Privacy Policy
Effective date: October 12, 2026
MioPrep (“the app”) is a weekly meal planner for iPhone and Android, operated by the MioPrep team (“we”, “us”). We are the controller of the personal data described here. Privacy contact: support@mioprep.com.
MioPrep is for adults aged 18 and over who plan meals for their household. It is a planning tool. It does not give medical or nutrition advice.
Summary
- Your quiz answers, plans and grocery list stay on your phone until you save an account.
- If you save an account (Apple, Google or an email code), your data is also stored on our servers in the United States so you can sync devices and share with your household.
- Diet styles, allergies and foods you cannot eat are health-related information. We store them only after you agree in the app, and we use them only to choose recipes for you.
- Some features use a third-party AI provider. A change request that you type is sent to it when you send the request. You can switch typed requests off in the app. The rules for your household’s recipes (for example “no shellfish, vegetarian”) can be sent to it, without your name, email or account ID, when new recipes need to be written. Details are in “AI processing” below.
- We do not sell your personal information, we do not share it for advertising, and we do not track you across other companies’ apps or websites. The app has no ad SDKs and does not read your advertising identifier.
- We do not record your screen. Session replay is off.
- Payments are handled by Apple or Google. We never see your card details.
- You can delete your account and data at any time: in the app (You > Account > Delete account and data) or by following Delete your account.
One login across our apps
We offer more than one app, and our apps share one sign-in system. If you use the same Apple, Google or email sign-in in one of our other apps, it is the same login. Each app keeps its own data separate and only that app can read it. When you delete your MioPrep account, we delete your MioPrep data right away. Your underlying login is deleted too, unless you also use another one of our apps. In that case the login stays so that app keeps working.
Data we collect
| Data | What it includes | Why | Where it comes from | How long we keep it |
|---|---|---|---|---|
| Account data (optional) | user ID, email, your name if Apple or Google shares it, a display name, language, units, time zone | create and secure your account, sync, show who is in your household | you, your sign-in provider | until you delete your account |
| Household and planning preferences | country, the first 3 characters of your postal code (optional), store types, number of adults, number of children by age band (no names, no birth dates), which meals and days to plan, shopping day, weekly budget, cuisines, foods you like and avoid, kitchen equipment, cooking time, skill, spice level, staples you keep at home | build your plan and price your list | you | until you delete your account |
| Diet and allergy details (health-related, only with your consent) | diet styles, allergens, other foods you cannot eat, and the time you gave consent | leave out recipes that break your rules | you | until you delete them or your account |
| Plans and activity | weekly plans, meals, what you marked as cooked, dishes you loved, asked for again or hid, streak pauses, grocery list items and who checked them, prices you corrected, the total you paid if you tell us | provide the planner, the list and the cost estimate | you and your household members | until you delete your account |
| Typed change requests | the text you type (up to 280 characters), the change that was made, and its status | change your plan the way you asked | you | the text is erased from our database after 30 days; the record of the change stays until you delete your account |
| Reports and support messages | the reason and note of a recipe report, your support message, the email for our reply, app version, platform | fix recipes and answer you | you | until you delete your account |
| Household invites | a one-way hash of the invite code, who created and used it, expiry date | let people join your household | you | until you delete your account |
| Subscription data | product, period, store, renewal state | unlock the app for you and your household, restore purchases | Apple or Google, through RevenueCat | until you delete your account; transaction records as the law requires |
| Usage data | screens viewed, buttons used, quiz steps completed, paywall and purchase events, an analytics ID. No text you type. Diet and allergy details only as yes or no flags, and only after your consent | understand which features work and fix problems | the app | see Retention |
| Diagnostics | crash logs, device model, system and app version, your user ID | fix bugs | the app | see Retention |
| Approximate location | country or city derived from your IP address by our analytics and subscription providers, and IP addresses in server logs | analytics, security | your connection | same as the data above |
| Install source (Android) | the Google Play install referrer, which says which link led to the install | measure which channels bring people to the app | Google Play | see Retention |
We do not collect precise location, contacts, photos, audio, or your advertising identifier. We do not ask for the names of your children or other household members.
People in your household. If you join or create a household, its members see the shared plan and list, each member’s display name, and who checked an item.
Diet and allergy details and your consent
Information about your diet and allergies can reveal health conditions, so we treat it as sensitive data. We process it only to plan meals for you, based on your explicit consent (LGPD art. 11, I; GDPR art. 9(2)(a) where it applies; and express consent under Canadian and Quebec privacy law). The app asks for that consent before it saves diet or allergy details. If you decline, the app still works, without those rules.
You can withdraw consent at any time in the app (You > Plan preferences > Delete my diet and allergy data), by deleting your account, or by writing to support@mioprep.com. Withdrawing does not affect what we did before.
We do not use diet and allergy details for advertising or marketing, and we do not sell them. They reach third parties only as described in “AI processing” and “Service providers”.
An important limit. MioPrep filters recipes by their ingredients. It cannot guarantee that a product is free of an allergen. Always check product labels and cross-contact warnings.
AI processing
MioPrep uses a third-party AI provider for two things. The provider is OpenRouter, which passes requests to the model maker (currently OpenAI). Both are in the United States.
