Legal
Last updated: 2026-10-26
Maistiqo is operated by MB Lengvin, a company registered in Lithuania (company code 307826590, registered address: Minties g. 15-36, LT-08231 Vilnius, Lithuania), which is the data controller. We provide a nutrition-tracking and recipe-generation service: a web application available at maistiqo.com and the Maistiqo apps for iOS and Android. Contact: info@maistiqo.lt.
When you register, we store your email address, name, and a hashed password. If you sign in with Apple or Google, we receive and store that account's identifier, its email address (with Apple this may be a relay address created by Apple) and your name if the provider shares it. As you use the app, we store the data you create: meals logged, recipes you save or publish, ingredients added, pantry items, weekly meal plans, shopping list, water and drink logs, weight and body-measurement logs, goals, photos you upload (profile photo, recipe covers, community post photos), the profile details you add (username, "About me" text, country or location), the people you follow and the recipes you like or rate, and any preferences you configure (target calories, dietary tags and diet style, allergies and disliked foods, units, language). If you use the AI Coach (Pro), we store the suggestions it generates and your feedback on them (for example, which suggestions you didn't like). If you start cancelling your subscription in the app, we store your answers: the reason you pick, an optional comment (up to 500 characters) and, if you name a missing feature, its description (up to 120 characters), which offers were shown and whether you accepted one, plus your plan, whether it is a trial, the period end date, platform and app version. Giving a reason or comment is optional. If you allow notifications, we store your device's push token and platform, and a record of which notifications were sent to you and when. If you contact us from the app, we store your message, its type, the app version and platform, and our notes on it. We also keep technical metadata: account creation date, last login time, IP address at sign-in and at other actions recorded in an audit log (for example password and email changes, and some in-app actions such as creating or rating a recipe), crash reports (app version, screen, error details; on the web also the page address and browser user-agent), AI usage records (feature, model, cost and time, without your photos, text or voice), usage statistics (which features you use, searches with no results, scanned barcodes) and how you found us at sign-up (for example, an ad campaign or invite link). If you subscribe to our newsletter on maistiqo.com, we store your email address, language, where you subscribed and the date, only to send you Maistiqo news. You can unsubscribe at any time via the link in any newsletter email or by writing to hello@maistiqo.lt; we keep your address until you do. When you first open the app (before registering), we create a random, anonymous device token (containing no personal data) so we can see which onboarding step people leave at and improve that flow. If you try AI meal recognition during sign-up, the app also sends a device identifier (the identifier for vendor on iOS, the Android ID on Android); we use it only to limit the number of tries, keep it only in server memory and never write it to the database. Advertising identifiers. The iOS app never asks for permission to track you (App Tracking Transparency), so Apple's advertising identifier (IDFA) is not collected. On Android devices, the Meta SDK and RevenueCat may receive Google's advertising ID (see sections 9 and 10). We do NOT collect your contacts or your location (the app never asks for location access), we don't read your photo library (we only receive photos you pick or take), and we don't collect data from other apps on your device, except Apple Health (iPhone) and Health Connect (Android) if you turn on sync (see section 3).
Apple Health (HealthKit). If you turn on Apple Health sync in the iPhone app, the app, with your permission, reads your weight, water intake and active energy burned, and writes your weight, your water and your meals (calories, protein, carbohydrates, fat, fibre and sugar) into the Health app. You manage these permissions in the Health app. Health Connect (Android). If you turn on Health Connect sync in the Android app, the app, with your permission, reads your weight, water intake and active calories burned. If you allow it, the app also reads total calories burned and your basal metabolic rate. These are needed when your watch or fitness app records only total calories burned, and are used only to work out your active calories. The app writes your weight, your water and the name, meal type (for example breakfast) and nutrition of each meal you log (calories, protein, carbohydrates, fat, fibre and sugar) into Health Connect. You choose which data Maistiqo may read or write and can change this at any time in Health Connect settings. How we use health data. We use data from Apple Health and Health Connect only for features you see in the app: showing how many calories you burned today (your daily calorie target does not change because of it), adding weigh-ins to your weight history and water to your daily water goal. If you use the AI Coach and have given consent to the AI features in the app, the Coach also takes your weight trend (and, if you have a weight goal, how far along it you are) and water intake into account in its daily suggestions; that data is then sent to Anthropic without your name, email address or account identifier. On our server in the European Union we keep, with your other account data, only what these features need: your daily calories-burned total, weigh-ins and water amounts, not your full health records. Data between the app and our server is sent only over encrypted connections (HTTPS). We never sell health data, never use it for advertising, marketing, or credit or insurance decisions, and never pass it to advertising or analytics providers or to data brokers. We share it with others only with your explicit consent or where the law requires it. The exception is the