Privacy Policy

1. What We Collect

We collect information in three ways: (A) you provide it, (B) it's collected automatically, and (C) from third parties you connect.

A. Information You Provide

• Account Information. Name and email from Apple or Google Sign-In (OAuth).
• University Preferences. Selected school and dining hall preferences.
• Body Stats & Goals. Height, weight, date of birth, gender, activity level, target weight, and fitness goals (used for nutrition calculations).
• Dietary Preferences. Allergens, intolerances, disliked ingredients, and diet types (e.g., vegetarian, vegan).
• Meal Plan Data. Generated plans, tracked meals, ratings, and customizations.
• Support Communications. Messages you send us, including feedback or bug reports.

Note: Certain items above (e.g., allergies, diet type, weight) may be considered sensitive in some jurisdictions. We only use them to provide requested features (personalized plans and filters).

B. Information Collected Automatically

• Device & App Info. Device model, OS version, App version, language, and time zone.
• Usage & Diagnostics. In-app actions, crash logs, performance metrics, and basic analytics (aggregate).
• Approximate Location (if enabled). We do not require precise GPS. If you grant approximate location, we may use it to surface nearby campus options. (If you don't enable it, you can still select your campus manually.)

C. Information From Third Parties

• Dining Providers. Menu items and nutritional labels surfaced from university/campus dining sources.
• Subscription Platforms. Status and transaction metadata from Apple App Store and RevenueCat (we do not receive your full payment card details).
• AI Provider(s). When generating meal suggestions, we may send relevant prompts and preference parameters to our AI vendor(s) (e.g., OpenAI) to produce outputs.

2. How We Use Information

We use your information to:

• Provide the Service. Generate personalized weekly meal plans, calculate nutrition targets, filter by allergens/diets, and let you track or customize meals.
• Operate & Improve. Monitor performance, fix bugs, develop new features, and enhance user experience.
• Communicate With You. Send plan reminders, important notices, and responses to support requests.
• Process Subscriptions. Manage purchases, trials, renewals, and account status through the App Store/RevenueCat.
• Security & Legal. Detect, prevent, and address fraud, abuse, or violations; comply with legal obligations.

3. Legal Bases (EEA/UK Only)

Where GDPR/UK GDPR applies, we rely on these bases:

• Contract. To provide and support the Service you request.
• Legitimate Interests. To maintain and improve the Service, prevent fraud, and secure systems (balanced against your rights).
• Consent. For certain optional features (e.g., push notifications, approximate location, marketing emails where applicable). You can withdraw consent at any time in-app or via device settings.
• Legal Obligation. To meet legal, tax, and audit requirements.

4. How We Share Information

We do not sell your personal information. We share it only with:

Service Providers / "Processors"

• Supabase (managed Postgres, hosting, and auth)
• RevenueCat (subscription management)
• Apple App Store (payments)
• OAuth providers (Apple/Google Sign-In)
• AI Vendor(s) (e.g., OpenAI) to generate meal suggestions
• Analytics/Crash Diagnostics (e.g., Apple/RevenueCat diagnostics; optional analytics if enabled)

• Dining Data Sources. We surface university dining data but do not share your personal information back to them.
• Legal/Compliance. Where required by law, regulation, legal process, or to protect rights, safety, or security.
• Business Transfers. In connection with a merger, acquisition, or asset sale (your data will remain protected under this Policy or a policy of equal or greater protection; we'll notify you of material changes).
• AI Providers. We minimize personal data sent in prompts and restrict sharing to what is necessary to provide the Service. We configure vendors to limit retention and training use where available; however, vendor practices may change—see their privacy notices for details.

5. Data Storage, Security & Retention

Storage

We store data in Supabase (PostgreSQL) and other reputable cloud providers.

Security

Data in transit is protected with HTTPS/TLS. Access is limited to authorized personnel with role-based controls and is reviewed periodically. We also implement routine patches and security updates.