- Change requests you type. When you type a request such as “make Friday vegetarian”, the text and the names of this week’s dishes are sent through our server to the AI provider, which turns the request into a set of changes for the planner. A line under the text field says that an AI service reads the request. You can switch typed requests off at any time (You > Plan preferences > Typed requests use an AI service). The text is checked for abusive content first. We do not send your name, email, allergies or diet with a typed request. The quick change buttons work without the AI provider.
- Writing recipes for your rules. Recipes come from a library shared by all households. When the library does not have enough recipes that fit your household, our server asks the AI provider to write new ones. That request contains your household’s rules: country, language, the meal, diet styles, allergens to leave out, foods to avoid, cuisines, kitchen equipment, cooking time and spice level. It does not contain your name, email, account ID or anything you typed. New recipes are checked by our system against your rules and saved in the shared library without any link to you.
The AI provider processes these requests under its own terms and may keep them for a limited time. Results can contain mistakes. You can report a recipe or an answer inside the app (Report this meal, or Report a problem with this answer). Do not put personal or health information about anyone in a typed request.
How we use data and legal bases
- Provide the service (planner, list, account, sync, household sharing, subscriptions): performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
- Typed requests sent to the AI provider: performance of a contract, because you asked for the change (LGPD art. 7, V; GDPR art. 6(1)(b)). You can switch them off in the app.
- Diet and allergy details: your consent.
- Security, fraud prevention, crash diagnostics: legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
- Product analytics (without free text or health details): legitimate interests. You may object at support@mioprep.com.
- Legal obligations (tax, accounting, lawful requests): LGPD art. 7, II; GDPR art. 6(1)(c).
Service providers
We use these providers under contracts that limit what they can do with your data.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | hosting, database, sign-in, server functions | United States (AWS us-east-1) |
| RevenueCat | subscription management | United States |
| PostHog | product analytics (session replay is off) | United States (PostHog US Cloud) |
| Sentry | crash reporting | United States |
| OpenRouter, and the AI model maker it passes requests to (currently OpenAI) | reads typed change requests and writes new recipes, as described in “AI processing” | United States |
| Resend | sends the email with your sign-in code | United States |
| Apple | Sign in with Apple, App Store distribution and payments | worldwide |
| Sign in with Google, Google Play distribution and payments | worldwide | |
| Vercel | hosts this website | United States and other regions |
International transfers
Our servers and providers are in the United States. If you live outside the US, for example in Brazil or Canada, your data is transferred to the US when you save an account or use features that need our servers. We rely on the safeguards available under your law, including the mechanisms of LGPD art. 33 and standard contractual clauses where they apply. In the United States, your data is subject to US law and may be accessed by US courts and authorities under that law.
Retention
- Your MioPrep data (profile, preferences, diet and allergy details, plans, list, feedback, reports, support messages, subscription record): kept until you delete it or delete your account. When you delete your account in the app, it is deleted from our database right away.
- The text of a typed change request is erased from our database after 30 days.
- Items that can outlive deletion: encrypted backups, analytics and diagnostics records at our providers, and transaction records that the law requires us to keep. We keep these only as long as needed to provide the service or meet legal obligations, and then delete or anonymize them.
- Apple and Google keep their own purchase records under their own policies.
Your rights
- Everyone: access, correct, delete and receive a copy of your data, withdraw consent, and contact support@mioprep.com. We answer within 30 days.
- Brazil (LGPD): confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, information about the possibility of refusing consent, and revocation of consent (art. 18). You may petition the ANPD. Our data protection officer (encarregado): MioPrep privacy team, support@mioprep.com.
- Canada (PIPEDA and provincial laws, including Quebec’s Law 25): access and correct your personal information, withdraw consent, ask how your information is handled outside Canada, and complain to the Office of the Privacy Commissioner of Canada or your provincial regulator (in Quebec, the Commission d’accès à l’information). The person responsible for the protection of personal information is the MioPrep privacy team, support@mioprep.com.
- California (CCPA/CPRA): right to know, delete, correct, and to limit the use of sensitive personal information. We do not sell or share personal information. We use sensitive personal information (diet and allergy details, account sign-in) only to provide the service you ask for. Categories collected in the last 12 months: identifiers, commercial information (purchases), internet or electronic activity, health-related information you choose to give, and approximate location. We do not discriminate against you for using your rights.
- Other US states: several states have privacy and consumer health data laws. In every state we collect diet and allergy details only with your consent, never sell them, and delete them when you ask.
- EEA and UK: if the GDPR or UK GDPR applies to you, you also have the right to restrict or object to processing, to data portability, and to complain to your data protection authority.
Children
MioPrep is for people 18 and over. We do not knowingly collect data from anyone under 18. The app asks how many children you cook for, by age band, and nothing else about them. If you believe a minor gave us data, write to support@mioprep.com and we will delete it.
This website
This website does not use analytics or advertising cookies. If you pick a language, we store one cookie named lang to remember it. Our hosting provider keeps standard server logs, which include IP addresses. If you email us, for example to ask for launch news, we use your address only to answer you or to send what you asked for.
Security
Data is encrypted in transit (TLS) and at rest by our hosting provider. Database rules let each account read only its own household’s rows. No system is perfectly secure. If a breach affects you, we will notify you and the authorities as the law requires.
Changes
We will post updates on this page and change the date above. If a change is material, we will tell you in the app before it applies to your diet and allergy details.
Contact
The MioPrep team. Privacy and support: support@mioprep.com.