Menuli

Menuli Privacy Policy

Last updated: November 11, 2026 (the app's name, Menuli, and §6 on the catalog's AI). Before: October 28, 2026.

1. Who is responsible

Juan Francisco Jiménez Martín (trading as juanfrandevs), an independent developer in Spain. Tax ID (NIF) 74929807Q. Address: Avda. Hernán Núñez de Toledo 12, 29018 Málaga (Spain). Phone: +34 952 22 86 39.

For anything about your data, to exercise your rights or to complain: juanfrandevs@gmail.com, in English or Spanish. It is also the point of contact for authorities and users under the EU Digital Services Act.

There is no data protection officer: the controller handles everything himself. For some countries he also has a specific role (§13).

2. The essentials

• The app works without signing up: when you open it, an account with no name or email is created, identified by a random code.
• Your allergies, your body data, what you log that you eat and your weight are health data. Allergies always apply on your phone and are only kept on our servers if you agree; your body data, what you log and your weight are only kept with your health consent, on your phone too. You can withdraw each one with one tap. You can export or delete what you log and your weights whenever you like.
• Usage analytics is optional too: nothing is sent until you accept it.
• There are no ads, we don't sell or share data and we don't track you across apps.
• You can delete your account and your data from the app, instantly (the little that is kept, and for how long, is in §8).

3. What data we process

• If you link an account (Google or Apple, to use the app on another device or to pay): that account's email and the identifier Google or Apple gives us. With Google your name and the link to your profile picture come too, because Google includes them in the sign-in: they are kept with the account, but the app doesn't use or show them. With Apple we also keep a code that only serves to withdraw your authorization from Apple when you delete the account. Signing out on a phone deletes nothing: your data stays in your account and comes back when you sign in again. The first time you link it, we email that address to confirm it.
• If you subscribe: which plan you have, in which store, since when, until when, whether it renews and as which plan, plus the purchase identifier the store gives us to check it. On the yearly plan, also when we emailed you about the renewal and whether the email went out. The store takes the payment: we never see your card or payment details. When we verify a new subscription we email your account's address the confirmation of the contract, and we keep when it went out.
• If you delete your account and had a Google or Apple account linked, we read its email before deleting it to send you the confirmation of the deletion; we don't keep it after sending it.
• If you withdraw from the subscription (with "Withdraw from contract here" or by writing to us): your name, the email you give us for the acknowledgement, the contract (plan, store, start date and purchase identifier), the date and time you sent it, and whether the refund has been made and the acknowledgement sent.

Google Firebase services the app uses:

• Usage analytics (Google Analytics for Firebase), only if you accept it. It is a separate choice, made on each phone (accepting it on one doesn't turn it on on your other devices), that you can change in Profile → Privacy and consent; nothing is sent until you accept it. It collects the app's installation identifier, the phone model, the system and app versions, the language, the approximate location (city or region, inferred from the connection) and:
  • the events Firebase records on its own: first open, start of a usage session, time of use, screens viewed and app updates;
  • and ours: that you finished the initial setup, created a week, opened the shopping list or the batch session, finished the batch, changed a setting (which one, not its value), swapped a dish (the reason, picked from a list, the position of the alternative you chose, how many you saw and whether it was the fastest or the cheapest), that a recipe was placed in your week, that you marked a recipe as "Don't suggest again", sent a report, linked an account, saw the plans screen and bought (the plan, its price and its currency); and, since phase 11 of the app, that you opened the calendar or the messages, that you were asked for the notification permission and what you answered, that you opened a notification (of which kind: week, shopping, batch, free week, timer or news; the weigh-in reminder counts as "other") and which Home card you tapped; and, since phase 12, that the app asked the store for its rating prompt (after finishing the batch or creating a week; only the store knows whether it showed it) and that you tapped "Rate the app".
• Crash reports (Firebase Crashlytics), only if you accept them. They are asked about together with analytics and have their own switch in Profile → Privacy and consent; it is also a choice for each phone, and nothing is sent until you accept it (if you decline or withdraw it, any reports not yet sent are deleted). When the app crashes, or when an operation hits an error that doesn't close it: the point in the program where it happened, the phone model, the system and app versions and the installation identifier.

To turn the AI off if needed we don't use Firebase: our server decides it when it gets the request, with no new data.

Your allergies, your restrictions, your body data, your goal, what you log that you eat, your weights, your logging settings, what you type and which dishes or ingredients are in your menus never go to Firebase. We don't use the phone's advertising identifier.

