Draft, not yet in effect. The highlighted parts still need filling in.
Privacy policy
Effective September 1, 2026
MealBright is a place to store recipes, plan meals by the week, and share a grocery list. It is run by Michael Wilson in the United States (“we”, “us”). This policy explains what we collect, why, who else handles it, and what you can do about it.
The short version
- We collect what you need to use MealBright: your account details and the recipes, plans, and lists you put in it.
- We don’t sell your data or show ads. The app has no analytics and no tracking. This website counts visits with Google Analytics, and you can turn that off below.
- You can download your household’s data, and delete your account, from Settings at any time.
1. What we collect
Your account
- Your email address and the name you give us.
- Your password, stored only as a secure one-way hash (Argon2id). We can’t read it.
- If you use Sign in with Apple: an ID from Apple that stays the same for you, and the email Apple shares. If you chose “Hide My Email”, that’s an Apple forwarding address, not your real one. Apple shares your name only the first time you sign in. We also keep an encrypted token from Apple so that deleting your account can disconnect MealBright from your Apple ID.
- If you use Continue with Google: an ID from Google that stays the same for you, your email, and your name. We ask Google for nothing else (no contacts, files, or calendar).
What you put in MealBright
This is shared with your household (see section 4).
- Recipes, including ingredients, steps, notes, nutrition, photos, tags, collections, ratings, and the web address a recipe came from.
- Your meal plan, cooking history, grocery lists, and pantry staples.
- Photos you add. We remove hidden information such as location (GPS) and camera details from every photo when you upload it.
- Mealime imports: when you import your Mealime file, we keep your recipes, favorites, step notes, and nutrition, plus a copy of each imported recipe’s original details. We download recipe photos only from Mealime’s photo server. The uploaded file itself is deleted once the import finishes (within about a day at most). The file doesn’t include your Mealime password, and we never ask for it.
Technical information
- Sign-in sessions: a random session ID in a secure cookie (on the web) or in your iPhone’s Keychain (in the app). We don’t record your IP address or device type with your session.
- Server logs: for each request, the time, the kind of request, whether it worked, and your account ID if you’re signed in. They don’t contain your IP address, except when a sign-in is blocked after too many wrong passwords. Then the IP address and a scrambled form of the email (not the email itself) are logged so we can spot attacks. Our hosting provider keeps these logs for a limited time and deletes them automatically; we keep no copy of our own.
- AI usage records (only when you use an AI feature): which feature was used, when, by whom, and how much it cost to run. Never the recipe text, photos, or AI answers.
This website
MealBright’s website (mealbright.app) counts visits with Google Analytics. It records the pages you view, roughly where you are (from your IP address, which Google shortens), and what kind of device and browser you use, and it keeps a cookie on your device so repeat visits are counted as one person rather than several. We see totals, never who you are.
You can turn it off here, for this browser:
Visitors in Europe, the UK and Switzerland are asked first, and nothing is loaded from Google unless they accept. If your browser sends a Global Privacy Control signal, we treat that as a no everywhere. Your choice is kept on your own device, so clearing your browser data resets it. The same choice covers advertising measurement: where we use it to see which ads bring people here, turning this off turns that off too.
The app is different: the iPhone app and the web version of the app (app.mealbright.app) have no analytics at all.
What stays on your device
The app and website keep some things on your device so they work quickly and offline: your grocery list and changes waiting to sync, recent photos, cooking timers, unfinished AI suggestions, and display preferences such as grid or list view. Signing out clears all of it except display preferences and cooking timers.
What we don’t collect: your location, contacts, advertising ID, browsing on other sites, or payment card details. When paid plans start, purchases go through Apple, so we learn only whether your subscription is active, never your card.
2. How we use it
- To run MealBright: store your recipes, sync your household’s plan and grocery list, sign you in, and keep your account secure (for example, limiting repeated sign-in attempts).
- To send you emails you need, such as sign-in codes for “Forgot password?”.
- To answer you when you contact support.
- To fix problems and prevent abuse.
We don’t sell your information or use it to build a profile of you, and we’ll only send product news if you ask for it. We also advertise MealBright, and we may measure which ads bring people to this website. That measurement happens on this website only, never in the app, never with the recipes you store, and only where you’ve allowed it.
