Privacy Policy

Last updated October 13, 2026

Mynu ("we," "our," or "us") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your choices when you use the Mynu mobile app.

1. Scope

This Privacy Policy applies to the Mynu iOS and Android apps and related services. Features that use Apple services, including account sign-in, iCloud sync, and menu sharing, are available only in the iOS app. The Android app does not offer accounts, cloud sync, or menu sharing; its menu content is stored locally on the device.

2. Information We Collect

We collect the following categories of information:

Account and sign-in information

• On iOS, if you sign in with Apple, the app receives the identifiers Apple provides — a stable Apple user identifier, and, on the first authorization only, a display name and email address. These are stored on your device and, for signed-in users, in your own iCloud account. They are not sent to us.
• Authentication is performed natively by Sign in with Apple. Apple handles the credential exchange; the app never sees or stores a password. Earlier versions of this app used Firebase Authentication; it is no longer used.
• The Android app does not offer account creation or sign-in.

App content you create

• Menu data, dishes, activity entries, labels, schedule-related details, and other content you enter in the app.
• Profile data such as display name and avatar URL.

Photos and media

• On iOS, if you are signed in: dish images and avatar images are uploaded to your Apple iCloud account as CloudKit assets in your private CloudKit database. We do not host or process these images on our own servers.
• On Android, and for iOS guests who are not signed in, dish and avatar images are stored locally on your device only.
• The app may temporarily process local image files on-device (for example cropping/editing and asset preparation) for both guest and signed-in flows.
• If you sign in after using guest mode, your guest dish/activity data — including the underlying image files — is migrated into your iCloud account on a one-way, additive basis. After successful migration, the guest workspace is marked as claimed and is not surfaced again on this device.

Device and usage data

• Product analytics events. We use Firebase Analytics (a Google service) to understand how the app is used in aggregate — for example app opens, sign-ins, whether a user continues as a guest or signs in, menus and dishes created, menu sharing, and completed purchases. These events are associated with a randomly generated app-instance identifier and your pseudonymous Firebase user ID. They do not include your name, email, dish photos, or menu contents. Firebase Analytics also automatically collects standard mobile measurement data such as app version, device model, operating system version, and approximate region derived from IP address (the IP address itself is not retained for analytics).
• Product analytics events — second processor. A per-event subset of the same product events described above is also sent to PostHog (PostHog Inc., United States), a product-analytics service, so we can analyse feature funnels and retention. Events are associated with a random device identifier generated by PostHog and, only if you are signed in, with your pseudonymous Mynu user ID; guest use is not linked to any account identifier. These events carry the same bucketed, identifier-free parameters as the Firebase events and never include your name, email, dish photos, menu contents, or menu/dish identifiers. PostHog automatically attaches the app version, screen size, and device type. We disable PostHog's automatic screen and tap capture, session recording, IP-based location lookup, feature-flag fetching, and push-token collection.
• Crash and stability diagnostics. We use Firebase Crashlytics (a Google service) to collect crash reports and non-fatal error reports — including stack traces, device model, OS version, and app state at the time of the issue — so we can diagnose and fix problems.
• Additional detailed diagnostic/logging events (for example data backend initialization, subscription health, and migration progress) are kept in a rolling log on your device. This log is never uploaded automatically. It leaves your device only if you deliberately send it — see “Diagnostic logs you choose to send” below.
• On iOS, push notification registration if you enable shared-menu notifications. The app uses iOS background delivery so notifications can be received and processed when the app is not in the foreground. See “Push notification tokens” below, including a historical practice that has been removed. Android meal reminders are scheduled locally on your device and do not require a Mynu server account or a remote push token.

Push notification tokens (including a historical practice)

• Current versions. When you enable notifications, the app registers with Apple Push Notification service so that Apple can deliver notifications about changes in menus you share. No push identifier is sent to any third-party push service.
• Versions before 1.1.0. Earlier versions obtained a push token from Expo’s push notification service, which required transmitting a device push identifier to Expo’s servers. That token was then stored in your own iCloud private database. It was never used to send you anything. This practice has been removed — current versions do not contact Expo and do not create such a token.
• Tokens stored by those earlier versions remain in your iCloud private database. They are deleted when you delete your account through the in-app “Delete account” flow. There is currently no separate cleanup for users who do not delete their account.