What we don't collect: your name or your email unless you link an account, your precise location, your contacts, or the photos and files on your phone.

4. Health data

Allergies, body data, what you log that you eat and your weights are health data (GDPR, art. 9; "sensitive data" in other countries). We process them only with your explicit consent, with a text that says what is kept, why and how to withdraw it, which you sign electronically. There are two: the allergies one and the health one, which covers your body data, your target, what you log that you eat, your weights, your pace and how you want logging to look. You don't have to give or authorize them: the app works without them.

• Without the allergies consent, your restrictions still apply to your menus, but they stay on your phone: neither they nor the settings that name them leave the device. The server does keep the dishes of your menus (which already respect them) and, if a slot was left free, only that it was because of your rules, without saying which. Reports of a wrongly marked allergen in a recipe always arrive without being linked to your account.
• The health consent is asked for when you save "My goal" and when you choose to start logging what you eat or your weight (in "Diary", or with "Read and accept" in the day or in your weight). It never opens by itself. Its text lists what for: working out and adjusting your target and your serving; showing you your day, your week and your weight trend; warning you if your weight drops too fast; and keeping it on our servers for your other devices. If you earlier accepted a version that only covered "My goal", it still counts for your target, but to log what you eat or your weight we ask for the new one.
• Without the health consent, there is no personal goal (menus use standard portions) and nothing is logged, not even on your phone only: "Diary" shows your menus (what was planned, not what you eat), without storing any health data. Our servers also reject that data if there is no consent in force.
• Withdrawing them takes one tap in Profile → Privacy and consent. Withdrawing a consent doesn't make unlawful what was done with it before. Withdrawing the allergies one deletes them from the servers and keeps them on your phone (so your menus stay safe). Withdrawing the health one deletes your target, your body data, what you've logged and your weights from our servers at once and from all your devices when they sync, together with the target your menus used, and portions go back to standard.
• Export and delete: in Profile → My goal → "How logging looks" you can download what you've logged and your weights as two CSV files, one for each (they're prepared in the app's temporary storage, not in your documents, and deleted when you come back; what you do with them afterwards is up to you), and delete with one tap everything you've logged or all your weights, on this phone and the others. It's free.
• People at home: the allergies of the people who eat with you are kept as household rules, without saying whose they are or asking for any other data about them. To keep them on our servers, the consent includes your statement: if any belongs to someone under 14, you agree as their mother, father or guardian; if it belongs to someone 14 or older, they've told you they agree and you've shown them this information. If you can't confirm it, they stay on your phone only, and the menus are just as safe. From the app you can send them a link to this policy.
• If you are one of those people and don't use the app: what is kept are rules like «gluten-free» or «no eggs», without your name. You can ask whoever uses it to remove them or to withdraw the consent in Profile → Privacy (they're deleted from our servers at once), or write to us at juanfrandevs@gmail.com: since we don't know whose each rule is, we'll ask you for what we need to find the account.
• "My goal" is profiling (GDPR, art. 4.4): with your body data the app works out your calories and protein and adjusts portions; with your weights it works out their trend. It does so on your phone, with public formulas and cautious limits (explained in "How it's calculated", in the app), and it has no legal effect on you and doesn't significantly affect you: you can change or remove it whenever you like (after a safety raise, it doesn't go below that figure for 4 weeks).
• Safety notices: once a week, the app looks at your weight trend and what you log. If your goal is to lose weight and your weight drops faster than is prudent, it raises your target and tells you, and it doesn't lower it below that figure for the next 4 weeks (after that you can review it in "My goal"). If, by your trend, your weight falls below the healthy range for your height, or if because of your age we no longer suggest losing weight, it switches to maintaining and tells you; also if you were maintaining or gaining with a target you set by hand below what you use. With obesity, the raise never goes past what you use. If you aren't trying to lose weight and your weight drops fast, if it keeps dropping when it's already low, or if what you log is often below the minimum, it suggests talking to your doctor, without changing your target. It never lowers your target unless you ask, and logging your weight doesn't change it. It isn't a diagnosis or medical advice.
• Your choice, and we tell no one: just logging, no numbers and hide weight keep no reason, don't go to analytics and nobody else sees them. Notifications (the reminders, off unless you turn them on, and the news, only if you accept it) never carry health data, and who gets a news item is never decided by health data.
• Health data is not used for advertising and doesn't go to Firebase analytics or crash reports; it doesn't go to any AI service, except what you describe for “Work it out with AI” if you agree to it separately (§6); it isn't sold or shared with third parties, and it isn't included in the phone's backups. Allergies kept with your consent are also counted, aggregated and anonymously, to improve the catalog (§5).
• If you live in the US: please also read our Consumer Health Data Privacy Policy.

