Privacy policy

1. Who we are

Meal Ark Inc., based in Ontario, Canada, is the data controller responsible for personal data processed through Meal Ark.

You can contact support@mealark.com for privacy questions or requests.

2. Information we collect

We collect account information such as your email address, name, and profile details. We also process information you choose to provide, including dietary preferences, restrictions, weight, height, activity level, calorie goals, saved meal plans, and feature usage.

Technical information may include IP address, browser or device type, operating system, and identifiers needed to secure and operate the Service. When you use Google sign-in, we use the basic profile information Google provides for authentication and do not access unrelated Google data.

3. Legal basis for processing

We process data to perform our contract with you, to operate and improve the Service, and to meet legal obligations. We rely on your consent for dietary or health-related information you voluntarily provide.

We may also rely on legitimate interests to protect accounts, prevent abuse, understand product performance, and improve the user experience where those interests do not override your rights.

4. How we use information

We use information to create personalized meal plans and nutrition recommendations, save your preferences, provide account features, communicate service or security updates, and improve Meal Ark.

We may also use it to detect fraud, unauthorized access, or misuse and to respond to lawful requests.

5. How we protect information

Personal data is protected in transit and at rest using industry-standard encryption. Passwords are securely hashed by our authentication provider and are not available to Meal Ark staff.

Access is limited to authorized people who need the information for legitimate work. We also use security reviews and vulnerability assessments to improve our safeguards. No online service can guarantee absolute security.

6. Processors and transfers

We use service providers including Supabase for hosting and authentication, Google for optional OAuth sign-in, and Apple App Store, Google Play, or Stripe for payment processing.

Providers process only the information needed for their role under contractual safeguards. Where data is transferred internationally, we use appropriate protections such as Standard Contractual Clauses when required.

7. Sharing and data sales

We do not sell or rent personal data. We may share information with service providers that help operate Meal Ark, when required by law, to protect users or the Service, or during a business transfer such as an acquisition.

Aggregated or anonymized information that does not identify you may be used for research, analytics, and product improvement.

8. Your privacy rights

Depending on your location, you may request access, correction, deletion, restriction, or a portable copy of personal data. You may withdraw consent for optional processing and opt out of marketing emails at any time.

EU and UK users may also lodge a complaint with their local data protection authority. We aim to respond to verified privacy requests within 30 days.

9. Automated recommendations

Meal Ark uses automated systems to suggest meals based on information and preferences you provide. These suggestions do not produce legal or similarly significant effects and can be reviewed, changed, or ignored by you.

10. International users

Meal Ark is operated from Canada. Your information may be processed in Canada and other countries where our providers operate, subject to the safeguards described in this policy.

11. Children’s privacy

Meal Ark is not intended for children under 16, and we do not knowingly collect their personal data. Contact us if you believe a child has provided information so we can investigate and remove it where appropriate.

12. Retention and policy changes

We keep personal information only as long as needed to provide the Service and meet legal obligations. Account data is typically retained while the account is active and for up to 30 days after deletion; limited security logs may also be kept for 30 days.

We may update this policy as our Service or legal obligations change. The current version will always appear on this page with its effective date.