This policy covers the Mindful Meal Plans iPhone app and the web portal at mindfulmealplan.com. One account, one policy.

Privacy Policy: Mindful Meal Plans

Effective Date: September 18, 2026 Last Updated: October 6, 2026

Mocha's MindLab Inc. ("we," "our," or "us") operates the Mindful Meal Plans mobile application and the website at mindfulmealplan.com (together, the "App" or the "Service"). This Privacy Policy explains how we collect, use, share, and protect your information when you use either one. They share a single account, so what you save in one appears in the other.

By using the App, you agree to the practices described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

Account information

Name and email address
Authentication identifiers (email/password, Apple Sign-In identifier, or one-time email codes)
Profile photo (optional)

Profile and dietary information you provide

Dietary preferences and restrictions (diet style, allergies, intolerances, dislikes, health conditions)
Household membership and the role you hold within a household
Pantry items and inventory you choose to track

Content you create or import

Shopping lists, list items, categories, notes, and quantities
Recipes you save, rate, edit, scale, or organize into collections
Recipe photos and dish photos you upload
Recipe URLs you import and the extracted content from those URLs
Text you paste into the App (e.g., Instagram or TikTok captions used for recipe extraction)
Photos of printed or handwritten recipes you scan
Fridge or pantry photos you scan with AI features
Meal plan entries, cooking history, and ratings

Device and usage information

Device model, operating system version, and language settings
App version and bundle identifier
Crash reports and diagnostic logs (when crash reporting is enabled)
Anonymous usage events (when product analytics is enabled)
On the website: pages visited, how you arrived (including campaign details in the link you followed and, when you arrive from one of our ads, Google's ad click identifier), browser and device type, an approximate location from your IP address, and how you interact with pages, including session replay on the public pages (see "Website analytics, advertising and cookies" in Section 6)

The App does not collect your precise location, contacts, advertising identifier (IDFA), or health/fitness data from Apple Health.

Payment information

Where you subscribe decides who handles the payment:

In the app: Apple processes the payment through the App Store.
On the website: RevenueCat Web Billing handles checkout, with Stripe processing the card payment.

RevenueCat keeps track of your subscription status in both cases, which is how Pro follows your account between the app and the website.

In neither case do we see or store your card details. We receive only the status of your subscription and the entitlements it grants.

2. How We Use Your Information

To provide the App's core features: shopping lists, recipes, meal planning, household sharing, and AI assistance
To sync your data across your devices and to other members of your household
To personalize recipe and meal-plan suggestions based on your dietary profile and pantry
To process AI features (recipe extraction, fridge scanning, AI Chef refinements, meal plan generation) by sending the minimum necessary content to our AI provider (see Section 4)
To send transactional communications (account verification, password reset, invitations)
To send opt-in notifications (e.g., meal-plan reminders): you can disable these in your device settings at any time
To diagnose crashes and improve stability
To understand how the website is used and improve it, and to measure and improve our marketing and advertising, including learning which of our ads and search results lead people to sign up
To detect abuse, prevent fraud, and enforce our Terms
To comply with legal obligations

We do not sell or rent your personal information, and we do not use your content to train AI models.

Your dietary, health and meal-plan information is never used for advertising. That covers your diet style, allergies, intolerances, health conditions, recipes, lists, pantry and meal plans. We do not send any of it to Google Analytics or Google Ads, and we do not build advertising audiences from it or from the diet-related pages you view.

3. Household Sharing

The App is built around shared households. When you invite someone to your household, or accept an invitation to one:

All members of the household can see and edit shared lists, recipes, meal plans, and pantry items belonging to that household
Your profile name and email may be visible to other members of your household
An admin can remove members; removed members lose access to household content going forward
Deleting your account removes your personal profile, but content you created inside a household may remain visible to the remaining household members

Only invite people you trust with this access.

4. AI Features and What We Send to Our AI Provider

The App uses Anthropic's Claude API to power features including:

Recipe extraction from URLs and pasted captions
Recipe scanning from photos (OCR fallback / Vision)
AI Chef refinement chats
Fridge and pantry scanning ("what can I make?")
Meal plan generation and refinement

For each request, we send only the data needed to complete that specific feature (e.g., the recipe URL/text you imported, the photo you scanned, the dietary preferences relevant to the prompt). Anthropic processes this content to return a response.