Diagnostic logs you choose to send

• The app keeps a rolling diagnostic log on your device to help investigate problems. It is never uploaded automatically. It leaves your device only when you deliberately send it — by long-pressing “Send feedback” in the profile screen, which opens your mail app or system share sheet with the log attached, addressed to support@getmynu.app.
• Before each line is written, it is redacted. The redaction removes, by pattern: email addresses; http(s):// and file:// URLs; application container file paths; UUIDs; the values of known identifier fields (user ids, owner ids, member ids, CloudKit user record names); member id lists; and long hexadecimal or opaque identifier strings.
• What redaction does not remove. The redaction works on patterns, and a name is not a pattern. One category of your content therefore survives into the report: the names of your menus (for example “Weeknights”). Dish names are reduced to a character count, and dish notes, labels, photos and image files never appear at all.
• Redaction is otherwise thorough but is not a guarantee. The report is plain text; you can read it in the mail draft before you send it, and you can choose not to send it.

Clipboard

• The app does not read your clipboard. There is no clipboard API in the app. On iOS, the “paste invite link” screen is an ordinary text field: pasting happens through the system paste control, under your direct action, and the app only ever sees what you place in that field. Android does not offer the invite-link feature.

Cloud and local storage data

• On iOS, signed-in app data is stored using SwiftData and replicated to your Apple iCloud account via CloudKit. Reads and writes go through your private CloudKit database; we do not have access to it.
• Android app content and iOS guest app content are stored locally on your device using on-device storage. Menu content and photos are not transmitted to our servers.
• Backup files are created only when you choose to export them. They leave the app only through a destination you select in the system share sheet. Imported backup files are processed on-device.
• Some content may be cached on your device for performance and offline use.

3. How We Use Information

We use your information to:

Provide and operate the app

• Create and manage menus, dishes, activity history, labels, and collaboration features.

Authenticate users

• On iOS, support native Sign in with Apple and keep your data associated with your account across your devices.

Enable syncing and sharing

• On iOS, sync your menu and activity across devices signed into the same Apple ID, and enable family/household collaboration via CloudKit sharing (CKShare). These features are not available on Android.

Enable optional notifications

• Deliver push notifications and respect your notification preferences.

Maintain reliability and safety

• Diagnose app errors and improve stability.

Understand usage and improve the app

• Measure aggregate engagement, growth, and retention through Firebase Analytics and PostHog, and monitor crashes through Firebase Crashlytics, to guide product improvements. We do not use this data for advertising or to build cross-app behavioral profiles.

4. Legal Bases (Where Applicable)

Depending on your location, we process data based on one or more of the following:

• Performance of a contract (providing app features you request).
• Legitimate interests (security, reliability, and service improvement).
• Consent (where required, such as notifications or specific platform permissions).
• Legal obligations.

5. Sharing of Information

We do not sell your personal information.

We rely on the following third-party services solely to operate the app:

Apple CloudKit / iCloud

• Stores and syncs your menu, dishes, activity entries, image assets, and push token data in your private iCloud database. Powers cross-device sync and CloudKit sharing for invited collaborators.

Firebase Analytics & Firebase Crashlytics (Google LLC)

• Process aggregate app-usage events and crash/diagnostic reports to help us measure engagement, growth, and retention and to fix bugs. Data is associated with a pseudonymous identifier, not your name or email. Google processes this data as described in its own privacy policy. We do not enable Google advertising features or share this data with advertising networks.

PostHog (PostHog Inc.)

• Processes a per-event subset of the same aggregate app-usage events to help us analyse feature funnels and retention. Data is associated with a random device identifier and, for signed-in users, a pseudonymous user ID — not your name or email. PostHog processes this data as described in its own privacy policy. We do not use PostHog's session recording, autocapture, or advertising-related features.

Apple Push Notification service

• Delivers push notifications (if enabled), including background delivery. Notifications are delivered by Apple through CloudKit; no third-party push service is involved.

