Privacy Policy

Data Controller: Clockwork Meal Pty Ltd

Contact: privacy@clockworkmeal.app

Website: clockworkmeal.app

We are the data controller responsible for your personal information. If you are in the EU and we are required to appoint an EU representative under Article 27 of the GDPR, details will be published on this page.

We collect the following categories of personal information:

Information you provide

Information collected automatically

Information derived by AI

We collect personal information:

• Directly from you — when you sign up, complete onboarding, update settings, or interact with AI chat
• From authentication providers — if you sign in with Google, we receive your email address, name, and profile picture URL. If you sign in with Apple, we receive your email address and name
• Automatically — crash reports (Sentry), IP addresses for rate limiting, and AI usage logs for tier enforcement
• Derived by AI — learned preferences extracted from your AI chat conversations

We only collect information that is reasonably necessary to provide the meal planning service. You can use the app with minimal data (e.g., skip location, use a pseudonym for family members), though this may reduce personalisation quality.

We apply enhanced protections to this data:

• Explicit consent: We collect this data only with your explicit consent during onboarding. You actively enter this information knowing it will be used for meal planning.
• Purpose limitation: We use allergy and dietary data solely to generate safe, suitable meal plans. We do not use it for marketing, advertising, or profiling unrelated to the service.
• Minimisation: We only collect the allergy and dietary data you choose to provide. You can update or remove it at any time via Settings.
• No sale: We never sell your health information to anyone.

We do not use your personal information for: targeted advertising, selling to data brokers, building advertising profiles, or any purpose unrelated to providing and improving the meal planning service.

For users in the EU, UK, and other jurisdictions that require a legal basis, we process your data on the following grounds:

You may withdraw consent at any time by updating your settings or contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

What data is sent to the AI

• Family member names and age groups
• Allergies and dietary restrictions (per person and household-wide)
• Cuisine preferences, cooking skill, spice level, preferred proteins
• Location (if provided)
• Learned preferences from past conversations
• Recipe context and your questions (for AI chat)

How the AI uses your data

The AI receives your household context as part of a prompt and generates a personalised meal plan or response. The AI does not independently store your data or build a persistent profile of you. Each request includes the relevant context needed for that specific generation.

AI data retention

Anthropic processes your data via their API and, per their API terms, does not use API inputs or outputs to train their models. Anthropic may temporarily retain API inputs for abuse monitoring (typically 30 days). See Anthropic's Privacy Policy for details.

Learned preferences

When you chat with the AI about a recipe (e.g., "Can I use paneer instead of cheddar?"), the AI may detect preferences (likes, dislikes, substitutions) and save them to your household profile. These are used to improve future meal plans. You can view and delete learned preferences at any time in Settings.

Automated decision-making (GDPR Art. 22)

AI-generated meal plans are a form of automated decision-making. However, these decisions do not produce legal effects or similarly significantly affect you — they are recommendations you can modify, swap, or ignore. You have the right to request human review of any AI-generated output by contacting us.

We never sell your personal information. We share data only with the following service providers, who process it on our behalf:

We may also disclose your information if required by law, court order, or to protect the safety of our users.

Clockwork Meal is based in Australia. Your personal data is transferred to and processed in the United States by our service providers (Anthropic, Supabase, Stripe, Sentry, Vercel, Expo/EAS).

Safeguards for international transfers

• Australia (APP 8): We take reasonable steps to ensure overseas recipients handle your data in accordance with the Australian Privacy Principles. We use contractual agreements with our service providers that require them to protect your data to a standard comparable to the APPs.
• EU / UK (GDPR Chapter V): For transfers from the EU/UK to the US, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and where applicable, the EU-US Data Privacy Framework for certified recipients. You may request a copy of the relevant safeguards by contacting us.
• India (DPDP Act): Your data is transferred to the United States and Australia. As of the effective date of this policy, no countries have been restricted by the Indian government for data transfers.

We retain your data only as long as necessary for the purposes described in this policy, or as required by law.

We use minimal cookies and tracking technologies. We do not use advertising cookies, marketing trackers, or cross-site tracking.

Essential cookies are required for the app to function. They cannot be disabled while using the service.

We do not currently use non-essential analytics cookies. If we introduce analytics tracking in the future, we will update this policy and, for users in the EU/UK, request consent before enabling it.

We do not respond to Do Not Track (DNT) browser signals at this time, as there is no industry-standard protocol. However, we do not engage in cross-site tracking regardless.

We apply the following protections to children's data:

• Only a parent or guardian (the account holder) can add, edit, or remove a child's information
• Children's data is used solely for generating age-appropriate meal plans (e.g., suitable portion sizes, school-day packed lunches)
• Children's data is never used for marketing, profiling, or advertising
• Children's data is never shared with third parties except as part of AI meal plan generation (Anthropic) as described in Section 7
• Parents can review and delete their children's data at any time via Settings

Jurisdiction-specific

• US (COPPA): We do not knowingly collect data directly from children under 13. Children's data is entered by the parent account holder.
• India (DPDP Act s.9): We obtain verifiable parental consent via the parent's account for processing any child's data (under 18). We do not track or behaviourally monitor children.
• EU/UK (GDPR Art. 8): Children's data is processed based on the parent's consent, given through their account.