Per Anthropic's terms, content sent through the Claude API is not used to train their models. Anthropic may retain inputs and outputs for a limited period for abuse-monitoring purposes. See Anthropic's privacy policy for details: https://www.anthropic.com/legal/privacy

AI-generated recipe images. When a recipe needs a photo, we generate one by sending the recipe's title and short description (no personal information) to an image-generation provider: Replicate (running the FLUX model) and/or Google (Imagen). These providers process that text to return an image. We do not send your account details, photos, or other personal data to them.

A note on accuracy. AI-generated recipes, meal plans, and scans can be wrong or incomplete. They are suggestions, not professional dietary, medical, or food-safety advice. Always check ingredients and allergens before cooking, and consult a qualified professional for medical or dietary needs.

We log aggregate metadata about AI calls (timestamps, token counts, estimated cost) for billing and capacity planning. We do not log the full content of your prompts on our own servers beyond what is needed to deliver the response back to the App.

5. Device Permissions

The App will request permission to access:

Camera: to take photos of recipes, dishes, and fridge/pantry contents
Photo Library: to upload existing recipe photos and to scan printed recipes you have photographed
Notifications: to send meal-plan reminders and household invitation alerts (opt-in)

You can grant or revoke any of these permissions at any time in your device's Settings → Mindful Meal Plans.

6. Service Providers and Sharing

We share information only with the service providers required to operate the App:

Provider	Purpose	Data shared
Supabase (database, authentication, realtime, storage)	Hosts your account, content, and photos	Account info, content you create, photos you upload
Anthropic (Claude API)	Powers AI text features	Per-request content; see Section 4
Replicate and Google (AI image generation)	Generate recipe photos	Recipe title and description only; no personal data
Apple (Sign in with Apple, App Store, push notifications)	Authentication, payments on in-app purchases, notification delivery	Apple-supplied identifiers, subscription state
Google (Sign in with Google, website only)	Authentication, only if you choose to sign in with Google	Your name, email address and Google account identifier, supplied by Google
RevenueCat (subscription management)	Tracks your subscription across the app and the website, and runs web checkout	Your account identifier, entitlement status
Stripe (payment processing, web subscriptions only)	Processes card payments made on the website	Payment details you enter at checkout, handled by Stripe; we do not receive your card number
Sentry (crash reporting, when enabled)	Diagnoses crashes and errors	Crash stack traces, device info, app version
PostHog (product analytics and session replay)	Shows us which features are used and where pages are confusing	Usage events and, on the public website only, session replays with typed input masked; see "Website analytics, advertising and cookies" below
Google (Google Analytics, website only)	Measures how mindfulmealplan.com is found and used; with Google signals, aggregated demographics and cross-device reporting	Pages visited, how you arrived, browser and device type, approximate location from your IP address; never your account content
Google (Google Ads, website only)	Measures which of our ads lead to visits and sign-ups, and shows our ads to people who have visited the website	Google's advertising cookies and identifiers, and the website visit information above; never your dietary, health or meal-plan information
Vercel (hosting and web analytics)	Hosts the website and measures page views and speed	Page views and performance timings

We may also disclose information when required by law, to enforce our Terms, to protect rights or safety, or in connection with a business transfer (merger, acquisition, or sale of assets).

We do not sell your personal information.

Website analytics, advertising and cookies

On mindfulmealplan.com we use a small number of measurement and advertising tools to understand how people find and use the site:

Google Analytics records pages visited, how you arrived (for example, from a search or from one of our ads), browser and device type, an approximate location based on your IP address, and when someone signs up or logs in (the sign-in method only, such as "password" or "Apple"). We use Google Analytics advertising features, including Google signals: where you are signed in to a Google account and have allowed ads personalisation, Google may associate your visit with your Google account information to give us aggregated demographics and interests, and cross-device reporting. We do not receive information that identifies you from this.
Google Ads. Our Google Analytics is linked to our Google Ads account. We use that to measure whether our advertising works, and so that Google can show our ads to people who have visited the site. This uses Google's advertising cookies and identifiers.
PostHog records which features are used and which buttons and links are clicked, and we use its session replay to understand where pages are confusing. A session replay reconstructs what happened on a page: mouse movement, clicks, scrolling, and the page as it appeared. Everything you type into a form field is masked before it leaves your browser, passwords included. Replay runs on the public pages only. It is switched off for the signed-in web portal and the sign-in, sign-up and invite pages, so your lists, recipes and AI Chef conversations never appear in one. Replays are seen only by us, to fix problems, and are never shared with Google or used for advertising. On the public pages PostHog also records where visitors click and how far they scroll (heat maps), never anything you type, and this too is switched off in the web portal and on the sign-in, sign-up and invite pages. Neither replay nor heat maps are ever recorded for visitors whose device is set to a European time zone or shares no time zone.
Vercel Web Analytics and Speed Insights record page views and page speed.

What is never used for advertising. Your dietary, health and meal-plan information: the diet style, allergies, intolerances and health conditions in your profile, and your recipes, lists, pantry and meal plans. We do not send any of it to Google Analytics or Google Ads, and we do not build advertising audiences from it or from the diet-related pages you view.

These tools use cookies and similar browser storage. We also use essential cookies to keep you signed in to the web portal, and it does not work without them.

Your choices: opt out of Google's ads personalisation at adssettings.google.com, install the Google Analytics opt-out browser add-on, review or delete activity Google has associated with your account at myactivity.google.com, or block or delete analytics and advertising cookies in your browser settings (the site still works with them blocked). Google describes its own handling of this information in How Google uses information from sites that use its services.

7. Data Location and International Transfers

Your account data and content are hosted on Supabase infrastructure in the United States (us-east-1) region. AI requests are processed by Anthropic in the United States. By using the App, you consent to the processing of your information in these locations.

8. Data Retention

Account and content data is retained for as long as your account exists.
Photos you delete are removed from our storage within 30 days.
Crash and analytics data is retained for up to 90 days in aggregate form.
When you delete your account, we remove your personal profile and personal content within 30 days, subject to:
- Content you contributed to a shared household may remain accessible to remaining household members
- Backups may retain copies for up to 90 days before being overwritten
- Records we are required by law to keep (e.g., tax records for purchases) may be retained longer

9. Your Rights and Choices

You can:

Access your data through the App
Correct your profile and content at any time
Export your recipes via the cookbook PDF export feature
Delete your account and personal data from Settings → Advanced → Delete Account (this runs our delete_my_account server function)
Revoke device permissions in your device's Settings
Disable notifications in your device's Settings
Cancel any subscription: in your Apple ID's Subscriptions screen if you subscribed in the app, or through the manage link in your receipt email if you subscribed on the website

Depending on where you live, you may also have rights under PIPEDA (Canada), GDPR (EEA/UK), or CCPA (California), including the right to request a copy of your data or lodge a complaint with a regulator. To exercise these rights, contact us at the address in Section 13.

10. Data Security

We protect your information using:

TLS encryption for data in transit
Encryption at rest for our Supabase Postgres database and Supabase Storage buckets
Row-Level Security (RLS) policies that enforce household-scoped access on every table, and that scope photo uploads/edits/deletes to your household (recipe-photos) or your account (profile-photos)
Token-based authentication with rotating refresh tokens
Restricted access to production systems

Note on photo storage: Recipe photos and profile avatars are stored in public Supabase Storage buckets. Writes are restricted (you and your household members can upload to recipes; only you can change your avatar), but the read URLs are unauthenticated: anyone who has the URL can view the image. Do not upload photos you would not want to be viewable by anyone with the link.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately.

11. Children's Privacy

The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

In some regions the minimum age is higher (e.g., 16 in parts of the EEA). You may use the App only if you meet your jurisdiction's minimum age for consent to data processing.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date above and, for material changes, notify you in-App or by email before the change takes effect. Your continued use of the App after a change means you accept the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your information:

Mocha's MindLab Inc. Email: support@mindfulmealplan.com Website: https://mindfulmealplan.com

This policy covers both the Mindful Meal Plans iPhone app and the web portal at mindfulmealplan.com. One account, one policy.