1. Introduction

Meshi (the "Service") is operated by Renya Studios LLC ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. This policy reflects significant feature additions made through April 2026 — including AI-assisted recipe parsing, the public Hub for sharing recipes, encrypted health and body-measurement tracking, the Cook Stack meal planner, and gift-credit and donation flows.

2. Information We Collect

Information You Provide

• Account Information: Email address when you create an account
• Phone Number: If you choose phone-based authentication, we collect your phone number to send one-time SMS verification codes
• Recipe Data: Recipes you create, including titles, ingredients, and steps
• Health Data: Body measurements, weight, daily food logs, nutrition targets, and goals — all stored with at-rest encryption (AES-256 via vault-managed keys) so the data is unreadable to operators in raw form. Decryption only happens during your own session or when you request a data export
• Hub-Published Content: Recipes, packs, collections, and meal plans you choose to publish are visible to other Meshi users along with your display name, bio, and avatar. Cooking outcomes (PASS/NOTE/KEEP/STAPLE ratings) are stored with your user identification on the recipes you cook
• Cook Stack & Spreads: When you plan a multi-recipe spread or cook session, we store the schedule, runtime state (timer progress, completed steps), and notification preferences linked to your account
• Chat Conversations: Messages you exchange with our AI cooking assistant. Prompts and responses are logged with your user identification for ~30 days for safety, quality, and abuse-prevention review
• Payment Information: Processed securely by Stripe; we do not store your card details directly. Stripe retains a customer record (email, name, billing address) per their privacy policy. On account deletion we send a delete request to Stripe to remove this customer record
• Donation Records: If you contribute via the supporters page, your donor name and message (if you opt to make them public) are visible to other users. Refunded donations are hidden from the public list but retained for audit. Your Stripe customer ID and amount are kept regardless of public-display preference

Information Collected Automatically

• Usage Data: How you interact with the app (pages visited, features used)
• Device Information: Browser type, operating system, device type
• Error Logs: Technical errors to help us improve the service
• AI Cost Tracking: Token counts, model name, and per-call cost are stored per user for billing, abuse prevention, and the per-user 24h cost circuit breaker
• Security Event Logging: Failed login attempts, prompt-injection detection hits, rate-limit triggers, and admin actions are logged for auditing. Admin audit logs are retained indefinitely; rate-limit and prompt-injection events are aged out automatically

3. How We Use Your Information

• Provide and maintain the Meshi service
• Process your subscription payments
• Send transactional emails (receipts, account updates)
• Send one-time SMS verification codes for phone-based account authentication
• Improve our AI cooking assistant based on usage patterns
• Monitor and fix technical issues
• Protect against fraud and abuse

4. Third-Party Services

We use the following third-party services to operate Meshi:

• Supabase: Database, user authentication, and file storage
• Stripe: Payment processing for subscriptions and donations
• OpenAI / Google Gemini (via OpenRouter) and Anthropic: AI providers used for recipe parsing, scraping assistance, the cooking chat assistant, ingredient categorization, intent detection, and the Cook Stack planner. Recipe content, scraped URLs, and chat messages are sent to these providers for processing
• fal.ai: AI-generated recipe images
• Vercel: Hosting and privacy-focused analytics
• Sentry: Error monitoring with PII scrubbed before transmission
• Upstash Redis: Rate limiting (only IP / user identifier and counters)
• Resend: Transactional email delivery (receipts, password reset, payment action required, beta access requests)
• Twilio: SMS delivery for phone-based authentication verification codes

Each service has its own privacy policy. We only share the minimum data necessary for each service to function. AI provider requests carry recipe / chat content but are tagged with a Meshi-internal user identifier rather than your email — the providers do not see your personal account directly. For the full, current list of subprocessors and the data each receives, see our Subprocessors page.

4a. Your Rights Under GDPR / CCPA

Meshi treats every user's data with the same protections regardless of jurisdiction. You have the following rights:

• Access & portability: Download your full data set in JSON form via GET /api/export from your account settings. The export covers your recipes, meals, meal plans, pantry, shopping lists, cook projects + sessions, hub profile and published content, ratings and follows, support conversations, and decrypted health-data entries
• Erasure ("right to be forgotten"): Use the "Delete account" button in account settings. This deletes:
  • Your profile, recipes, meals, meal plans, pantry, shopping lists, cook projects, cook sessions, food log, weight log, body measurements, goals, and other per-user data via cascading database constraints
  • All your uploaded images from our storage buckets
  • Your Stripe customer record (sent to Stripe for deletion)
  • Your active subscription is canceled before account deletion
  The following are retained for legitimate purposes after deletion:
  • Admin audit log entries (security trail; user-id reference is set to NULL)
  • Anonymized AI cost log rows (user-id set to NULL — used for aggregate billing reports and abuse detection)
  • An email-hash record indicating you've consumed your free trial (this prevents trial abuse via account churn; the original email itself is not retained)
  • Public Hub content you previously published may remain visible (you can also un-publish before deleting)
• Correction: Edit your profile, hub profile, and recipe / health data directly in the app
• Objection / restriction: Email contact@meshi.recipes to object to processing or request restriction
• Right not to be subject to automated decision-making: Meshi does not use AI to make decisions that significantly affect you. AI features are advisory only — recipe suggestions, parsing, and chat

5. Data Storage and Security

Your data is stored securely on Supabase servers in the United States. We implement industry-standard security measures including encryption in transit (HTTPS) and at rest. However, no method of transmission over the Internet is 100% secure.

6. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your recipes in a portable format
• Opt-out: Unsubscribe from marketing emails (transactional emails required for service)

To exercise these rights, contact us at alex@meshi.recipes

7. Cookies and Local Storage

Meshi uses essential cookies and local storage to keep you logged in and remember your preferences. We use Vercel Analytics, which is privacy-focused and does not use cookies for tracking. We do not use third-party advertising cookies.

8. SMS Communications

If you choose to sign up or log in using your phone number, we will send you a one-time SMS verification code via Twilio. By providing your phone number and consenting to receive SMS messages during signup, you agree to receive these verification messages.

• We only send transactional SMS messages (verification codes) — never marketing messages
• Message and data rates may apply depending on your carrier
• You can opt out of SMS at any time by switching to email-based authentication in your account settings
• SMS consent is not a condition of purchase or use of the service — email and Google sign-in are always available as alternatives
• Typically one (1) message is sent per login or signup attempt

9. Children's Privacy

Meshi is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

10. International Users

Meshi is operated by Renya Studios LLC from the United States. If you are accessing the service from outside the US, please be aware that your information may be transferred to, stored, and processed in the US where our servers are located.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the service after changes constitutes acceptance of the new policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at: