MealTag Privacy Policy

1. Overview

MealTag is built by Rocky River Software, LLC. MealTag is a private nutrition coach for iPhone and iPad: deterministic math computes your targets and day state on your device, and optional AI features receive only an anonymous structured summary (and, for a plate photo, the photo itself) — never your food log, never your identity.

Your food log belongs to you. It stays on your devices and in your own private iCloud, and it is never sold, shared for advertising, or used to track you. MealTag has no user accounts. Its only analytics is subscription reporting through RevenueCat, for MealTag+ subscribers only (see Subscriptions).

2. What MealTag Stores, and Where

Your food log, goals, and preferences — the meals you log, your calorie and macro targets, your day plans and weekly check-ins (which can include an optional body-weight entry), and your dietary restrictions, allergies, disliked foods, cuisine preferences, your usual meal times, and coaching preferences such as Auto or Ask, meal prep, and household size — are stored on your device and synced through your personal iCloud account via Apple's CloudKit.

Rocky River Software cannot read this data. It lives in your private iCloud database, protected by your Apple ID. See Apple's privacy policy.

Your Apple Health data (active energy, steps, and workouts) is handled separately and only if you choose to connect it — see the next section.

3. Apple Health (HealthKit)

If you choose to connect Apple Health, MealTag reads your activity data (active energy, steps, and workouts) to adjust your daily guidance: when you open the app, and in the background when Apple Health records a new workout. It is displayed in the app and factored into your remaining calorie budget. MealTag keeps this week's activity totals and workouts on your device only (never in iCloud, and left out of device backups) so your plan can update quickly. Your day plan, which syncs through iCloud, holds your meal choices and short notes about changes to them. When a workout changes the plan, the synced plan keeps the new meal, marks that meal as adjusted, and saves a note on what it now leans on (for example, “Your lunch now leans on protein”). The plan never names or measures a workout. By default MealTag requests read-only access.

Weight is always optional. Weights you type in a check-in are part of your check-ins and sync through your iCloud as described above. If you turn on “Read weight from Apple Health” in Profile, MealTag also reads the weights in Apple Health (read-only) and keeps those copies only on this iPhone, in a store that never syncs to iCloud and is left out of device backups. They feed your weight trend on the Summary tab. When that trend suggests a new calorie target and you accept it, MealTag saves the new calorie and carbohydrate targets in your goals, which sync through your iCloud and are the targets used in the summary sent for AI features. The weights themselves are never sent to our suggestion service, and are deleted from MealTag when you turn the setting off.

MealTag never stores your Apple Health samples on any server.

Writing meals to Apple Health is off by default. If you turn on “Write meals to Apple Health” in Profile, MealTag asks Apple Health for permission to write and then saves the calories, protein, carbohydrates, and fat of each meal you log, each tagged with an internal meal ID so deleting or undoing a meal removes it again. Turning the setting off stops new writes. Samples already written stay in Apple Health until you delete them there or delete the meal in MealTag. MealTag only writes these four values; it never reads nutrition back from Apple Health.

You can revoke MealTag's access to Apple Health at any time in Settings > Health > Data Access & Devices > MealTag on your iPhone.

4. AI Features and What Leaves Your Device

The AI features are part of MealTag+, an optional subscription. When you use a MealTag+ AI feature, MealTag sends a structured summary to our suggestion service — a proxy hosted on Google Cloud (Firebase) that holds our OpenAI key and forwards your request to OpenAI, then returns the response. Google acts only as our hosting provider for that proxy and stores none of your content. Depending on the feature, that summary contains only what is needed:

• AI meal ideas and the AI day plan: remaining calories, protein, carbs, fat, and fiber for the day; your goal type and coaching style (e.g., "Lose weight", "Flexible"); status flags (e.g., "Low protein"); dietary restrictions, allergies, disliked foods, and preferred cuisines; while you have Traveling turned on, a "traveling" note and your Ask or Auto setting (never your location or your end date); and titles of suggestions you previously accepted or rejected.
• Daily coach notes (MealTag+): the words in your reminders. On an iPhone that can write them itself, with Apple's on-device model, nothing is sent. Otherwise, at most twice a day while the app is open, MealTag sends the same summary as above plus the names of the meals in today's plan that are still open and their labels (for example "Lunch"), your Ask or Auto setting, whether Traveling is on, and, after a recent workout, a note that your next meal should lean on protein or carbs (never the workout's type, length, or calories). The reply is checked on the server and again on your iPhone before you see it, and is kept on your iPhone only (left out of device backups).
• Plate photos (MealTag+): the meal photo you take or pick, made smaller and with its location and camera details removed first, plus whether you use metric units and your dietary restrictions, allergies, and disliked foods, so the foods on the plate can be identified and estimated. MealTag analyzes the photo once and does not save it: it is never added to your food log, your iCloud, or your photo library. Like any other request, OpenAI may keep it for up to 30 days for abuse monitoring (see below).
• Type-to-log: the food description you typed or dictated (e.g., "two eggs and toast") and whether you use metric units, so it can be turned into nutrition estimates. If you use the microphone button, your speech is converted to text on your device using Apple's on-device speech recognition; the audio is not sent anywhere or saved, and only the resulting text is sent, exactly as if you had typed it.

