Privacy Policy
Last Updated: August 20, 2026
Privacy first: Manna Meals is local-first. Your recipes, grocery lists, profile preferences, and ongoing meal plans live on your device. We also store a copy of your onboarding week’s meal plan on our servers, tied to your account, so it can be recovered after a reinstall. We do not sell your personal information. Deleting your account in the app removes that server copy along with your account.
1. Introduction
This Privacy Policy describes how Raymarin LLC ("Company," "we," "us," or "our") collects, uses, shares, and protects your information when you use the Manna Meals mobile application (the "App" or "Service").
By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. Please also review our Terms of Service at https://manna-meals.vercel.app/terms.html.
2. Information We Collect
2.1 Information You Provide Directly
Account Information (stored via Firebase Authentication):
- Email address (if using email/password sign-in)
- Name (if provided via Google or Apple Sign-In)
- Authentication method (email/password, Google, or Apple)
- Account creation date and last sign-in timestamp
Profile Information (stored locally on your device):
- Name (optional)
- Age (optional)
- Gender (optional)
- Dietary preferences (e.g., vegetarian, vegan, keto, gluten-free)
- Food allergies
- Cooking skill level
- Food preferences (spicy foods, quick meals, etc.)
Usage Content (stored locally on your device, with one server exception):
- Meal plans you create (on-device; a copy of the onboarding week is also stored in Firestore — see Section 3.2)
- Recipes saved to your library
- Grocery lists
- AI chat history (conversations with the meal planning assistant)
- App settings and preferences
2.2 Information Collected Automatically
Device and Usage Information:
- Device type (iOS/Android), operating system version
- App version number
- Unique device identifier (for crash reporting only)
- IP address (temporary, for API requests only)
- Error logs and crash reports (via Sentry)
- Feature usage analytics (which screens you visit, how long you use the app)
2.3 Subscription and Purchase Information
Manna Meals offers an optional auto-renewable subscription ("Premium") processed entirely through Apple's App Store. In connection with a purchase, we (via our subscription infrastructure provider, RevenueCat) receive:
- Subscription/entitlement status (e.g., active, trial, expired, canceled)
- Product and plan identifiers (e.g., monthly or annual), purchase and renewal dates
- An anonymized RevenueCat/App Store transaction identifier, linked to your account
We do NOT receive or store your credit card number, billing address, or other payment credentials — Apple processes and retains that information under its own privacy policy.
2.4 Information We Do NOT Collect
We explicitly do NOT collect:
- ❌ Payment card or billing information (processed by Apple — see 2.3)
- ❌ Precise location data (GPS coordinates)
- ❌ Contact lists or address books
- ❌ Photos from your camera roll (we do not scrape or upload your library in the background). If you use Scan recipe, we process only the photos or PDF pages you explicitly choose — camera, photo library, or a file — and send them for extraction (see Section 3.4). We do not keep a photo library on our servers.
- ❌ Microphone access. Camera access is used only if you grant permission to take a photo for Scan recipe.
- ❌ Health data beyond dietary preferences and allergies
3. How We Store Your Information
3.1 Local Storage (On Your Device)
Local-first: Your recipes, grocery lists, AI chat history, profile preferences, and ongoing meal plans are stored on your device (AsyncStorage). We do not operate a general cloud sync of that library. The exception is a server-side copy of your onboarding week’s meal plan, described in Section 3.2.
Secure Storage:
- iOS Keychain: Authentication tokens are stored securely in the iOS Keychain
- Android Keystore: Authentication tokens are stored securely in the Android Keystore
If you uninstall the App, all locally stored data is permanently deleted from your device.
3.2 Firebase Authentication (Google)
We use Google Firebase for user authentication. Firebase stores:
- Email address (if using email/password sign-in)
- Encrypted authentication tokens
- Account creation date and last sign-in timestamp
- User ID (Firebase UID)
- Onboarding meal plan (Firestore): A copy of the first week’s meal plan generated during onboarding, stored at
onboarding_plans/{uid} and keyed to your Firebase user ID. This copy is deleted when you delete your account. Ongoing meal plans you edit later remain on your device unless we add a general sync feature in a future version.
Firebase's privacy policy: https://firebase.google.com/support/privacy
3.3 Vercel Serverless Backend
Our backend API runs on Vercel serverless functions:
- Request processing: API requests are processed in memory. Vercel does not keep your recipe library or grocery lists.
