Privacy Policy

1. Controller

Judith Nigge, Riera Coma Fosca 20, 08328 Alella, Barcelona, Spain.
Email: info@menja-fresh.com · Phone: +34 633 378 722. Further details in the Legal Notice.

2. Overview

We process personal data only to the extent necessary to provide the app and website. You can use Menja Fresh as a guest; in that case your planning data is stored solely locally in your browser and is not transmitted to us.

3. Hosting (Vercel)

The website and app are hosted by Vercel (Vercel Inc., USA). When you access the site, technically necessary server logs (e.g. shortened IP address, timestamp, requested resource) are processed. Legal basis: Art. 6(1)(f) GDPR (secure operation).

4. Account & data storage (Supabase)

If you create an account, we process your email address, name and your planning and preference data. Authentication and storage are handled via Supabase. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). In guest mode, data stays local (localStorage).

When you pick a supermarket in the shopping list, we record a usage entry: which shop, country, language, how many items were on the list, how many you took across, and the time. The entries of one shopping trip are grouped by a random identifier held only in memory; if you are signed in, your user id is attached as well. We do not store which items are on your list. We use this only to see whether the feature is used at all. Legal basis: Art. 6(1)(f) GDPR.

4b. Health data (allergies, body data)

Allergies, and your sex, age, height, weight and activity level, are health data and therefore a special category of personal data (Art. 9 GDPR). We store them only if you explicitly agree in the app; without that tick the fields stay locked. Legal basis: Art. 9(2)(a) GDPR (explicit consent). We use them solely to hide recipes containing those ingredients and to work out your daily target — they are not analysed, not passed on and not used for advertising.

You can withdraw your consent at any time in your profile under "Preferences & allergies". That deletes your allergies and your body data; the lawfulness of processing up to that point is unaffected. If you plan together in a household, the members of that household see the allergies of the shared list.

5. Payments (Stripe)

For Premium subscriptions we use Stripe as our payment processor. Payment data is processed directly by Stripe; we do not store full payment details. Legal basis: Art. 6(1)(b) GDPR.

6. Local storage & cookies

We use only technically necessary local storage (localStorage) for your language setting, planning data and login session. We set no tracking or advertising cookies on our own pages. If you tap a partner link to REWE, Awin and REWE store an identifier on their own domains — see section 9.

7. Fonts & images

The fonts are held on our own server and served from there — no connection to Google Fonts or any other third-party service is opened. Recipe images are AI-generated, held in our own Supabase storage and served from there. The images were generated in advance — using the app opens no connection to an image generator. Legal basis: Art. 6(1)(f) GDPR.

8. Crash reports

When something in the app breaks, we send a short technical report to our own database (Supabase) — no external service such as Sentry is involved. The report contains the error message, the place in the code, the screen size, the chosen language and the browser identification, plus a random id that only applies to the open tab. It contains no account details, email address, week plan or shopping list. At most five reports per session. Purpose: finding faults we would otherwise never see. Legal basis: Art. 6(1)(f) GDPR (interest in an app that works). We delete the reports after 90 days.

8b. Usage counts

We count four things in the app: that a week was planned, that the shopping list was opened, that someone sent an invitation to a shared household, and that someone tapped through towards Premium. Stored with it: the name of the event, a number (evenings planned, items on the list), the chosen language, and a random id that applies only to the open tab. No account details, email address, week plan or postal address, and no IP address we keep. One row per event per session. This counts how often something is used — it cannot follow who uses it: two visits by the same person are two separate sessions to us. No external service is involved, and no cookie is set for it. Purpose: seeing whether the app does what it was built for. Legal basis: Art. 6(1)(f) GDPR (interest in understanding our own service). We delete the rows after 90 days.

8c. Push notifications

If you switch on the weekly reminder, your device gives us a delivery token, which we store together with your language, your time zone, the weekday you usually plan on, and whether next week is already planned — nothing else, no meal plan, no email address. The token is only ever used to send one message a week, and only while next week is empty. Delivery runs through Firebase Cloud Messaging (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland); Google sees the token and the message text. Switching the reminder off deletes the token. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw in the profile at any time.

9. Affiliate / partner links (Awin, REWE)

In the shopping list we offer to look your items up directly at the REWE delivery and collection service. These links run through the partner programme of AWIN AG, Eichhornstraße 3, 10785 Berlin, with the advertiser REWE Markt GmbH, Domstraße 20, 50668 Cologne, Germany. We do not embed REWE in our pages and never redirect you automatically — it happens only when you deliberately tap an item or the basket button.

Tapping opens a link on awin1.com that forwards you to rewe.de. In doing so, Awin and REWE store an identifier on their own domains (a cookie, or a parameter in the address) so that a subsequent purchase can be attributed to us as the referring partner. As a technical necessity your browser transmits your IP address and browser data to Awin and REWE. We ourselves pass on no personal data from your Menja Fresh account: the link contains neither your name nor your email address nor your shopping list. From Awin we receive settlement data on referred orders (time, order value, commission), but nothing identifying you.

For the forwarding and the recording of the commission, we and REWE are joint controllers within the meaning of Art. 26 GDPR. The essence of the arrangement: we inform you about the processing within our own service — this section — and REWE informs you about the processing in the REWE shop. You may exercise your rights under Art. 15–22 GDPR against either of us; requests we cannot fulfil ourselves are passed on to REWE. On rewe.de, REWE's own privacy terms apply.

If an order results from such a link, we receive a commission. The price does not change for you. The legal basis for the forwarding is our legitimate interest in funding the service (Art. 6(1)(f) GDPR). Awin and REWE are responsible for the identifiers they set on their own domains.

9b. Supermarkets outside Germany

Outside Germany the shopping list offers a link to a supermarket — E.Leclerc Drive and Carrefour in France, Mercadona, Carrefour and Veritas in Spain, Tesco and Sainsbury’s in the UK. These are ordinary links with no affiliate programme behind them: no identifier is set, we receive no commission, and your list is not transmitted. Tapping one opens that shop’s own site, where its privacy policy applies.

10. International transfers

Some of the services named (e.g. Netlify, Stripe, Google) may process data in the USA. Transfers are based on appropriate safeguards (e.g. EU Standard Contractual Clauses or the EU-US Data Privacy Framework).

11. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a data protection authority – our competent authority is the Spanish authority AEPD (Agencia Española de Protección de Datos); you may also contact the authority in your country of residence. Please send requests to info@menja-fresh.com.

12. Deleting your account

You delete your account in the app itself: Profile tab → scroll to the bottom → Delete account. Deletion is immediate and complete — meal plan, preferences, family settings, ratings, payment mapping and the login itself. If you are part of a household, your membership is ended first. Step-by-step instructions are also at menja-fresh.com/delete-account.html. If you can no longer reach the app, an email to info@menja-fresh.com is enough.

13. How long we keep data

Account, plan and preference data stays for as long as your account exists and is removed completely when the account is deleted. In guest mode it lives only in your browser; clearing your browser data removes it. Crash reports are deleted after 90 days. For the supermarket usage note (section 4), deleting your account removes your user identifier; the remaining row no longer refers to you and is kept as a plain count. Server logs at Vercel are deleted according to their own schedule.