Mealith

Privacy Policy

Last updated October 28, 2026

Mealith is built so that we know as little about you as possible. This policy explains what little that is, why, who else is involved, and what you can ask us to do. "We" and "us" mean Labyrinth Works LLC, which makes Mealith.

The short version

• Your diary lives on your device. On the free app we never receive it.
• No ads, ever. No analytics, no tracking and no advertising code in the apps or on this site. We don't sell or share your data.
• When you search for a food or scan a barcode, the search goes to our food lookup service, without an account or a device identifier. You can turn this off and search offline only.
• If you subscribe to Mealith Plus, your backup is encrypted on your device before it leaves. We store it, but cannot read it.
• You can export your data, and delete your account, yourself.

1. The free app

Everything you enter, including food, weight, measurements, exercise, water, fasting and photos, is stored on your device only. We don't receive it and can't see it. The app has no account and no sign-in.

2. Food searches and barcode scans

To find foods that aren't already on your device, the app sends your search words or the scanned barcode to our food lookup service. We don't attach an account, name or device identifier. Our servers see your IP address while answering the request, as every website does. We do not store IP addresses with searches, and keep server logs for no more than 7 days.

To keep the service from being abused without asking you to sign in, requests are rate limited by IP address.

You can turn on "search offline only" in Settings, and then nothing is sent.

3. Food corrections and shared foods

If you correct a food, we receive the correction (the food and the values you changed). It is sent without your name, and it may become part of the public food data. We keep a random identifier with each correction, not linked to you, so that abusive corrections can be filtered.

If you add a food that wasn't found, it stays on your device. If you tick "Share this food with the Mealith community", the app sends only the food's name, brand, barcode and nutrition values. Nothing identifies you or your device. If you read the label with your camera, the photo is read on your device and is never uploaded or stored. A shared food becomes public, as part of the public food data under the ODbL. Our server uses your IP address in memory to limit how often foods can be shared, and does not store it.

Anyone can report a shared food as wrong or abusive, and reports are anonymous. To stop one person flooding reports, we keep a scrambled form of the IP address, made with a key that changes every day, and discard it within a day.

4. Mealith Plus subscribers

A subscription needs an account. For it we store:

• Your sign-in. Your email address. You sign in with a link we email you, so there is no password.
• Your encrypted backup. Your diary, including photos only if you choose to back them up, encrypted on your device with a key we never have. We cannot read, search or change it.
• Your keys, locked. Two locked copies of your data key, one opened by your passphrase and one by your recovery key. We never have your passphrase, your recovery key or the open key.
• Technical records. When you last backed up or restored, the size of your stored data, and when you signed in.
• Your subscription. Whether it is active, its plan and renewal date, as Paddle tells us. We never see your card.

Why: to provide the backup you are paying for.

5. Before launch: the waiting list

If you join the waiting list on this website, we store your email address and when you joined, and nothing else. We use it only to email you about Mealith's launch. Ask us and we will remove it.

6. Who else is involved

We use these services to run Mealith. Each gets only what it needs, and none may use your data for its own purposes:

• Paddle sells web subscriptions as our merchant of record and handles payment, tax and receipts. Paddle shares with us your email address, country, what you bought and its status. See the Paddle privacy policy.
• DigitalOcean hosts our servers in the United States, including subscribers' encrypted backups, and this website and the waiting list. The Mealith server is kept separate from every other system we run.
• Cloudflare stores our encrypted server backups in a storage bucket used for nothing else, and runs getmealith.com, which only redirects to this website. A copy of those encrypted backups is also kept on our own backup server. Your backup is still encrypted with your key inside them.
• Mailgun sends sign-in emails to subscribers. It receives your email address and the email it delivers.
• Microsoft hosts our email, so it holds anything you send us.

7. How long we keep things

• Account and encrypted data: until you delete your account, or 90 days after a subscription ends.
• Copies in our server backups: after you delete your account, or after the 90 days above, copies can remain in our server backups for up to 30 more days, until those backups expire. They stay encrypted with your key the whole time.
• Emails with us: as long as needed to help you.
• Purchase records: Paddle keeps these as tax law requires.

8. Your choices and rights

You can export everything in the app at any time. Subscribers can delete their account in the app, under Settings. You can also email us to ask for a copy of what we hold, to correct it, or to delete it, and we will reply within 30 days. Wherever you live, you have these choices. Depending on where you live, including Connecticut and other US states, the European Union and the United Kingdom, the law also gives you these rights, and the right to complain to a data protection authority. We do not sell personal data, do not use it for targeted advertising, and do not profile you.

9. Consumer health data

Some laws, including Connecticut's and Washington's, treat food, weight and fitness information as consumer health data. Mealith collects none of it in readable form: the diary stays on your device, and backups are encrypted before they leave. We never sell it or share it. The rights above apply to it. Washington residents: see our Consumer Health Data Policy.

10. Children

Mealith is not meant for children under 13, and we do not knowingly collect personal information from them. If you think a child has given us information, email us and we will delete it.

11. Security

Data is encrypted in transit everywhere, and backups are encrypted end to end. We keep the data we hold to a minimum, so there is little to lose. If a breach ever affects your information, we will tell you as the law requires.

12. Where data is processed

We are in the United States, and our servers and their backups are in the United States. If you use Mealith from elsewhere, the little information described above is processed there.

13. Changes

If we change this policy in a way that matters, we will say so in the app and on this page before the change applies.

Contact

Labyrinth Works LLC, a Connecticut limited liability company, 2389 Main St, Ste 100, Glastonbury, CT 06033. Email support@mealith.com.