Your meals. Your choice.

Privacy, at home.

Meals organizes your cooking life. Your private library stays in your Apple account. You choose what to share.

Meals Privacy Policy · Updated November 5, 2026

Your cooking journal

Meal recognition and supported Apple Intelligence recipe features run on your iPhone. Original photos stay in Photos. Meals keeps local meal media and journal information and syncs your private library through your Apple account using CloudKit. The Meals team does not receive access to your private CloudKit library just because you use Meals.

Early-access invite codes

When you join with a code, Meals verifies your Sign in with Apple identity and records a protected account identifier, your invite code, and the times you join and complete setup. This essential access record is stored privately on Vercel, separately from optional improvement sharing. The invite dashboard shows combined join and setup counts by code. It does not receive your private meals, photos, Apple Health data, contacts, or voice recordings. Apple identity tokens are processed for verification and are not stored in the invite ledger. Meals also passes a fresh Apple authorization code and token through its protected server to Apple to establish or revoke sign-in permission. These credentials are processed in transit, not kept in the server database or analytics. A revocable token is stored only in this iPhone’s protected Keychain for account deletion. Older sign-ins can reconnect before deletion; deleting Meals data is still available without reconnecting. Temporary protected connection identifiers limit repeated attempts for 15 minutes. Deleting your account removes your admission record; combined code totals remain. Reinstalling or signing in again with an existing account does not add another join. After account deletion, joining again creates a new admission. The original code cannot be changed after joining.

Sharing you choose

Meals start private. People you invite can see the meals you share with your close circle or participate in a meal or plan you share with them. Shared items can include photos, meal details, recipes, profile information, hearts, and comments. Your contacts are not uploaded to a developer contact database.

Meal preview links, when enabled, contain an encrypted snapshot of the meal information shown in the sharing preview. Anyone with the link and its embedded key can view the snapshot during its seven-day validity. Editing the original does not update a previously created snapshot. Revoking a link stops new loads but cannot remove screenshots or copies others already saved. Expired encrypted assets can remain in iCloud until the creating app performs cleanup.

Help improve Meals is optional

This setting is off by default. In build 26 and later it sends text only: feature-use counts, timing and error totals, previous and corrected meal titles with food labels, and recipes you import, save or edit. Recipe examples can include ingredients, steps, servings, cooking time and the previous version. Photos and cookbook images are excluded from this ordinary text-feedback report. Health data, voice recordings and contacts are excluded from all improvement contributions.

Meals does not upload your photo library to the Meals team. The separate tester program described below shares selected meal previews only with your authorization. Food recognition runs on your iPhone using Apple’s models. Your private journal syncs through your Apple account. Sharing photos with friends is a separate action you choose.

Earlier app versions offered optional photo examples. Build 26 removes local feedback image copies, queues deletion of the previous report and sends a new text-only report. Server cleanup removes legacy photo-bearing feedback reports without downloading their images; explicitly authorized build 57 tester contributions follow the separate policy below. Earlier versions retain their original consent behavior until updated. Text examples may contain personal details and are stored in restricted CloudKit records, separate from the private journal. Apple retains technical creator metadata, so reports are not anonymous. We do not sell feedback or use it for advertising or cross-app tracking.

Review feedback in Settings → Privacy & data → Help improve Meals. Remove examples, clear the report or turn sharing off. Turning it off stops collection and queues deletion when connected. Reports expire after 30 days; the app and daily server cleanup remove them when available. The restricted admin dashboard displays aggregate counts and coarse timing buckets, without fetching image assets. Combined daily KPI totals are kept privately on Vercel for up to 30 days without account identifiers or examples. Removing a report does not remove previous combined totals. Feedback deletion does not delete your meals or recipes.

Optional tester contributions (build 57 and later)

Approved super users can choose to contribute existing and future meals they own. Being assigned a super-user role does not give consent: other testers first accept an in-app disclosure. The owner may authorize their own contributions in admin. This separate choice includes resized meal photos and video preview images, generated and edited titles, tags, notes, ingredient text, recipes and corrections, profile food preferences, and the ordinary usage feedback above. It excludes collaborative meals, recipes attributed to someone else, original videos and audio, Health data, voice recordings, contacts, Calendar events, precise location metadata, source Photos identifiers, and the rest of your photo library. User-written notes and recipe text can contain details you entered.

