Privacy Policy — LumaMeal

Last updated: August 14, 2026

LumaMeal ("the App", "we", "us") is a meal-planning app that builds a personalized weekly meal plan, generates a grocery list, estimates nutrition from photos of your meals or pantry, and lets you track what you eat. This policy explains what data the App collects, why, and how it is stored and protected.

1. Account & identity

LumaMeal uses Firebase Anonymous Authentication. On first launch, the App creates an anonymous account consisting of a random identifier (UID) — no email, phone number, name, or password is collected or required. This identifier is used solely to associate your preferences, meal plans, grocery lists, and logs with your device so they can sync and persist across app launches.

• If you delete and reinstall the App, or use a new device, a new anonymous identifier is created and your previous data is not automatically linked to it.
• We have no way to identify you personally from your anonymous account.

2. Information you provide during setup

To personalize your plan, the setup flow asks you for:

• Household details: number of adults, number of children and their ages.
• Goals & preferences: your meal goal (e.g. balanced, weight loss, muscle gain), dietary preferences (e.g. vegetarian, vegan, keto), allergies and foods to avoid, favorite cuisines, cooking "vibes", loved and avoided ingredients.
• Kitchen & logistics: available kitchen equipment, maximum cooking time, cooking difficulty, weekly grocery budget and currency, and your preferred grocery store.

This information is used only to generate and refine your meal plans and grocery lists. It is stored in your Firestore user document and is never used for advertising.

3. Camera & photo library

• Camera: used only when you choose to take a photo — of your pantry/fridge (Scan tab) to detect ingredients, or of a meal (Track tab) to estimate its nutrition. The App does not access the camera in the background.
• Photo library: used only when you choose to pick an existing photo for the same purposes (ingredient scanning or meal logging). The App requests access only to the photos you select, not your full library.
• Photos you submit for scanning or meal-photo estimation are sent securely to our AI provider (Google's Gemini models via Firebase AI Logic) for analysis (ingredient detection or calorie/macro estimation) and are not used to train third-party models or shared with advertisers. Generated meal images may be cached in Firebase Storage, keyed to an anonymized description of the dish (not to your photo or identity), so the same illustration can be reused efficiently across users.

4. Meal plans, grocery lists & logs

The App stores, under your anonymous account:

• Generated weekly meal plans, recipes, and grocery lists.
• Meals you log (including nutrition estimates such as calories, protein, carbs, and fat) and the associated date/meal type.
• Your plan history and how many times you've regenerated a plan (used to enforce feature limits).

This data is stored in Google Firebase (Firestore and Cloud Storage), scoped to your account so that only your own device/account can read or write it.

5. AI-generated content

Meal plans, recipes, ingredient recognition, nutrition estimates, and dish illustrations are generated using Google's Gemini and Imagen models through Firebase AI Logic (Vertex AI). Your setup preferences, pantry/meal photos, and prompts derived from them are sent to Google's AI services solely to generate this content for you. Nutrition estimates are AI-generated approximations and should not be treated as precise medical or clinical measurements — see the Terms of Service for details.

6. Subscriptions & payments

LumaMeal offers optional auto-renewable subscriptions (weekly and monthly, each with a free trial) that unlock full AI-generated plans, recipes, and unlimited regenerations. Payments are processed entirely by Apple through your App Store account — LumaMeal never sees or stores your payment or card details. We use RevenueCat to manage subscription status and entitlements; RevenueCat receives your anonymous app-generated identifier and purchase/transaction data (such as product ID, purchase date, and renewal status) — never your name, email, or card details.

7. What we do not collect

• No name, email address, or phone number.
• No location data — the App never requests location permission.
• No contacts, calendar, microphone, or Health app data.
• No advertising SDKs and no third-party analytics used for ad targeting.
• We do not sell your personal data to anyone.

8. Third-party service providers

We use the following service providers to operate the App. Each processes data only as needed to provide its service to us:

Provider	Purpose	Data involved
Google Firebase (Auth, Firestore, Cloud Storage)	Anonymous account, data storage & sync	Anonymous UID, preferences, plans, logs, cached images
Google Firebase AI Logic (Gemini / Imagen via Vertex AI)	Meal plan, recipe, ingredient & nutrition generation	Preferences, prompts, submitted photos
RevenueCat	Subscription management	Anonymous UID, purchase/entitlement data
Apple (App Store / StoreKit)	Payment processing	Handled entirely by Apple

These providers are contractually and technically restricted from using your data for their own advertising purposes.

9. Data security

Your data is protected by Firebase security rules that scope every document and file to your own anonymous account — no other user or account can read or write your data. Data is encrypted in transit (HTTPS/TLS) and at rest by Google Cloud/Firebase infrastructure.

10. Data retention & deletion

• Your preferences, plans, logs, and cached images are retained as long as your account is active, so your plan and history remain available across sessions.
• To request deletion of your data, contact us at the email below with your request; we will delete your Firestore and Storage data associated with your account.
• Deleting the App from your device removes local app data but does not automatically delete data stored in Firebase — contact us to have it removed.

11. Children

LumaMeal is not directed at children and is not intended for use by anyone under 13 (or the applicable minimum age in your country). While the App lets a parent or guardian record a child's age as part of household size for portioning purposes, it does not knowingly collect personal data directly from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Your rights

Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your data, or to object to certain processing. Because your account is anonymous, we can only act on such requests when you can identify your account (e.g. via the anonymous ID visible in the App, if applicable) or via the device/App instance itself. Contact us using the details below to exercise these rights.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected on this page with a new "last updated" date; continued use of the App after a change constitutes acceptance of the revised policy.

14. Contact

Privacy questions or data deletion requests: emirarikan99@gmail.com