Privacy notice

1. Controller and contact

Email: contact@mealsforfriends.com

You can use this address for privacy questions and requests for access, rectification and erasure.

News and read status

When you open a news item or choose “Mark all as read”, we store your account ID, the item ID and the read timestamp so your unread count stays consistent across devices. This is part of the requested account functionality (Article 6(1)(b) GDPR). Read records are removed when your account is deleted. This feature does not subscribe you to a newsletter or send marketing emails.

2. Registration, account and shared planning

When you register, we process your name, email address and password. Your password is stored as a hash. We also store the account identifier, creation and modification timestamps, role, approval and suspension status, and account notification status. New accounts verify their email address. Space membership is established by creating a space or accepting an invitation.

For planning, we store the projects, trip dates, group sizes, meals, ingredients and quantities, shopping checkmarks, restaurant suggestions and project access grants you enter. Numbers of adults, teenagers and children are group counts; children’s names or dates of birth are not requested for this purpose. Imported legacy data retains its source identifiers.

New projects are visible to their creator and administrators. People individually granted access can also view and help plan them. Project members see the access list with names and email addresses; creators and admins can select additional users to grant access. Ingredients and settings are shared only within their space. Space admins can access projects in their space. An account can belong to multiple spaces; their content stays separate. Content may also come from other project members.

The legal basis for accounts and requested planning features is Article 6(1)(b) GDPR. Managing access, preventing abuse and coordinating within the chosen group are based on Article 6(1)(f) GDPR; our legitimate interests are secure operation and shared meal planning.

Registration is optional. An account requires your name and email address, plus a password or Google sign-in. AI, external polls and MCP connections are optional. Please do not enter health data or other sensitive information in meal names, ingredients or publicly shared polls.

Workspaces, invitations and subscriptions

We store memberships and roles per space, the owner, invitation address, validity and acceptance status, as well as plan, payment status, usage counters and deadlines. Invitation links are personal; only the account with the invited, verified email can accept them. Members can see names and email addresses of other members in the same space.

Article 6(1)(b) GDPR applies to the requested services and their billing. Security checks and limited usage counters support secure operation and enforcement of booked limits under Article 6(1)(f) GDPR.

Subscription purchases are processed by Stripe as the payment service provider. Stripe receives the contact, billing and payment details entered at checkout, along with a technical workspace and payment reference. Meals, ingredients and member lists are not sent to Stripe. We receive the customer, subscription and transaction identifiers required to activate access. Further information is available in the Stripe privacy policy. We do not store full card details.

Upstash QStash triggers regular background tasks. Requests contain no names, email addresses or planning content, only the technical destination address and a signed message. Information on processing and international transfers is available in the Upstash privacy policy and the Data processing addendum.

Without a subscription, trial access ends after seven days; space data is deleted after 14 days. After previously paid access, data remains readable and exportable for 30 days. We notify the owner by email before deletion; technical problems or unresolved payments may delay deletion. Deletion includes associated restaurant polls held by the provider. Your personal account and memberships in other spaces remain. Billing records required by law are retained separately. Successful AI requests and their results are stored for allowances and retry protection for no longer than 90 days.

Google sign-in and passkeys

You may choose Google as a sign-in provider. We receive your verified email address, name and a technical account identifier from Google, and store the account connection and tokens needed for authentication. Google receives technical connection data during sign-in; project contents are not transmitted. Processing supports the sign-in you request under Article 6(1)(b) GDPR. For details of Google’s processing, including international transfers, see its privacy policy. Google Privacy

For optional passkeys we store the public key, credential identifier, name, technical authenticator information and a usage counter. We never receive fingerprints, face scans, device PINs or private keys. Synchronisation between your devices is handled by your chosen password manager. Passkeys can be removed in your settings and are deleted from our active database when your account is deleted. The account data retention and backup rules also apply to these login records.

Age information

We do not ask for age confirmation during registration, workspace creation or ownership transfer. We collect neither dates of birth nor identity documents for this purpose. Email verification demonstrates access to the email inbox, not age.

Timestamps of previous self-declared age confirmations may still be stored in existing accounts. No new confirmations are collected. Previous information is removed from the active database when the relevant account is deleted; backups follow the processes described in section 8.

