Privacy policy

Effective September 23, 2026. Updated November 3, 2026.

MealBright is a place to store recipes, plan meals by the week, and share a grocery list. It is run by Michael Wilson in the United States (“we”, “us”). This policy explains what we collect, why, who else handles it, and what you can do about it.

1. What we collect

Your account

• Your email address and the name you give us.
• A photo of yourself, if you choose to add one. You can change or remove it at any time in Settings, and it is deleted with your account.
• Your password, stored only as a secure one-way hash (Argon2id). We can’t read it.
• If you use Sign in with Apple: an ID from Apple that stays the same for you, and the email Apple shares. If you chose “Hide My Email”, that’s an Apple forwarding address, not your real one. Apple shares your name only the first time you sign in. We also keep an encrypted token from Apple so that deleting your account can disconnect MealBright from your Apple ID.
• If you use Continue with Google: an ID from Google that stays the same for you, your email, and your name. We ask Google for nothing else (no contacts, files, or calendar).

What you put in MealBright

This is shared with your household (see section 4).

• Recipes, including ingredients, steps, notes, nutrition, photos, tags, collections, ratings, and the web address a recipe came from.
• Your meal plan, cooking history, grocery lists, and pantry staples.
• Photos you add. We remove hidden information such as location (GPS) and camera details from every photo when you upload it.
• Mealime imports: when you import your Mealime file, we keep your recipes, favorites, step notes, and nutrition, plus a copy of each imported recipe’s original details. We download recipe photos only from Mealime’s photo server. The uploaded file itself is deleted once the import finishes (within about a day at most). The file doesn’t include your Mealime password, and we never ask for it.

Technical information

• Sign-in sessions: a random session ID in a secure cookie (on the web) or in your iPhone’s Keychain or your Android phone’s encrypted storage (in the apps). We don’t record your IP address or device type with your session.
• Server logs: for each request, the time, the kind of request, whether it worked, and your account ID if you’re signed in. They don’t contain your IP address, except when a sign-in is blocked after too many wrong passwords. Then the IP address and a scrambled form of the email (not the email itself) are logged so we can spot attacks. Our hosting provider keeps these logs for a limited time and deletes them automatically; we keep no copy of our own.
• AI usage records (only when you use an AI feature): which feature was used, when, by whom, and how much it cost to run. Never the recipe text, photos, or AI answers.

This website

MealBright’s website (mealbright.app) counts visits with Google Analytics. It records the pages you view, roughly where you are (from your IP address, which Google shortens), and what kind of device and browser you use, and it keeps a cookie on your device so repeat visits are counted as one person rather than several. We see totals, never who you are.

Measuring our ads. When you arrive by clicking one of our ads on Google, Google Analytics also tells Google Ads whether you then pressed a button such as Download on the App Store, so we can see which ads are worth paying for. Google uses an ad cookie and the ad click’s ID for this. We don’t use it to show you ads elsewhere, and you aren’t added to any advertising audience.

Do not sell or share my personal information. We never sell your data. California law treats this kind of ad measurement as “sharing”, and you can opt out of it with the button below, or by turning on Global Privacy Control in your browser.

You can turn it off here, for this browser:

Don’t count my visits

Visitors in Europe, the UK and Switzerland are asked first, and nothing is loaded from Google unless they accept. If your browser sends a Global Privacy Control signal, we treat that as a no everywhere. Your choice is kept on your own device, so clearing your browser data resets it. The same choice covers advertising measurement: where we use it to see which ads bring people here, turning this off turns that off too.

The app is different: the iPhone and Android apps and the web version of the app (app.mealbright.app) have no analytics at all.

What stays on your device

The app and website keep some things on your device so they work quickly and offline: your grocery list and changes waiting to sync, recent photos, cooking timers, unfinished AI suggestions, and display preferences such as grid or list view. Signing out clears all of it except display preferences and cooking timers.

What we don’t collect: your phone’s location (GPS), contacts, advertising ID, browsing on other sites, or payment card details. Purchases go through Apple or Google Play, so we learn only whether your subscription is active, never your card.

The store you shop at: if you use Send to a store, you type a ZIP code to find a nearby store, and we keep the name and address of the store you pick, which says roughly where you shop. The ZIP code goes to that store’s search and isn’t saved.

