Privacy statement
Mealjot is a food diary. It works with an account, but your diary itself reaches our server only when you choose that (see Health data); otherwise it stays on your phone. This statement says what we do process, why, on which legal basis, where, and for how long.
Who is responsible
The controller is Silberie Solutions, Heisterberg 4 G, 6431 JC Hoensbroek, Netherlands, Chamber of Commerce (KvK) number 94576963.
For questions about your data, or to use one of your rights: privacy@silberie.com. We answer within one month.
What we process, why, and on which basis
| Data | When | Why | Legal basis (GDPR) |
|---|---|---|---|
| Your diary (foods, amounts, times, notes, water, exercise), weigh-ins, body details (sex, birth year, height, weight, activity, goal), targets, own foods, recipes, settings | Only with an account and after you chose "sync my diary" | Keep your phones in sync, back them up, share with people you choose | Explicit consent, art. 9(2)(a) and 6(1)(a) |
| Username, display name, password (stored only as a hash), passkeys (public key only), recovery code (hash only), sign-in sessions | With an account | Sign you in | Contract, art. 6(1)(b) |
| When you gave or withdrew consent | With an account | Show that you consented | Legal obligation, art. 6(1)(c) with art. 7(1) |
| What a coach or dietitian you added sees: your diary, weigh-ins, body details and targets (and in their Monday summary, counted together with their other clients, on how many days you logged) | When you add a coach | Their guidance | Explicit consent, art. 9(2)(a) |
| Messages between you and your coach | When either of you writes | Talk about your diary | Explicit consent, art. 9(2)(a) |
| A shared day, meal or week (a copy), or a shared recipe | When you make a link | Show it to whoever has the link | Explicit consent, art. 9(2)(a) |
| A coach's public profile (title, area, what they offer, a location rounded to about 100 m) | When a coach publishes it | So people nearby can find them | Consent, art. 6(1)(a) |
| That you recommend a coach (others only see how many clients do, never who) | When you recommend them, after two weeks of sharing with them and 7 days with food logged | Help people choose a guide | Explicit consent, art. 9(2)(a) |
| Push address, time zone, reminder times, and for today which meals have something in them, whether you reached your water goal and whether you weighed in | When you turn reminders on | Remind you only when it's needed | Explicit consent, art. 9(2)(a) |
| A backup of your diary under a code only you have (anyone with the code can read it) | When you turned it on in an earlier version, or move your diary from app.mealjot.app | Restore your diary on another phone | Explicit consent, art. 9(2)(a) |
| Photos and descriptions you send to the AI | When you use it | Read your meal | Explicit consent, art. 9(2)(a); not kept |
| How many AI reads you used today: a number per account, or without an account per internet connection (as a scrambled code) | When you use the AI | Keep the AI free and fair: nobody can use up everyone's | Legitimate interest, art. 6(1)(f) |
| Your location, rounded | When you open Nearby | Find places and people near you | Consent (your phone's location permission), art. 6(1)(a); not stored with you |
| Crash reports: the error, the screen, the app version, language and browser | When the app crashes | Fix bugs | Legitimate interest, art. 6(1)(f) |
| Your plan: which plan, its status, renewal date, and Stripe's customer and subscription numbers | When you buy Mealjot Plus or Coach Pro | Give you what you paid for | Contract, art. 6(1)(b) |
| A scrambled part of your internet address (8 bytes of SHA-256), in counters that expire within 48 hours | On each request | Limits against abuse | Legitimate interest, art. 6(1)(f) |
There are no ads and no trackers, nothing is sold and nothing is used for profiling. Visits are counted with Umami on our own server (umami.silberie.com): without cookies, without storing your internet address, never the part of a page address after "?" or "#" (a link can carry a share code), and not at all when your browser asks not to be tracked. Basis: legitimate interest, art. 6(1)(f).
The front page sets two small cookies, only for itself: mj_hl remembers the language you picked, and mj_app (set by the app) makes mealjot.app open the app instead of the front page for someone who uses it. They hold nothing about you and are strictly necessary for what you asked for, so no consent is asked for them.