- Temporary logs: Retained for 7 days for debugging (timestamp, user ID, endpoint, error messages)
- Onboarding plan backup: When you complete onboarding, the API writes the onboarding week’s plan to Firebase Firestore (see Section 3.2). That is account data, not Vercel disk storage.
- Recipe scan: Photos or PDF pages you submit are received in the extract request, forwarded to Google Gemini, and are not stored as a photo library on Vercel.
3.4 Google Gemini API
When you generate meal plans, we send your dietary preferences and requests to Google's Gemini API. When you use Scan recipe, we also send the photos or PDF pages you selected so Gemini can extract a recipe:
- Data sent (meal planning): Dietary preferences, allergies, food preferences, meal planning requests
- Data sent (Scan recipe): Images and/or PDF page images you choose from the camera, photo library, or a PDF. They go through our backend to Gemini for extraction. We do not retain them as a photo library on our servers.
- Data retention: Google logs prompts and responses (including submitted images) for a limited period per the Gemini API Additional Terms (for paid usage: safety, abuse detection, and legal compliance)
- Training data: For paid Gemini API usage, Google does not use your prompts or responses to train or improve its products. Unpaid quota is subject to different terms.
- Third-party policies: https://ai.google.dev/gemini-api/terms and https://policies.google.com/privacy
3.5 Sentry (Error Tracking)
We use Sentry for crash reporting and error tracking:
- Data sent: Error messages, stack traces, app version, device type, OS version, user ID (Firebase UID), timestamp
- Data NOT sent: Dietary preferences, allergies, meal plans, authentication tokens, email addresses, API keys
- Sensitive data scrubbing: All sensitive data is automatically redacted before sending to Sentry
- Third-party policy: https://sentry.io/privacy/
3.6 RevenueCat (Subscription Management)
We use RevenueCat to manage auto-renewable subscription purchases and entitlements made through Apple's App Store:
- Data sent: Anonymized user/device identifier, subscription/entitlement status, product and plan identifiers, purchase and renewal dates
- Data NOT sent: Payment card numbers, billing addresses, or other Apple billing credentials
- Purpose: To verify your active subscription and unlock Premium features across your devices
- Third-party policy: https://www.revenuecat.com/privacy/
4. How We Use Your Information
We use the information we collect for the following purposes:
| Purpose |
Information Used |
| Provide the Service |
Account info, profile data, usage content |
| Generate Meal Plans |
Dietary preferences, allergies, food preferences |
| Extract recipes from photos |
Images or PDF pages you submit via Scan recipe |
| Authenticate Users |
Email, authentication tokens |
| Improve the App |
Usage analytics, error logs |
| Fix Bugs & Crashes |
Error logs, device info, crash reports |
| Communicate with You |
Email address (for account-related notices only) |
| Comply with Legal Obligations |
Any information as required by law |
| Manage Subscriptions |
Subscription/entitlement status, product and plan identifiers, purchase and renewal dates |
5. How We Share Your Information
We do NOT sell your personal information to third parties.
We may share your information in the following limited circumstances:
5.1 Service Providers
We share information with third-party service providers who help us operate the Service:
- Google Firebase: User authentication, account management, and the onboarding meal-plan backup in Firestore
- Google Gemini API: AI-powered meal plan generation (dietary preferences, allergies) and recipe extraction from photos or PDF pages you submit via Scan recipe
- Sentry: Error tracking and performance monitoring
- Vercel: Backend API hosting
- Apple (App Store) and RevenueCat: Processing subscription purchases and managing entitlements — see Section 2.3 and 3.6
5.2 Legal Requirements
We may disclose your information if required by law or in response to:
- Valid legal process (court orders, subpoenas)
- Government or regulatory requests
- Protection of our rights, property, or safety
- Protection of the rights, property, or safety of our users or the public
5.3 Business Transfers
If Raymarin LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
6. Your Privacy Rights
6.1 Access and Control
You have the right to:
- Access your data: View your profile and usage content within the App
- Update your data: Edit your profile, dietary preferences, and settings
- Delete your account: You can delete your account in the app (Profile). Deletion is immediate and permanent. It removes your Firebase account, associated server data (including the Firestore onboarding plan), and local app data on that device. Deleting your account does not cancel an App Store subscription — manage or cancel billing in your Apple ID subscription settings.
