Privacy Policy
Last updated: 5 September 2026
Matly plans your week of dinners. To do that, the app needs to know a few things about you — how many people you cook for, what you don't eat, what your budget is. This page describes exactly what data that is, why we process it, which other companies are involved, and how you get rid of all of it.
1. Who is responsible for your data
The data controller is Jonas Sitel, a private individual in Sweden. Matly is not operated by a company and is not part of any other business. You can reach us at support.matly@gmail.com for anything concerning your data.
2. Summary
- We never sell your data.
- The app shows no advertising. It asks once whether we may measure which ad brought you here — say no and no tracking happens at all, and nothing about your purchases leaves us.
- Your onboarding answers stay on your phone until you create an account. Only then are they synced to our server, so you get them back if you change phones.
- Dietary and allergy information is health data. We only process it if you give explicit consent in the app, and you can remove it at any time.
- We never see your card or payment details. All purchases are made through Apple.
- You can delete all your data, or your entire account, from within the app's settings.
3. What data we process
3.1 Account data
When you create an account we process your email address and a password. The password is never stored in plain text — it is handled and encrypted by our authentication provider Clerk, and we cannot read it. If you sign in with Google or Apple instead, we receive an identifier and the email address that service shares with us, but never a password.
The account also carries technical sign-in information: a session identifier, when the account was created and when you last used the app.
3.2 Your onboarding answers
During the initial questions you provide:
- your first name (used only to greet you in the app — you may enter anything)
- what you want to achieve and what usually gets in the way of cooking
- how often you cook and on which days
- which grocery store you shop at
- how many people are in your household
- your weekly food budget
- the kinds of dishes you like
These questions are answered before you create an account, and the answers do not leave your phone as long as you have no account. When you sign in, they are synced to our database and linked to your account.
3.3 Diet and allergies — health data
You can state that you are vegetarian, vegan or pescatarian, and that you avoid gluten, dairy, nuts, shellfish or eggs. Information about allergies and diet is considered health data, a special category of personal data under Article 9 of the GDPR. We therefore only process it if you give explicit consent in the app, which you do in the step where you select it.
We use it for exactly one purpose: filtering out recipes that don't suit you and building your weekly plan. It is never used to profile you for any other purpose, and never disclosed to anyone other than the providers listed in section 6.
You can withdraw your consent at any time by clearing your selections under Konto (Account) in the app, or by deleting your data or your account. Withdrawing consent does not affect processing that took place before the withdrawal.
3.4 Subscription and purchases
Matly is a paid service. The purchase itself is carried out by Apple through the App Store — we never handle your card number, address or payment details and never see them.
So that the app knows you have paid, we receive the following from our subscription provider RevenueCat: an identifier corresponding to your account ID with us, whether the subscription is active, whether it is in a trial period, which product it concerns, when the period ends and whether it will renew. None of this contains payment information.
3.5 What stays only on your phone
Your weekly plan, saved favourites, shopping list and which items you have ticked off are stored only locally on the device. They are never sent to us and exist on no server. If you uninstall the app, they are gone.
The same goes for the app's reminders. If you allow notifications they are booked in the phone's own notification system, with their text already written at the time of booking. Nothing is sent from our servers, and we never learn whether a notification was shown or opened.
3.6 Technical information
When the app loads recipe images they are fetched directly from the image service Unsplash. As with any image request on the internet, that service then sees your IP address and basic information about your device. We never include anything about you in the request, and we receive no information back about who viewed what.
Our server logs technical information about requests, such as timestamps and error messages, so that we can find bugs and protect the service from abuse.
3.7 Advertising measurement
We advertise Matly on Facebook and Instagram, and so we need to see which ads actually lead somewhere. For that purpose the app includes Meta's measurement tools.
The first time you use the app, iOS asks whether we may track you. If you say no, nothing happens — no advertising identifier is read, and no data about you leaves the app for Meta. All we then learn, through Apple's own system, is how many installs a campaign produced in total. That number cannot be traced back to any one person.
If you say yes, we share your advertising identifier (IDFA) and an anonymous Meta id, along with the app having been installed and opened, a trial having started, and a subscription having been bought or renewed. The purchase events are sent from our server via RevenueCat, because renewals happen at Apple long after you last opened the app.
What is never shared with Meta: your name, your email address, your answers during onboarding, what you eat, your allergies or your weekly plan. You can withdraw your answer at any time under Settings → Privacy & Security → Tracking on your phone.
