Privacy policy

This policy explains which personal data Gudera Meals processes, why, and what rights you have. It follows Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). As of: 14 November 2026.

In short

• Everything you enter (diary, goals, body data, family members, friends) stays in an encrypted database on your device. We never receive it.
• There is no account, no advertising, no tracking and no analytics.
• The app connects to the internet only when you decide so: to update the food data, to look up a barcode or to submit a product to Open Food Facts.
• On these connections our server sees your IP address, as every server on the internet does. It never writes it to disk. For barcode lookups and contributions it keeps a salted hash of it in memory for at most 24 hours, to limit how many requests each address can make.

Who is responsible

The controller under the GDPR is the operator named in the legal notice, which also gives the email address for questions about your data and for exercising your rights. There is no data protection officer, because the law does not require one for a project of this size.

Data on your device

Your diary, goals, weight and other body data, water and activity, managed profiles, your friend list and your key pair are stored only on your device, in an encrypted database (see Your data). Backups are encrypted files that you save wherever you choose (see Backups). Shared meals go from your device to your friend's device as a QR code or as a link you send yourself. None of this reaches us or anyone else, so we cannot read, hand over or delete it; you control it yourself, and deleting the app deletes it.

When the app connects to our server

The app talks to only one server, the food server food.gudera-meals.eu, which we operate. It sends no cookies, no device or advertising identifier and no app identifier, not even a user agent. Every connection is encrypted (TLS 1.3). Because an answer has to find its way back, the server necessarily receives your IP address and the time of the request. The app makes such a connection only in the following cases, each of which you start yourself.

Updating the food data

When you tap Update now under Settings → Food data, or after you have switched on Update automatically there (it is off until you do), the app downloads the current list of products and the changes since your last update. Everyone downloads the same files, so a download says nothing about what you eat or search for. The server writes no access log: it does not keep your IP address or the time of the download. Its error log records only critical faults of the server itself, without client addresses.

Looking up a barcode

When a product is not in the food data on your device and you ask the app to look it up online, the app sends only the first 10 of the 13 digits of the barcode. The server answers with all products that share them, typically a manufacturer's range, and the app picks yours, so the server learns at most the manufacturer, not which of its products you hold. The same lookup runs when you submit a product (see below), to compare your values with those on Open Food Facts.

Submitting a product to Open Food Facts

Submitting is off for every food until you switch it on for that food, and the app shows exactly what will be sent before you tap Submit.

• What is sent: the barcode, the product name and, if you entered them, brand, net quantity and serving size, the nutrition values, the language on the packaging, the country where it is sold, the photo of the nutrition table and, if you took one, a photo of the front. Please photograph only the packaging. The server re-encodes the photos and thereby removes location, device and other metadata.
• Review queue: the server stores the contribution with the date (not the time) of receipt and a random ticket number, which your app uses to ask whether it was accepted. While a contribution waits for a decision, the app asks for its status each time it starts. Your contribution is not linked to you or your device.
• How long: the photos are deleted from the server as soon as we have approved or rejected the contribution. The rest of the record is deleted 90 days after receipt, provided a decision has been made by then; until then it waits in the queue. On your device, the photos are deleted once the contribution has been sent.
• Open Food Facts: an approved contribution is sent from our server to Open Food Facts under the project's own account, without any information about you. There it is published for everyone, the data under the Database Contents License and the photos under CC BY-SA, which you agree to when you submit. Open Food Facts is an independent non-profit organisation in France; its own privacy policy applies to what it publishes.

Links, invitations and shared meals

Links to sources and other websites open in your browser; the website you visit then receives your IP address under its own privacy policy. Invitations and shared meals are links to gudera-meals.eu, but their content is in the part after #, which a browser never sends to a server. If you send such a link through a messenger or email, that service's terms apply.

App Store

You get the app from Apple's App Store. Apple processes your purchase and download under its own privacy policy. We receive from Apple only anonymous, aggregated sales and download figures, no names or contact details.

No tracking, no advertising

The app contains no advertising, no analytics or tracking tools and no crash reporting service. It sends nothing to Apple, Google or other third parties.

Recipients and transfers

The food server runs in a data centre of netcup GmbH in Karlsruhe, Germany, which processes data on our behalf under a data processing agreement (Art. 28 GDPR). Contributions we approve go to Open Food Facts in France. We do not transfer personal data to countries outside the European Union.

Legal basis

We process your IP address to deliver the food data, lookups and contributions you requested and to protect the server from abuse. For lookups and contributions, the server keeps a counter per address so that nobody can overload it: it keeps only a hash of the address, salted with a random value that changes every day, in memory and never on disk, and forgets it at the end of the day. The legal basis is our legitimate interest in providing these functions, forwarding contributions to Open Food Facts as you asked and keeping the server secure (Art. 6(1)(f) GDPR). We do not process health data: what you eat never reaches us.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to data portability and to object to processing based on our legitimate interest (Art. 15 to 21 GDPR). Because our server stores no IP addresses and no data linking a contribution to a person, we usually cannot identify you (Art. 11 GDPR). A contribution that is still on our server can be found by its barcode and the day you sent it: tell us both, and we delete it.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.

Changes to this policy

If the app or the server starts processing data in a new way, we update this policy before the change takes effect, and the What's new page says so.