service providers that run these features for us: the servers that store the data and notification delivery (for example, a water reminder says how much of your goal you have drunk; see section 10). They receive only as much as the feature needs. Our staff do not look at this data except at your request (for example when you contact support), for security reasons or where the law requires it. Our use and transfer of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Control and deletion. You can turn sync off at any time in your profile in the app and revoke permissions in the Health app (iPhone) or in Health Connect settings (Android). Once sync is off, nothing new is read or written. Weigh-ins and water already received stay in your Maistiqo account until you delete them in the app or delete your account, and daily calories-burned totals stay until you delete your account or ask us to delete them by writing to hello@maistiqo.lt. When you delete your account, this data is removed with your other account data (see section 7). What Maistiqo wrote to Apple Health or Health Connect stays there until you delete it in those apps. While sync is on, when you edit or delete a meal from the last 7 days in the app, the app also updates or removes its record there. Meal photos and descriptions. When you use AI meal recognition from a photo or text (including the first AI try-out during sign-up, before your account exists), the photo or meal description (up to 600 characters) and any clarification you add are sent to Anthropic's API for food identification. We do not send your name, email address or account identifier with it. We do not store the photo or the description text; we keep only the recognition result (food names and estimated amounts) for 180 days and, if you log the meal, the meal entry itself. When you scan a receipt into your pantry, the whole receipt photo is sent to Anthropic's API; it may show the store, date, loyalty-card or payment details. The AI is instructed to read only the store name and the food items and to skip payment, loyalty-card and total lines. We do not store the receipt photo. When you create a meal share card, the photo is processed in our server's memory and not stored. If an AI reply cannot be read, a short excerpt of it (up to a few hundred characters, which may repeat what the photo or text showed) can remain in our server log for troubleshooting. Under Anthropic's commercial terms, data received via the API is not used to train models. Voice input. In the "Describe your meal" box you can dictate your meal. Recording runs only while you hold the microphone button and lasts at most 30 seconds; the app uses the microphone only for this and only with your permission. The audio clip is sent to our server and from there to OpenAI's API (US) to be turned into text. If the first OpenAI model returns an error or no text, the same clip is sent once more to a second OpenAI model. We do not send your name, email address or account identifier with the clip. We do not store the audio: on our server it is processed in memory only and never written to the database, logs or backups, and the temporary audio file on your device is deleted once the upload finishes. The resulting text is returned to the app and placed in the description box, where you can review and edit it; we do not store it separately. When you tap "Identify", that text is sent to Anthropic's API just like a typed description (see the previous paragraph). For each clip our database keeps only a technical record without content (account, time, model used, cost), and our server log keeps only your account number, the clip length, size and the length of the recognised text. OpenAI states that API data is not used to train its models by default and may be retained for up to 30 days for abuse monitoring. Voice input is optional: you can always type your meal instead.
Public profile. Your profile is public by default: anyone, including people without a Maistiqo account, can see your public name (first name plus last-name initial), username, profile photo, "About me" text, country or location, the date you signed up, a Pro badge if you subscribe, your follower and following counts, your published recipes with their ratings and likes, your achievements and the total calories you have tracked. Your weight change is shown only if you turn it on. If you make your profile private, only your followers see the full profile; your public name, username and photo stay visible to everyone. Leaderboards. Public profiles appear on the leaderboards (weekly, monthly and all-time) with the public name, photo and result, for example a logging streak, the number of meals logged, likes on your recipes or your average meal-quality score, unless you turn this off. Top-three weekly results are also shown in the leaderboard history. Published recipes. Recipes you publish are visible to everyone, including on maistiqo.com/recipes, and are shown with your public name in the app and on recipe share cards. Your choices. In the app you can turn off the leaderboard under Profile → "Show me on the leaderboard"; on the website, under Profile → Account → Privacy, you can make your profile private and hide your achievements, calorie total or weight change. Maistiqo includes a community section ("Bendruomenė") where you can share tips, recipe ideas, and progress stories, and comment on other users' posts. Public visibility. Approved community posts and comments are visible to all Maistiqo users. They are shown with your public display name (first name plus last-name initial) — never your email address. Do not include personal data you don't want public: detailed health information, contact details, or other people's names or photos without their consent. Moderation. Every post is reviewed by moderators before it is published; we also run automated safety checks (for example, for dangerous dieting practices). Moderation decisions and related notices are stored with the post. Deletion. You can delete your posts and comments at any time — they disappear from the community immediately. Community data is included in your data export and is deleted together with your account.
