Privacy policy
Effective 16 October 2026
The short version. We keep what you save in Mealoop so the app can show it to you and the people you plan with. We use an AI service to read recipes you capture. There are no ads, no analytics or tracking in the app, and we never sell your data. You can export it or delete it at any time.
This policy covers the Mealoop app and this website, mealoop.app. Mealoop is run by Metamorphic Mobile, in Singapore ("we", "us"). Questions: [email protected].
What we collect
Your account
- Your email address, and the account identifier from Sign in with Apple or Google. If you use Apple's Hide My Email, we only receive Apple's relay address.
- Your display name and the emoji you pick, which the people in your kitchen see.
What you put in Mealoop
- Recipes: titles, ingredients, steps, notes, photos, translations, and the link a recipe came from.
- Captures: the links you share or paste, the caption or page text we read from them, and photos you take or choose to capture a recipe.
- Plans and lists: your kitchen's meals, who's cooking, the week's plan, grocery items and ticks, collections.
- People you add by name (for example a child, or a partner without the app): just the name and emoji you give them.
- Invites: we keep a one-way code (a hash) of each invite, never the invite itself, so an invite can't be read back from our side.
A kitchen is shared: everything in it can be seen and changed by its members. Only invite people you're happy to plan with.
On your phone
Mealoop keeps your sign-in in the phone's secure storage, a copy of recipes you've opened in cook mode so they still work without signal, and a few display preferences. These stay on the device, and the recipe copies are removed when you sign out.
When you contact us
If you email us, we get your email and whatever you write. Emails started from the app also include your app version, phone model and iOS version, which you can see and remove before sending. Report a mistake adds the recipe's title and the link it came from, nothing else from your recipes.
On this website
The website sets no cookies, uses no analytics and loads nothing from other companies. If you join the launch list, we store the email address you give and which form you used.
What we don't collect
No location, contacts, advertising identifiers, or analytics about how you use the app. If we ever add analytics, we'll update this policy first, and it will never include your recipes, emails or kitchen names.
Why we use it
- To run Mealoop: sign you in, store and sync your kitchen across your household's phones, and build your grocery list.
- To read and translate recipes you ask us to (see AI below).
- To keep it working and fair: rate limits, preventing abuse, and fixing problems you report.
- To answer you when you write to us, and to email the launch list once, when Mealoop is out.
We rely on providing the service you asked for, and on our legitimate interest in keeping it secure and working. For the launch list, we rely on your consent, which you can withdraw at any time.
AI: how recipes are read
When you capture a recipe, ask for a translation, or a recipe's ingredients are sorted for your grocery list, the relevant text or photos are sent to Anthropic (the Claude API) to do that job, and the result comes back to Mealoop. Anthropic's commercial terms say it doesn't use this data to train its models. We send only what the task needs, never your email or your name.
To read a link, our servers fetch that post or page from the site it's on (for example Instagram, TikTok, YouTube or a recipe blog). The site sees a request from our servers, not from you.
Who we share it with
Only the services that run Mealoop, each for its part of the job:
- Supabase: our database, sign-in and file storage. Your data is stored on its servers in Seoul, South Korea.
- Anthropic: reading, translating and sorting recipes, as above (United States).
- Apple and Google: if you sign in with them, and Apple for subscriptions.
- Expo: delivers app updates. Your phone tells it which version it has; it gets nothing from your kitchen.
- Cloudflare: hosts this website and forwards email sent to [email protected].
We don't sell or rent personal data, and we don't share it for advertising. We'd disclose it only if the law requires it, or to protect people's safety.
Some of these services are outside your country. Where data moves abroad, we rely on the providers' contractual and security commitments to protect it to a standard comparable to the law where you live.
How long we keep it
- Your account and kitchen: until you delete them.
- A capture you dismiss: its photos are deleted straight away; the record of it (the link and the text read from it) stays with your kitchen until the account is deleted.
- The launch list: until we've sent the launch email, or sooner if you ask.
- Support emails: as long as needed to help you, and no longer than two years.
When something is deleted, copies in backups are overwritten in the normal course, usually within a few weeks.
Your choices and rights
- See and change everything you've saved, in the app.
- Take a copy: Settings → Your recipes exports every recipe.
- Delete your account and its data: Settings → Account → Delete my account, or see Delete your account.
- Ask us for a copy of the data we hold about you, to correct it, or to stop a use you object to, at [email protected].
Depending on where you live (for example under Singapore's PDPA, the EU or UK GDPR, or Californian law), you may have further rights, including complaining to your local data protection authority. We'll answer requests within 30 days.
Security
Data travels encrypted. Each kitchen's data is walled off in the database itself, so one household can never read another's, and photos are kept in private storage that only that kitchen can open. No system is perfectly secure, but we take care to keep yours safe, and we'll tell you without undue delay if a breach affects you.
Children
Mealoop isn't meant for children under 13, and we don't knowingly collect their personal data. A parent can add a child to their kitchen by name; that name belongs to the parent's account. If you think a child has signed up, write to us and we'll delete the account.
Changes
If we change this policy, we'll update the date at the top. If a change matters, for example a new kind of data or a new company we share it with, we'll tell you in the app before it takes effect.
Contact
Metamorphic Mobile, Singapore · [email protected]