3. Who else handles your data
We use a few companies to run MealBright. They process data only to provide their service to us.
| Company | What for | What they receive |
|---|---|---|
| Railway | Runs our servers and database | Everything stored in MealBright, on servers in California, in the United States. |
| Cloudflare | Stores recipe photos; hosts this website and our domain name | Your photos; standard web traffic information for visits to this website |
| Google (Gemini) | AI features you choose to use: cleaning up a recipe, reading a recipe from a web page, a photo, a social post, or pasted text, writing a description, and making a recipe picture | Only what the feature needs: the recipe’s text, the page or post text, or the photo. For cleanup suggestions, also the recipe’s web address, which Google may open. Your email and name are never sent. We use Google’s paid service, and under Google’s terms these requests aren’t used to improve Google’s products. |
| Google (Analytics) | Counting visits to this website, and measuring which ads bring people here. In Europe, the UK and Switzerland only if you accept the notice; elsewhere unless you turn it off | The pages you visit on mealbright.app, your rough location, and your device and browser type. Never used in the app. |
| Resend | Sends emails such as sign-in codes | Your email address and the email’s content |
| Apple | Sign in with Apple; the App Store | What you share with Apple. Apple’s own privacy policy applies. |
| Google (sign-in) | Continue with Google | That you’re signing in to MealBright. Google’s own privacy policy applies. |
Websites and posts you import from: when you paste or share a recipe link, our server visits that page to read the recipe, so the website sees a visit from MealBright’s server, not from you. For a TikTok post, our server asks TikTok for the post’s caption. For Instagram, Facebook, and YouTube posts, the iPhone app opens the post from your phone to read its caption, just as if you opened the link, and sends only the caption and the post’s photo address to MealBright.
We may also share information if the law requires it, to protect someone’s safety, or as part of a sale or merger of MealBright. In that case we’d tell you first, and this policy would still apply to your data.
4. Your household
Everything in a household is shared with its members. Other members can see your name, your email, when you joined, your star ratings, and which recipes, plans, and list items you added or changed. Anyone with a valid invite link can join the household, so only share invite links with people you trust.
5. How long we keep it
| What | How long |
|---|---|
| Your account and household content | Until you delete it or your account |
| Recipes you delete | Hidden right away and kept until you delete your account, so a mistake can be put right |
| Deleted photos | Removed from storage 30 days after they’re deleted |
| Recipe import drafts | Deleted after 7 days if not saved, or right away if you discard them |
| Your uploaded Mealime file | Deleted when the import finishes (at most about a day) |
| Sign-in sessions | End after 30 days without use, and always after 90 days |
| Sync history for live updates | 48 hours |
When you delete your account: if other members remain in your household, your account, sign-ins, ratings, and Apple link are deleted, and what you added to the household stays for them, shown as from a “Former member”. If you’re the last member, the whole household and all its photos are deleted. Any copies in backups disappear as the backups expire.
If another member removes you from the household, your account is switched off and you can no longer sign in. Email us and we’ll delete it completely.
6. Your choices and rights
- Download your data: Settings, then Your data, then Download my data gives you a file with your household’s recipes, plans, lists, members, and settings (photos are listed, not included).
- Correct it: change your name, password, and household details in Settings.
- Delete it: Settings, then Your data, then Delete my account.
- Ask us: email support@mealbright.app for anything else, including a copy of your data or a question about this policy. We’ll answer within 30 days.
Depending on where you live (for example California, the UK, or the European Union), you may have more rights, such as objecting to how we use your data or complaining to a data protection authority. We honor these requests for everyone, wherever you live. We don’t sell or “share” personal information as California law defines those words.
7. Security
Passwords are hashed with Argon2id, connections use HTTPS, sign-in cookies can’t be read by scripts, and repeated sign-in attempts are limited. Photos are stored without hidden location data. No system is perfectly secure; if a breach affects your data, we’ll tell you as the law requires.
8. Children
MealBright isn’t meant for children under 13, and we don’t knowingly collect their information. If you think a child has an account, contact us and we’ll delete it.
9. Where your data is stored
MealBright’s servers are in California, in the United States. If you use MealBright from another country, your data is transferred there.
10. Changes to this policy
If we change this policy, we’ll update the date at the top. For important changes, we’ll tell you in the app or by email before they take effect.
11. Contact
Michael Wilson
Email: support@mealbright.app