Privacy Policy

MealBond: the iPhone app. Effective 27 October 2026.

Who is responsible

The operator of the service and data controller: Oleksandr Haidamaka, Spain. For any question about your data, including using your rights (below), write to support@mealbond.app.

What we collect and why

• Sign-in. The identifier and email Apple or Google pass to us when you sign in, your name if you give it, and your Google profile photo if you have no photo of your own yet. Used to sign you in.
• Profile. Name, nickname (people find you by it), profile photos, date of birth or age, sex, height, weight, goal, lifestyle, your league country, time zone and language, "Diet" (foods you avoid, allergies and conditions such as diabetes or blood pressure), messenger links if you add them (for WhatsApp that is a phone number), health flags (pregnancy or breastfeeding, an eating disorder). Used to calculate your calorie and protein targets; health flags and age switch on the careful mode (below).
• Diary. Food you write down in words or photos, barcodes, your recipes, activities, weight, measurements (waist, body fat by tape, caliper or scales), your questions to the coach and its answers. Used to count calories, protein, fat, carbohydrates, fiber and your daily target.
• When a photo was taken. From the photos and videos you send, your phone takes only the time they were taken, to put a meal at that time. We never receive or keep the location or any other metadata of the file.
• Apple Health data, only if you connect it: active and resting energy, steps, exercise minutes, workouts and their distance, weight, body fat, and the days of your period with their flow, if you record your cycle in Health. Read only. Used so that your target reflects what you burn, you don't enter weight and body fat twice, and the water your body holds around a period is not taken for fat. You can disconnect it in your profile or in Health's settings.
• Your messages and posts. Messages, photos, videos, voice notes and video messages in groups and private chats, Notes, feed posts, comments and likes, live streams and their comments, follows, requests and permissions to see a day, looks and hearts on other people's days, reports and blocks.
• Problem reports. What you write in "Report a problem" (or tell the coach about the app itself), the screenshot of the screen you sent it from unless you removed it, the app's version, the phone's model and iOS, the screen and the app's last errors. Used to fix the app; only the owner of the service reads them.
• Technical data. A push notification token, when you were last in the app ("online"), the text of an error if the app crashed (without the content of your records). The server keeps no access logs; it holds an IP address in memory for a minute to stop codes and links being guessed.

Legal bases (GDPR): performance of the contract, and your explicit consent for health data, given when you fill in your profile, record food and weight and connect Health. You can withdraw it by removing the data, disconnecting Health or deleting your account.

Who sees what

• Your day (food with photos and numbers, activities, weight) is closed until you open it. You can open it to anyone - when they ask or on your own - and to everyone in your group with one switch. Only today is visible, never your past days. You can close it at any time; the person is not told.
• Who looked at your day. You see who opened your day and which hearts they put on your meals and activities; this is kept while you have an account. When you look at someone's day, its owner sees it the same way.
• A group is a paid chat: on Pro or Max you make as many groups as you like, with up to 6 people in all of them on Pro (you and 5 more) and up to 50 on Max. People join a group only by an invitation or its link, and only if they agree. Members see your name, photo, messenger links (if you added them) and when you were online. You can write privately only to people you share a group with; on the free plan, only to your group's admin or to someone on Pro or Max who wrote to you first.
• Feed. A profile is private by default: your posts are seen by the followers you approved. Posts "for all" of a public profile are seen by anyone and go into recommendations. Your diary weight never goes to the feed; a body photo only if you post it yourself. Everyone sees the number of likes; only the author sees who liked. Comments come from those you choose.
• People recommendations (in the feed only): you may be shown to others in "Who to follow" and "Similar". They see your face, name and nickname, and for a public profile your goal and streak; for a private one only that it is private. The order is worked out from follows, a group in common, looks at and requests to see a day, likes and comments, language, country, goal and activity, never naming people in common. You can switch it off in your profile: "Show me in suggestions". People in the careful mode are never recommended.
• People search finds people by nickname and name. Someone in the careful mode only by their exact nickname.
• League: shared tables of the world, the country and your own people - face, nickname, level, points and medals; no food, no weight. You can switch it off in your profile.
• Live streams are seen by those you open them to: your followers or everyone in the feed, a group or the person in a private chat. A stream is not recorded: after it ends its card, its comments and who was there stay.
• View once. A photo, video, video message or voice note sent "view once" in a private chat is deleted from the server once viewed (at most 10 minutes after it was opened); if the recipient takes a screenshot, the sender sees it in the chat.
• Online. When you are in the app is seen by the people of your groups and private chats. You can choose "Nobody" in your profile.
• The careful mode (under 18, a very low weight, pregnancy or breastfeeding, an eating disorder): the coach helps you keep your weight rather than lose it; there is no feed; you see no one's day and no one sees yours; you are not in the league or in recommendations.
• Any message, post or comment can be reported and anyone can be blocked: then you stop seeing each other everywhere.