Under GDPR Article 6: • Performance of contract (Art. 6(1)(b)) — we need your account data + the content you create to actually deliver the service you signed up for, including subscription billing, Sign in with Apple or Google, and the reminders and notifications you allow. • Legitimate interest (Art. 6(1)(f)) — for security audit logs, crash reports, abuse prevention, service usage statistics, cancellation survey answers, notices about your subscription and service news, and measuring how well our ads work (the Meta SDK and the Google Ads tag, see section 9). We balance this against your rights; you can object via email. • Consent (Art. 6(1)(a)) — for the AI features: meal recognition from a photo, text or voice, receipt scanning, nutrition-label reading, AI ingredient estimates, the AI Coach and AI meal-plan fill. By using them, you consent to sending the photo, text or voice clip you provide, plus the context the feature needs (for example your daily nutrition totals, goals, diet style, allergies, pantry, recent and planned meals, weight trend), for processing: voice clips to OpenAI's API for transcription, everything else to Anthropic's API. The app uses the microphone, camera, photos, Apple Health and Health Connect data only with your permission, which you can withdraw at any time in your device settings. We process synced health data on the basis of your explicit consent (GDPR Article 9(2)(a)), which you give by turning on sync and granting the permissions. We also rely on your consent for the newsletter on maistiqo.com; you can withdraw it at any time by unsubscribing.
All your data, uploaded photos and server logs are stored on a Hostinger server located in the European Union (the data in an SQLite database). Backups are taken every 6 hours and kept on the same server for 14 days; in addition, once a day the latest backup is copied to the data controller's computer and kept there for 60 days. Some admin lists (for example cancellation survey answers together with the email address) may be downloaded to the data controller's computer for review. Some of our service providers are outside the European Economic Area, mainly in the US: Anthropic (AI recognition and the AI Coach), OpenAI (voice transcription), Meta, RevenueCat, Expo, Stripe, Resend, and Apple and Google. These transfers rely on the safeguards GDPR provides for: the European Commission's adequacy decision for the EU-US Data Privacy Framework (where the provider is certified under it) or Standard Contractual Clauses. We send Anthropic and OpenAI only the content the feature needs, without your name, email address or account identifier.
Account + content data: kept for as long as your account exists. When you delete your account (Profile → Delete account), the database records linked to it are removed immediately (CASCADE delete), except the audit-log entries, from which your email address and account number are removed (see below), and crash reports, some usage statistics (for example searches with no results), past weekly leaderboard placings and reports other users filed about your content, which may keep your former account number. The files of photos you uploaded (profile photo, recipe covers, community post photos) are not automatically deleted from the server's disk; email hello@maistiqo.lt if you want them removed. Copies in backups remain until those backups expire (see below). At your request we also have your data deleted at RevenueCat and Stripe, which process it on our behalf; Meta handles its ad-measurement data under its own terms. Audit logs (sign-ins, password and email changes, account creation and deletion, admin actions and some in-app actions, such as creating or rating a recipe; the weight and body measurement values you log are not kept in them): kept for security investigations; no automatic deletion period is set for them. Once you delete your account, the entries for your own actions keep only the time, the action code and the IP address. Your email address, your account number and the values you entered are removed, including from entries about admin actions on your account. Crash reports, searches with no results, past weekly leaderboard placings and reports about content: no automatic deletion period is set, and they remain after you delete your account. AI usage records (without content), AI Coach suggestions and support messages: kept until you delete your account. Voice clips, meal and receipt photos, and text submitted for AI recognition: not stored on our server (see section 3). AI recognition results (food names and estimated amounts): kept for 180 days, then auto-purged. Data received from Apple Health and Health Connect: weigh-ins and water are kept until you delete them in the app or delete your account, and daily calories-burned totals until you delete your account or ask us to delete them (see section 3). What the app wrote to Apple Health or Health Connect stays in those apps until you delete it there. Cancellation survey answers: kept until you delete your account or reset your data. Push tokens: kept until you sign out, the token stops working or you delete your account. Newsletter: your email address is kept until you unsubscribe. Visits through our creator and campaign links (device type, where you came from and the IP hash): kept for campaign statistics; no automatic deletion period is set. Backups: 14 days on the server and 60 days on the data controller's computer, on a rolling basis.
You have the right to: • Access your data — download a copy of your data at any time via Profile → Download my data. If you also want data the export does not include (for example body measurements or technical records), email hello@maistiqo.lt. • Erasure — delete your account at any time via Profile → Delete account. • Rectification — edit your profile, meals, recipes, and any other content directly in the app. • Portability — your data export is in standard JSON, ready to import elsewhere. • Restrict processing or object — email hello@maistiqo.lt and we'll honour the request within 30 days. • Withdraw consent — you can stop using the AI features at any time and revoke microphone, camera, photo, Apple Health or Health Connect permissions in your device settings, and unsubscribe from the newsletter at any time. This does not affect the lawfulness of processing before you withdraw.
