Privacy Policy

Last updated: July 2026

1. Data Controller

Responsible for data processing in the mangia app:

Dominik Stolz, Basel, Switzerland Email: info@mangia-app.com

2. What data we process

Account and sign-up

When you create an account, we process your email address and your password (stored encrypted). This data is managed by Supabase and is required to operate your account.

Usage data

Your recipes, meal plans and shopping lists are stored on our servers so you can access them across devices. The family (workspace) includes: workspace name, member IDs and an invitation code.

Child profiles (optional, Family module)

When you create a child profile in the Family module, you store the following information about your child:

• First name or nickname
• Taste feedback from the meal plan (likes / dislikes)

This information is used exclusively to personalise the meal plan and is only visible to members of your family.

AI processing

For AI features (recipe import from PDF or website, meal plan generation, recipe search), recipe texts, images and meal plan context are sent to Google Gemini. Requests and responses are stored in our database for up to 90 days for quality assurance, then automatically deleted.

Push notifications

When you enable push notifications, we store a device token (FCM token) of your mobile device as well as your time zone and language setting, so that notifications can be sent at the right time and in your language. You can disable push notifications at any time in app settings or in your device's system settings.

Analytics

We use PostHog (servers in the EU) to understand how mangia is used and where it falls short. Session recordings are disabled and your IP address is not stored. We analyse usage to improve the app — not to assess you as a person.

We keep two areas separate:

Before sign-in (website, public recipe pages, onboarding)

Plain audience measurement. No cookies are set and nothing is stored on your device, no user profile is created, and you are not recognised across sessions or devices. We record page views and how far people get through onboarding.

After sign-in (in the app)

So that questions like "is the meal planner still being used after a few weeks?" can be answered, usage here is linked to your account ID, and an identifier is stored on your device for that purpose. We record:

• Page views
• App events: sign-up, recipe created/imported (URL/photo/PDF), AI recipe generated, meal plan used, shopping list created
• No content of your recipes, lists or child profile data

The anonymous measurement before sign-in and the account-linked measurement afterwards are not connected — the anonymous identifier is discarded when you sign in.

Objection:

You can object to analytics at any time: in the app under Account → Privacy, on the website via Cookies & tracking in the footer. Your objection applies to both areas.

Payment data

If you subscribe to a plan, Google Play processes your payment data. We only receive information about your plan status and an anonymous user ID from RevenueCat. No credit card or bank account data is stored by mangia.

Image search

When you tap "Search image" while editing a recipe, the recipe title is sent to Brave Search as the search term to find a suitable image. No personal search terms of yours are collected; the request only contains the recipe title. Search queries are not stored permanently.

3. Legal basis

We process your data on the following legal grounds:

• Performance of contract (Art. 6(1)(b) GDPR / Art. 31(2)(a) FADP): account management, recipes, meal plan, shopping lists, push notifications, AI processing
• Legitimate interest (Art. 6(1)(f) GDPR / Art. 31(1) FADP): analytics via PostHog (improving and stabilising the app), security logging. You can object to this processing at any time — see the “Analytics” section.

4. Third-party providers

All US providers are either certified under the EU-US Data Privacy Framework (DPF) or covered by Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

5. Retention periods

• Account data: until you delete your account
• AI call logs (`ai_calls`): 90 days, then automatic deletion
• Subscription billing log: 10 years (statutory retention obligation)
• Push tokens: until logout or account deletion

6. Your rights

You have the following rights regarding your personal data:

• Access: you can find out at any time which data we have stored about you.
• Rectification: you can have incorrect data corrected.
• Erasure: you can request deletion of your data.
• Restriction: you can have processing restricted under certain circumstances.
• Data portability: you can request your data in a common format.
• Objection: you can object to processing based on legitimate interest.

You can delete your account and all associated data yourself under Settings → Delete account. For questions regarding your data protection rights, contact us at info@mangia-app.com.

You have the right to lodge a complaint with:

the Federal Data Protection and Information Commissioner (FDPIC) (Switzerland): www.edoeb.admin.ch

Or with the competent data protection authority in your EU member state.

7. Children and minors

mangia is intended for users aged 18 and over. The Family module allows legal guardians to create and manage profiles for their children. Children do not use the app independently — all data is managed via the parent account.

Child profiles contain: first name or nickname and taste feedback (likes / dislikes). This information serves exclusively to personalise recipe suggestions.

8. Data security

All data transmissions are encrypted via TLS. Data in the database is stored encrypted (Supabase Encryption at Rest). Database access is strictly limited to your workspace via Row-Level Security (RLS).

9. Changes to this policy

If we make material changes to this privacy policy, we will inform you via push notification or email. The current version is always available at mangia-app.com/datenschutz.

10. Contact

For questions regarding privacy, you can reach us at info@mangia-app.com.