5. What we use it for, and on what basis

Where the basis is legitimate interest, you can object (§10).

We don't make automated decisions with legal effects on you or that significantly affect you (art. 22): the calculator and the safety notices are an estimate for guidance, not medical advice, and you can change your target within its limits (after a safety raise, once 4 weeks have passed).

6. Artificial intelligence

• Menus are not made by an AI: they come from a recipe catalog and an algorithm that runs on your phone.
• In the batch session, if you agree, an external AI service says which ingredients each step uses. We only send it your week's recipes as they are in our catalog (titles, steps and ingredients). It does not receive your identifier, your allergies, your household or your body data, and what it returns is checked on our servers before you see it.
• The provider is OpenAI (US). If it doesn't answer, we fall back to DeepSeek (China) or Gemini (Google). In the batch none of them receives personal data.
• When you log something off the menu, if you agree (a separate consent asked the first time), “Work it out with AI” sends OpenAI what you typed, the language and the meal, to estimate the foods, their amounts, their calories, their macros and their fiber. It is health data. Before estimating, an OpenAI filter and the model itself check whether the text speaks of self-harm or of not eating: if so, we calculate nothing and the app tells you where to find help by the country the phone is in (on Android, its mobile network’s; on iPhone, the Region setting): in Spain, 024 and 112; in the US, its territories with 988 and Canada, 988 and 911; elsewhere we name no line, because we can’t be sure it would work there, and point you to the emergency number and your doctor; the country never leaves the phone). It is not a help service and doesn't always detect it, and the result of that check is not kept anywhere, neither in our logs nor in analytics. We don't send your identifier, your email, your allergies, your profile or your target, and our servers don't keep the text: only how many times you use it and its cost. OpenAI doesn't train on it and may keep it for up to 30 days to monitor abuse. It never goes to DeepSeek or Gemini. The result is approximate: you check and correct it before saving, it is marked “Estimated with AI” and you can report a mistake. You can withdraw it anytime in Profile → Privacy.

7. Who it is shared with

We don't sell or share your data, or use it for targeted advertising. These providers process it on our behalf, as processors and under contract:

• The batch's AI providers (OpenAI and, as fallback, DeepSeek and Google Gemini) only receive catalog recipes, nothing about you.
• OpenAI, L.L.C. (US), as a processor and only if you agree to “Work it out with AI”: it receives what you describe having eaten, the language and the meal (§6). Transfer safeguard: for the European Union the contract is with OpenAI Ireland Ltd., and what goes to the US is covered by the European Commission's standard contractual clauses in its data processing addendum.
• Apple and Google (App Store and Google Play) distribute the app and charge subscriptions as controllers in their own right, under their own policies. If you link an account, they give us your email and an identifier (Google also gives your name and a link to your photo; Apple may give you a hidden email). During sign-in, Google and Apple may process other data on their own account, such as your phone number or approximate location, under their policies. We send them nothing about your menus.
• You can ask us for a copy of the safeguards of any transfer by writing to juanfrandevs@gmail.com.
• Authorities: we only give them data when a law or a court order requires it.
• If the app changes hands (if it is sold, for instance), your data would pass to the new owner under this same policy, and we would tell you in the app beforehand so you can delete your account if you prefer.

8. How long we keep it

9. How we protect it

• Communications are encrypted (HTTPS).
• On the servers, each person can only read and write their own rows (row-level security), checked with automated tests.
• The session is kept in the system's secure storage (Keystore on Android, Keychain on iOS).
• The app's data on your phone is not included in cloud backups.
• Our servers reject health data that arrives without a consent in force, and delete it on their own when you withdraw it.
• If there were a security breach affecting your data, we would report it to the competent authority and, where the law requires it or there is a risk to you, to you too.

10. Your rights

You can access your data (and find out who it has been shared with), correct it, delete it, restrict its processing, ask for its portability, object to what is based on legitimate interest and withdraw your consents at any time. Each country names them its own way (§13).

