Privacy policy

Draft for review. This is not yet Last Meal’s legal text: the founders and their lawyer will check every word.

Last updated: [To fill in: the date a lawyer signs this policy off]

Who is responsible

MALA Interior GmbH, registered in Switzerland at Obermühleweid 13, 6330 Cham, is responsible for your data (“Last Meal”, “we”). Write to us at support@lastmeal.app.

[For the lawyer: Our representatives in the UK and in the EU (UK GDPR and GDPR, article 27), if we need them, and how to reach them.]

What we keep, and why

Your account: the name and email address Apple or Google give us when you sign in (never the picture Google has of you), your handle, your language, a city if you chose one in an earlier version of the app (no longer asked for or used), whether you read distances in kilometres or miles if you choose, and whether we have confirmed that it is really you (a “Real account”). To run your account and show your profile. The confirmed email address is also what lets you seal.
Your name and your handle are yours to change, on your profile (Edit profile) or in Settings: your name as often as 10 times a day, or none at all (you are then shown by your handle); your handle once every 30 days, so we keep when you last changed it, which only you see. We keep only the name you gave last, and once your handle changes, the old one no longer leads to you and anyone may take it.
Your picture, if you choose one there: a photo from your phone or computer, made square and small (512 pixels) on your device before it is sent, so nothing larger reaches us. To show it beside your name. You can replace it or remove it whenever you like (it counts among the day’s changes); the one replaced or removed is deleted within minutes.
A few lines about you, if you write them there (“About you”, 160 characters at most). To show them under your name on your profile. You can change them or empty them whenever you like (it counts among the day’s changes); we keep only what you wrote last.
Your links, if you add them: your handle on Instagram, TikTok, YouTube or Facebook, and when you added it. To show them on your profile, so people can find you there.
If we invite you: the handle we keep for you, with our note of who it is for, which only we see. So that nobody else takes it.
Your Last Meals: each version’s courses, dishes, places, stories and photo, sealed or not, and when. To show them, to count them on the map and in Last Meal’s numbers, and to check them before they are sealed.
Your comments: what you wrote, under which Last Meal and when; whether a word in it is on our list of words to look at, and whether we have (which only we see); and whether we removed it. And whether you turned comments off on your Last Meals. To show them under the Last Meal, and to look after them.
What you do with others: whom you follow, the courses of Last Meals you’re craving and the collections you sort them into, whom you block, the invitations you send and take up, what you share, and what you report. To show them and act on them.
Places you add or tell us have closed, the places’ websites you tell us are wrong, what else you tell us is wrong at a place (a dish they don’t serve, something inappropriate, a dish spelt wrongly, and your note), and the cities you ask Last Meal to come to. To check those places, websites and dishes, and to tell you when a city you asked for opens.
Notifications: your phone’s push token if you allow notifications, the notifications we send you, and the kinds you turned off. To tell you what you asked to hear about.
The Pro waitlist: your account, or the email address you gave, with its language and the day. To write to you once, when Pro opens.
Pro, once it is sold: whether you are Pro and until when, and the store’s news of your subscription. To give you Pro.
Orders of your card printed: what you ordered, which Last Meal’s card, its price, what you paid and the tax in it, where the order stands and its parcel’s tracking, and the country it went to. To make it, send it, tell you where it is, and keep our accounts. Your name, postal address, email address and phone number, which you give on Stripe’s checkout, go to Stripe and to Gelato, who prints and posts it (or Printify, for a tea towel); we don’t keep them.
If you take part in our test before Last Meal opens: your name, your answers to our survey, and the screenshot you add. You give them to Tally, who holds the survey for us (below); the app passes it nothing but the language you read Last Meal in. To learn what to change in Last Meal, before it opens and after.
Messages you send us through the app or the website: what it is about, the place it is about if any, your message, the language you wrote from, and the email address to answer (yours as a visitor; signed in, the one on your account, which we read from it when we answer), and our reply. To answer you.
Checks against abuse, and how the app is used: both below.

We never sell what you give us, and Last Meal has no ads.

[For the lawyer: The legal basis for each of these (our contract with you, our legitimate interests, or your consent).]

What others can see

Your sealed Last Meal and your profile are public to everyone with an account, as are your links (on your profile), whom you follow, on the map that you chose a place, and the “Real account” mark if we gave you one. Someone without an account, and the preview of a link people share (which search engines may list), see only whose it is and your main course and its place.

So is your picture, if you chose one: it is shown beside your name wherever you are on Last Meal, and anyone who has its address can open it.

So are the few lines about you, if you wrote some: on your profile, to everyone with an account (never while your account is suspended).

Your profile’s language and city can be read too, though the app doesn’t show them.

