1Who we are
The controller is Mykyta Bezkorovainyi, a sole proprietor (FOP) registered in Kyiv, Ukraine. Contact: support@jmenia.com. We reply within 2 business days.
2In short
- We collect only what the app needs to work. No ads, and we do not sell your data.
- We store allergies and body measurements only with your explicit consent. You can delete them at any time.
- Receipt photos are deleted after 30 days, meal photos after 90 days.
- Our server sends receipts and photos to an AI model provider; code checks the result.
- Data is stored in the European Union. Some services that data passes through are located in the US — see section 8.
- You can export your data and delete your account in the app.
3What we collect and why
Account and sign-in. Email address; your Apple or Google identifier if you sign in with them; sign-in method; country (taken from your phone's region at first sign-in, changeable in your profile). A name is not required for sign-in. For a shared list, you enter a name of up to 20 characters that other participants can see. If you use Sign in with Apple with a hidden address, we only see Apple's relay address. Email sign-in codes expire after 10 minutes.
Restrictions and goals. Allergies and intolerances, body measurements (sex, age, height, weight, activity) — only with consent, see section 4. Diet type, "Lent" (fasting) mode, foods you don't eat, favourite cuisines, kitchen equipment, cooking time, budget and priorities — to choose meals for you.
Pantry, plan and shopping. Food at home with quantities and expiry dates, the weekly plan, meals eaten, water, your recipe variants, the shopping list, weekly summaries.
Receipts. The receipt photo you take; recognised items, quantities, prices, discounts, the store (chain, legal entity, outlet) and date. The total from the fiscal receipt's QR code is used to check the recognised data. If you add a personal token for the Ukrainian tax authority's Electronic Cabinet in your profile, we use it to request the full receipt from the State Tax Service. You can remove the token at any time.
Other photos. A meal photo if you attach one to З'їдено (Eaten). A label photo of a new product, to add it to the product directory. Product and expiry-date photos — for recognition only.
Shared list (Jmenia Plus). If you invite people to your list or join someone else's: participants, items, quantities, notes, who added and who bought. Participants see only the shared list — not your pantry, plan, prices or budget. Items bought from the list go to the list owner's pantry.
Subscription. The App Store or Google Play tells us about your subscription: plan, term, status, purchase identifiers. We do not receive payment details (cards etc.) — the store processes payment.
Notifications. A device token for push notifications (for example, Ранковий план (Morning plan)). The cooking timer and other local reminders are scheduled on your phone.
Support. If you write to support@jmenia.com: your address, the message and attachments. The Написати нам (Write to us) button in the app adds a technical block: app version, platform and OS version, country, account identifier and codes of recent errors — no receipt contents, products or health data. You can delete the block before sending.
Error reports. When the app or server fails, Sentry receives a technical report: stack trace, device model, OS and app version. Reports contain no receipt contents, email, health data or tokens and are not linked to your account.
Usage statistics. To understand what works, our server records basic statistics: which types of actions you take and how often (for example, "receipt recognised, 2 lines corrected", "meal replaced"), app opens, date, plan, country, platform and version. No product or meal names, receipt items or amounts, or health data; a pseudonym instead of your email; IP addresses are not stored. There is no analytics SDK in the app. You can turn this off in Профіль → Дані й приватність → Статистика використання (Profile → Data & privacy → Usage statistics).
Допомогти покращити Jmenia (Help improve Jmenia) (off unless you turn it on). If you turn it on, we keep your receipts longer and use them together with detailed actions (which meals were eaten, replaced or skipped, how you corrected recognition) to improve recognition, the plan, and for research — without data that identifies you.
Event log. Our server keeps a log of actions in the app (recognition and corrections, pantry actions, plan building, AI calls) so that the app works correctly and we can compare algorithms. It holds minimal personal data and no photos.
Security. To protect accounts, the server limits sign-in attempts and temporarily processes the request's IP address. Request logs containing IP addresses are kept for 14 days.
4Health data
Allergies, intolerances and body measurements are health data. We store them only if you tick the consent box at the relevant step. Without it, these data are not stored. The required restrictions step can be completed without entering allergies; body measurements can be skipped.
- Why: so that meals with allergens you marked stay out of your plan, and to calculate calories and macros.
- Protection: this data never goes into statistics, error reports or server logs, and is not sent to AI models during recognition, meal generation or adaptation.
- Withdrawal: Профіль → Дані й приватність (Profile → Data & privacy). The data is deleted immediately. After that, your plan no longer takes your allergies into account — please be careful.
Jmenia is not a medical device: it does not diagnose, treat or replace a doctor's advice. We do not guarantee the absence of allergens: a product or meal whose status for an allergen you marked is unknown is kept out of the plan, but manufacturers' data and recognition can contain errors. Check the label.
5Legal bases
For people in the EU — the General Data Protection Regulation (GDPR); for people in Ukraine — the Law of Ukraine "On Personal Data Protection".
| Purpose | Basis |
|---|---|
| Account, pantry, plan, receipts, photos, shared list, subscription, notifications, support | Performance of our contract with you (GDPR Art. 6(1)(b); Law, Art. 11(1)(3)) |
| Allergies, intolerances, body measurements | Your explicit consent (GDPR Art. 9(2)(a); Law, Art. 7(2)(1)) |
| Допомогти покращити Jmenia (Help improve Jmenia), beta test | Your consent (GDPR Art. 6(1)(a); Law, Art. 11(1)(1)) |
| Basic statistics, error reports, abuse prevention | Our legitimate interest in making the app better and secure (GDPR Art. 6(1)(f); Law, Art. 11(1)(6)). You can object — see section 10 |
| Records of your consents and requests | Our legal obligation (GDPR Art. 6(1)(c), Art. 7(1)) |
Withdrawing consent does not affect processing carried out before the withdrawal.
