Privacy policy
Last updated 2026-09-28
The short version: Misa works without an account. Your meal plan, shopping list, food diary, water log, pantry, favourites and saved recipes stay in your browser on your device. We only receive data when you choose an online feature: an account backup, importing a recipe from a link, an AI estimate, or a purchase. We don’t sell data, show ads or use tracking or analytics cookies.
Who is responsible
Franciszek Tomczyk, ul. Jaśminowa 6/11, 05-827 Grodzisk Mazowiecki, Poland. Contact: hello@misameals.com.
Data that stays on your device
Your household size, meal plan, shopping list, food diary, water log, habits, pantry, favourites, units, language and imported recipes are saved in your browser’s local storage. We can’t see them. They stay until you clear them in Misa’s settings or in your browser. The barcode scanner uses your camera only on your device; no images leave it.
Data we process, and why
| When | What | Why and legal basis | How long |
|---|---|---|---|
| Using the website | Technical request data (IP address, browser, time, page) in our hosting provider’s logs | Delivering and securing the service; legitimate interest (GDPR Art. 6(1)(f)) | Short-term server logs, typically days |
| Rate limiting | A one-way hash of your IP address, or your account ID, with a request counter | Preventing abuse; legitimate interest | About one minute |
| Error reports | Error message, file and line, app version, language and screen name. No IP address, no content you entered | Finding and fixing bugs; legitimate interest | Short-term server logs |
| Usage counts | The name of an action (for example “app opened”, “meal added to the plan”, “recipe imported”, “second active week”), how many times, and the app version. No identifier, no cookie, no IP address, no content. Not sent when your browser sends Do Not Track or Global Privacy Control | Knowing whether Misa is useful and what to improve; legitimate interest | Daily totals, deleted after 400 days |
| Website page views | If switched on: Vercel Web Analytics counts visits to the website pages (not the app) without cookies | Knowing which pages help people; legitimate interest | As set by Vercel |
| Creating an account | Email address, name if you give one, sign-in data and session cookies | Providing the account; contract (Art. 6(1)(b)) | Until you delete the account |
| Saving a backup | A copy of the Misa data on your device, which can include your food diary | You ask us to keep it; contract, and your explicit consent for diet-related data (Art. 9(2)(a)), which you can withdraw by deleting the backup | Until you replace it or delete your account |
| Rating a recipe | Recipe, rating, outcome and comment | Community reviews after moderation; contract | Until you delete it or your account |
| Importing a recipe from a link | The link you paste. Our server downloads that page, so the site sees our server, not you | Providing the feature; contract | Not stored on our servers; the recipe is saved on your device |
| AI labels, nutrition estimates and allergen warnings | Recipe text only: title, ingredient lines, first steps and source site. No personal data | Providing the feature; contract | Not stored by us; the result is saved on your device |
| Buying Misa Plus (not on sale yet) | Subscription status; payment details are handled by the payment provider, not by us | Contract, and legal obligations for tax records (Art. 6(1)(c)) | As long as required by tax law |
Services that receive data
- Vercel: hosting the website and API, server logs.
- Clerk: sign-in and account profile.
- Supabase: database for backups and reviews.
- Upstash: short-lived rate-limit counters.
- TypeSafe: the AI model (Jev) that reads recipe text for labels, estimates and allergen warnings.
- Stripe: payments, once Misa Plus is on sale.
- Open Food Facts: when you search for a product or scan a barcode, your device asks Open Food Facts directly, so they receive your IP address and the search.
- Wikimedia Commons and GitHub: some recipe photos load from their servers, so they receive your IP address.
- Sites you import recipes from: the photo of an imported recipe loads from that site’s server, so it receives your IP address (without the address of the Misa page you came from).
Some of these providers are based in the United States. Where data leaves the EU, we rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses that these providers offer.
Cookies and local storage
Misa uses local storage on your device to save your data and settings. If you sign in, the sign-in provider sets cookies that are needed to keep you signed in. We don’t use advertising, analytics or tracking cookies, so there is nothing to opt out of.
Your rights
You can access, correct, download and delete your data, restrict or object to processing, and withdraw consent at any time. On your account page you can download everything we store for your account and delete the account yourself. For anything else, contact us at hello@misameals.com. You also have the right to complain to your local data protection authority.
Children
Misa is not directed at children. Please don’t create an account if you are under 16, or under the age of digital consent in your country.
Health information
Nutrition values, allergen warnings and estimates in Misa are approximate and are not medical advice. See the terms of use.
Changes
If we change how Misa handles data, we’ll update this page and the date at the top, and tell you in the app before a change that needs your consent.