Your comments are public too: anyone who can see the Last Meal they are under can read them, with your name and handle, signed in or not; but never someone you blocked or who blocked you, nor anyone the Last Meal’s owner blocked or who blocked them, while they are signed in. Nobody sees them while your account is suspended, and nobody but you while the Last Meal’s owner has turned comments off (they are kept, and show again once comments are on). A comment under a Last Meal its owner has since chosen again stays with that version, which only they see, and they may delete it; you can no longer reach it in the app, so to delete yours there, write to us. Whether you turned comments off on yours can be read by anyone.

When you comment on someone’s Last Meal, they are told by a notification (if they allow them) that names you, never its words.

Only you see your drafts, your past versions, your cravings and your collections of them, your orders, your notifications, whom you blocked, what you reported and a comment of yours we removed; the person whose Last Meal you’re craving a course of is told you are, and which course, and anyone can see how many people are craving each course of a Last Meal, and the Last Meal as a whole. An invitation is seen by you and by whoever takes it up.

Checks against abuse

When you seal, we check that it is one real person on a real device, so that nobody seals Last Meals for many:

On an iPhone, Apple’s App Attest confirms that the app is ours and the device genuine; on Android, Google’s Play Integrity does the same. The website sends no such proof.
Each seal names this installation of the app by a random number it keeps on your device.
For 30 days we keep a coded fingerprint of the device and of the network (your IP address, cut down to its network) each seal came from, never the address itself. They count how many people seal from one device or network, and show us when many new accounts choose one restaurant at once.

When someone joins the Pro waitlist without an account, we keep a coded fingerprint of their network for a day, to limit sign-ups from one network.

When someone writes to us through the app or the website, we keep a coded fingerprint of their network, and their account if they are signed in, for a day, to limit how many messages come from one network or person.

When you post a comment, we note that you did, for a day, so that nobody posts more than 30 comments a day.

When you change your name, your picture or the lines about you, we note that you did, for a day, so that nobody changes them more than 10 times a day.

When you are signed in, we count how many requests your account makes each minute and each day, so that nobody copies Last Meal in bulk. Past a limit the app asks you to wait a while. We see which accounts reached a limit today, and how much they read.

When you paste a short map link (or an OpenStreetMap place) to add a place, our server asks Google, Apple or OpenStreetMap where it leads, sending the link and nothing about you, and we note that you did, for a day, so that nobody has more than 20 read an hour.

How what you post is checked

Every Last Meal and every comment is first read by word lists, in our own server functions: lists of rude words, of words we look at again, and of dishes’ names (taken from Wikidata’s open data and kept with the lists). Nothing is sent to anyone else for it.

A Last Meal with a rude word in a dish or a story is turned down, saying which course’s dish or story, never the word. One whose every dish is a dish we know, with no story, no photo and no contact details, is sealed, the lists naming its dishes for the map. Either way, no person or AI reads it first. Anything else goes on to Claude, or to one of us.

A comment with a rude word, a link, an email address, a phone number or an @handle is turned away as you post it, saying why, and nothing of it is kept. One with a word we look at again is shown, and listed for one of us to keep or remove. No AI reads comments, and they aren’t translated.

Your name is read by the same lists as you save it: one with a rude word, a link, an email address or a phone number is turned away, saying why, and nothing of it is kept. The name Apple or Google give us when you first sign in is read the same way, and left out if it would be turned away. No AI reads names.

The lines about you are read the same way as you save them: with a rude word, a link, an email address, a phone number or an @handle they are turned away, saying why, and nothing of them is kept. No AI reads them, and they aren’t translated.

Your picture is shown as you choose it: nobody, person or AI, looks at it first. Anyone can report a profile, and we take away a picture that shouldn’t be there (below).

Claude, an AI model by Anthropic, reviews the other Last Meals before they are sealed. It gets the dishes, the places, the stories and the photos, but not your name, handle or email address. It seals the Last Meal, turns it down with its reasons, or leaves it to one of us. What was decided is kept with the Last Meal, with who decided it: the word lists, or Claude and which model.

Those are decisions about what you post, made by a machine. If yours is turned down, you can change it and seal it again (a comment, change it and post it again); if you think it got it wrong, write to us.

[For the lawyer: Whether these decisions made with no person (the word lists turning a Last Meal down or sealing it, or turning a comment away; Claude sealing or turning down a Last Meal) are decisions “based solely on automated processing” under the GDPR and the UK GDPR (article 22), and if so whether changing it and trying again, or writing to us, is enough of a way to a person.]

Claude also translates dishes and the stories of sealed Last Meals into the readers’ languages. A translation is kept, so that each text is translated once.

Anthropic may not train its models on what we send it, and deletes it within 30 days, unless it has to keep it longer to enforce its usage policy or because the law requires it.