2. How we use it

• To run MealBright: store your recipes, sync your household’s plan and grocery list, sign you in, and keep your account secure (for example, limiting repeated sign-in attempts).
• To send you emails you need, such as sign-in codes for “Forgot password?”.
• To answer you when you contact support.
• To fix problems and prevent abuse.

We don’t sell your information or use it to build a profile of you, and we’ll only send product news if you ask for it. We also advertise MealBright, and we may measure which ads bring people to this website. That measurement happens on this website only, never in the app, never with the recipes you store, and only where you’ve allowed it.

3. Who else handles your data

We use a few companies to run MealBright. They process data only to provide their service to us.

Websites and posts you import from: when you paste or share a recipe link, our server visits that page to read the recipe, so the website sees a visit from MealBright’s server, not from you. For a TikTok post, our server asks TikTok for the post’s caption. For a Pinterest pin, our server reads the pin’s page to find the recipe page it points at, and then visits that page. For Instagram, Facebook, and YouTube posts, the iPhone and Android apps open the post from your phone to read its caption, just as if you opened the link, and sends only the caption and the post’s photo address to MealBright.

We may also share information if the law requires it, to protect someone’s safety, or as part of a sale or merger of MealBright. In that case we’d tell you first, and this policy would still apply to your data.

4. Your household

Everything in a household is shared with its members. Other members can see your name, your photo if you added one, your email, when you joined, your star ratings, and which recipes, plans, and list items you added or changed. Anyone with a valid invite link can join the household, so only share invite links with people you trust.

Potluck, households you connect with: if your household connects with another through a Potluck invite, that household can see your household’s name, the first names of its members and the photos they have added, the recipes you choose to post (always the latest version) with the first name of whoever posted each and any note added to it, your household’s average star rating on them, and the meals your household marks cooked: the dish’s name and picture, by day and never by time, any note you add to that meal for them, and the recipe behind it, which they can open and save a copy of, whether or not you posted it. Sharing what you cook is on until you turn it off in Potluck, and you can hide any one meal. Only meals marked cooked in the 30 days before Potluck arrived or since, and while sharing is on, are ever shown. A connected household never sees your plan, grocery list, the notes you keep on recipes, email addresses, or the ingredients and steps of recipes you haven’t posted or shared as a meal. Nobody can find your household unless you send them an invite. When you save one of a connected household’s recipes, that household can see that you saved it, where from, and on which day, and, if you share what you cook, when you made it. Removing or blocking a connection stops them seeing anything at once, though a copy of a recipe they already saved stays theirs. If you report a post or a household, we keep the report and see which household made it; the household you report isn’t told who you are.

5. How long we keep it

When you delete your account: if other members remain in your household, your account, sign-ins, ratings, and Apple link are deleted, and what you added to the household stays for them, shown as from a “Former member”. If you’re the last member, the whole household and all its photos are deleted. Any copies in backups disappear as the backups expire.

If another member removes you from the household, your account is switched off and you can no longer sign in. Email us and we’ll delete it completely.

6. Your choices and rights

• Download your data: Settings, then Your data, then Download my data gives you a file with your household’s recipes, plans, lists, members, and settings (photos are listed, not included).
• Correct it: change your name, password, and household details in Settings.
• Delete it: Settings, then Your data, then Delete my account.
• Ask us: email support@mealbright.app for anything else, including a copy of your data or a question about this policy. We’ll answer within 30 days.

Depending on where you live (for example California, the UK, or the European Union), you may have more rights, such as objecting to how we use your data or complaining to a data protection authority. We honor these requests for everyone, wherever you live. We don’t sell or “share” personal information as California law defines those words.

7. Security

Passwords are hashed with Argon2id, connections use HTTPS, sign-in cookies can’t be read by scripts, and repeated sign-in attempts are limited. Photos are stored without hidden location data. No system is perfectly secure; if a breach affects your data, we’ll tell you as the law requires.

8. Children

MealBright isn’t meant for children under 13, and we don’t knowingly collect their information. If you think a child has an account, contact us and we’ll delete it.

9. Where your data is stored

MealBright’s servers are in California, in the United States. If you use MealBright from another country, your data is transferred there.

10. Changes to this policy

If we change this policy, we’ll update the date at the top. For important changes, we’ll tell you in the app or by email before they take effect.

11. Contact

Michael Wilson
Email: support@mealbright.app