Privacy policy

As of 22 October 2026

This policy explains which personal data MealCrew processes, why, and what rights you have. MealCrew shows no ads, sells no data and uses no analytics or tracking services. Under Profile → Partner programmes there are labelled affiliate links; they are ordinary links and set nothing on our side.

1. Controller

MaSeConsulting, owner Markus Seifert
Birkenstraße 4, 82287 Jesenwang, Germany
Contact person: Markus Seifert
Email: kontakt@mealcrew.de

2. What we process and why

Account. When you sign in with Google or Microsoft, the provider shares your name and email address with us, and Google possibly your profile picture; when you sign in with an email code, only your email address. We also store your display name, language and last used crew. Legal basis: performance of the user agreement (Art. 6 (1) (b) GDPR). You can attach several sign-in methods to your account; it stays one account, and no additional data is created.

Content you create. Crews and their people (including people without an account, e.g. children, with name, colour and diet), invitations, meals with participants, description, ingredients, links, restaurant, cost and traffic light, recipes, photos, the shopping list, the pantry, wishes and your own nutrition values. For the statistics we also keep track of what was ticked off on the shopping list and when a pantry item ran out – without recording who it was – and delete this after two years. Members of the respective crew can see this content; recipes are visible only to you or to the crews you share them with. If you rate a recipe from mealcrew.de with stars, we store your rating with your account; the website shows only the average and the number of ratings, never who rated. Legal basis: Art. 6 (1) (b) GDPR. If you add people without an account, you should have their consent – or, for children, their parents'.

Pantry and articles. What sits in your crew's pantry is stored with quantity, unit and your note. When you scan a barcode, the article is added to a shared article catalogue (name, brand, barcodes, category and a product image from Open Food Facts); a short name of your own applies to your account only, the crew still sees the central one. If you enter a price you paid, we store it with date and shop for your crew so the app can show price changes. Legal basis: Art. 6 (1) (b) GDPR.

Photos. Photos are downsized on your device before upload; metadata (EXIF) including the location is removed. Originals never leave your device.

Adding product details. For an article in the shared catalogue you can submit photos (pack, nutrition table, ingredients, packaging) and details such as nutrition values or the ingredient list. We store the submission with your account and the crew it came from so the operator can review it and act on misuse. If you like, text recognition on your device or in your browser reads the text on the photos; nothing is sent to third parties for this. If the operator accepts the submission, the details and possibly one photo as the product image apply to all users – without your name. We may also pass them on to Open Food Facts (a non-profit database, Open Food Facts Association, France), again without any information about you. The photos don't count towards any quota. Rejected and completed submissions are deleted together with their photos after 180 days. Legal basis: your consent when submitting (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future.

Feedback. Feedback from the app is stored with your account so we can reply and fix problems (Art. 6 (1) (f) GDPR – legitimate interest in a working app). Photos you send along (such as a screenshot) can only be seen by you and us. We delete them together with the feedback, with your account and at the latest one year after sending.

News and notices. The operator can show you messages in the app: greetings, news and important notices, for example about changes to this policy. They appear once as a card when you open the app and afterwards under Profile → News; we send no push notifications and no emails for them. For this we store which messages you have read and whether you switched off "Greetings and news". You find the switch under Profile → News. Important notices (e.g. about privacy or the terms of use) reach you either way, because we have to inform you about changes. Legal basis: Art. 6 (1) (b) GDPR for these important notices, otherwise Art. 6 (1) (f) GDPR (contact with users inside our own product, with an opt-out).

My data. Under Profile → My data you can see what is stored about your account and download a copy as a file. To enforce the limit of one copy per 24 hours we remember when each copy was made. Photos appear in the copy as links that stay valid for 7 days; anyone who knows the link can see the photo during that time – so do not pass the file on (Art. 6 (1) (c) GDPR, fulfilling the duty to provide access and portability).

Technical data. Requests to our servers involve technically necessary data (IP address, time, requested address, device type). It is used for secure operation and abuse prevention, e.g. rate limits, and kept only briefly in server logs (Art. 6 (1) (f) GDPR).

Usage figures. To see which features are used, the server counts successful calls of selected features (e.g. “meal added”, “shopping scanned”) per day. Only the feature, the day and the count are stored – no account, crew, IP address or device, so nothing that relates to you. Nothing is stored on or read from your device for this. The figures are deleted after 400 days.

Administration. To run the service, the operator can see your display name, email address, sign-up and last sign-in date, the crews you belong to and their Plus status, plus overall usage figures. Content such as meals, photos, recipes or wishes is not visible there. So that items on shopping lists and in pantries get a fitting symbol, the operator also sees freely typed item names without a product (e.g. “Cabanossi”) – only the name and in how many crews it occurs, without crew, person or quantity. Access is additionally protected by a second factor, and changes (e.g. a gifted Plus) are logged (Art. 6 (1) (b) and (f) GDPR).

3. Service providers

Supabase (Supabase Inc.; database, sign-in, file storage and server functions). Data is stored in a data centre in the EU (Frankfurt am Main). A data processing agreement is in place; EU standard contractual clauses cover possible access from the USA.

IONOS (IONOS SE, Montabaur; web hosting). The web app at app.mealcrew.de is delivered, like the website, from web space of IONOS SE in Germany; visits produce technical data there (IP address, time, requested address) that is stored only briefly. We have a data processing agreement with IONOS. Your content is not at IONOS but at Supabase.

Microsoft (Microsoft Ireland Operations Ltd.) for signing in with Microsoft: you sign in at Microsoft in your browser, which transmits your IP address to Microsoft; we receive your name and email address. If you do not use it, nothing is sent to Microsoft.

Google (Google Ireland Ltd.) for signing in with Google. The web app's graphics engine is served from our own servers, no longer from Google. If a view contains characters our bundled font does not know – above all emoji, such as the shopping list symbols – your browser fetches the matching font from fonts.gstatic.com, which transmits your IP address to Google. We will move that to our own servers when the public web app launches.

Text recognition. In the Android app, Google ML Kit recognises text on your device; the photo is not uploaded. On the web, text recognition is loaded from jsDelivr on first use (transmitting your IP address); the photo does not leave your device either.

Cloudflare Turnstile. When you sign in in the app or on the web with an email code, Cloudflare (Cloudflare Germany GmbH) first checks whether the request comes from a human. This transmits your IP address and technical details of your browser or device to Cloudflare. It prevents anyone from using us to send mass mail to other people's addresses; the legal basis is our legitimate interest in abuse-free operation (Art. 6(1)(f) GDPR). The check is only loaded once you open the email sign-in. Signing in with Google sends nothing to Cloudflare.

Open Food Facts and link previews. When you scan a barcode or paste a recipe link, our server queries Open Food Facts or the linked page. These providers only see our server, not you or your account.

AI assistants (the wand). In the recipe list you can have a text (a "prompt") created to ask an AI for recipe ideas. MealCrew transmits nothing: the text is put together on your device, copied to the clipboard and shown to you in full; then the service you picked opens (for example ChatGPT, Gemini, Claude, Copilot, Perplexity). Only when you send the text there does it leave your device – under your own account with that provider, subject to their terms and privacy policy. We have no account there and see neither your question nor the answer. Mind what you put into the text: depending on your choices it holds details from your crew – the contents of your pantry, open meal wishes, the names of recipes you already have (never their ingredients or steps) and any intolerances you type in. Information about intolerances is health data; we do not store it and do not prefill it – you type it for this one question. Opening the service via the button may reveal your IP address to it.

An image from an AI. For a recipe without a photo of your own you can likewise have a text created that asks an AI for a picture of the dish. The same applies: MealCrew transmits nothing, the text is shown to you in full, and you send it under your own account. Depending on your choices it holds the name of the dish, the names of its ingredients (without amounts), category and tags, and – only for a recipe you wrote yourself or whose source allows passing it on – the last steps of the instructions. With someone else's source we do not offer the instructions at all. You bring the generated image back yourself by adding it as a photo in the recipe editor; it then sits in our storage like any other photo of yours.

Affiliate links. On the partner programmes page, labelled links lead to providers who pay us a commission if you order. We transmit nothing about you or your account. Tapping a link leaves the app; the provider then learns your IP address, may set cookies and can tell that you came via MealCrew. Its privacy policy applies.

Maps and links. When you open an address in Google Maps or a saved link, you leave the app; the provider's privacy policy applies.

4. Storage on your device

The app stores what it needs on your device or in the browser: the sign-in session, settings (e.g. calendar view) and recently loaded data so the app stays readable offline. We do not set cookies, neither for advertising nor for analytics; the app and the website show no ads. A previously set cookie "mc_noads" is deleted by the web app the next time it starts. The website has its own privacy policy.

5. Retention and deletion

Deleted entries stay in the crew's trash for 30 days and are then deleted permanently (unless the crew has switched the trash off). When you delete your account, we delete your profile, your own recipes and your memberships; crews in which you were the only member are deleted with their content. In crews with other members the shared entries remain; you stay there as a person without an account under your name so past meals remain correct – the crew can rename or remove this person. Your feedback is anonymised; photos sent along are deleted. With the account also go your read status for messages, your opt-out and the log of your data copies. Server logs are deleted automatically after a short time.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can handle access, data copy and erasure yourself in the app: under Profile → My data and Profile → "Delete account". For anything else please contact the email address above. You may also lodge a complaint with a data protection supervisory authority, for example the one where you live.

7. Changes

MealCrew Plus currently cannot be purchased; some features have limits in the free version, and Plus is only granted so far. We therefore process no payment data. Should a paid subscription arrive, we will extend this policy to cover the payment route (Google Play) and the data involved before it starts.

When the app changes, we will update this policy. The current version is available in the app and at mealcrew.de.

The German version is legally binding.