# Privacy Policy

> How SafeMeal handles your information. Your food profiles are stored on your phone; we receive them only if you choose to back them up with us or share them. No ads, no selling, and statistics that never include your foods.

Version 1.2, effective 2026-10-12.

**In short**

- Your food profiles (allergies, diets, religious rules) are stored on your phone. We receive them only if you sign in to back them up, which needs your explicit consent, or if you create a share link. Your phone's own backup (iCloud, Google), if you use it, includes them; we have no access to it.
- We never sell your data, never show ads, and never use your foods or diets for statistics, advertising or profiling.
- Usage statistics use a random identifier, never include your foods or diet, and can be turned off in Settings. Crash reports help us fix the app and never include your profiles.
- Our database and file storage are in the European Union: your backed-up profiles, support messages and photos. Some providers are elsewhere, such as Google for sign-in, RevenueCat for purchases and Resend, which sends our emails, in the United States (section 6).
- You can delete your account and its data in the app at any time, and you can ask us for a copy of your data or to delete anything else.

## 1. Who we are

SafeMeal is published by **Moty Studio LLC**, a limited liability company organized under the laws of Wyoming, United States ("**we**", "**us**"). We are the controller of the personal data described in this policy. You can reach us at **[support@safemeal.app](mailto:support@safemeal.app)** for any question or request about your data; write "Privacy" in the subject so that it reaches the right person quickly.

This policy covers the SafeMeal app for iOS and Android, its home-screen widgets, the shared card pages (safemeal.app/s/…) and the website safemeal.app. Our [Terms of Service](/terms) explain the rules for using SafeMeal. If you live in Washington, Nevada or Connecticut (United States), or use SafeMeal while you are in Washington or Nevada, also see our [Consumer Health Data Privacy Policy](/health-data).

## 2. The short version: what stays on your phone

SafeMeal was designed so that the most sensitive information, **what you cannot eat and why**, stays with you.

When you use SafeMeal without signing in, your profiles (their names, colours, foods, severity and presets), your settings and your card are stored **on your phone**, in the app's private storage, and in the storage of its home-screen widgets. We cannot see them. Uninstalling the app deletes them from your phone.

Like other apps' data, they are included in your phone's own backups and transfers to a new phone, if you use them (iCloud or device backups on iPhone, Google backup or your phone maker's transfer tool on Android), so they can come back when you reinstall SafeMeal or set up a new phone. These backups are run by Apple, Google or your phone's maker under your account and their own terms; we have no access to them. Uninstalling the app does not remove copies already in a backup: you manage them in your phone's or account's settings.

Apart from your phone's own backups, your profiles leave your phone only when **you** choose to:

- **sign in** with Google or Apple to back them up (section 4.2), after ticking a box that gives us your explicit consent;
- **create a share link** for a profile (section 4.3);
- **export an image** of a card and send it, which goes through the app you choose and is not sent to us;
- **contact us**, and only what you write and attach (section 4.5).

## 3. Your health and religious information

The foods you avoid, the severity of a profile, its presets (such as "Peanut allergy", "Coeliac disease", "Halal" or "Vegan") and the kitchen precautions can reveal information about your health or your religious beliefs, or those of the people you create profiles for. The law treats this as **special category data** (Article 9 of the EU General Data Protection Regulation, the "GDPR") or **consumer health data** in some U.S. states. We therefore apply strict rules to it:

- We process it **only to provide the features you ask for**: backing up your profiles and showing a shared card. Our legal basis is your **explicit consent** (GDPR Article 9(2)(a)), given with the sign-in checkbox and when you create a share link.
- We **never** use it for advertising, statistics, profiling, research or to train any artificial intelligence, we never sell it, and we never share it except with the service providers that host it for us (section 6).
- It is **never sent** to our statistics or crash reporting tools. Those tools receive only the technical information listed in sections 4.6 and 4.7.
- You can **withdraw your consent** at any time by deleting your account in the app (Settings), which deletes the backed-up profiles, their share links and everything else linked to your account (section 8). Withdrawing consent does not affect what was done before.