Apple StoreKit / App Store

• Processes in-app purchases of Mynu Plus subscriptions and the lifetime SKU. We receive a Mynu-tier flag (free vs paid) and the purchase product identifier; we do not receive payment card or billing-address details. Subscription entitlement state is mirrored from StoreKit into your iCloud private database so it persists across your devices. Apple's privacy policy governs how Apple handles your purchase data.

Google Play

• Distributes the Android app and handles installation and updates. The Android app is currently free and does not offer Google Play purchases.

We may also disclose information if required by law, legal process, or to protect rights/safety.

6. Data Retention

We retain information for as long as needed to provide the app and legitimate business purposes, unless a longer retention period is required by law.

• Cloud-backed data is stored in your iCloud account and persists until you delete it from within the app, until you delete your Mynu account, or until you remove the data through Apple's iCloud controls.
• Android app content and other locally stored data remain on the device until removed through app actions, Android’s app-storage controls, or app uninstall. Backup files remain wherever you chose to save or share them until you delete them there.
• Local cached data may remain on device until removed by app actions, operating-system storage controls, or device uninstall.
• Account deletion (via the in-app “Delete account” flow) removes your menus, dishes, activity, and any stored push token records from your iCloud private database, then signs you out.
• Analytics and crash-report data is held by Google and retained according to the retention settings configured for our Firebase project. Product-analytics data sent to PostHog is held by PostHog Inc. and retained according to the settings configured for our PostHog project. Those settings can be changed, so this policy does not state a fixed period.

7. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, or export your information.

You can also:

• Update profile information in-app.
• On iOS, delete your account and associated CloudKit data via the in-app "Delete account" flow.
• On Android, remove locally stored app content through available in-app deletion actions, Android’s app-storage controls, or by uninstalling the app. The Android app does not create a Mynu account.
• Reset all test data on this device via the "Reset test data" action in profile.
• Disable notifications in app settings or your device’s system settings.
• Note: there is currently no in-app control to disable analytics or crash reporting. Uninstalling the app stops all collection.
• Revoke app permissions (camera, photos, notifications) in iOS Settings or Android Settings at any time.

For privacy requests, contact us using the details below.

8. Do Not Track and Advertising

Mynu uses Firebase Analytics, PostHog, and Firebase Crashlytics to measure how the app itself is used and to fix bugs, as described above. We do not use advertising networks, we do not enable Google advertising/"Google signals" features, and we do not use the device advertising identifier (IDFA on iOS or Advertising ID on Android) or sell your personal information. We do not track you across other companies' websites or apps to build advertising profiles. Because the app does not perform that kind of cross-app advertising tracking, it does not respond to browser-based "Do Not Track" (DNT) signals — there is no such activity to suppress. We treat all users consistently with the practices described in this policy.

9. Children's Privacy

Mynu is not intended for children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children.

10. International Data Transfers

Your information may be processed in countries other than your own, depending on Apple, Firebase, and PostHog infrastructure providers. We take reasonable steps to protect data during transfer and processing.

11. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. App data stored in CloudKit benefits from Apple's iCloud security model. No method of transmission or storage is completely secure.

12. Third-Party Services

The app relies on third-party services with their own privacy terms, including:

• Apple CloudKit / iCloud
• Firebase Analytics & Firebase Crashlytics (Google LLC)
• PostHog (PostHog Inc.)
• Apple Push Notification service
• Apple StoreKit / App Store (in-app purchases)
• Google Play (Android app distribution and updates)

Please review those providers' policies for additional details.

13. Camera and Photo Library Access

Mynu requests camera and photo library access only when needed for image-related features, such as:

• Taking a new dish or avatar photo with your camera.
• Selecting an existing photo from your photo library.
• Editing/cropping selected images before saving.

If you deny camera or photo access, these image features may not work, but the rest of the app can still be used. You can change permission settings at any time in iOS Settings or Android Settings.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date when changes are made.

15. Contact Us

If you have questions or requests about this Privacy Policy, contact:

• Email: support@getmynu.app