly for 12 months. Deleted data therefore disappears from all backups within 12 months. Backups are used only to restore the service after a failure.
- AI usage records stay after you delete your account, without your name, email or any content, linked only to a one-way code made from your sign-in ID. They keep the monthly limit from starting again when someone deletes the account and signs up again, and show what the service costs.
- Crash reports: 90 days.
5. Your rights
You can ask us for access to your data and a copy of it, to correct it, to erase it, to restrict its processing and to receive it in a portable format, and you can object to processing based on our legitimate interest. Where processing is based on consent (allergies and diets) you can withdraw it at any time by removing them; this does not affect what was done before. Most of this you can do yourself in the app; for the rest write to privacy@smartmealai.com. We answer within a month.
You may also lodge a complaint with a data protection authority: in Poland the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority where you live or work. In Brazil you also have the rights of the LGPD and may complain to the ANPD.
6. Children
SmartMeal AI is not meant for children under 16. If you believe a child has given us data, write to us and we will delete it.
7. Security
Data travels encrypted (HTTPS). The server accepts only what the app needs, backups are encrypted before they leave it, and access is limited to the controller.
8. Changes
When this policy changes we will publish the new version here with its date, and tell you in the app if the change matters to you.