Privacy

Last updated: 2026-08-28

This privacy policy applies to the processing of personal data by Joyride GmbH in the context of the app and the online offering at https://www.mealbuddy.com (together, the "Services").

"Personal data" is defined in Art. 4 No. 1 GDPR as any information relating to an identified or identifiable natural person.

Below, in accordance with Art. 13 and 14 GDPR, we inform you about which personal data we process when you use our Services, on what legal basis, with whom we share data, and which rights you have. As the processing may differ between the web and the app, the respective processing activities are presented in separate sections.

Controller

The controller responsible for the processing of personal data within the meaning of the GDPR is:

Joyride GmbH Bartenbacher Str. 4, 73033 Göppingen, Deutschland Email: privacy@mealbuddy.com

Data Protection Officer

For any data-protection-related inquiries you may reach our data protection officer at:

Florian Klytta DS Compliance GmbH, Carlsplatz 24, 40213 Düsseldorf Email: privacy@jaumo.com

Supervisory authority

The data-protection supervisory authority competent for Joyride GmbH is Landesbeauftragter für Datenschutz und Informationsfreiheit Baden-Württemberg, reachable at https://www.baden-wuerttemberg.datenschutz.de/ and by email at poststelle@lfdi.bwl.de.

You have the right under Art. 77 GDPR to lodge a complaint with this or another supervisory authority if you believe that the processing of your personal data violates the GDPR.

Processing via our online offering (Web)

The following processing activities relate to the use of our online offering. Each describes the purpose, the legal basis, and the categories of personal data. Recipients and retention are set out in the "Recipients (Web)" section and in the "Retention period" section.

Website provision & server log files

Purpose: Secure delivery of the website and statistical access evaluation (functionality and security).
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: IP address, Browser type / version, Operating system (web), ISP / host domain, Pages visited (URLs), Access date & duration

Website contact

Purpose: Handling enquiries received via the website contact form or email.
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: IP address, Email address, Access date & duration, Name, Contact message content (website)

Recipients (Web)

In the context of our online offering we share your personal data only with carefully selected recipients, and only where this is necessary for the stated purposes or you have consented. Where we engage external service providers to process data on our behalf, we have entered into data processing agreements with them pursuant to Art. 28 GDPR.

International data transfers (Web)

Where we transfer personal data in the context of our online offering to countries outside the scope of the GDPR ("third countries"), we do so in accordance with Art. 44 et seq. GDPR. In the absence of an adequacy decision of the EU Commission, we secure the level of data protection by appropriate safeguards under Art. 46 GDPR, in particular standard contractual clauses (SCCs).

Processing in our app

The following processing activities relate to the use of our app. Each describes the purpose, the legal basis, and the categories of personal data. Recipients and retention are set out in the "Recipients (App)" section and in the "Retention period" section.

Apple Send Consumption Information API

Purpose: Send consumption information about an in-app purchase to the App Store after receiving a consumption request notification (e.g. refund decisioning).
Legal basis: Art. 6(1)(a) GDPR — consent
Categories of personal data: In-app purchases (products acquired)

Authentication data storage

Purpose: Sign-in to the app
Legal basis: Art. 6(1)(b) GDPR — contract
Categories of personal data: Account ID (Apple / Google SSO)

In-app purchases

Purpose: Unlocking extended paid features
Legal basis: Art. 6(1)(b) GDPR — contract
Categories of personal data: IP address, Device data (model, OS, device ID), Advertising IDs, In-app purchases (products acquired)

Consent management (Usercentrics CMP)

Purpose: Collect, store and document end-user consent decisions as proof of consent, via the Usercentrics Consent Management Platform.
Legal basis: Art. 6(1)(c) GDPR — legal obligation
Categories of personal data: IP address, Consent decisions / preferences, Consent ID (unique identifier), Consent metadata (timestamp, policy version, language)

Campaign measurement (AppsFlyer)

Purpose: Measuring advertising performance
Legal basis: Art. 6(1)(a) GDPR — consent
Profiling: This processing includes profiling within the meaning of Art. 4 No. 4 GDPR. It is used solely for the purpose stated above.
Categories of personal data: IP address, Device data (model, OS, device ID), User interactions (registration date, first message, first match, purchases), Advertising IDs

Campaign measurement (Google Analytics)

Crash reports

Purpose: Product improvement through crash analysis
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: Crash report data (Sentry)

Customer support

Purpose: Responding to user enquiries
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: Email address, Support conversation (support ↔ end customer)

In-app analytics

Purpose: Measuring in-app user interactions (e.g. registration funnel step, button/tab clicks) for product analysis
Legal basis: Art. 6(1)(a) GDPR — consent
Categories of personal data: User interactions (registration date, first message, first match, purchases)

Campaign measurement (Singular)

Purpose: Measuring advertising performance and install attribution.
Legal basis: Art. 6(1)(a) GDPR — consent
Profiling: This processing includes profiling within the meaning of Art. 4 No. 4 GDPR. It is used solely for the purpose stated above.
Categories of personal data: IP address, Device data (model, OS, device ID), User interactions (registration date, first message, first match, purchases), Advertising IDs, Gender, Age / age range