Tester photos leave the device for this program. They are rendered as new JPEG previews, at most 768 pixels on the longest edge, without the original camera or location metadata. Contributions are stored in restricted CloudKit records readable by their creator and the Meals diagnostics reviewer role. The owner can review examples in the authenticated admin website; photos are served through an authenticated, uncached proxy. Apple retains creator metadata, so these examples are not anonymous. Meals may review contributed examples to evaluate and train recognition, title and recipe models. Contribution does not itself train or replace Apple’s models.

Turn tester sharing off in Settings → Privacy & data → Help improve Meals to stop collection and queue removal of submitted examples when connected. Your private meals and Photos originals remain. Examples expire after 30 days and daily cleanup removes expired or no-longer-authorized photo records when available. Reviewed examples may already have informed a model update; deleting an example cannot undo that update. Opting out on a device prevents the same owner authorization from silently re-enabling sharing. Authorizing a new owner choice is explicit. Role removal stops delivery after the device refreshes its short-lived access policy. No contributions are sold or used for advertising or cross-app tracking.

Reports and blocking

Sharing checks run on your device. Meals checks text and classifies food media before sharing; it does not upload your private media to a moderation service. Connected apps download a small safety policy containing hashed restricted account/content identifiers, with no report text or images. An administrator can hide reported content or restrict sharing in Meals. Minimal restriction hashes remain until the restriction is lifted, including through a support appeal; review decisions are retained for 30 days. Restrictions do not delete another person’s private iCloud journal. See our community standards.

Reporting shared content is your explicit choice, separate from Help improve Meals. Before sending, Meals shows the selected meal or comment text. The report includes that text, your reason and optional note, and technical account/content identifiers needed to investigate. It does not attach your photos, Health data or recordings. Reports are stored in restricted CloudKit records and reviewed through a restricted admin dashboard hosted on Vercel. Review notes are stored in private Vercel storage. Reports expire after 30 days; the daily cleanup removes expired reports and their review notes when successful.

Blocked account identifiers and unblock changes sync through your private iCloud database. Blocking hides meals and activity locally, then removes the person from your shares and leaves incoming groups containing them when connected. Offline changes remain pending. Unblocking does not restore past invitations. Saved copies cannot be recalled.

Health and voice stay private

Apple Health information is read or saved only with your permission. You can request an on-device, clearly labelled estimate of a typical serving for your meals or visible shared meals. A preview does not save to Health until you review and save it. You can also enter values manually or separately opt into automatic estimates for new personal meals. Automatic estimates run on the iPhone using Apple Intelligence; they do not measure the photographed portion or establish that you ate the meal. New imports use the original meal date; backfilling existing meals requires a separate action. You can edit or remove Meals entries from a meal’s Health card. Turning automatic logging off stops new logging and leaves existing Health entries in place. Health readings are not included in meal sharing or improvement feedback. Voice recognition requires on-device support and has no cloud fallback. Meals does not retain or upload voice recordings, speech transcripts, or cooking-assistant questions and answers as feedback.

Apple and other services

Meals uses Apple’s sign-in, iCloud, notifications, and system permission services. Apple processes information under its own policies. Importing a recipe link makes a request to that website; opening links or sharing through another app also involves that service’s policies. The reference ingredient guide downloads common artwork and descriptions; looking up an ingredient does not upload your recipe to the catalog.

Calendar memories (optional beta)

On supported builds, an optional feature can read the calendars you explicitly select to connect a meal with a nearby dinner or celebration. Event titles are shown only to you on this iPhone, not saved in your journal, uploaded to the Meals team, or included in sharing and improvement reports. A fixed occasion category, such as Thanksgiving, can guide an automatic meal title on device; a resulting meal title follows your normal journal, sharing and feedback choices. Meals does not create or change Calendar events. Holiday emojis work without Calendar access. Turn Calendar clues off, change your selected calendars, or disable holiday styling in Settings → Calendar & holidays.

