Verimeal Privacy Policy
1. Who is responsible
The Verimeal app ("app") is published by Julia Lenz, an individual developer based in Spain ("we", "us"). Contact for any privacy matter: verimeal@outlook.com.
2. Summary
- Verimeal requires no login or user profile and does not store your meals outside your device. The only exception is the optional free AI analyses feature, described in section 11.
- We do not use analytics, ads, crash reports, or advertising or device identifiers (except the random access credential the app generates for the optional free AI analyses feature, section 11).
- Your data (profile, goals, meals, photos, chats) is stored on your device.
- When you use an AI feature with your own API key, the app sends the necessary data directly from your device to the AI provider you chose. We do not receive that data. With the optional free AI analyses, the photo passes through our server (section 11).
3. Data stored on your device
The app stores locally, on your device: your profile (age, height, weight, sex, activity level, goal and any dietary notes you write), goals, meal log, photos, Nutri AI conversations and temporary data (cache). Some of this data, such as weight and eating habits, may be considered health data. We have no access to it.
Your AI provider API key is stored only in the system's secure storage (Android Keystore / iOS Keychain) and is not included in backups.
4. AI providers you choose ("bring your own key")
To use the AI features, you enter your own API key from a provider of your choice: Google Gemini, Anthropic, OpenAI, OpenRouter, Groq, Mistral, or an OpenAI-compatible address you provide (HTTPS only).
Only when you trigger an AI feature, the app sends directly to the chosen provider, depending on the feature:
- photos of meals and food labels;
- text you write in the chat;
- in the Nutri AI: your profile (age, height, weight, sex, activity level, goal, dietary notes), your goals and your meal history.
This happens at your initiative, within your own account with the provider. The provider's processing of this data is governed by its own terms and privacy policy, which we recommend you read. Some providers may process data outside the European Economic Area. If you do not want to share certain data with the provider, do not use the corresponding feature.
5. Barcodes and Open Food Facts
When you scan a barcode, the product number is looked up in Open Food Facts, an open food database, and, if you choose, also with your AI provider. Product images shown in the app come from Open Food Facts. In these lookups, Open Food Facts receives the barcode number and technical connection data, such as your IP address, under its own policy.
On Android, barcode reading uses Google Play Services (ML Kit). This component is provided by Google and is governed by Google's terms and privacy policy.
6. Model catalog and this website
The app periodically downloads a public file listing the available AI models, hosted at verimeal.com. When this file is downloaded, or when you visit this website, our hosting provider (Cloudflare) processes the technical data needed to deliver the content and protect the service, such as your IP address and browser or device type. We do not use this data to identify you or build profiles. The legal basis is our legitimate interest in providing and protecting the service.
7. Purchasing the app
The app is paid and has no in-app purchases. Payment is processed by Google Play or the App Store under their own policies. We receive only limited transaction information from these stores, such as the order number and country, for accounting and tax purposes.
8. Backups
- Manual backup: the app lets you export a ZIP file, not encrypted, saved wherever you choose. It does not include your API key or Nutri AI conversations. Keep this file in a safe place.
- Android: the system's automatic backup to your Google account is enabled and may include the app's database, profile and conversations. It is managed by Google and can be turned off in your device settings.
- iOS: the app follows the standard iCloud/iTunes backup, managed by Apple and configurable by you.
9. How long data is kept and how to delete it
Data stays on your device until you remove it (except for the data of the free AI analyses feature, described in section 11). The app does not yet offer an option to delete all data at once; uninstalling the app removes the local data. Copies in backups (Google account, iCloud or ZIP files) are managed by you and must be deleted in those services. Data sent to an AI provider follows that provider's retention rules.
10. Minimum age
The app is intended for people aged 18 or over. We do not knowingly collect data from minors.
11. Free AI analyses
When you buy Verimeal on the App Store or Google Play you get 20 free AI analyses. This feature is optional: it only works after you accept it in the app, and you can withdraw consent at any time under Settings > AI Providers. If you set up your own AI key, the free analyses are not used, and your photo goes straight from your device to the provider of your key, without passing through our server.
What happens in each free analysis:
- When activating the feature for the first time, the app verifies that it was purchased: on iOS, it sends the App Store receipt; on Android, it sends a Play Integrity token and the device identifier.
- In each analysis, the app sends our server (hosted on Cloudflare) the photo of the meal or nutrition label, the language, the type of analysis and a random request identifier.
- The server forwards the photo to Google Gemini for analysis and returns the result to the app. We do not send Google any identifier of you, your device or your account.
- The photo is not stored on our server.
- Under the terms of the paid Gemini API, Google does not use your photos or the responses to improve its products, but may keep this data for a limited period, solely to detect misuse and meet legal obligations.
What we store:
- An account record with your credit balance, a support code and an irreversible code (hash) derived from your App Store purchase (on iOS, linking credits to your purchase without revealing your name or Apple ID) or from the device identifier (on Android, stored in an irreversible form to limit new accounts on the same device, without storing the original identifier). Kept while you use the feature or until you ask for deletion.
- Device access credentials, stored as hashes until account deletion (including revoked ones).
- A technical record of each analysis, without the photo, deleted after 10 minutes.
- Temporary validation challenges (stored only as hashes), deleted 1 hour after use.
- Aggregated, anonymous daily statistics, deleted after 400 days.
Your IP address is not stored by us. It is seen by Cloudflare, which provides the network infrastructure, and used only to limit abuse.
Deletion: to delete your data from the server, send your support code (under Settings > AI Providers) to verimeal@outlook.com; we will respond within 30 days. Data stored on your device is removed when you uninstall the app.
Providers involved: Cloudflare (server hosting), Google (AI analysis through the Gemini API and verification via Play Integrity that the app was obtained on Google Play) and Apple (purchase and verification that the app was purchased on the App Store).
12. Your rights
Under the General Data Protection Regulation (GDPR) and similar laws, you have the right to access, rectify, erase, restrict, object to and port your data. Except for data from the free AI analyses feature (section 11), we do not store your data on servers of ours, and you exercise most of these rights directly in the app and on your device. For data processed by your AI provider, Open Food Facts, Google or Apple, contact those services. For any question, write to verimeal@outlook.com.
You may also lodge a complaint with a data protection authority. In Spain, this is the Agencia Española de Protección de Datos (www.aepd.es).
13. Security
The app's communications with AI providers and Open Food Facts use encrypted connections (HTTPS). Your API key is kept in the system's secure storage. No system is completely secure; protect your device with a screen lock.
14. Changes to this policy
We may update this policy. The current version will always be available at this address, with the date of the last update at the top.