Portion calculations use numbers of adults, teenagers and children. No names or dates of birth are required.

3. Hosting, technical data and cookies

The website runs through OpenAI Sites on Cloudflare infrastructure. App data is stored in a D1 database. When you visit a page, technically necessary information such as your IP address, timestamp, requested address and browser information is transmitted to the hosting infrastructure. This supports delivery, troubleshooting and website security. The legal basis is Article 6(1)(f) GDPR.

Signing in stores a session with an IP address, browser identifier and validity timestamps. Necessary cookies keep you signed in and secure sign-in and connection flows. A session normally lasts seven days and can be renewed during active use. Authentication cookies are protected against access by page scripts and are transmitted over HTTPS.

This storage is necessary for the sign-in and use you explicitly request (section 25(2)(2) TDDDG); subsequent processing is based on Article 6(1)(b) and (f) GDPR. You can delete or block cookies in your browser. The protected area does not work without session cookies.

Fonts and the food photograph are served by this website. Optional Google Ads conversion measurement is enabled only after consent; see the details below. External websites have their own privacy notices.

Further information: OpenAI privacy policy and Cloudflare privacy notice.

Language and display

We store your preferred language in your account and in a necessary browser cookie (mff_locale, one year). Without signing in, your selection stays in the browser. It determines the interface and new system messages; your own content is not translated. Switching language updates your account preference. Emails already prepared retain their language and content for retries. Your account preference is deleted with your account. The legal basis is Article 6(1)(b) GDPR; the cookie supports your expressly selected display settings (section 25(2)(2) TDDDG).

4. Account and project emails

Resend sends email verification messages, requested password resets, workspace invitations, ownership transfer offers, and notices about access and deletion deadlines. When project access is newly granted, the invited person receives an email with their name, the inviter’s name, project name, dates, planned group numbers and a project link. These details are sent to Resend for delivery. Your password is not sent by email. There are no automatic restaurant invitations or newsletters.

Resend processes recipient and sender addresses, message content and technical delivery information. The app stores delivery status, timestamps and approval message content for traceable retries. For project invitations, we store the recipient address and message content when access is granted, for possible retries. Once the delivery provider confirms acceptance, this message content is removed from the access record. Delivery identifier, status and timestamps remain until access is removed or the project or account is deleted; pending message content also remains until then. Revoking access does not remove an already sent email from the recipient’s inbox. The project link still requires authorised access.

The legal basis is Article 6(1)(b) GDPR for account creation and Article 6(1)(f) GDPR for reliable delivery and notification of expressly granted project access. Our legitimate interest is to enable shared planning and access to the shared project.

Resend states that email and log data are retained for 30 days on standard plans and processed in the USA. A European sending region does not mean storage exclusively in Europe. Details: Resend: privacy and retention.

5. Optional AI ingredient assistant

Only when you choose “Suggest ingredients automatically” does the application, depending on the request, reuse an existing proposal or send the entered meal name, group numbers for adults, teenagers and children, portion factors and the ingredient catalogue with ingredient identifiers, names, units and origins to the OpenAI API. Your account name, email address, project members and other projects are not included in this request. However, personal information entered in meal or ingredient names is transmitted as part of that text.

The purpose is your requested ingredient selection with quantity suggestions; the legal basis is Article 6(1)(b) GDPR. You can add ingredients without AI at any time. Suggestions only become a permanent part of planning when you save the meal.

For newly generated proposals, the application disables regular response storage in the Responses API. The Decisions API may compare the new meal name with up to four of your recent proposals from the same project to check whether a proposal can be reused unchanged; this API has no response-storage switch. This does not rule out technical caching or abuse monitoring logs at the provider. OpenAI states that these are normally retained for up to 30 days, with exceptions for legal obligations and security cases. According to the provider, API content is not used for model training by default. More information: OpenAI: API data processing.

To speed up requests, we store meal names and complete AI proposals separately for each account, space and project. They can be reused for 24 hours while group numbers, factors, language and the ingredient catalogue remain unchanged. After that, they are no longer used and are deleted during the next cleanup run, or sooner when the account, project or space is deleted. The separate AI request history for quotas and safe retries is retained for up to 90 days. Backups and provider logs follow the retention periods described separately.

6. Restaurant polls with Tally

When you explicitly start a poll, the app sends the date, meal type and restaurant suggestions, including optional website links, to Tally. Other project data and user lists are not sent when creating the form.

Anyone opening the participation link visits Tally directly. The form collects a name, yes/no/maybe attendance, group sizes and restaurant preferences. The link can be used and shared without a Meals for Friends account. Responses are stored at Tally and retrieved by the app for reporting. Administrators and people with access to the associated project can view the results. Participation is voluntary; unique identity is not verified.

Processing supports shared restaurant and attendance planning. Article 6(1)(b) GDPR applies to creation and retrieval by account holders; Article 6(1)(f) GDPR applies to coordinating voluntary responses. Our legitimate interest is to agree on suggestions and participant numbers for the shared outing.

Tally states that form data is stored in Europe. Closing a poll ends participation but does not delete responses. Removing a restaurant visit in the app does not automatically delete the Tally poll either. To request deletion, use the contact details above. Further information: Tally: privacy, processing and deletion.

7. Connections with ChatGPT, Codex and other MCP clients

An external connection is created only after you sign in and approve the requested permissions. We store information including the client identifier, account association, approved permissions and access tokens with expiry dates. The connection can transfer accessible projects and their members, meals, restaurant visits, shopping lists and the shared ingredient catalogue to your chosen client. Write permissions enable the supported changes.

Processing on this website serves the integration you request under Article 6(1)(b) GDPR. The external client processes retrieved content under its own terms and privacy notices. For ChatGPT and Codex, the relevant information includes the OpenAI privacy policy and your data controls there are relevant.

Under ChatGPT connections you can revoke further access. Content already sent to a chat or client is not deleted there by revocation. Use that service’s deletion options for this. Project access is also checked for connected clients.

8. Storage periods and deletion

Accounts and planning content are stored to use the service and to reuse previous plans as expressly intended. The end of a project or an account suspension does not automatically trigger deletion. The separate deletion deadlines described above apply when trials and subscriptions end; the legacy workspace is exempt. Projects and meals no longer needed can be deleted using the available functions. You can request account deletion and a review of personal information in shared content by email. The rights of other participants and any statutory retention requirements will be taken into account.

Accounts without a space: If an account has neither a membership nor its own workspace (including a trial) after 48 hours, we send a reminder email. No earlier than seven days after confirmed sending, the still-unattached account is deleted along with its credentials, sessions and connected ChatGPT access. Joining or creating a workspace stops this process. Checks run every six hours; delivery problems prevent automatic deletion. Superadmin accounts and accounts with existing planning references are exempt. The operator can pause cleanup or delete accounts manually. Logs of these administrative actions are removed after 90 days.

Sessions normally last seven days, MCP access tokens one hour and refresh tokens up to 30 days; renewed use, renewal or earlier revocation affects this validity. Expired access does not mean that all related database entries are immediately removed. Connection permissions, replay protection and stored write confirmations support security and error handling.

Poll responses remain with Tally until deleted. Delivery records and messages may also remain in the administrator’s or recipient’s mailbox. Technical hosting logs and backups are subject to the relevant provider’s retention and deletion processes; the app does not configure one fixed period for all such copies. When handling a deletion request, necessary deletion steps are also reviewed with the services concerned.

Contact and support enquiries

Our contact mailbox and forwarding from the German contact address are hosted by 1blu. When you contact us directly by email, 1blu processes sender and recipient addresses, messages including attachments, and technical delivery information. This also applies to replies sent from our mailbox. The purposes, legal bases and retention criteria described under Contact and support requests apply.

1blu privacy notice

Signed-in users can contact us about support, feature requests, general enquiries and billing. We store the link to the user account, category, subject, messages, processing status and timestamps. Other users and workspace admins cannot access your enquiries.

We use HubSpot to handle enquiries. We send it your name, email address and enquiry content, including further replies. Resend delivers the initial enquiry to the HubSpot inbox. A technical sender address ensures it is matched correctly. Public support replies from HubSpot appear on the contact page; internal comments are not displayed there.

The legal basis is Article 6(1)(b) GDPR for enquiries about your account, a contract or pre-contractual steps. We handle other messages and feature requests on the basis of our legitimate interest in communication and improving the service under Article 6(1)(f) GDPR. Please do not submit passwords or complete payment details.

