Privacy Policy

Last updated: April 17, 2026

Introduction

BeMeal ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share your personal information when you use our mobile application.

Data We Collect

We collect the following types of information to provide and improve our service:

Personal Information: We collect your email address, username, and profile photo for account management and authentication purposes.
User Content: We collect photos and media (food posts) that you upload to the app.
Contacts: With your permission, we may access your contacts to help you find friends on the platform. This is optional.
Crash Reports: We collect anonymous crash reports (via Sentry) to improve app stability and performance.
Product Analytics: We collect anonymous usage events (screens viewed, taps on core actions like creating a post or following a friend, and device model/OS) via PostHog to understand how BeMeal is used and to improve it. We do not send post content, captions, messages, email, phone number, or precise location. You can opt out at any time in Settings → Share usage analytics.

How We Use Your Data

We use your information for the following purposes:

To provide the BeMeal service and allowing you to share meals with friends.
To manage your account and authentication.
To improve the app through error tracking and crash reporting.

Third-Party Services and Sub-Processors

The full, dated list of our subprocessors is maintained at bemeal.app/subprocessors.html.

We use trusted third-party services to help operate our app:

Supabase: Authentication and database hosting.
Amazon Web Services (AWS): Media storage, compute, and AI services (Rekognition for food detection and content safety).
OpenAI: Generation of accessibility alt text descriptions for food photos.
Sentry: Real-time error tracking and crash reporting.
PostHog (EU region): Anonymous product analytics (event data retained for 12 months).
Foursquare: Location and restaurant place search.
Expo: Over-the-air app updates and build infrastructure.
Firebase Cloud Messaging (FCM): Push notification delivery.

Data Retention

We retain different types of data for different periods:

Account data: Retained for as long as your account is active.
Posts and content: Deleted within 30 days of a deletion request.
Server logs: Retained for 90 days for security and debugging purposes.
Contact hashes: Retained while needed to provide contact-based friend discovery and deleted when you delete your account or revoke contact access.
Product analytics events (PostHog): Retained for 12 months, then automatically deleted. When you delete your account in the app, we also request immediate erasure of your associated PostHog profile and events as part of the deletion flow.

You may delete your account and all associated data at any time directly within the BeMeal app settings.

Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

Consent: Where you have given clear consent for us to process your personal data for a specific purpose (e.g., accessing your contacts for friend discovery).
Contract performance: Processing necessary to provide the BeMeal service to you, including account management, content hosting, and social features.
Legitimate interest: Processing necessary for our legitimate interests, such as improving the Service, ensuring security, and preventing abuse, where those interests are not overridden by your rights.

International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. Our primary infrastructure is hosted in AWS eu-west-2 (London, UK). Some data is processed by services located in the United States:

OpenAI: Alt text generation (US-based processing).
Sentry: Error tracking (US-based processing).
Supabase: Database and authentication infrastructure.

Where data is transferred outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards as required by applicable data protection law.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete personal data.
Erasure: Request deletion of your personal data.
Portability: Request a machine-readable copy of your data.
Restriction: Request that we limit the processing of your data.
Objection: Object to our processing of your data based on legitimate interests.
Withdraw consent: Where processing is based on consent, you may withdraw it at any time.
Lodge a complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence.

To exercise any of these rights, please contact us at support@bemeal.app.

AI and Automated Processing

BeMeal uses artificial intelligence in the following ways:

Food detection (AWS Rekognition): Photos you upload are analyzed to determine whether they contain food-related content. This helps maintain the food-focused nature of the platform.
Content safety (AWS Rekognition): Photos are screened for potentially inappropriate content to keep the platform safe.
Accessibility alt text (OpenAI): Food photos are analyzed to generate descriptive alternative text, improving accessibility for users with visual impairments.

You have the right to request a human review of any automated content moderation decision by contacting support@bemeal.app. We do not engage in profiling or make automated decisions that produce legal effects or similarly significant effects on you.

Location Data

BeMeal allows you to optionally tag your posts with a restaurant or location. If you choose to use this feature:

Your device GPS coordinates are sent to Foursquare to search for nearby places.
The selected location name is stored with your post.
You can skip location tagging entirely — it is not required to use the app.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to know: You may request information about the categories and specific pieces of personal information we have collected about you.
Right to delete: You may request deletion of your personal information, subject to certain exceptions.
Right to opt-out of sale: We do not sell your personal information to third parties.
Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, please contact us at support@bemeal.app.

Children's Privacy

BeMeal is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. Users must confirm that they are at least 13 years old when creating an account. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us at support@bemeal.app.

Contact Us

If you have any questions about this Privacy Policy, please contact us at support@bemeal.app.