4. What we do not do
This matters as much as the list above. Matly contains:
- no advertising inside the app
- no analytics software following what you do in the app
- no tracking at all if you answer no to the question the app asks
- no sale or rental of personal data
- no access to your location, camera, microphone, contacts or the phone's health app
- no automated decisions producing legal effects for you
5. Why we process the data, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password, sign-in identity | Create and protect your account, let you sign in on a new phone | Performance of a contract (Art. 6(1)(b)) |
| Household, budget, store, days, preferences, first name | Build your weekly plan, estimate cost and shopping list | Performance of a contract (Art. 6(1)(b)) |
| Diet and allergies | Filter out recipes that don't suit you | Explicit consent (Art. 9(2)(a)), given in the app and withdrawable at any time |
| Subscription status | Give you access to what you paid for and show the right information in the app | Performance of a contract (Art. 6(1)(b)) |
| Technical logs | Debugging, operations and protection against abuse | Legitimate interest in a working, secure service (Art. 6(1)(f)) |
| Advertising identifier and events about install, trial and purchase | Measuring which ads lead to new users | Consent (Art. 6(1)(a)), given by answering yes to the question in the app and withdrawable at any time in your phone's settings |
6. Who else processes the data
We use a small number of providers that process data on our behalf (processors). They may only use the data to deliver their service to us, never for their own purposes.
| Provider | Role | What they process |
|---|---|---|
| Clerk | Authentication and account management | Email, password, sign-in identity, sessions |
| Convex | Database and server functions | Account ID, email, your answers including diet and allergies, subscription status |
| RevenueCat | Subscription management | Account ID and subscription status |
| Apple | App distribution and all purchases | Payment and purchase history, which Apple handles as an independent controller under its own privacy policy |
| Unsplash | Recipe photography | Your IP address when an image is fetched |
| Meta | Measurement of our advertising | Advertising identifier and events about install, trial and purchase — but only if you answered yes to the tracking question. Meta processes this as an independent controller under its own privacy policy |
We may also disclose data where we are required to by law, official decision or court order.
7. Transfers outside the EU and EEA
Clerk, Convex, RevenueCat and Meta are US companies, so data may be processed in the United States. Such transfers rely on the European Commission's adequacy decision for the US (Data Privacy Framework) or, where that does not apply, on the Commission's standard contractual clauses together with supplementary safeguards. If you would like a copy of the safeguards applying to a specific provider, contact us and we will send it.
8. How long we keep the data
- Account and profile: for as long as you have an account. If you delete the account, the data is removed immediately.
- Diet and allergies: until you remove them, withdraw consent, or delete your data or account.
- Subscription status: for as long as the account exists. Apple's own purchase history is governed by Apple's terms and cannot be deleted by us.
- Local data on the phone: until you delete it in the app or uninstall the app.
- Technical logs: a short period, normally no more than 30 days.
9. Your rights
You have the right to:
- know what data we process about you and receive a copy of it
- have inaccurate data corrected
- have data erased
- request that processing be restricted
- object to processing based on legitimate interest
- receive the data you provided in a machine-readable format and move it (portability)
- withdraw your consent to the processing of diet and allergy data at any time
Contact support.matly@gmail.com and we will handle your request, normally within one month. If you are unhappy with how we process your data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), the supervisory authority in Sweden.
10. Deleting your data yourself
You do not need to contact us to get rid of your data.
Radera konto — Delete account
Found under Inställningar (Settings) in the app, it removes everything in one step: your sign-in, your profile and your subscription status on our servers, and the weekly plan, favourites and shopping list held on the phone. This cannot be undone.
Note that an active subscription is not cancelled automatically when you delete your account — you cancel it in the App Store settings on your phone. Apple handles the payment, not us.
11. Children
Matly is not directed at children. You must be at least 13 years old to use the app, and at least 18 to take out a subscription — if you are under 18 you need your guardian's consent to the purchase. If we learn that an account belongs to a child under 13, we delete it.
12. Security
All traffic between the app and our servers is encrypted. Your sign-in is stored in the phone's secure keychain rather than ordinary storage. On the server side every record is tied to your account, and our server functions require a verified sign-in token before releasing or changing anything — so the server cannot be asked for somebody else's data.
13. Changes to this policy
If we change how we process data we will update this page and change the date at the top. For material changes we will notify you in the app or by email before they take effect.
14. Contact
Jonas Sitel
support.matly@gmail.com