Privacy Policy for Mealvexa

Welcome to Mealvexa ("we," "our," or "us"). We are committed to protecting your privacy and ensuring that your personal data is handled securely and transparently. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application Mealvexa (the "App") and our website https://mealvexa.com.

Please read this Privacy Policy carefully. By installing and using the App, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

A. Information You Provide to Us

• Account & Profile Data: When you sign in using Google Sign-In or create an account via Firebase Authentication, we collect your name, email address, profile picture URL, and unique user identifier (UID).
• Meal Photos & User Hints: When you capture or select a meal photo and voluntarily provide additional details or hints (e.g., "2 hard-boiled eggs, whole wheat bread"), this information is transmitted to our secure backend API to perform AI-based nutritional analysis.
• Dietary Preferences & Goals: Your daily calorie target, height, weight, gender, lifestyle, and dietary goals selected during onboarding or in app settings.

B. Automatically Collected Information & Device Data

• Hardware & Device Identifiers: For guest users operating without a Google account, we collect a cryptographic hash of a hardware device identifier (ANDROID_ID / X-Device-Id) solely to manage daily AI scan limits and prevent fraud.
• Time Zone & Locale Data: Your device's time zone setting (X-Time-Zone) and system language (Accept-Language) to reset daily scan limits at local midnight and deliver AI responses in your preferred language.
• Usage & Diagnostic Analytics: Anonymous event data collected via Firebase Analytics, including features used, meal scan counts, limit reached events, camera permission status, and app crash logs.
• Security & App Authenticity Tokens: Cryptographic tokens generated by Google Play Integrity / Firebase App Check (X-Firebase-AppCheck) to verify that API requests originate from a genuine Mealvexa app binary.

2. How We Use Your Information

We use the collected information for the following purposes:

1. Nutritional & Calorie Analysis: To analyze meal images, estimate calories and macronutrients (protein, fat, carbohydrates), and generate meal descriptions using Google Gemini AI and OpenRouter API services.
2. Account & Freemium Limit Management: To manage user authentication, verify PRO subscriptions, and enforce daily scan limits across guest and registered accounts.
3. App Functionality & Personalization: To store your meal history locally on your device (via Room Database) and sync daily nutritional goals.
4. Security & Fraud Prevention: To protect our backend infrastructure against automated abuse, brute-force attacks, and unauthorized API calls.
5. App Analytics & Improvement: To monitor app stability, diagnose technical errors, and optimize user experience.

4. Third-Party Services & Data Sharing

We do not sell, rent, or trade your personal data. We share information with trusted third-party service providers strictly to the extent necessary to operate the App:

• Google Firebase Services (Google LLC):
  • Firebase Authentication: User identity and sign-in management.
  • Firebase Cloud Firestore: Storing user usage counts, custom limits, and subscription status.
  • Firebase Analytics: Anonymous usage metrics.
  • Firebase App Check & Play Integrity: App authenticity verification.
  • Google Privacy Policy
• Google Gemini AI API (Google LLC): Generative AI processing for meal image analysis and calorie estimation.
• OpenRouter API (OpenRouter Inc.): Fallback AI processing service if the primary AI endpoint is unavailable. OpenRouter Privacy Policy
• Google Play Billing (Google LLC): Processing in-app purchases and PRO subscription payments. We do not store or process payment card details directly; all transactions are handled securely by Google Play Store.

5. Data Security

We implement industry-standard technical and organizational security measures to protect your data, including:

• Mandatory HTTPS / TLS 1.3 encryption for all network communications.
• Salted SHA-256 hashing for guest device identifiers stored in databases.
• Backend IP Rate Limiting to prevent brute-force attacks.
• Execution of server processes under an unprivileged non-root user container environment.
• Code obfuscation and minification via R8 / ProGuard in production builds.

6. Cookies & Website Storage

Our website (https://mealvexa.com) uses browser localStorage solely to remember your preferred language selection (e.g. English, Polish, Spanish, Portuguese). We do not use tracking cookies or third-party advertising cookies on our website.

7. Data Retention & Your Rights

A. Local & Cloud Data Retention

Meal history and thumbnails are stored locally on your device in your app database and can be deleted at any time within the App. User scan counts in Firestore are automatically managed and reset daily.

B. Your Rights (GDPR & CCPA)

Under applicable privacy laws (including GDPR and CCPA), you have the right to access, update, export, or request the deletion of your personal data ("Right to be Forgotten").

To request the complete deletion of your account and associated cloud usage data, please contact us at:

Email: mr.stachowicz@gmail.com

Upon receiving your request, we will verify your identity and permanently delete your user record and associated cloud usage documents within 30 days.

8. Children's Privacy

Mealvexa is not directed to children under the age of 13 (or 16 in the European Union). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us immediately, and we will take steps to remove such information.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

• App Name: Mealvexa
• Developer: Marcin Stachowicz
• Email: mr.stachowicz@gmail.com
• Website: https://mealvexa.com