On the website and web app we use our own cookies: an httpOnly authentication cookie (`nutrisync_token`) to keep you logged in (expires after 30 days); short-lived security cookies when you sign in with Apple or Google (10 minutes); a language-preference cookie (30 days); and, if you arrive through one of our ad, campaign or creator links, cookies that remember that link and campaign for 30 days so we know where a sign-up came from. In the mobile apps, your sign-in token is kept in your device's secure storage. The web app also keeps your language and theme choice and the notices you dismissed in your browser's local storage until you clear it. Meta SDK in the apps. Our iOS and Android apps include the Meta (Facebook) SDK so we can measure how many installs and sign-ups our ads on Meta platforms bring. The SDK starts when you first open the app and automatically sends Meta app install and app launch events; when you sign up, we also send a registration event that carries only the sign-up method (email, Apple or Google). With these events Meta receives technical device and app information (such as device model, operating system version, language, time zone and app version), your IP address and a Meta anonymous identifier, and on Android devices also Google's advertising ID. The iOS app never asks for permission to track you (App Tracking Transparency), so Apple's advertising identifier (IDFA) is not collected. Depending on the settings we choose on Meta's platform, the SDK can also automatically record in-app purchases and trial starts (for example the product, price and currency). These settings can also make the SDK send Meta a hashed (coded) form of details you type into the app's fields, such as your email address. We also pass the Meta anonymous identifier to RevenueCat so that it can forward subscription events (such as a trial start or a purchase) to Meta and they can be attributed to the ad that brought you. You can limit ad measurement: on Android, delete or reset your advertising ID in your device settings; if you have a Facebook or Instagram account, you can review and disconnect your activity off Meta technologies in your Meta account settings. You can also object by emailing hello@maistiqo.lt. Website. On the maistiqo.com/atsisiusti page we use the Google Ads conversion tag (gtag.js): it loads when the page opens, may set Google cookies and sends Google your visit to the page, your IP address and browser information and, if you click an app-store link, that click, so we can measure ad performance. We count these clicks ourselves without cookies or identifiers (platform, where you came from, campaign tags). When you open one of our creator or campaign links (maistiqo.com/l/…), we record the visit: device type, where you came from and a hash of your IP address made with a secret key, not the IP address itself. If you sign up from the same IP address within 7 days, we credit the sign-up to that link. Fonts on our web pages are loaded from Google Fonts, so Google receives your IP address. If you use receipt reading on the website, the text-recognition library and its language data are loaded from public code CDNs (unpkg, jsDelivr and tessdata.projectnaptha.com), which receive your IP address; the receipt itself is read in your browser and is not sent to them or to us. We use no other third-party advertising cookies or analytics scripts.
We use these services to deliver the product: • Hostinger (EU) — servers, database, backups + email delivery. • Anthropic (US) — AI meal recognition from photos and text (including dictated text), receipt scanning, nutrition-label reading, AI ingredient estimates, the AI Coach (Pro), AI meal-plan fill and other AI features. It receives only the content the feature needs, without your name, email address or account identifier. • OpenAI (US) — voice-to-text transcription, only when you dictate a meal. It receives only the audio clip. • RevenueCat (US) — subscription management in the apps: receives your Maistiqo account number, purchase and subscription status from the App Store / Google Play, device identifiers (the identifier for vendor on iOS; the Android ID and Google advertising ID on Android), your IP address and the Meta anonymous identifier. In-app payments are processed by Apple or Google — we never see your card details. • Stripe (Ireland / US) — subscription payments on the website: receives your email address and account number; you enter card details directly on Stripe's page and we never see them. • Meta Platforms (Ireland / US) — ad measurement in the apps (see section 9). If you choose "To Instagram Story", the generated meal or recipe card is handed to the Instagram app on your device, and Instagram's own terms apply from there. • Expo (US) — push notification delivery (through Apple's and Google's push services) and app updates. Receives your device's push token and the notification text, which may include your progress (for example, how much of your water goal you have reached or which pantry items are about to expire); when the app checks for updates, also your IP address, a random installation identifier, platform and app version. • Apple and Google — Sign in with Apple / Google, app stores and their in-app payments, notification delivery; on the website, the Google Ads tag and Google Fonts (see section 9). • Resend (US) — fallback email delivery (only if SMTP is unavailable). • Open Food Facts — barcode lookup: our server sends only the barcode number; the product photo may be loaded directly from Open Food Facts, which can then see your IP address. • MyMemory (Translated) and Internet Archive — recipe import from a link on the website: the recipe text may be sent for translation, and the recipe link is passed to the Internet Archive if the page cannot be fetched directly. We send them none of your personal data. Each provider receives only the data its function needs. Providers that process data on our behalf use it only for the purposes we set, under their data processing terms; Apple, Google and Meta also process data under their own privacy policies for their own services (sign-in, app stores, payments, advertising).
Maistiqo is not intended for users under 16. We do not knowingly collect data from anyone under 16. If you believe a child has registered, email hello@maistiqo.lt and we will delete the account.
When we change this policy materially, we'll notify registered users by email at least 14 days before the change takes effect. The current version is always available at maistiqo.com/privacy.