Privacy Policy

Lusson LLC (“Mealbird,” “we,” “us”) makes the Mealbird app for iPhone, iPad and Android and runs the mealbird.app website. This policy explains what we collect, why, who helps us process it, how long we keep it, and the choices you have.

The short version: the app keeps the answers you give it so it can build your meal plan, under a random account ID. You don’t have to give us your name or email address. The app also sends usage and device information to a few service providers so we can run it, fix it, understand how it’s used and measure our own ads. Mealbird shows no ads, and we don’t sell your personal data.

1. Who we are

Lusson LLC, 30 N Gould St, Sheridan, WY 82801, United States, is responsible for (the “controller” of) the personal data described in this policy. You can reach us about anything in it at info@mealbird.app.

2. What the app collects

Your account. The first time you open Mealbird it creates an account for you, identified only by a random ID. Your answers and plans are stored against that ID. If you choose to add an email address and password (so you can log in on another device), we store the address, and our database provider stores the password only in hashed form. If you ask to reset your password, we email you a one-time link. Our login provider records the IP address of sign-ins for security.

Sign in with Apple or Google. You can also log in with Apple on iPhone and iPad, or with Google on Android. This adds the login to the account you already have; it doesn’t create a second one. The app asks Apple only for your email address, never your name, and Apple may give us a private relay address instead of your real one. From Google, the app uses only your email address, but our login provider stores the profile Google sends: your email address, your name and a link to your profile picture. The app doesn’t show or use your name or picture. Apple and Google also send an ID for your account with them, which our login provider keeps so it can recognize you next time.

Information about your device. When the account is created the app sends a random device identifier that it creates and keeps on your phone (in the iOS Keychain, or Google’s Block Store on Android), along with your device model, the app version, the language and the country or region your phone is set to (on Android, read from your SIM or mobile network when there is one). The device identifier lets us count installs, recognize the same phone after a reinstall and limit how many phones one creator code can unlock. If you redeem a creator code, we also record the device identifier and IP address of each attempt, to stop abuse. If you allow notifications, we store the push token Apple or Google gives your phone, so we can send them; they can include details of your plan (such as a dish name or your budget) and the start of a chat reply.

Your answers. To build a plan you can actually eat, the app stores: your goal and what you want from Mealbird, your calorie and protein targets, your diet, allergies and any dietary needs you pick, ingredients you love or never want, dishes you heart or rule out, cooking styles, the equipment in your kitchen, how many adults and children you’re feeding (children by age group), your weekly grocery budget and currency, your country, store and shopping day, which days and meals to plan, snacks, what usually gets in the way of eating well, and your language. Some of these can reveal information about your health or beliefs (for example “diabetic-friendly” or “no pork”). We use your answers to build your plan, and a few of them (such as your goal, targets and diet) to tailor the subscription offer (section 6).

Your body measurements stay on your phone. To calculate your targets the app asks for your sex, age, height, weight and activity level. That calculation happens on your phone, and only the resulting calorie and protein targets are sent to us.

Your plans and what you do with them. The weeks we build for you, the swaps you ask for and the reason you pick, and the days you mark as eating out are stored on our servers. Your shopping-list ticks, the items you add to the list yourself and the meals you log stay on your phone; our analytics records that you logged a meal and your streak length, not what you ate.

Scan the Plate (iPhone and iPad). If you photograph or describe a meal, the photo and any text you type are sent to our server and on to our AI provider (see section 5) to estimate it. We don’t keep the photo or your text. We record that a scan happened and whether it worked, and delete that record after 30 days. Your phone keeps the estimate and a small thumbnail of the photo.

Messages you send us. If you use Chat with Lukas, we store your messages, our replies (which can include images), timestamps and read status against your account so you can continue the conversation. It is answered by a person: Lukas and authorized administrators read and reply in our private inbox. When a message arrives, our team gets an email alert without its text, and a notification with a short preview on their own devices, delivered encrypted through the browser’s push service. If you email us, we keep the email. The support emails the app drafts for you include your app version, device model, account ID and the week you were looking at, written in plain sight in the message body.