Push notifications

Purpose: Send transactional/functional notifications. Per-channel opt-out in the app.
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: Device data (model, OS, device ID), Push token / device registration

Recipe management & AI recipe organizer

Purpose: Let you create, import (from a URL or a photo) and organize recipes and generate grocery lists. An AI recipe assistant turns recipe text and food photos into structured recipes.
Legal basis: Art. 6(1)(b) GDPR — contract
Special categories of personal data (Art. 9 GDPR): Recipe content (ingredients, photos, instructions)
Legal basis for the processing of special categories: Art. 9(2)(a) — explicit consent
Categories of personal data: Message content (chat / support), Recipe content (ingredients, photos, instructions)

User profile & onboarding personalization

Purpose: Collect at onboarding and store the user's gender, date of birth and dietary profile to personalize the app and tailor recipe suggestions.
Legal basis: Art. 6(1)(b) GDPR — contract
Special categories of personal data (Art. 9 GDPR): Dietary profile (may reveal health condition or religious beliefs)
Legal basis for the processing of special categories: Art. 9(2)(a) — explicit consent
Categories of personal data: Date of birth, Gender, Dietary profile (may reveal health condition or religious beliefs)

Data storage for reporting, monitoring and debugging

Purpose: Internal analysis and performance measurement
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: Session, profile and interaction data (aggregated for reporting)

Session & version data

Purpose: Secure session and login management, and storing your operating system, platform and app version so the app runs reliably and stays compatible across updates and devices.
Legal basis: Art. 6(1)(f) GDPR — legitimate interests
Categories of personal data: IP address, Device data (model, OS, device ID)

Recipients (App)

In the context of our app we share your personal data only with carefully selected recipients, and only where this is necessary for the stated purposes or you have consented. Where we engage external service providers to process data on our behalf, we have entered into data processing agreements with them pursuant to Art. 28 GDPR.

We share data with the following recipients or categories of recipients:

Apple (United States)
Zurkuhl (Germany)
Google Cloud BigQuery (Ireland)
Adapty (United States)
Usercentrics (Germany)
AppsFlyer (Israel)
Google Analytics (Ireland)
Zendesk (Germany)
Singular (United States)
Firebase (Ireland)
Google Cloud Gemini (Ireland)

International data transfers (App)

Where we transfer personal data in the context of our app to countries outside the scope of the GDPR ("third countries"), we do so in accordance with Art. 44 et seq. GDPR. In the absence of an adequacy decision of the EU Commission, we secure the level of data protection by appropriate safeguards under Art. 46 GDPR, in particular standard contractual clauses (SCCs).

The following safeguards apply:

EU–US Data Privacy Framework
EU-US Data Privacy Framework
Standard Contractual Clauses (SCC)
Standard Contractual Clauses (SCCs)

App permissions

To use certain functions of our app, it is necessary to grant the app specific device permissions. If you do not grant a permission, you cannot use the corresponding function.

Camera: taking food photos for calorie estimation.
Photo library: analyzing existing food images to determine nutritional information.
Notifications: sending functional notices.
Tracking (App Tracking Transparency): solely to measure which campaign you found the app through.

Legal basis: for function-necessary processing, Art. 6(1)(b) GDPR (contract); for the subsequent access to and storage of information on your end device, § 25(2) No. 2 TDDDG. The tracking permission is based on your consent (Art. 6(1)(a) GDPR).

You can grant and revoke the permissions at any time in your device settings.

Retention period

We retain your personal data only for as long as necessary to fulfil the respective processing purpose. Thereafter the data is deleted, unless we still need it to comply with statutory retention obligations (in particular under commercial and tax law) or to establish, exercise or defend legal claims. The specific retention period is determined by these criteria and by the legal basis of the respective processing; data we process on the basis of your consent is deleted once you withdraw it, unless another legal basis applies.

Your rights

You have the following rights regarding the personal data we process about you:

Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR), in particular against processing for direct-marketing purposes
Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
Complaint to a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact us at privacy@mealbuddy.com or our data protection officer at privacy@jaumo.com.

Obligation to provide data

Where we ask you to provide personal data, this is either required by law or contract, or necessary for entering into a contract. Without such data, the corresponding functions of our Services are generally not available.

Profiling and automated decision-making

We do not engage in automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or significantly affects you in a similar way.

Profiling within the meaning of Art. 4 No. 4 GDPR is used for the purposes flagged in the processing sections above, in particular to display relevant content and advertising. You have the right to object to such processing at any time pursuant to Art. 21 GDPR.

Changes to this privacy policy

We reserve the right to amend this privacy policy where this is necessary due to changes in the law, case law, or our Services. The most recent version is always available at https://www.mealbuddy.com/privacy.

Contact

For any questions relating to data protection and the processing of your personal data, please contact us at privacy@mealbuddy.com. General inquiries should be directed to help@mealbuddy.com.