The coach and AI

• The AI coach works only for you. The Claude model (Anthropic) reads what you send to your diary and to the coach's chat: words and photos of food, labels, foods by name, activities in words, questions and photos (for instance for a body fat estimate, if you ask for one); and your profile, "Diet" and the diary numbers it needs to answer. With them it counts your food and writes its answers, menus and plans, the evening summary of your day and the vitamins review. To remember you, the coach keeps short notes about you (facts from your records and conversations) - only the coach uses them, and they are kept while you have an account.
• Messages of groups and private chats, Notes, posts, comments and streams are never sent to the model.
• Feed photos are checked by our own model on our own server (no outside service) to keep forbidden content out.
• Dictation and the words of voice notes in Notes are recognised on your iPhone itself, by an open speech model (Parakeet, below): the sound never leaves the phone, and we receive only the words you send. The app downloads the model's files (about 480 MB) once, by itself and over Wi-Fi only, from Hugging Face. A second, small model that comes with the app tells which language is being said, so a dictation that changes language is heard in each (below). Until the model is on the phone, and on an iPhone before iOS 17, the iPhone's own recognition does it (Apple, below).
• On the free plan the model does not run: the app's food database recognises your food.

What we don't do

• We do not sell your data or share it with advertising networks. There are no ads, ad trackers or third-party analytics in the app or on the site.
• Data from Apple Health is not used for advertising or marketing and is not shared with third parties, except for processing by the AI coach when you use it.

Processors

• OVHcloud (France, EU): our server - the database, files and the live streams server.
• Anthropic (USA): the Claude model, only as described under "The coach and AI".
• Hugging Face (USA): the speech model's files are downloaded from it once; like any download, it sees the phone's IP address and nothing else.
• Apple: Sign in with Apple, dictation and voice note transcription by the iPhone's own recognition (for languages the phone cannot recognise itself, Apple's servers process the sound; we never receive it), Health, App Store subscriptions.
• Google: only if you sign in with Google.
• Expo (USA): delivers push notifications through Apple.
• KLIPY (USA): the GIF catalog. When you search for a GIF, our server passes them the search words, the language and a number that does not identify you; your phone never contacts them directly.
• Open Food Facts: when you scan a barcode our database doesn't have, the server asks them for that number and nothing else.
• Cloudflare: only the site's address (DNS); no traffic goes through it.

A notification shows the start of a message; its text passes through Expo and Apple. You can turn the text in notifications off in your profile.

Transfers to the USA rely on the EU Standard Contractual Clauses.

Open models and code in the app

• Speech recognition: Parakeet TDT 0.6B v3 by NVIDIA, licensed under CC BY 4.0, in its Core ML conversion by FluidInference (converted and quantized for Apple's Neural Engine; CC BY 4.0), run by FluidAudio (Apache License 2.0).

Payment

Pro and Max will be App Store subscriptions: Apple will take the payment, we will never receive your card details, only which plan you have and until when it is paid. During the beta there is no purchase in the app: the service's owner grants plans to testers.

Retention

• Groups and private chats: messages, photos, videos, voice notes and video messages are deleted from the server after 90 days. Feed: posts with their comments, photos and videos after 90 days; a live stream with its comments 90 days after it ends.
• Notes are kept while you have an account.
• Photos of your food are kept for a year, so you can look back through your menu: full size for the first 30 days, then reduced, and deleted after 365 days. Diary numbers, meal names and the words of your records are kept while you have an account.
• The coach's chat: the model sees only the last day of the conversation; the words themselves are kept while you have an account, photos as photos of food.
• An account not used for 30 days is paused (you leave the league's tables, your data stays); a notification in the app comes 3 days before. A free account not used for 90 days is deleted entirely; notifications in the app come 7 days and 1 day before the deletion. If your notifications are off, the rule is written in your profile under "Delete account". While a subscription is paid, the account is not deleted.
• Deleting your account in the app (Profile, "Delete account") erases everything at once: profile, diary, messages, posts, Notes, photos and recordings, sign-in methods. Groups stay with their other members. The record of AI costs, reports and the fingerprints of photos hidden by reports (both for a year at most) stay without your name.
• Reports on messages, posts, comments and people are kept for a year, then deleted.
• Problem reports on the app are kept for a year, their screenshot for 90 days.
• Fingerprints (hashes) of photos hidden by reports are kept for a year, and while they are, the same photo cannot be posted again. They contain no photo.
• The database is backed up once a day on the same server and each copy is kept for two weeks, and OVHcloud keeps a copy of the whole server for a day: what is deleted leaves the copies within two weeks too.

Data on your phone

The app keeps copies of its screens, what is waiting to be sent and a cache of photos, videos and voice notes on your phone, to open without a network and not to download the same file again. You choose the cache's size and how long media stay in "Data and Storage". Signing out erases all of it from the phone and disconnects Health. "View once" photos and videos are never saved on the phone.

Your rights

You can download a copy of your data: Profile, "Download my data". It is one zip archive with a page that is easy to read and the full data.json file for other programs. It holds your profile and sign-in methods, diary, food records and questions to the coach, the coach's answers, menus, recipes, your messages in groups and private chats, Notes, your posts and comments in the feed and in live streams, follows, blocks, access to days, the league, your problem reports, and the files of your photos, videos, voice notes and video messages while they are kept (the periods are above).

You can also correct your data, delete your account and withdraw consent; for any of this write to support@mealbond.app. You can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD, www.aepd.es), or to the data protection authority of your own EU country.

Age

The service is for people aged 13 and over. If your country sets a higher age to consent to the processing of your data (in the EU, from 13 to 16 depending on the country), you need a parent's or guardian's consent until that age. Under 18, the careful mode is always on.

Not medical advice

The coach is an AI. Its food estimates are approximate and its nutrition advice is not medical care and does not replace a doctor.

Changes

We will announce material changes to this policy in the app.