Your subscription. Apple or Google processes every payment; we never see your card details. Through our subscription provider we receive which plan you bought, its price, currency and tax, the store country, transaction IDs and dates, your device model and app version, and later renewals, cancellations, refunds and billing problems, so the app knows what to unlock.

How you use the app. The app records a fixed list of events, such as reaching each onboarding step, a plan being ready, the subscription offer being shown, subscribing, logging a meal, scanning a plate or asking for a swap, with a few details about each. These events carry your account ID and device and app details (such as model, OS version, language and time zone, and on Android your mobile carrier and network type). Our analytics provider also receives your IP address and derives an approximate location (city and country) from it. We don’t record your screen or your taps.

Errors and crashes. When something breaks, the app sends us a report: what went wrong, on which screen, the app and OS version, the device model and the time. It never contains your answers or plans, but it arrives with your account ID so we can look at the right account.

Permissions. On iPhone and iPad the app asks for the camera only for Scan the Plate; you can also pick a photo through the system picker, which gives the app only the photo you choose. On both platforms it asks for notifications only if you want them. The app does not use your precise location, contacts, microphone, Apple Health or Health Connect data. It does not ask to track you, so it never receives your phone’s advertising ID.

3. What the website collects

Visits. We use Vercel Web Analytics to count page views and referrers in aggregate. It doesn’t use cookies or build a profile of you across sites. The password-reset page sends no analytics at all.

Creator sign-ups. If you apply to make content with us, we store what you type into the form (name, email, WhatsApp number, postal address, country, social accounts, when you can start, how you’d like to be paid, a PayPal email if you choose PayPal, and any notes) plus the country your request came from, and we email a copy to our team.

The old waitlist. Before launch you could leave your email on a waitlist. It is closed. If you joined it, we hold your address only to tell you about Mealbird, and you can ask us to delete it at any time.

4. Why we use it, and our legal basis

If you are in the EU, the UK or another place with similar law, we need a legal basis for each use of your data. These are ours:

We don’t sell your personal data, and we don’t use it to show you ads. We don’t make decisions about you that have legal or similarly significant effects by automated means.

5. AI processing

Mealbird uses AI models to propose dishes, then checks every number with arithmetic against public nutrition data. Here is exactly what the models get:

• Building your week and swaps (Anthropic). Your calorie and protein targets, goal, the meals to cover, kitchen equipment, household size, budget and currency, language, cooking styles, dietary needs, the ingredients and dishes you love or rule out, and for a swap the dishes in your current week and the reason you picked. Your allergies and diet are not named: we remove those ingredients before the model sees the list.
• Scan the Plate (Anthropic). The photo and any text you add, the name of the meal it replaces, your country and your language.
• Dish photos (OpenAI; Google can be used instead). Only a dish name and its ingredient list. The photos are shared by everyone who gets that dish.

None of these requests carries your account ID, name, email or device identifier, and we don’t store the prompts. Anthropic processes this data for us under its commercial terms, which don’t allow it to train its models on it.

6. Analytics and advertising measurement

Product analytics (PostHog). Receives the usage events described in section 2 with your account ID, device and app details and your IP address. We use it to see where people get stuck and whether changes help.

Subscription offer (Superwall). Shows the subscription offer and tells the app whether your subscription is active. It receives your account ID, an app-specific device identifier, the offer screens you see and what you tap on them, your purchases, device and app details, and a few figures the offer screen can show you, such as your calorie and protein targets, goal, diet, budget, household size and details of your plan. On iPhone it also reads Apple’s attribution token, which tells us whether you came from one of our Apple Search Ads campaigns. On Android it reads the Google Play install referrer, and passes Google Play an obfuscated form of your account ID with each purchase.