We store enquiries to handle them and for necessary follow-up. You can request deletion through the privacy contact; statutory retention obligations and retention necessary to assert or defend claims remain applicable. When an account is deleted, local ticket data is removed; any necessary deletion at the support provider is reviewed and carried out separately.

Our HubSpot account is set up in the EU hosting region. This does not entirely rule out access and processing outside the EU. Further information: HubSpot privacy notice and Data processing terms.

Technical error diagnostics with Sentry

We use Sentry (Functional Software, Inc.) to detect and fix technical errors. Server diagnostics help us keep the service stable and secure (Article 6(1)(f) GDPR). Browser diagnostics are optional and start only after your separate consent (Article 6(1)(a) GDPR). You can withdraw this at any time using Cookie settings in the footer; withdrawal stops future browser reports. Already sent reports are not automatically deleted.

Reports contain the time, error class, technical code positions and whether an error occurred in the browser or server. Our integration removes free-form error messages, request URLs and contents, headers, cookies, account identifiers, names, email addresses and planning contents before sending. It creates no Sentry cookies or persistent browser identifiers. Session recordings, activity histories, performance tracing and AI input/output logging are disabled. Technical connection data, including the IP address, necessarily reaches the provider when sending; the event uses a fixed placeholder for the IP address.

The project uses Sentry’s EU region in Germany. Authorised operators can access the reports. Provider retention depends on the current plan and configuration; a fixed deletion period is not configured in our application. Privacy requests also cover reports at Sentry where they can be identified. EU storage does not rule out international processing by the provider or its subprocessors. Sentry describes contractual safeguards, including standard contractual clauses, in its data processing addendum. Sentry privacy policy · Data processing addendum

9. Recipients and processing outside Europe

In addition to people authorised in your project and the administration, recipients may include the hosting, email, AI and form services named here, and clients you connect. Providers may use subprocessors. OpenAI, Cloudflare and Resend may also process data outside the European Economic Area, particularly in the USA.

Providers describe safeguards for international transfers in their privacy and data processing terms, particularly EU standard contractual clauses and, where applicable, adequacy decisions. Information on these safeguards is available in the OpenAI data processing addendum, in Cloudflare data processing addendum and in Resend data processing addendum. You can request further information or copies of the applicable safeguards using the privacy contact.

10. Your data protection rights

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on consent, you may withdraw it with effect for the future.

Right to object: You may object to processing based on legitimate interests for reasons relating to your particular situation. Please contact contact@mealsforfriends.com.

You can complain to a data protection supervisory authority, particularly where you normally live, work or believe an infringement occurred. In Berlin, you can contact the Berlin Commissioner for Data Protection and Freedom of Information.

The app does not make solely automated decisions with legal or similarly significant effects. AI ingredient suggestions and calculations only assist your planning.

Full text of legal bases and rights: General Data Protection Regulation.

Encrypted backups

We create encrypted full backups on 1blu-Drive for disaster recovery, with a daily backup schedule. This includes account and authentication data, permissions and planning data. The retention period is 30 days; the last verified backup is retained if newer backups fail. The private decryption key is kept separately outside the website.

Backups are restricted to the operator and are not publicly accessible. They are used for platform recovery, not for recovering individual project versions. Before reopening a restored system, privacy-related deletions since the backup are reviewed manually.

Beta, loyalty discount and acceptance record

When you participate, we store your space, joining time, announced beta end, transition deadline and discount entitlement. After the first paid subscription, we also store the bound plan and subscription reference; if the discount ends, its time and reason. This supports performance of the beta and subscription and records agreed terms (Article 6(1)(b) GDPR).

The beta end is announced at least 14 days ahead. Afterwards, at least 30 days remain for reading, owner export and explicit subscription purchase. Without a purchase, the space is then deleted, provided notices and payment status have been resolved. The 50% discount applies to a timely first purchase for the uninterrupted subscription to the same plan; an effective plan change or final subscription end terminates it. Other spaces and accounts are handled separately.

We store the accepted terms version, language, time and account/space reference. System messages use the recipient’s language; prepared retries retain their content. Beta participation does not imply marketing consent. Payment records, external support data and backup copies are handled separately from active planning data. Deletion requests take these storage locations into account; mandatory retention is assessed individually.