If you create a profile for someone else, such as a child or a partner, make sure you are allowed to do so (Terms, section 5). The information in that profile is about that person, and they keep their own rights over it (section 10); you can exercise them on their behalf when you are allowed to. A parent or guardian creating a profile for their child gives consent on the child's behalf.

## 4. What we collect, why, and on what basis

No law requires you to give us any of this information. What the app needs to run is listed in section 4.1; everything else is optional, and not giving it only means that the feature that needs it is unavailable.

### 4.1 To run the app (everyone)

| What | Why | Legal basis (GDPR) |
| --- | --- | --- |
| A random **app identifier** created by RevenueCat when the app first starts (replaced by your account identifier once you sign in) | As the identifier of your purchases, and to limit abuse of support messages | Performance of our contract with you (Art. 6(1)(b)) |
| An **app integrity check** (Firebase App Check, with Google Play Integrity on Android or Apple App Attest on iOS) when the app talks to our servers | To make sure support messages come from the genuine app, to block automated spam | Our legitimate interest in protecting SafeMeal from abuse (Art. 6(1)(f)) |
| The **catalog entries** of the foods in your profiles, downloaded with all their languages | To show your card offline. We do not keep a record of which entries your app downloads | Contract (Art. 6(1)(b)) |
| Your **approximate location**, only if you allow it, to detect the country you are in | To show your card in the local language. The country is found on your phone; your coordinates are never stored, logged or sent to us. Only the country code is kept, on your phone. Your phone's system service (Apple or Google) may be used to look up the country from your position, under their own privacy policies | Your consent, given in your phone's permission prompt (Art. 6(1)(a)); you can withdraw it in your phone's settings |
| Your device's **language and region** | To choose the app's language and a first card country | Contract (Art. 6(1)(b)) |

### 4.2 Backing up your profiles (if you sign in)

| What | Why | Legal basis (GDPR) |
| --- | --- | --- |
| Your **Google or Apple account identifier, email address**, and the **name and profile photo** your provider shares (with Apple you can hide your email) | To create your account, let you sign in on another device, and show which account you use | Contract (Art. 6(1)(b)) |
| Your **profiles**: name, colour, foods, presets, severity, cross-contamination precaution, share link | To back them up and restore them on your devices | **Explicit consent** (Art. 9(2)(a) and 6(1)(a)) |
| The **date and version of your consent** | To prove that you gave it | Our legal obligation to demonstrate consent (Art. 6(1)(c), Art. 7(1)) |

### 4.3 Share links

When you create a share link for a profile (you need to be signed in), we publish a copy of that profile's **foods, severity and cross-contamination precaution** at a secret address (safemeal.app/s/…), kept up to date each time the profile is backed up. **Anyone who has the link or the QR code can see this card.** We never publish the profile's name, colour or presets, or anything that identifies you. Shared pages are hidden from search engines. You can change the link (the old one stops working) or turn it off at any time. Legal basis: your **explicit consent**, given when you create the link after reading what it does (Art. 9(2)(a)).

### 4.4 Purchases

SafeMeal's paid features are bought through the **App Store or Google Play**, which handle your payment under their own privacy policies; we never receive your payment card details. We use **RevenueCat** to check which purchases your app is entitled to. RevenueCat receives your app's identifier (the app identifier of section 4.1, or your account identifier once you sign in), your store purchase receipts and transactions (product, price, currency, dates, store country, trial and renewal status), and basic device information (app version, operating system, language). Legal basis: contract (Art. 6(1)(b)) and, for keeping records of transactions, our legal obligations (Art. 6(1)(c)).

We sometimes give free access with a **code**. To redeem one on safemeal.app/redeem, you sign in with Google or Apple (the account data of section 4.2, without any profile); we keep which account redeemed which code and when, and RevenueCat records the free access given to that account. To limit abuse, we count the codes tried by your account and, using only an irreversible hash of your IP address, the codes refused from that address over 24 hours, never the address itself. Legal basis: contract (Art. 6(1)(b)).