Meta and TikTok (iPhone and iPad only). We advertise Mealbird on Facebook, Instagram and TikTok. To measure those ads, the iOS app includes Meta’s and TikTok’s software development kits. They tell Meta and TikTok when the app is installed and opened and when a subscription starts (with its price and currency), together with technical details such as the device model, OS version, language, IP address and an app-specific device identifier. Our subscription provider also reports new subscriptions and renewals to Meta from its servers. We don’t give Meta or TikTok your account ID, email, answers or plans. We don’t ask for permission to track you, so neither receives your advertising ID; Apple’s SKAdNetwork reports ad results to them in aggregate. Meta and TikTok use this data under their own terms and privacy policies. The Android app contains neither.

7. Who processes your data

We share personal data only with the providers that make Mealbird work, and only what each one needs. They process it on our behalf, except where noted.

We may also disclose information if the law requires it, to protect our rights, our users or the public, or as part of a sale or merger of our business, in which case this policy keeps applying to it.

8. How long we keep it

• Your account, answers, plans, chat and push token: until you delete your account.
• Scan records and creator-code attempts: 30 days. Scan photos aren’t kept at all.
• Error and crash reports: 60 days.
• Purchase records: as long as tax and accounting law requires, including after you delete your account.
• Device records (device identifier, model, country and app version): kept after you delete your account, no longer linked to it, so that install counts stay right and a creator code can’t be redeemed again on the same phone.
• Analytics events: as long as they help us understand how the app is used; we delete a person’s events when they ask.
• Emails and creator sign-ups: as long as we’re in touch, then only as long as we need them for legal or business records.

Meta and TikTok keep what they receive under their own policies.

9. Your choices and rights

• Change your answers at any time in Settings.
• Notifications: turn them off in your phone’s settings, or turn off just reminders and offers in Mealbird’s Settings.
• Subscriptions are managed by Apple or Google. Deleting the app or your account doesn’t cancel one.

Deleting your account. In the app, open Settings (the You tab on Android) and tap Delete account; if you haven’t subscribed, it’s also in the menu on the subscription screen. This removes your profile, every week we’ve built, your swaps, your chat history, your push token and your login from our servers straight away, and clears the app on your phone. If you signed in with Apple, the app asks you to confirm with Apple once more, and we ask Apple to stop sharing your Apple Account with Mealbird. If you signed in with Google, you can also remove Mealbird from the third-party connections in your Google Account. We keep only the purchase and device records described in section 8. If you no longer have the app, email info@mealbird.app from the address on your account, or tell us roughly when you used the app and on which kind of phone so we can find it, and we’ll delete it for you. We also delete your analytics events on request.

Depending on where you live, you also have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, restrict or object to how we use it (including our legitimate interests), and withdraw consent at any time. Email info@mealbird.app and we’ll answer within one month. If you’re in the EU or UK and unhappy with our answer, you can complain to your data protection authority. We won’t treat you differently for exercising these rights.

10. Children

Mealbird isn’t directed to children under 13, and we don’t knowingly collect their personal information. If you believe a child has given us their information, contact us and we’ll delete it.

11. Security

Data is encrypted in transit between the app, our servers and our providers, and access to our systems is limited to the people who need it. No method of transmission or storage is perfectly secure, so we can’t guarantee absolute security, but we work to keep what we hold safe.

12. International transfers

We are based in the United States, and most of our providers process data in the United States. If you use Mealbird from elsewhere, including the EU and UK, your data is transferred there. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses (with the UK addendum) or a provider’s certification under the EU-U.S. Data Privacy Framework.

13. Not medical advice

Mealbird is not a medical device and does not provide medical advice, diagnosis or treatment. The targets it calculates are general nutrition estimates. Talk to a doctor or a registered dietitian before making changes to your diet, especially if you have a medical condition.

14. Changes to this policy

If we change this policy, we’ll update the “Last updated” date above and, for material changes, tell you in the app before they apply.

15. Contact

Questions or requests about your privacy? Write to us at info@mealbird.app.

Lusson LLC · 30 N Gould St, Sheridan, WY 82801, United States