Admin access

The separate admin website uses CloudKit Apple-account sign-in and verification codes. The owner approves dashboard access. Essential session cookies and private Vercel storage hold admin account permissions, protected authentication information and review notes. App super-user status is managed separately and does not grant dashboard access. Admin sign-in does not provide access to private meal journals or Apple Health data.

This website and support

This website does not use advertising, analytics scripts, or cookies. It is hosted by Vercel, which processes ordinary connection and request information, including IP addresses, to serve and secure the site. If you email support, your email provider, Apple’s mail services, and the Meals support team process the address and information you choose to send to respond to your request.

Optional account email

When email linking is available, you can connect an address in Settings → Meals emails. This requires fresh verification of your Meals Apple sign-in and confirmation in your mailbox. We store the verified address, a Meals account identifier, join/setup times, link requests and your email choices privately on Vercel. Apple identity proofs are processed for verification rather than saved in the email records. This does not give staff access to your private journal, Photos, Health data or voice recordings.

Product tips and features are an optional, unchecked choice, separate from beta and launch email. If you confirm that choice, new-account email journeys use your join time and email preferences; manual campaigns and journeys share the two-per-week limit. Resend processes delivery and receipts. Unsubscribe and suppression apply to queued messages too. Unlinking disables the account connection and future journeys tied to it; separate email preferences remain until you change them or unsubscribe. Request, consent and delivery history can remain to prevent duplicate sends and honor your choices. Contact support to request email-record deletion.

The Meals waitlist

If you join the waitlist, we collect your email address, the time of your request, and your agreement to receive Meals beta and launch updates. The list is stored privately in the Meals project on Vercel. Signup addresses are not published or shared with other visitors. This website signup is separate from your private journal in your Apple account.

We use the address to contact you about trying Meals and its launch. When we send those updates, Resend processes the recipient address and message to deliver them and handle delivery failures. These messages do not contain your private meal library, Health data, or voice recordings. We do not sell the list or use it for unrelated advertising. Beta and launch emails and optional product updates are separate choices. Optional tips and feature emails are sent up to twice a week. Where email confirmation is enabled, we verify your address before marketing sends. Email preferences and unsubscribe links let you stop these messages; we retain a minimal suppression record to honor that choice. Delivery receipts tell us whether a message was accepted, delivered, delayed, bounced, or reported as spam. We do not use email tracking pixels or rewrite links to measure opens and clicks. Email support to request deletion. We keep your signup until you ask us to remove it or the waitlist is no longer needed.

Notifications and automatic scans

Meals can check accessible photos on this iPhone when iOS grants background time, including while charging. You can pause scans or disable automatic checks in Photos & library settings. Scan timing is controlled by iOS, not guaranteed by Meals.

If server notifications are enabled, Meals sends its server a protected Meals account identifier, installation identifier, Apple push token, app build, time zone and notification preferences. These records are stored privately on Vercel and used with Apple Push Notification service. Tokens expire from our registry after 30 days without renewal and are removed when the account is no longer active. Product news and tips require a separate optional opt-in; turn them off in Notifications. They are separate from meal activity alerts and email preferences. We limit marketing push campaigns to two per rolling week, at least 48 hours apart, and request them during daytime in your device time zone. Apple controls actual delivery timing. Silent background hints contain no meal photos and only request permitted local work. Photos, Health data and voice recordings are not included in these requests.

Eligibility for Apple rating requests uses local engagement and request history on this iPhone. We do not receive your rating or whether Apple displayed the prompt.

Your controls

Manage Photos, Calendar, Contacts, microphone, Speech, notifications, and Health permissions in iPhone Settings and Apple Health. Meals includes controls to edit or delete individual content, change meal visibility, and manage invitations and preview links. Removing Photos permission does not erase previously saved journal content. Contact support for additional data-removal help. Copies saved by other people or services are subject to their controls.