Retention

• Account & Profile Data: retained while your account is active and then deleted or anonymized within 30–90 days after deletion.
• Meal Plans & Preferences: retained to power personalization and history until you delete them or delete your account.
• Backups/Logs: retained for up to 30–180 days (or as required by law) and then purged.

We may retain minimal records as required for legal, tax, security, or dispute-resolution purposes. You can request deletion at any time (see Your Rights below).

6. Your Choices

• Manage Profile. Update stats, goals, and preferences in the App.
• Notifications. Control push notifications in the App and in your device settings.
• Location. Enable/disable approximate location in device settings.
• Marketing. If we send marketing emails (rare), you can unsubscribe via the link in the email.
• Access/Export/Delete. Use in-app options where available or email support@unimeals.io.

7. Your Rights

A. United States (Including California & Texas)

Depending on your state (e.g., CA CPRA, VA, CO, CT, UT, TX TDPSA), you may have:

• Right to Know/Access the categories and specific pieces of personal information we collected about you.
• Right to Delete personal information (subject to legal exemptions).
• Right to Correct inaccuracies.
• Right to Data Portability (a copy in a usable format).
• Right to Opt-Out of sale or sharing of personal information and targeted advertising (we do not sell personal information; we also do not share it for cross-context behavioral advertising).
• Right to Limit Use of sensitive personal information (we use sensitive fields only to provide requested features like allergen filtering).
• Right to Non-Discrimination for exercising your rights.

Appeals Process (where required): If we deny a request, you may appeal by replying to our decision email; we will respond within the timeframe required by your state law.

Submit requests at support@unimeals.io. If you reside in California, you may also designate an authorized agent to make requests on your behalf.

B. EEA/UK (GDPR/UK GDPR)

You may have the rights to: access, rectify, erase, restrict or object to processing, portability, and withdraw consent where processing is based on consent. You may lodge a complaint with your local data protection authority. Contact us at support@unimeals.io to exercise rights.

8. International Data Transfers

We may process and store data in the United States and other countries that may not have the same level of data protection as your home jurisdiction. Where required (e.g., EEA/UK), we use appropriate safeguards such as Standard Contractual Clauses (SCCs).

9. Children's Privacy

Unimeals is intended for users 13+. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided data, contact support@unimeals.io and we will promptly delete it. If you are under the age of majority in your jurisdiction, you must have a parent/guardian's consent to use the App.

10. Cookies, SDKs & Tracking

We don't use web cookies in the native App, but we may use mobile SDKs and App Store/OS-level frameworks for authentication, subscriptions, analytics, and diagnostics. You can limit certain tracking via device settings (e.g., Limit Ad Tracking, App Tracking Transparency). We do not respond to Do Not Track signals.

11. Third-Party Services

We integrate with third parties to operate the App. Their handling of your data is governed by their own policies. Review them for details:

• Supabase – database/auth hosting
• RevenueCat – subscription management
• Apple App Store – payments and account features
• Apple / Google OAuth – sign-in
• AI Provider(s) (e.g., OpenAI) – meal suggestion generation

We only share the minimum data necessary to provide the feature you're using. We do not control third-party availability or accuracy.

12. Data Safety, Allergens & Food Responsibility

13. FERPA & University Affiliation

Unimeals is not affiliated with any university and is not a FERPA-covered service. We do not request or process your official student education records.

14. Data Subject / Consumer Requests (How-To)

To access, export, correct, delete, or appeal a decision, contact support@unimeals.io from the email on your account and specify your request. We may need to verify your identity (e.g., email verification). We will respond within the timelines required by applicable law.

15. Changes to This Policy

We may update this Policy to reflect changes in the App or laws. We'll post updates here and adjust the "Last Updated" date. For material changes, we'll notify you in-app or by email and, where required, seek your consent.

16. Contact Us

Email: support@unimeals.io

Mailing Address: 5900 Balcones Dr., Austin, TX 78731