- Export your data: In the app, go to Profile → Export my data. That shares a JSON file of the recipes, meal plans, grocery lists, and profile preferences stored on this device. It is not a download of server-only records (for example the Firestore onboarding backup). You can also email us at contact@mannamealsapp.com.
6.2 California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
Right to Know: You can request details about the personal information we have collected about you in the past 12 months, including:
- Categories of personal information collected
- Sources of personal information
- Business or commercial purpose for collecting
- Categories of third parties with whom we share personal information
- Specific pieces of personal information we have collected
Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
Right to Opt-Out of Sale: We do NOT sell personal information. However, our use of analytics and third-party services may be considered "sharing" under CCPA. You can opt out by disabling analytics in the App settings.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
Right to Limit Sensitive Data: You can limit the use of your dietary preferences and allergy information by not using meal planning features.
To Exercise Your Rights: Email us at contact@mannamealsapp.com
6.3 European Privacy Rights (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):
- Right to Access: Obtain confirmation of whether we process your personal data and access to that data
- Right to Rectification: Correct inaccurate personal data
- Right to Erasure: Request deletion of your personal data
- Right to Restrict Processing: Limit how we use your personal data
- Right to Data Portability: Receive your personal data in a machine-readable format
- Right to Object: Object to our processing of your personal data
- Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
Legal Basis for Processing: We process your data based on:
- Consent: For optional profile information and meal planning features
- Contract: To provide the Service you requested
- Legitimate Interests: To improve the Service, fix bugs, and ensure security
- Legal Obligation: To comply with applicable laws
To Exercise Your Rights: Email us at contact@mannamealsapp.com
Supervisory Authority: You have the right to lodge a complaint with a data protection authority in your jurisdiction.
7. Data Retention
We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy:
- Account data (Firebase Auth): Until you delete your account
- Onboarding meal plan (Firestore): Until you delete your account
- Local device data: Until you uninstall the App, clear app data, or delete your account in the app
- Google Gemini API: Limited period per Google's Gemini API Additional Terms
- Error logs (Sentry): 90 days
- Backend logs (Vercel): 7 days
- Subscription/entitlement data (RevenueCat): Retained for the life of your subscription plus a limited period after expiration, per RevenueCat's data retention practices
After you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it by law.
8. Data Security
We implement commercially reasonable security measures to protect your information:
- Encryption in transit: All data transmitted to/from our servers uses HTTPS/TLS encryption
- Encryption at rest: Authentication tokens are encrypted using iOS Keychain/Android Keystore
- Access controls: Limited employee access to production systems
- Security headers: Our API includes security headers (X-Frame-Options, CSP, etc.)
- CORS restrictions: API access restricted to authorized origins
- Input validation: All API inputs are validated and sanitized
However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.
9. Children's Privacy
The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.
If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at contact@mannamealsapp.com. We will promptly delete such information.
10. International Data Transfers
The Service is operated from the United States. If you are located outside the United States, your information will be transferred to, stored, and processed in the United States.
By using the Service, you consent to the transfer of your information to the United States, where data protection laws may differ from those in your country.
11. Third-Party Links
The Service may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:
- Posting a notice in the App
- Sending an email to the address associated with your account
- Updating the "Last Updated" date at the top of this policy
Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
14. Summary of Data Practices
What We Collect:
- Email address (for authentication)
- Dietary preferences and allergies (for meal planning)
- Photos or PDF pages you explicitly choose in Scan recipe (sent for extraction; not kept as a photo library)
- Usage analytics (to improve the app)
- Subscription/entitlement status, for Premium subscribers (via RevenueCat)
What We DON'T Collect:
- ❌ Payment card or billing information (processed by Apple)
- ❌ Location data (GPS)
- ❌ Contact lists or address books
- ❌ Photos except those you explicitly choose for Scan recipe (camera, library, or PDF)
Where Your Data Lives:
- On your device: Recipes, grocery lists, profile preferences, and ongoing meal plans
- Firebase Auth: Email, authentication tokens (encrypted)
- Firebase Firestore: Onboarding week’s meal plan, deleted when you delete your account
- Google Gemini API: Meal-planning prompts and Scan recipe images/PDF pages you submit (limited retention per Google's terms; we do not keep a photo library)
- Sentry: Error logs (sensitive data scrubbed)
- Apple / RevenueCat: Subscription status and purchase identifiers (no card data)
Your Control:
- ✅ Access, update, or delete your data anytime
- ✅ Export a JSON copy of on-device data from Profile → Export my data
- ✅ Opt out of analytics