### 4.5 Support messages and food requests

When you write to us from the app ("Need help?", "Ask for a food"), from a shared card page or by email to support@safemeal.app, we receive:

- **what you write** (and the food you ask for), and **the photos and screenshots of the app you choose to attach** (up to 3 in the app). A screenshot shows what was on your screen, which can include your profiles and foods; you see it, and can draw on it, before attaching it. The app never attaches a screenshot for you: when you open "Need help?" from a page of the app, you can add a screenshot of that page yourself. Photos and screenshots are compressed and their metadata (such as GPS location) is removed;
- **your email address**, only if you give it (it is optional in the app), so that we can answer you;
- from the app: your **account identifier** if you are signed in, and **technical information** to solve your problem: app version, device model, operating system version, app language and device region, time zone, card country and language, whether you are signed in or have the paid service, the number of profiles, the identifier of the last error report, the technical detail of the last error the app met (its type, text and place in the code), and the app's last technical log lines (from which emails and share links are removed). **Never the contents of your profiles**. To limit abuse, we count the messages sent from your account over 24 hours or, if you are not signed in, those sent from your app and from your IP address, using only irreversible hashes of the app identifier of section 4.1 and of the address, never the identifier or the address themselves;
- from a shared card page: your browser's description (user agent), the page language and time zone, and a security check by **Cloudflare Turnstile** to block automated spam. To limit abuse, we count the messages sent from your IP address over 24 hours using only an irreversible hash of it, never the address itself.

Our answers are emailed to you through our email provider, and you can reply to them by email. Our team receives a notification email when a new message arrives, without its content. **Please do not include health information in a message or a screenshot unless you need to.** If you do, we use it only to answer you, on the basis of your explicit consent: in the app, a notice next to the send button tells you this before you send; by email, you choose what you write.

Legal basis: our legitimate interest in answering your request and solving problems with SafeMeal (Art. 6(1)(f)), and your consent for the optional email address, photos and screenshots (Art. 6(1)(a)).

### 4.6 Crash and error reports

To find and fix bugs, the app and our servers send error reports to **Sentry** (stored in the European Union). A report contains the error and where it happened in the code, the steps that led to it (screens and actions, never their contents), your device model, operating system, app version, language, card country and language, and your **account identifier** if you are signed in, so that we can link it to a support message you send us. Reports **never contain** your profiles or foods, your name or email address, your share links, your IP address, screenshots or recordings of your screen. Legal basis: our legitimate interest in keeping SafeMeal safe and working (Art. 6(1)(f)). You can object by writing to us.

### 4.7 Usage statistics

To understand which features are used and improve SafeMeal, the app sends **usage statistics** to **PostHog** (stored in the European Union): for example that a card was shown, the card's country and language, that the onboarding was completed, that a link was shared, or that the paywall was viewed, with your app version, operating system, device type, app language and whether you are signed in or have the paid service.

- They use a **random identifier** specific to this purpose, renewed every 12 months and **never linked** to your account, your purchases, your email or your error reports. This identifier lets us see that events come from the same app, not who you are: the statistics are pseudonymous, not anonymous.
- They **never include** your foods, diets, presets, severity, profile names, texts you type, share links or anything that reveals your health or religion.
- Your IP address is **discarded**; only your country is kept.
- **They are on by default and you can turn them off** at any time in Settings → "Share usage statistics". The identifier is then deleted.

On safemeal.app, the landing page and the shared card pages send the same kind of statistics (page viewed, section viewed, store button clicked) with a new random identifier for each page load. **The website uses no cookies** and stores nothing in your browser for statistics. The shared card page only remembers the language you chose, in your browser's storage.

We do not try to identify anyone from these statistics, and we do not let our providers do it.

Legal basis: our legitimate interest in measuring the audience of SafeMeal and improving it (Art. 6(1)(f)). You can object at any time with the switch in Settings.