Parts of the summary can reflect activity read from Apple Health: your remaining calorie budget (which can include part of your workout calories), the status notes worked out from it (such as “Calories tight” or “Under-fueled”), the meal names in today's plan sent for coach notes, and the protein-or-carb note after a recent workout. No raw Health samples ever leave your device, and Health data is never used for advertising or shared with data brokers.

Data sent to OpenAI's API is not used to train OpenAI's models, and is retained by OpenAI for up to 30 days for abuse monitoring before deletion (a standard OpenAI API policy). Our own suggestion service does not store your requests. See OpenAI's privacy policy.

Usage limits

To keep usage fair, the first time you use an AI feature MealTag creates a random install ID for the app on your device, using Google's Firebase Authentication in anonymous mode. There is no sign-in, and the ID is not linked to your name, email, Apple ID, or your device's own identifiers. Our suggestion service counts your recent requests under that ID, plus a looser count per network address so that reinstalling the app can't be used to get around the limits. Each count is filed under a scrambled one-way code made from the ID or the address; MealTag's own code never saves the ID or the address itself. Each count expires at most two days after your request and is then deleted automatically, normally within a day of expiring. Firebase keeps the install ID, with the dates it was created and last used, until it is deleted. When you turn off AI features in Profile, MealTag deletes the install ID straight away; if your iPhone is offline at that moment, the clean-up below deletes it instead. Our suggestion service also deletes, once a day, any install ID that has not been used for 30 days. If you turn AI features back on, MealTag asks your permission again and creates a new ID.

Like any web host, Google Cloud keeps standard request logs for our suggestion service, which include the network address each request came from; they are used only for security and troubleshooting and are deleted after 30 days.

To keep these features from being abused, the app attaches an anonymous Apple App Attest token that proves the request comes from a genuine copy of MealTag. It carries no personal data and does not identify you. To have the token ready, MealTag may ask Google's Firebase App Check service for one when the app opens, before you use any feature; that exchange carries no personal data either.

5. Barcode and Food Searches

Barcode and food searches are sent to Open Food Facts and the USDA FoodData Central database to look up nutrition information. These lookups contain the barcode or search text only. USDA food searches pass through MealTag's own lookup service on Google Cloud, which adds our USDA access key, forwards the search text to USDA, and returns the results; it does not store your searches. It also checks the same anonymous App Attest token described above, and it never receives the AI install ID. To keep searching fair, it counts searches per network address in the same way as the AI counts above (filed under a scrambled one-way code and deleted automatically on the same schedule), and Google Cloud keeps the same standard request logs.

A barcode or a search term identifies a food item, not a person. No personal information (name, email, Apple ID, device identifier, or location) is included in these requests. See Open Food Facts terms and USDA FoodData Central.

6. Subscriptions

MealTag+ is an optional auto-renewing subscription purchased through Apple. Payment, renewal, and cancellation are handled entirely by Apple — MealTag never sees your payment details, and there is no MealTag account attached to your purchase. Manage or cancel anytime in Settings → Apple Account → Subscriptions.

If you have MealTag+, your purchase is reported to RevenueCat for subscription analytics. MealTag starts RevenueCat only when you buy or restore MealTag+, or open the app while it is active. If you have never had MealTag+, nothing is sent to RevenueCat. If MealTag+ ends while the app is open, RevenueCat can keep running until the app is closed; MealTag does not start it again after that. RevenueCat receives the App Store receipt for your MealTag+ purchase (which plan, its price, and its dates) under an anonymous ID it creates, plus the technical details every request carries (app version, iOS version, App Store country, and the device identifier Apple gives Rocky River's apps on this device, which other companies' apps cannot see). It does not decide whether you have MealTag+; that comes from Apple alone. It never receives your food log or any health data.

7. What MealTag Does NOT Do

• No advertising — no ad SDKs, no tracking, no data brokers.
• No selling or sharing of personal data — we don't keep your personal data on our servers to sell.
• No user accounts, so there is no profile of you to breach. The anonymous install ID used for AI usage counts holds nothing about you.
• Apple Health data is never used for marketing. Your Health samples (workouts, energy, steps, weight) are never shared with anyone. For the AI features you allow, some of what is sent to OpenAI can reflect them, such as your remaining-calorie budget, which can include part of your workout calories (the full list is in section 4).

8. Notifications

Meal reminders are scheduled locally on your device. Their buttons (such as Had it or Skipped) update your plan on your iPhone and never start an AI request. Nothing about your notifications leaves your phone; a plan change you make from one syncs through your own iCloud like any other change.

9. Deleting Your Data

Your data is yours to delete at any time:

• Delete individual meals or reset suggestion memory inside the app.
• Delete the app to remove all local data.
• To remove synced data from iCloud: iPhone Settings → [your name] → iCloud → Manage Account Storage → MealTag → Delete Data.

10. Children's Privacy

MealTag is not directed at children under 13 and does not knowingly collect personal information from children.

11. Changes to This Policy

If this policy changes, the updated version will be posted at this address with a new effective date.

12. Contact

If you have any questions about this Privacy Policy or how MealTag handles your information, please contact us: