Privacy Policy

Effective date: 9 September 2026

1. Who We Are

Comida ("we", "us", or "our") is a recipe and meal planning mobile application designed for university students in the United Kingdom. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our app on iOS or Android.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We collect the following categories of personal data:

• Account information: your name and email address, provided when you create an account, together with a unique user ID.
• Saved recipes and meal plans: recipes you save, meals you create, meal plans, shopping lists, and meal folders. Where you choose to add an image to a meal, this is a web address you supply; the app does not access your device's photo library or camera.
• Usage analytics: anonymised data about how you interact with the app, including screens visited, features used, and session duration.
• Device identifiers: advertising identifiers (IDFA on iOS, Advertising ID on Android) used to serve ads, subject to your consent.
• Crash and diagnostic data: anonymous crash reports and diagnostic information collected via Firebase Crashlytics to help us fix bugs and improve stability.

We do not collect sensitive personal data such as health information, racial or ethnic origin, political opinions, or biometric data.

3. How We Use Your Data

We use your personal data for the following purposes:

• To create and manage your account
• To save your recipes, meal plans, and shopping lists so they are available across sessions and devices
• To improve the app through anonymised usage analytics
• To diagnose crashes and improve app stability and performance
• To serve advertisements, including personalised ads where you have given consent
• To communicate with you about your account or respond to support requests
• To comply with legal obligations

4. Legal Basis for Processing

We process your data under the following legal bases:

• Contract: processing necessary to provide you with the app and its features (e.g. account creation, saving recipes)
• Consent: processing of advertising identifiers and serving personalised ads, which you can grant or withdraw at any time
• Legitimate interests: anonymised analytics and crash diagnostics to improve the app experience

5. Third-Party Services

We use the following third-party services that may process your data:

• Firebase Authentication (Google LLC): to securely manage user accounts and sign-in. Data processed: email address, authentication tokens
• Firebase Cloud Firestore (Google LLC): to store your saved recipes, meal plans, and account preferences. Data processed: account data, user-generated content
• Firebase Crashlytics (Google LLC): to collect anonymous crash and diagnostic reports. Data processed: crash traces, device model, operating system version, and an anonymous installation identifier
• Firebase Analytics (Google LLC): to understand how the app is used so we can improve it. Data processed: in-app events (such as viewing a recipe or adding a shopping list item), an app instance identifier, device model, operating system version, and your device advertising identifier. On iOS this is only enabled after you consent via App Tracking Transparency — if you decline, no analytics data is collected or transmitted
• Google AdMob (Google LLC): to display advertisements within the app. Data processed: device advertising identifier, approximate location, ad interaction data. Personalised ads are only served with your explicit consent via App Tracking Transparency (iOS) or equivalent
• Expo (Expo Inc.): development and update infrastructure. Data processed: device type, OS version, app version for update delivery

These third parties process data in accordance with their own privacy policies. We encourage you to review them. Data may be transferred to servers located outside the UK, including the United States. Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office.

6. Advertising and Device Identifiers

We use Google AdMob to serve advertisements to non-premium users. AdMob may use device identifiers (such as Apple's IDFA or Android's Advertising ID) and cookies or similar technologies to deliver ads and measure their effectiveness.

On iOS, we request your consent via Apple's App Tracking Transparency (ATT) framework before accessing your advertising identifier. If you decline, only non-personalised, contextual ads will be shown. Within the European Economic Area and the UK, we also present a consent request through Google's User Messaging Platform.

Our analytics also uses the advertising identifier, and is subject to the same consent. Analytics collection is switched off when the app starts and is only enabled after you have answered the tracking request. If you decline, no analytics events are collected or sent.

You can change your tracking preferences at any time:

• iOS: Settings > Privacy & Security > Tracking
• Android: Settings > Google > Ads

You can also remove all advertisements by upgrading to premium.

7. Data Sharing and Sale

We do not sell, rent, or trade your personal data to any third party.

We only share data with the third-party service providers listed in Section 5, solely for the purposes described in this policy, or where required by law or to protect our legal rights. We do not share your personal data for independent marketing by third parties.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the app's services.

• Account data (name, email): retained until you delete your account
• Saved recipes, meal plans, and shopping lists: retained until you delete them or your account
• Usage analytics: retained in anonymised form for up to 26 months
• Crash and diagnostic data: retained by Firebase Crashlytics in accordance with Google's retention policies
• Advertising data: managed by Google AdMob in accordance with their retention policies

When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it.

9. Your Rights Under UK GDPR

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• Right of access: you can request a copy of the personal data we hold about you
• Right to rectification: you can request that we correct inaccurate or incomplete data
• Right to erasure: you can request that we delete your personal data ("right to be forgotten")
• Right to restrict processing: you can request that we limit how we use your data
• Right to data portability: you can request your data in a structured, machine-readable format
• Right to object: you can object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

You can delete your account and all associated data directly in the app at any time, from Profile > Manage Account > Delete Account. This permanently removes your account and the data stored against it.

To exercise any of these rights, please contact us at comidasupport@gmail.com. We will respond to your request within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure authentication via Firebase
• Access controls limiting who can access user data
• Regular review of security practices

The app also caches your data locally on your device so that it remains available offline. This local copy is removed when you sign out or delete the app.

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

11. Children's Privacy

Comida is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at the email address below.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the app's features.

When we make material changes, we will notify you by posting the updated policy within the app and updating the effective date at the top of this page. We may also notify you via an in-app message for significant changes.

Your continued use of Comida after changes are posted constitutes your acceptance of the updated Privacy Policy.

13. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any disputes arising from or relating to this policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

comidasupport@gmail.com