### 4.8 Technical logs and security

Our hosting and server providers record technical logs (such as IP addresses, dates, and the identifier making a request) to deliver, secure and debug the service. Legal basis: our legitimate interest in security (Art. 6(1)(f)).

### 4.9 What we never do

We do not show ads, use advertising identifiers or track you across other apps and websites. We do not sell or rent personal data. We do not make decisions about you based solely on automated processing. We do not use your data to train artificial intelligence.

Because we do not track you across other websites or apps, and do not sell or share personal data for advertising, there is nothing for a "Do Not Track" or Global Privacy Control signal to turn off: SafeMeal works the same whether or not your browser or device sends one.

## 5. Permissions on your phone

SafeMeal asks for a permission only when you use the feature that needs it:

- **Location** (approximate, while using the app): to detect the country you are in (section 4.1). Optional: you can pick the country yourself.
- **Photos** (selected photos only): to attach photos to a support message, and to save the image of your card to your photos.

## 6. Who we share data with

We share personal data only with the service providers that help us run SafeMeal, under contracts that require them to protect it and to use it only on our instructions, and with the app stores and sign-in providers you choose to use:

| Provider | Role | Data | Location |
| --- | --- | --- | --- |
| Google (Firebase, Google Cloud) | Accounts, database, server functions, hosting, file storage, app integrity checks (App Check) | Account, backed-up profiles, share links, support messages and photos, app integrity tokens, technical logs | Database, functions and support photos in the EU (Belgium); sign-in (Firebase Authentication) in the United States |
| RevenueCat | Purchase management | Purchase identifier and transactions (section 4.4) | United States |
| Sentry | Error reports | Section 4.6 | EU (Germany) |
| PostHog | Usage statistics | Section 4.7 | EU (Germany) |
| Resend | Sending our emails | Your email address, our answers and the messages they quote, notifications to our team (without the content of your messages) | United States (emails sent from the EU) |
| Cloudflare | Domain name, receiving emails to safemeal.app, Turnstile anti-spam check | Emails you send us, technical data of the security check | Global network |
| Google (Gmail) | Our team's mailbox | Notifications of new messages (without their content); emails to support when our system is unavailable | Global |

**Apple and Google** also process data as independent controllers when you download the app, buy the paid service, sign in with their account, use their location services, back up your phone, or when they check the app's integrity (Play Integrity, App Attest), under their own privacy policies.

Our professional advisers (such as lawyers, accountants, auditors and insurers), who are bound by confidentiality, may receive the personal data they need to advise us, for example about a dispute or a request.

We may also disclose personal data if the law requires it, to respond to a valid legal request, to protect the rights, safety or property of our users, ourselves or others, or as part of a merger, acquisition or sale of SafeMeal, in which case this policy will continue to protect your data and we will tell you.

## 7. International transfers

Moty Studio LLC is based in the United States, and our team may access data from other countries where it works. Some of our providers are based in, or may access data from, countries outside the European Economic Area, the United Kingdom and Switzerland, including the United States. When this happens, we rely on the European Commission's adequacy decisions (including the **EU-U.S. Data Privacy Framework** for certified companies) or on the **Standard Contractual Clauses** approved by the European Commission, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

## 8. How long we keep data

| Data | Kept until |
| --- | --- |
| Profiles and settings on your phone | You delete them or uninstall the app |
| Their copies in your phone's own backups (iCloud, Google) | You delete them in your phone's or account's settings (under the terms of Apple, Google or your phone's maker) |
| Account, backed-up profiles and consent record | You delete your account |
| Share link and its public card | You turn off or change the link, delete the profile, or delete your account |
| Support messages, emails and photos | 3 years after our last exchange, or earlier if you ask us to delete them |
| Copies of the emails we exchanged, in our team's mailbox and at our email provider | Until we delete them: write to us and we delete them, also when you delete your account |
| Message and code limit counters | 30 days |
| Purchase records (RevenueCat, app stores) | As long as needed to provide your purchase, then as long as the law requires for accounting, tax and fraud prevention |
| Error reports (Sentry) | 90 days at most |
| Restore points of our database (Google Cloud), kept to recover from an incident | 7 days, then replaced; never used to bring back deleted data |
| Usage statistics (PostHog) | 1 year at most |
| Technical logs | 30 days at most, unless needed longer to investigate a security incident |

