Privacy Policy

Melna · Last updated: 16 August 2026

This Privacy Policy explains how Melna ("we", "us", "our") collects, uses, shares, and protects your personal data when you use our mobile application, the website at melna.app, and related services.

1. Who we are

Melna is a fitness and nutrition companion app. For privacy enquiries, contact us at [email protected].

2. Data we collect

Category	Examples	How collected
Account data	Email address, display name, user ID, authentication tokens	When you sign up or sign in (email/password, and Google or Apple when offered)
Health & fitness	Weight, height, age, gender at birth, goal (cut/bulk/maintain), workout logs, personal records, step count (via Health Connect, with permission), disabilities, pregnancy/period tracking preferences	Profile setup, in-app logging, Health Connect (optional)
Nutrition	Food logs, macro targets, meal plans, allergies, dietary restrictions, budget, barcode scans	In-app entry, AI coach, barcode scanner (Open Food Facts)
Photos & camera	Meal photos for calorie estimation (Groq vision); barcode frames for product lookup (not saved); profile photo (stored on device)	Camera or gallery, only when you choose
Location	Approximate or precise GPS coordinates	Only when you request nearby supermarkets, restaurants, or delivery options (with permission)
Usage & device	App interactions, crash reports, analytics events, device type, OS version	Automatically during app use
Subscription	Purchase status, entitlement (Pro/free), transaction identifiers	Google Play Billing via RevenueCat
Community	Feed posts, captions, likes	When you post in the community feed
AI coach	Chat messages and profile context sent for coaching responses	When you use the AI coach (Mara)
Website	Waitlist email; contact name, email, and message	When you submit a form on melna.app

3. How we use your data

Provide and personalise workouts, meal plans, macro targets, and progress tracking
Power the AI coach with context about your goals, logs, and restrictions
Estimate food from photos and look up barcodes to help you log nutrition (you confirm before a log is saved)
Send product updates if you join the website waitlist; reply to support messages
Find nearby stores and restaurants when you request location-based features
Manage Melna Pro subscriptions and restore purchases
Improve reliability, fix bugs, and understand feature usage
Send optional push notifications (e.g. reminders), if enabled

4. Legal basis for processing (GDPR)

If you are in the UK or EEA, we process personal data on the following bases:

Contract: to provide the app and your account (profile, plans, logs)
Legitimate interests: analytics, fraud prevention, service improvement (balanced against your rights)
Consent: location, camera/photos, Health Connect, push notifications, and the website waitlist — you may withdraw in device or app settings, or by emailing us
Legal obligation: where required to comply with applicable law

5. Third-party services

We use trusted processors. They access data only to perform services on our behalf:

Supabase - authentication and cloud data for many accounts
Google Firebase - authentication, Cloud Firestore, crash reporting, and push messaging when that path is used
Groq - Mara coach replies and meal-photo estimates
DeepSeek - optional coach fallback when configured
Open Food Facts - barcode and food-name lookup
Google Places - nearby supermarket and restaurant search (when you ask)
YouTube - only if the app shows a video link and you open it
RevenueCat and Google Play - Pro subscriptions and restore, when purchases are enabled
Cloudflare - website hosting and email routing for @melna.app
FormSubmit - delivers website waitlist and contact forms to [email protected]

We do not sell your personal information. The marketing site at melna.app does not use advertising or analytics cookies.

6. Data storage & security

Account and progress data are stored in Supabase and/or Firebase Cloud Firestore, depending on how you signed in
Profile photos may be stored locally on your device
Data is encrypted in transit using HTTPS/TLS
We apply access controls and industry-standard safeguards; no method is 100% secure

7. Data retention

Account and fitness data: retained while your account is active
After account deletion: we delete or anonymise associated data within a reasonable period, except where law requires retention
Crash logs: retained per Firebase Crashlytics settings when that service is active
Website form messages: kept in the support inbox as long as needed to reply

8. Your rights

UK / EEA (GDPR)

You have the right to:

Access - request a copy of your personal data
Rectification - correct inaccurate data in the app or by contacting us
Erasure - delete your account in Profile → Delete account
Restriction - ask us to limit processing in certain cases
Data portability - export weight or cycle CSV from Profile (free), export a progress PDF (Pro), or email [email protected] for a broader copy
Object - object to processing based on legitimate interests
Withdraw consent - for location, camera, health, or notifications via device settings
Complain - to the ICO (UK) or your local supervisory authority

California (CCPA/CPRA)

California residents have the right to:

Know what personal information we collect and how it is used (see sections above)
Delete personal information - use in-app account deletion or email us
Correct inaccurate personal information
Opt out of sale/share - we do not sell or share personal information for cross-context behavioural advertising
Non-discrimination - we will not discriminate against you for exercising these rights

To exercise CCPA rights, email [email protected] with subject line "California Privacy Request". We will verify your request within the timeframes required by law.

9. International transfers

Some processors (including Supabase, Firebase, Groq, RevenueCat, FormSubmit, and Cloudflare) may process data outside the UK/EEA. Where data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms provided by our vendors.

10. Children's privacy

Melna is not intended for anyone under 16. We do not knowingly collect data from children. Contact us if you believe a child has provided data and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date above. Continued use after changes constitutes acceptance.

12. Contact

Email: [email protected]