6Artificial intelligence
AI models read photos of receipts and labels, match product names to the directory, and create and adapt recipes to what you have at home. Code checks every result: receipt arithmetic, meal ingredients and allergens, plan restrictions. You can correct any result.
The models run at an AI model provider under a data processing agreement. The provider receives photos and request text without your email or name and does not use them to train models.
Allergies, intolerances, excluded ingredients and body measurements are not sent to the model; code checks the meal ingredients.
Jmenia makes no automated decisions that have legal or similarly significant effects on you. The meal plan is a suggestion you can change.
7Who receives data
Processors — services that process data on our behalf under a data processing agreement:
| Service | Purpose | Location |
|---|---|---|
| Hetzner Cloud | Server and database | EU (Germany, Nuremberg) |
| Cloudflare (R2, Workers) | Storage of photos and encrypted backups, website | EU |
| Postmark | Sending sign-in code emails | US |
| Sentry | Error reports | EU (Germany) |
| PostHog | Basic usage statistics | EU (Germany) |
| Zoho Mail | The support@jmenia.com mailbox | EU |
| AI model provider | Reading receipts and photos, recipes | US |
| Apple (APNs), Google (Firebase Cloud Messaging) | Push notification delivery | US |
Independent controllers — receive data under their own terms:
- Apple and Google — when you sign in with them, buy a subscription or download the app;
- the State Tax Service of Ukraine — if you added an Electronic Cabinet token: we send the token and receipt details to get the full receipt;
- participants of your shared list — they see list items and who added them;
- public authorities — only when the law requires it.
8Where data is stored
The server, database, photos and backups are in the European Union. Only the owner of Jmenia has access to the data — from Ukraine, through a secured admin panel; every view of a specific person's data is logged with a reason.
Some processors are located in the US (see section 7). Transfers rely on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the Standard Contractual Clauses approved by the Commission. You can request a copy of the safeguards by writing to us.
9How long we keep data
| Data | Period |
|---|---|
| Account, restrictions, pantry, plan, history | Until you delete your account |
| Allergies, intolerances, body measurements | Until you withdraw consent or delete your account |
| Receipt photos | 30 days |
| Receipt photos with Допомогти покращити Jmenia (Help improve Jmenia) on | While it stays on, but no longer than 2 years from the receipt date |
| Meal photos | 90 days |
| Label photo of a new product | Until the product is reviewed, no longer than 90 days |
| Product and expiry-date photos | Not kept after recognition |
| Recognised receipt you have not reviewed | 7 days |
| Sign-in code | 10 minutes |
| Support requests | 12 months after the request is closed; deleted together with the account |
| Basic statistics | Until you turn it off or delete your account |
| Error reports | 30 days |
| Database backups | 30 days |
After account deletion, event log records remain without any link to you.
10Your rights
You have the right to:
- access the data we hold about you and get a copy — Профіль → Дані й приватність → Експортувати дані (Profile → Data & privacy → Export data) (JSON file);
- rectify data — in the app;
- erase your account and data — Профіль → Дані й приватність → Видалити обліковий запис (Profile → Data & privacy → Delete account), or by email from your account address: we will send a confirmation code to it and, once you reply with the code, delete the account within 30 days. Instructions: jmenia.com/delete-account;
- withdraw consent — for health data and Допомогти покращити Jmenia (Help improve Jmenia) — in Дані й приватність (Data & privacy);
- object to basic statistics — the Статистика використання (Usage statistics) switch; turning it off deletes the statistics already collected about you;
- restrict processing and data portability — write to us;
- lodge a complaint with a supervisory authority — see section 15.
Send requests to support@jmenia.com from your account email. If you use Sign in with Apple with a hidden address, delete your account in the app — we cannot identify you by email.
11Security
Encrypted connections (HTTPS), private photo storage with temporary links, removal of metadata and location from photos, encrypted backups, passwordless sign-in, limited sign-in attempts. Only the owner has access to the admin panel, using a device passkey; every sign-in and every view of a person's data is logged. If a breach puts your rights at risk, we will notify the supervisory authority and you within the time limits set by law.
12Age
Jmenia is for people aged 18 and over. We do not knowingly process children's data. If you learn that a child is using the app, write to us and we will delete the account.
13The jmenia.com website
The website is static: no cookies, analytics or forms. The hosting provider Cloudflare Workers may keep technical request logs (IP address, time, page) for security; we do not use them.
14Beta test
Beta participants sign up by emailing support@jmenia.com and receive an invitation to TestFlight (Apple) or a Google Play closed test. For Android, you give us your Google account email so we can add it to the testers list. De-identified test data is used for product improvement and research only with the participant's separate informed consent.
15Complaints
Please write to us first — we will try to resolve the issue. You can also lodge a complaint with the data protection authority of the country where you live, work or where the infringement took place, for example:
- Poland — President of the Personal Data Protection Office (uodo.gov.pl);
- Germany — the data protection authority of your federal state;
- Ukraine — the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).
16Changes
We will notify you in the app about material changes before they take effect. This is the first version of the policy.