Health data
What you eat and weigh is health data (a special category, art. 9 GDPR). Mealjot stores it on its server only when you choose that yourself: at sign-up with the button "Create account and sync my diary", or later with "Turn on" under Account. Nothing is ticked for you. You can withdraw your consent any time under Account → Health data: the server copy is deleted at once, sharing with coaches ends, and the app keeps working on your phone.
Children
Mealjot is for people of 13 and older. Under 16 we ask no consent (in the Netherlands a parent has to give it below 16, art. 5 UAVG), so for someone under 16 nothing about the diary leaves the phone: no syncing, coach, share links, server backup, AI reads or reminders. If an account holds consent while its birth year says under 16, the consent is withdrawn and the server copy deleted.
Where it is stored, and who processes it for us
- Cloudflare, Inc. runs Mealjot: the app, the database, storage and the AI models (Workers AI). Cloudflare is our processor under its Data Processing Addendum. The database with accounts and diaries is held in the European Union (Cloudflare's EU jurisdiction). Backups under a code, the daily counters and short-lived caches are kept in Cloudflare's worldwide network, and AI reads are processed there and not kept. Where data may leave the EU, the transfer rests on the EU–US Data Privacy Framework, under which Cloudflare is certified, and on Cloudflare's standard contractual clauses.
- Stripe (Stripe Payments Europe, Ltd., Ireland) handles payments for the paid plans. You pay on Stripe's own page: your card or bank details go to Stripe, never to us. Stripe tells us only which plan you have and until when. For the payment itself Stripe is responsible on its own (its privacy policy: stripe.com/privacy), and it keeps payment records as the law requires.
- The push service of your phone or browser (Apple, Google, Mozilla) delivers reminders. The message is encrypted for your phone; they see its push address and when a message is sent, not what it says.
- Your browser's speech recognition (Apple's on an iPhone, Google's in Chrome) hears what you dictate, when you use the microphone. Mealjot only gets the words.
Services that get nothing about you: Open Food Facts (barcodes and product searches, asked by our server) and OpenStreetMap services (places near a rounded location, and the streets for the map, asked by our server). Some product pictures, and pictures from TheMealDB and Wikimedia, load directly on your phone, so those services see your internet address, like any website you open.
How long we keep it
| What | How long |
|---|---|
| Account, diary, weigh-ins and settings on the server | Until you withdraw consent or delete your account |
| Sign-in sessions | Deleted after 180 days without use |
| Messages with your coach | Until either of you deletes them, you stop sharing with that coach, or you delete your account |
| Shared day, meal and week links | Until they expire (7 days, 30 days or never) or you withdraw them |
| Shared recipe links | Until you withdraw them |
| A link's preview picture | Made when asked for; at most a day in Cloudflare's cache, and unreachable once the link is gone |
| Coach access | Until you remove the coach; with no coach left, the shared copy is deleted |
| Your recommendation of a coach | Until you take it back, withdraw consent or delete your account |
| Reminder data | Until you turn reminders off, or the push service says the address is gone |
| Backup under a code | Until you turn it off; deleted after 400 days without use |
| AI answers to short descriptions and food names | 30 days, without who asked (so the same words are answered faster) |
| Daily AI read counts | 7 days |
| Crash reports | 3 days |
| Abuse counters | At most 48 hours |
| Your plan (on our server) | While it runs; ended plans until you delete your account |
| Invoices and payments (with Stripe) | 7 years, as Dutch tax law requires |
| Database restore points | 7 days: deleted data can be restored from them for that long, then it is gone |
On your phone your diary stays until you erase it. Meal photos (small, for 60 days), earlier descriptions and today's AI coach chat are only ever kept on the phone.
Security
Passwords, recovery codes and link codes are stored only as hashes. All connections are encrypted (HTTPS). Shared links can't be guessed (32 random bytes). Only you, and the coaches you add, can see your diary.
Your rights
- Access and portability: download everything as a file in Settings → Backup & data, or ask us.
- Correction: change any entry, weigh-in or detail in the app.
- Erasure: delete your account under Account → Password, sign out, delete account; the server copy is deleted at once.
- Withdrawing consent: under Account → Health data; the server copy of your health data is deleted.
- Objection and restriction: e-mail privacy@silberie.com.
- Complaint: you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Changes
When this statement changes, the date below changes and the app says so.
Last changed: 10 October 2026