Privacy Policy

MealCraft — Plan. Prep. Plate.

Last updated: July 2026

MealCraft is a meal-planning app built by Maina Njoroge, an individual developer — there is no company behind it. This policy explains what information we collect, why we collect it, and how we protect it.

1. Information we collect

Information you provide directly

Account details — your name and email address when you create an account or sign in.
Household profile — the names, dietary preferences, allergen flags, and calorie goals of the people in your household. This is used solely to personalise recipe suggestions and nutrition tracking.
Meal plans & shopping lists — the meals you plan and the grocery items you generate.
Pantry inventory — items you mark as already in your kitchen.
Food log entries — meals and descriptions you log for tracking.
Imported recipes & photos — recipes you import, including any photos you choose to attach. Photos are stored locally on your device and, when you use an AI feature, are transmitted to our AI provider (see section 3).
Meal photos — if you use the AI meal scan in the Track tab, the photo you capture is sent to our AI provider to estimate what the meal contains. It is sent for that request only; we do not keep a copy on our server.

Information collected automatically

Analytics — if Vercel Web Analytics is enabled, aggregate, anonymised page-view data is collected (no personal identifiers, no cross-site tracking). We do not use advertising trackers.
Server logs — standard web server logs (IP address, request path, timestamp) are retained by our hosting provider, Vercel, for security and debugging.

2. How we store your data

Almost all of your personal data — household profiles, meal plans, pantry, food log, imported recipes — is stored only on your own device using browser localStorage. It never leaves your device unless you use a feature that explicitly transmits data (the AI features, billing).

Your account is stored on our server. Signing in creates an account record held in our database (hosted by Supabase), which holds your email address and sign-in credentials, an optional display name, and the records needed to run your plan: your subscription state, your trial dates, and a monthly count of AI requests. Your meal plans, household profiles and food log are not in that database — they stay on your device.

MealCraft does not currently sync your planning data between devices. If you clear your browser data or reinstall the app, that data is gone and we cannot recover it, because we never had a copy.

3. Third-party services

Anthropic (AI recipe import and meal scan)

Two features send an image to Anthropic's Claude API:

Recipe import — when you photograph a recipe, pick a photo from your gallery, or record a video, the still image is sent so the recipe text can be read from it.
Meal scan — when you photograph a meal in the Track tab, the image is sent so the calories and macros can be estimated.

Only the image and the instruction are sent — not your name, your email, your household profiles or your food log. Both features run only when you explicitly start them, and both require the server to have an API key configured; when it is not, the feature is unavailable rather than silently degraded.

Anthropic's handling of that data is governed by Anthropic's privacy policy and their commercial terms. We do not control their retention periods and do not state them here.

Supabase (accounts & database)

Your account — email address, sign-in credentials, optional display name, subscription and trial records, and your monthly AI usage count — is stored in a database hosted by Supabase. Access is restricted per user at the database level, so one account cannot read another's rows.

RevenueCat (app store subscriptions)

If you subscribe through the App Store or Google Play, the receipt is validated via RevenueCat, which tells our server whether your subscription is active. Payment card details are handled by Apple or Google and never reach us.

TheMealDB

Recipe data (titles, images, ingredients) for the extended recipe library is fetched from TheMealDB's public API. No personal data is sent in these requests — only the recipe category you're browsing.

Stripe (payments)

When billing is enabled, subscription payments are processed by Stripe. MealCraft never stores full payment card details. Stripe may collect billing name, email, and payment method details as described in their privacy policy.

Vercel (hosting & analytics)

MealCraft is hosted on Vercel. Standard server logs and, if enabled, anonymised Web Analytics data are processed by Vercel.

4. Health-related data

MealCraft lets you record dietary preferences and allergen information for household members. This data is classified as health-adjacent personal data. It is stored only on your device and is not transmitted to any server or third party except as described above. You can delete it at any time from the Setup screen.

5. Children's privacy

MealCraft is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us and we will delete it.

6. Data retention & deletion

Deleting your account — from inside the app

Open the Setup tab, scroll to Delete my account, and type DELETE to confirm. This deletes your account record and everything that hangs off it — your sign-in, your profile, your subscription and trial records, and your AI usage count — and wipes the MealCraft data stored on that device.

Deletion is permanent. There is no soft-delete, no grace period, and no backup we can restore from. You do not need to email anyone, and you do not need to wait for approval.

One thing we cannot do for you: if you subscribed through the App Store or Google Play, deleting your MealCraft account does not cancel that subscription. Only Apple or Google can cancel it, from your device's subscription settings. Cancel it there first, or you will keep being charged.

You can also remove the on-device data on its own, without deleting your account, using your browser's "Clear site data" option for the site — or, in the installed app, by deleting and reinstalling it.

Server logs held by Vercel are retained according to Vercel's standard retention policy. Those logs are not linked to your account record and are not deleted by the account-deletion process.

7. Your rights (GDPR / Australian Privacy Act)

If you are located in the European Economic Area, United Kingdom, or Australia, you have the right to access, correct, port, or erase your personal data, and to object to or restrict certain processing. Because most data is stored on your own device, many requests can be fulfilled by you directly: erasure is self-service via Delete my account (section 6), and your household, plan and log data can be viewed and edited in the app at any time. For anything else, contact us at the address below.

8. Security

All data transmitted to and from MealCraft is encrypted in transit via HTTPS (TLS). The AI scan endpoint enforces same-site origin checks, a per-IP rate limit, and a maximum payload size to prevent misuse. We cannot guarantee the security of data stored in your browser against device-level access.

9. Changes to this policy

We may update this policy as the app evolves. Material changes will be announced in the app. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact

For privacy questions, data requests, or to report a concern:

support@peaders.com