Security

Last updated: 12 October 2026

This page covers the MealCrew app for Android, the web app at app.mealcrew.de, the servers behind them and the website mealcrew.de. It explains how to report a security vulnerability to us, how long MealCrew receives security updates and how we handle vulnerabilities.

1. Reporting a vulnerability

If you believe you have found a security vulnerability in MealCrew, please write to security@mealcrew.de. If you can, tell us:

• what is affected (the app with its version number, the web app, the website or the API),
• how to reproduce the problem, step by step,
• what an attacker could achieve with it,
• how we can reach you with questions.

Please do not send us other people's personal data, and do not access other people's accounts or crews. Your own account or a second test account is enough to show the problem.

What you can expect from us:

• We confirm receipt within 72 hours (usually faster on working days).
• We tell you whether we can reproduce the problem and keep you informed about the fix.
• We fix confirmed vulnerabilities as quickly as possible and then publish them below under "Security advisories". If you like, we credit you there.
• Please publish details only after the vulnerability has been fixed, and no later than 90 days after your report, unless we agree on something else together.

If you report a vulnerability in good faith and follow these rules, you need not fear legal action from us.

A machine-readable version of these contact details is available at /.well-known/security.txt.

2. Security updates and support period

MealCrew receives free security updates at least until 31 December 2031. If this period is extended, it will say so here.

Updates reach you automatically:

• Android app: through the Google Play Store. Keep automatic updates switched on or install new versions soon after they come out.
• Web app: the current version runs automatically the next time you load the page.
• Servers: we update them ourselves, there is nothing for you to do.

If an old app version urgently needs replacing because of a vulnerability, we tell you in the app under Profile → News.

3. How we protect MealCrew

• Data in the EU: the database, sign-in and files are hosted by Supabase in a data centre in Frankfurt am Main. IONOS serves the website and the web app from Germany.
• Encrypted connections: all connections use HTTPS (TLS).
• Access for your own crew only: the database checks on every request that you belong to the crew (row level security). Recipes, photos and entries of other crews are out of your reach.
• Sign-in: we do not store passwords in plain text. Signing in with Google or Microsoft goes directly through that provider.
• Little data: we only collect what MealCrew needs to work. There are no ads and no tracking services.
• AI features: the magic wand puts the text together on your device. It only leaves your device when you send it to an AI provider yourself.
• Dependencies: we keep a list of all libraries we use (SBOM) and keep them up to date.

4. Security advisories

This is where we publish fixed vulnerabilities that affect users, and what to do about them.

There are no security advisories so far.

5. Contact

Security reports: security@mealcrew.de
Everything else: kontakt@mealcrew.de

MaSeConsulting, owner Markus Seifert, Birkenstraße 4, 82287 Jesenwang, Germany