• News by notification or by email is turned off with one tap in Profile → Notifications and email (each phone, its own; email, for the whole account) or with the unsubscribe link in every email; the reminders, on the same screen. None of this changes the rest of the app.
• Delete the account and all data: in the app, Profile → "Delete my account and data". It is immediate. Also by email (if you linked an account). More information: menuli-app.com/delete-account.
• Take what you log and your weights with you, or delete them: in Profile → My goal → "How logging looks", as CSV files or with one tap (§4).
• Withdraw a consent or turn analytics off: Profile → Privacy and consent.
• Object to the device code: write to us and we stop processing it for your account unless there are compelling legitimate grounds (keeping the free week from being repeated, for instance).
• Anything else: write to juanfrandevs@gmail.com. As the account has no name or email, we may ask you to do it from the app (Profile → "Report a problem") so we can tell which one is yours.
• Deadline: we answer within one month at most (or the shorter period your country's law sets, §13), free of charge.
• If you disagree with our answer, you can ask us to review it by replying to that email: we do so within 45 days at most and tell you why. You can always complain to the data protection authority: in Spain, the Agencia Española de Protección de Datos (aepd.es), or the one of your country of residence (§13).

Deleting the account doesn't cancel a subscription: it is cancelled in the store (App Store or Google Play).

11. Minors

The app is for adults: you must be at least 18 to use it. "My goal", logging and weight are only for the adult account holder, and the app checks it with your age or your date of birth. Children only count as smaller portions: we don't ask for data about them, except the household allergies you mark (§4), what they eat isn't logged, and it is not a children's meal plan. If we learn that an account belongs to a minor, we delete it.

12. Changes to this policy

If we change something important, we will tell you in the app before it applies. We always keep which version of each consent you accepted. If a consent changes to add a purpose, that purpose only applies to whoever accepts the new text; what you had already accepted stays valid for what it covered.

13. If you live in…

Everything above applies to everyone. In addition, depending on where you live:

• European Union, European Economic Area and Switzerland: the GDPR applies (and Swiss law). You can complain to your country's authority (in Spain, the AEPD).
• United Kingdom: the UK GDPR applies. Your data is processed in the European Economic Area, which the UK recognizes as adequate, and in the US under the UK extension of the Data Privacy Framework. You can complain to us (we acknowledge it within 30 days at most) and to the Information Commission (ico.org.uk), which replaced the Information Commissioner's Office on 30 September 2026.
• United States: we don't sell or "share" personal data or do targeted advertising. Your allergies, your body data, what you log that you eat and your weights are "consumer health data": read our Consumer Health Data Privacy Policy. We answer your requests within 45 days at most (extendable once, with notice). If we deny them, you can appeal by replying to our email; we decide the appeal within 45 days at most (60 in Connecticut) and, if we deny it, we give you the contact of your state's Attorney General.
• Canada: your data is processed outside Canada (EU and US) and may be subject to the laws of those countries. The person responsible for the protection of personal information is Juan Francisco Jiménez Martín (juanfrandevs@gmail.com). You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) and, in Quebec, to the Commission d'accès à l'information (cai.gouv.qc.ca).
• Brazil: the LGPD applies. Your rights (art. 18): confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, deletion of data processed with your consent, information about who we share it with and about the possibility of not giving consent and its consequences, and revocation of consent. We answer full access requests within 15 days at most. Our communication channel with data subjects and with the authority is juanfrandevs@gmail.com. You can complain to the Agência Nacional de Proteção de Dados (gov.br/anpd). There is a summary of this policy in Portuguese.
• Mexico: you have the rights of access, rectification, cancellation and opposition ("ARCO rights") and you can revoke your consent or limit the use of your data by writing to us or from the app. We answer within 20 business days at most and, where appropriate, put it into effect within the following 15 business days. Changes to this policy are announced in the app. You can turn to the Secretaría Anticorrupción y Buen Gobierno, the personal data protection authority.
• Argentina: we answer access requests within 10 calendar days at most and correction or deletion requests within 5 business days. "LA AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales."
• Colombia: you have the right to know, update, correct and delete your data and to revoke the authorization. We answer queries within 10 business days at most and claims within 15 business days; the controller handles them himself (juanfrandevs@gmail.com). You can complain to the Superintendencia de Industria y Comercio (sic.gov.co).
• Peru: representative for Peruvian territory: Juan Francisco Jiménez Martín, juanfrandevs@gmail.com. We answer information requests within 8 days at most, access requests within 20 days and the other rights within 10 days. You can complain to the Autoridad Nacional de Protección de Datos Personales (gob.pe/anpd).