**When you delete your account**, we delete at once your account, backed-up profiles and consent record, your share links, your support messages, emails and photos, and your message and code limit counters, and we ask RevenueCat to delete your customer record (if that fails, we finish it by hand within 30 days). Some copies go later: our database's restore points within 7 days, error reports within 90 days. Copies of the emails we exchanged are deleted when you ask us (table above). We keep only what the law requires us to keep (such as transaction records needed for accounting or tax), and the app stores keep their own purchase records. Usage statistics are never linked to your account. If you never signed in, you can ask us by email to delete the support messages sent from your app (see [how to delete your data](/delete-account)).

## 9. Security

Your data is encrypted in transit between the app and our servers. Our database only lets a signed-in account read and write its own profiles, and only the team members who need it can access our systems and support messages. Data on your phone is protected by your phone's own security. No system is perfectly secure: if a breach affects your data, we will inform you and the authorities as the law requires.

## 10. Your rights

Wherever you live, you can ask us to:

- **access** your personal data and get a copy of it in a portable format;
- **correct** it (you can edit your profiles directly in the app);
- **delete** it (you can delete your account in the app, see [how to delete your account](/delete-account));
- **restrict** or **object** to our processing, including our use of error reports and statistics;
- **withdraw your consent** at any time, without affecting what was done before.

Write to [support@safemeal.app](mailto:support@safemeal.app). We answer within one month (we may extend this by two months for complex requests, and we will tell you). We may ask you to confirm that the request is yours, for example by writing from the email address linked to your account or used in your messages; we never ask for more information than needed. We have no access to data that stays on your phone or in its own backups: you see, export and delete it yourself, in the app and in your phone's settings.

**If you are in the European Union, the United Kingdom or Switzerland**, you also have the right to lodge a complaint with the data protection authority of the country where you live or work, or where you think your rights were breached (for example the CNIL in France: [cnil.fr](https://www.cnil.fr); the ICO in the United Kingdom: [ico.org.uk](https://ico.org.uk); the FDPIC in Switzerland: [edoeb.admin.ch](https://www.edoeb.admin.ch)). We would appreciate the chance to address your concern first.

**Wherever you live**, you can also lodge a complaint with your country's data protection authority, under the law that protects you there.

**If you live in the United States**, you may have additional rights under the law of your state (for example California, Colorado, Connecticut, Virginia, Texas, Oregon or Washington), such as the right to know, delete, correct, and to appeal a decision we make about your request (write to us with the subject "Appeal"). We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information for any purpose other than providing the services you request. We will not discriminate against you for exercising your rights. You can also make a request through an authorized agent: we may then ask for proof that you gave them permission, and ask you to confirm your identity with us directly. For consumer health data, see our [Consumer Health Data Privacy Policy](/health-data).

## 11. Children

SafeMeal is not intended for children under 16, and we do not knowingly collect personal data from them. A parent or guardian may create profiles for their children on their own phone and manage them; the information in those profiles is about the child, who keeps their own rights over it, exercised by the parent or guardian where the law allows (section 3). If you believe a child under 16 has given us personal data, write to us and we will delete it.

## 12. Changes to this policy

We may update this policy when SafeMeal or the law changes. We will post the new version here with its date, and tell you in the app before a significant change takes effect. If a change requires your consent, we will ask for it.

## 13. Contact

Moty Studio LLC  
30 N Gould St, Ste R  
Sheridan, WY 82801  
United States  
Email: [support@safemeal.app](mailto:support@safemeal.app) (subject "Privacy")