Privacy Policy

Privacy Policy version 2026-09-08 · effective September 8, 2026

This policy explains how Minka handles personal data in the iPhone app, the Minka website, and the signed-in dashboard. Minka is local-first: the app can be used for manual and barcode logging without an account, while account, sync, and managed AI features involve additional processing described below.

1. Data controller

The controller is Kristaps Dreija, operating the Minka app and website.

For privacy questions or requests, contact privacy@getminka.com.

2. Information we handle

Information you provide

• Profile and account details, including the name or email information made available through Sign in with Apple.
• Age, height, weight, goals, calorie targets, dietary preferences, allergies, cooking preferences, and taste preferences.
• Food logs, nutrition values, saved foods, recipes, water, fasting, weight history, chat messages, and meal photos you choose to save or back up.
• Support messages and information needed to answer them.

Information from device features

• Apple HealthKit: when enabled, Minka reads active energy and selected body measurements such as weight and body fat. If you choose to sync back to Apple Health, Minka can write nutrition values and selected body measurements.
• Camera, photos, microphone, and speech: only when you use the related logging or chat feature.
• Barcode scanning: uses Google ML Kit on-device. Barcode images and decoded results are not sent to Google by ML Kit. The SDK independently sends the technical metrics described below.

Technical and service information

The service may process account identifiers, installation identifiers, request status, latency, token counts, charged AI units, request IDs, app version, and security information needed to operate the service, provide support, enforce limits, and prevent abuse. Minka does not use a third-party advertising SDK or a dedicated product-analytics service. Google ML Kit's barcode-scanning SDK may independently send device information, app and version information, per-installation identifiers not intended to uniquely identify a user or physical device, performance metrics, API configuration, event types, and error codes to Google for diagnostics and usage analytics. These ML Kit metrics are not used by Minka for advertising or cross-app tracking.

3. Why we use data and the legal basis

• Provide the app, account, and Pro features: processing necessary to provide the service you request, generally Article 6(1)(b) GDPR.
• Web cloud health data and optional AI: the web account service is provided under Article 6(1)(b) GDPR. Because the dashboard necessarily stores health-related profile, plan, measurement, meal and preference data in the cloud, Minka separately asks for explicit consent under Article 9(2)(a). AI processing of health-related context is optional and has its own explicit consent.
• Security, reliability, support, and prevention of misuse: legitimate interests under Article 6(1)(f) GDPR where appropriate, balanced against your rights, including operating reliable services, handling support, preventing misuse, and supporting SDK diagnostics, and legal obligations under Article 6(1)(c) where required.
• Subscriptions and entitlement checks: providing the subscription service and maintaining purchase records needed for access, refunds, and legal accounting requirements. Apple handles payment details for App Store purchases, and Paddle handles payment details for web purchases.

You may withdraw cloud consent in web account settings. Web access and device sync stop immediately, and Minka erases the cloud profile, onboarding answers, synced records, meal photos and AI-derived health context. This does not cancel Pro or delete local iPhone data. AI and HealthKit permissions remain separate controls.

4. Local storage and cloud sync

The iPhone app can be used locally without an account for supported manual and barcode features. The web dashboard cannot operate locally: after explicit consent it stores your profile, health-related plan, goals, measurements, meals, nutrition, fasting, food preferences, recipes, chat history and any meal photos you upload in your Minka account on Supabase. Signing in alone does not authorize these uploads.

Browser storage

Minka uses only storage necessary to sign you in, protect requests, remember language, complete checkout and, when you explicitly choose Save for later, keep an onboarding draft for seven days. The draft may contain health-related answers and is removed on completion, sign-out, account switch or expiry. Minka does not use advertising cookies or cross-site tracking.

5. Apple Health and health-related data

HealthKit access is optional and controlled by Apple. Minka uses the selected data to adjust nutrition calculations, show activity and body measurements, and optionally write nutrition or body measurements back to Health. Minka does not sell HealthKit data or use it for advertising.

Health-related values can remain on the device or become part of synced records if you explicitly sync them. Minka does not include raw HealthKit samples in the normal phone AI request, but an opted-in AI request may include derived values such as an activity-based calorie budget.

6. AI processing

AI is optional. If you choose food analysis, AI Coach, recipe generation, or another AI feature, Minka may process the meal photo, meal and nutrition context, goals, dietary preferences, allergies, taste preferences, calorie budget, and the text or voice transcript needed for that request.

Normal phone requests do not send your account name or raw HealthKit samples to the AI provider. Watch or Siri AI interactions, when enabled, may include the context needed for that feature, such as goal, weight, activity-derived budget, recent meals, and dietary preferences. See the full AI processing disclosure.

Minka does not use solely automated decision-making, including profiling, that produces legal effects or similarly significant effects on you within the meaning of Article 22 GDPR.

7. Providers and sharing

We do not sell personal data and do not share it for advertising. Minka does not use a third-party advertising SDK or a dedicated product-analytics service. Some providers and SDKs still receive operational or diagnostic data as described below. Depending on the feature you use, Minka may use:

• Supabase for authentication, explicitly synced records, and optional meal-photo backup.
• Hostinger infrastructure for the Minka web, API, and server-side AI infrastructure.
• LiteLLM and Google Gemini API (`gemini-3.5-flash-lite` route) for managed server-side AI routing. The route is configured on Minka's server, not in the iPhone app; Google Gemini API is the current upstream provider. See the AI processing disclosure.
• Apple for Sign in with Apple, App Store subscriptions, and the HealthKit platform. Paddle handles web subscription billing as the merchant of record.
• Open Food Facts for product-search and barcode-lookup requests. Minka's API receives typed queries, barcode values, and a pseudonymous installation identifier for abuse control; no Minka account is required and the Open Food Facts integration does not receive your Minka account identifier.
• RevenueCat for subscription offerings, purchases, entitlement status, transaction metadata, and subscription management. RevenueCat receives either an account-linked app user ID or a pseudonymous anonymous app user ID, plus relevant purchase or entitlement information. Apple and Paddle handle payment details for their respective purchases.
• Google ML Kit for on-device barcode scanning and the SDK diagnostics and usage metrics described above. Barcode images and decoded results are not sent to Google by ML Kit.

These services may process information outside the European Economic Area (for example, in the United States). We rely on the providers' applicable data-protection terms and, where required, on appropriate safeguards for data transfers (for example, EU standard contractual clauses or adequacy decisions). The AI processing disclosure explains how managed routing works.

8. Retention

• Local records remain on your device until you remove them or reset the app.
• Active cloud data remains for the life of the account unless you delete a record or withdraw cloud consent. Withdrawal erases cloud content from primary systems; metadata-only deletion markers are retained for no more than 30 days.
• Minka's AI API and self-hosted LiteLLM routing service do not retain request or response content after processing. Operational spend metadata such as route, status, latency, token counts, and charged units is retained for up to 30 days.
• AI providers may temporarily process or retain content under the endpoint and provider terms in effect when a request is made. Where a requested model supports it, Minka uses routes with no training and zero-data-retention controls.
• Ordinary access logs are kept for up to 14 days. AI and user-linked operational metadata are kept for up to 30 days. Resolved support reports are kept for up to 90 days unless a longer legal hold is required. Encrypted backups are targeted to expire within 30 days, and deletions are reapplied after a restore.
• Consent records, including the policy version and when you granted or withdrew consent, are kept as needed to demonstrate your choices and meet legal obligations.

9. Your rights

Depending on your location, you may have the right to access, correct, export, restrict, object to, or delete your personal data, to withdraw consent, and to complain to your local data-protection supervisory authority. Contact privacy@getminka.com. You can also use the account-deletion control in the signed-in web dashboard or iPhone app.

10. Children

Minka is intended only for people aged 18 or older. We do not knowingly collect children's personal data.

11. Changes

We may update this policy when the service or data practices change. We will update the date above and provide an in-app notice for material changes.