Email contact through 1blu and HubSpot

Emails to contact@mealsforfriends.com and kontakt@mealsforfriends.de are received in the 1blu mailbox and forwarded, including content and attachments, to our HubSpot inbox for processing. A copy remains in the mailbox. Replies may be sent through HubSpot. The legal basis and your rights follow the contact and support processing described above.

Demo and retention

After the demo, you have another 7 days to read, export and change plans. We send reminders 2 days before the demo ends, when it ends and 2 days before scheduled deletion. Without a plan change, the space is then deleted. Unconfirmed warnings or unresolved payments postpone deletion. Accounts and memberships in other spaces are handled separately.

We retain the record of demo use with the account until account deletion. Deleting a space does not restart the demo. AI usage records include timestamps and are removed after 90 days. Changing plans does not reset prior usage.

Notes

You can save optional project notes about accommodation, kitchen equipment and organisation. Everyone with access to the project can read and edit them according to their existing permissions, including authorised API/MCP access. Notes are not automatically sent to the integrated ingredient AI. They follow the same export, backup and deletion processes as other project data.

Optional live collaboration

Where enabled, the project detects whether other authorised members of the same area are active, to offer a joint planning session. Multiple tabs of one account count as one person. Joining is voluntary and requires confirmation. Only participants who accept see shared drafts, names, participant colours, current pointers, click indicators, temporary markers, viewports and text cursors. Saved planning data remains available under the existing project permissions. No additional external collaboration provider is used.

We keep current presence and pointer state on the existing hosting infrastructure, without a movement history. Presence disappears after 30 seconds without contact. The last pointer remains labelled during the five-minute resume period and is removed when participation ends. Click indicators last two seconds and markers ten seconds. Following another participant’s view is optional and can be stopped at any time; field reservations expire after 20 seconds without input. Consent to resume the same session lasts five minutes after leaving the page or losing the connection. Explicitly leaving or signing out ends your participation immediately. Shared drafts are removed after 24 hours without changes; saved planning data is unaffected. Temporary unsent inputs are held only in the browser tab’s memory and can be lost on a full reload. Encrypted backups follow their separate retention period described above.

Optional voice chat

Voice chat requires a separate, explicit join within the accepted collaboration session. The browser requests microphone access; the microphone starts muted. Only audio participants receive your audio. You can mute or leave at any time. Leaving the project or collaboration, signing out, or losing project access stops the local microphone. Meals for Friends does not record or transcribe conversations. Speaker indicators are calculated locally and are not stored.

Encrypted WebRTC audio is currently exchanged directly between browsers; no audio relay provider is configured. Direct connections can reveal network addresses to other audio participants and may fail in some networks. Connection setup messages, including session descriptions and network candidates, are temporarily processed on the existing hosting infrastructure. They cease to be delivered after at most 60 seconds and are removed on the next audio poll or collaboration cleanup. Audio membership expires after 20 seconds without contact; explicit leaving removes it immediately. Any encrypted backups retain their separate retention period. If an audio relay is added, its provider and data flows will be described here before activation.

Optional shopping-list transfers

Where enabled, you can explicitly transfer a shopping list to Apple Reminders or Google Tasks. The transfer includes the project title, selected ingredients, quantities, shopping locations, brands and known prices. Project notes and member details are not included. Existing items remain unchanged; subsequent changes and completion status are not synchronised back to Meals for Friends.

For Apple, the data is copied to your clipboard and passed to a shortcut on your device. Depending on your device settings, the clipboard and Reminders may synchronise through your Apple account. For Google, you separately authorise Tasks access. Google grants access to all tasks; our integration only reads list names and creates new shopping tasks. This authorisation is independent of Google sign-in.

Google connection credentials are stored encrypted on the server until you disconnect or delete your account. Export contents and per-item results are removed after seven days, or sooner when the connection, project or account is deleted. Disconnecting revokes the separate Google authorisation and removes local connection and export data. Tasks already created at the provider remain and can be deleted there. Encrypted backups follow the retention period described above. The requested transfer is performed to provide the service you choose (Article 6(1)(b) GDPR); it does not add advertising tracking.

Apple Privacy · Google Privacy