You can try Clockwork Meal without creating a full account (anonymous/guest access). In this mode:

• We assign a temporary anonymous user ID (no email required)
• Your onboarding data (household type, family members, allergies, preferences) is stored temporarily and linked to this anonymous ID
• We collect your IP address for rate limiting and abuse prevention
• If you sign up for a full account, your guest data is migrated to your new account
• If you do not sign up, guest data is retained until we periodically clean up inactive anonymous accounts. We aim to remove inactive guest data within a reasonable period

Anonymous usage supports the principle of pseudonymity under APP 2 of the Australian Privacy Act.

Regardless of where you are located, you have the right to:

• Access your personal information — see what we hold about you
• Correct inaccurate or incomplete information — update your profile, allergies, and preferences at any time via Settings
• Delete your data — delete your account and all associated data via Settings → Delete Account
• Withdraw consent — stop providing sensitive data or opt out of non-essential analytics
• Complain — lodge a complaint with us or with your local data protection authority

To exercise any right, contact us at privacy@clockworkmeal.app. We will respond within 30 days.

Under the Australian Privacy Act 1988 and the APPs, you have the right to:

• Access your personal information held by us (APP 12)
• Request correction of inaccurate information (APP 13)
• Complain to us about a breach of the APPs — we will respond within 30 days
• Complain to the Office of the Australian Information Commissioner (OAIC) if you are not satisfied with our response

We handle your sensitive information (allergies, dietary data) in accordance with APP 3.3 — collecting it only with your consent and only when reasonably necessary to provide the service. We disclose data overseas (to the US) in accordance with APP 8 and take reasonable steps to ensure overseas recipients comply with the APPs.

If you are in the European Economic Area or United Kingdom, you have the following rights under the GDPR:

• Right of access (Art. 15) — obtain a copy of your personal data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion of your data
• Right to restriction (Art. 18) — restrict processing in certain circumstances
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)) — at any time, without affecting prior lawfulness
• Right regarding automated decisions (Art. 22) — request human review of AI-generated meal plans
• Right to lodge a complaint with your local supervisory authority (e.g., UK ICO)

To exercise any GDPR right, email privacy@clockworkmeal.app with "GDPR Request" in the subject line. We will respond within 30 days.

If you are a California resident, you have the following rights:

• Right to know — what personal information we collect, use, disclose, and sell
• Right to delete — request deletion of your personal information
• Right to correct — correct inaccurate personal information
• Right to opt-out — of sale or sharing of personal information (we do not sell or share your data for advertising)
• Right to limit use of sensitive PI — limit use of health data to what is necessary for the service
• Right to non-discrimination — we will not discriminate against you for exercising your rights

We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising.

If you are in India, you have the following rights under the DPDP Act:

• Right to information — about what personal data is being processed and how
• Right to correction and erasure — correct or delete your personal data
• Right to grievance redressal — file a complaint with us; we will respond within 30 days
• Right to nominate — nominate another person to exercise your rights in case of death or incapacity

For children under 18, we obtain verifiable parental consent through the parent's account before processing any child's data. We do not track, behaviourally monitor, or target advertising at children.

Complaints may be directed to the Data Protection Board of India once operational. Until then, contact us at privacy@clockworkmeal.app.

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access. Our security measures include:

• Encryption in transit: All data transmitted between your device, our servers, and third-party services uses TLS/HTTPS encryption
• Encryption at rest: Database data is encrypted at rest via Supabase's infrastructure (AES-256)
• Row-Level Security (RLS): Every database table has RLS policies ensuring users can only access their own household's data
• Server-side API keys: AI API keys and secrets are stored in Supabase Edge Function secrets, never exposed to client code
• Rate limiting: Per-user and per-IP rate limits prevent abuse
• Password hashing: Passwords are hashed using bcrypt via Supabase Auth; we never store plaintext passwords
• No card storage: Payment card details are handled entirely by Stripe and never touch our servers

No system is completely secure. If you believe your account has been compromised, contact us immediately at security@clockworkmeal.app.

In the event of a data breach that is likely to result in serious harm, we will:

• Australia: Notify the OAIC and affected individuals as required by the Notifiable Data Breaches scheme (Privacy Act Part IIIC)
• EU / UK: Notify the relevant supervisory authority within 72 hours (GDPR Art. 33) and affected individuals without undue delay where the breach is likely to result in high risk (Art. 34)
• India: Notify the Data Protection Board of India and affected individuals (DPDP Act s.8)
• US: Comply with applicable state breach notification laws

Notification will include the nature of the breach, the data involved, and steps you should take to protect yourself.

We may update this Privacy Policy from time to time. For material changes, we will notify you via email or in-app notification at least 14 days before the changes take effect.

The "last updated" date at the top of this page indicates the most recent revision. We recommend reviewing this policy periodically. Continued use of the service after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, data access requests, or complaints:

Complaint process

1. Contact us first — we will acknowledge your complaint within 7 days and respond substantively within 30 days
2. If you are not satisfied, you may escalate to your local data protection authority:

• Australia: Office of the Australian Information Commissioner (OAIC)
• UK: Information Commissioner's Office (ICO)
• EU: Your local EU data protection supervisory authority
• California: Office of the California Attorney General
• India: Data Protection Board of India (once operational)