Who else handles it

These companies handle what they need of it, for us, to run Last Meal:

Supabase: our database, sign-in, photo storage, and the server functions that check, send and draw things. Everything above is kept there, in Ireland, in the EU.
Anthropic: Claude, as above.
Apple: Sign in with Apple, App Attest, notifications to iPhones, and purchases in the App Store.
Google: Google sign-in, Play Integrity, notifications to Android phones, and purchases on Google Play. Tapping “Look up their menu” opens a Google search for the place, and “Directions” opens it in Google Maps (its app, if you have it), under Google’s own policy.
Google Fonts: where a picture we draw of a Last Meal (a shared link’s preview, a story, a printed card, an invitation) holds letters our own fonts lack (Japanese, Chinese, Thai, Arabic, Hindi, Georgian or Tamil, for instance), or an emoji, our server asks Google Fonts for those letters. It sends only the set of characters the picture needs, sorted, each once: never the words in their order, who wrote them, or anything about you or your device. We keep the letters it sends back, so each set is asked for once.
Expo: passes our notifications on to Apple and Google. It gets your push token and each notification’s words, which may name the person who followed you, is craving a course of your Last Meal or commented on it.
RevenueCat: runs Pro across the stores and our website. It gets your account’s id (not your name or email address) and your purchases. On our website, Stripe takes the payment: your card details go to Stripe, never to us.
Stripe: takes the payment for a printed card (and for Pro on our website), and works out its VAT or sales tax. It gets your card, your name, email address and postal address (your phone number, if you give it), and what you ordered; not your account. Your card details go to Stripe, never to us.
Gelato: prints and posts what you order, through its printers near you. It gets your card’s print file (your menu card, which is public anyway), your name, postal address and email address (for the carrier’s word on delivery), and passes them to the printer and the carrier.
Printify: prints and posts a tea towel, which Gelato doesn’t make, through its printers in the US. It gets your card’s print file, your name, postal address, email address and phone number (if you gave one), and passes them to the printer and the carrier.
PostHog: counts how the app is used, in its EU cloud (below).
Cloudflare: serves our website, and writes the previews of shared links. It sees your IP address and the page you ask for. It also forwards email sent to our contact address to us.
OpenFreeMap: serves the maps’ streets and names. It sees your IP address and the areas you look at whenever a map loads.
Brevo: sends the one email to the Pro waitlist when Pro opens, and our replies to the messages you send us. It gets the email address and the email, which for a reply quotes your message.
Tally: holds the survey of our test before Last Meal opens, which “Tell us what you think” opens while the test lasts. It gets what you give it there (your name, your answers and a screenshot) and the language you read Last Meal in.

[For the lawyer: The data processing terms we have with each of them.]

Data outside the UK, the EU and Switzerland

Anthropic, RevenueCat, Expo, Stripe, Cloudflare, Apple and Google are US companies, so what they get may be handled in the United States. PostHog keeps our analytics in its EU cloud, Brevo is in France, and Tally, in Belgium, keeps the survey’s answers in the EU. Gelato is in Norway; it prints in the country you order to, or near it, so an order to the US or Canada is handled there. Printify is a US company and prints a tea towel in the US, wherever you are, so your name and address go there with it.

[For the lawyer: The safeguards for each transfer (the EU–US Data Privacy Framework and its UK and Swiss extensions, or standard contractual clauses).]

How the app is used

We count how Last Meal is used with PostHog, in its EU cloud:

what happens, as events: that a Last Meal was sealed, a place searched, a link shared. They carry ids, counts and codes, never what you wrote or searched for, nor your email address;
which screens and pages you open (their addresses can hold a handle or the code of a Last Meal), and on the website the page you came from, any campaign tags in the link, and which links and buttons you click, never their words;
once you sign in, your account’s id and your language, so the events are counted as yours;
your IP address, sent with each event, from which PostHog works out roughly where you are (the country and the city).

No cookies: on the website, PostHog keeps nothing on your device, so each visit starts afresh. In the iPhone and Android apps, PostHog keeps a random id and the events not yet sent in the app’s own storage on your phone.

Where you are

Only when you ask: when you tap “Near me” on the map or “See what’s near you” on Home, the app asks your phone or your browser where you are, while you use it, never in the background. Your phone asks your permission first, and you can take it back in its settings.

Where you are is sent once, to find the Last Meals sealed near it, and not kept: not in our database, not in any log we keep, not on your device beyond the screen that asked, and never in what the app counts with PostHog (which hears only that you looked, and how many places came back). Once you have allowed it, Home shows what is near you again in the same visit, asking your phone where you are anew.

On an iPhone or an Android phone, if you add Last Meal’s “Near you” widget to your home screen, it shows the nearest place you last saw near you, for a day: while the widget is on your home screen, the app leaves on your phone, for it, that place, its most chosen dish, how far it was, how many more were near, a picture of the map round it, and when. Never where you were. Without the widget, the app leaves none of it, and what it left goes once the widget is taken off. It stays on your phone and goes when you sign out.

What the app keeps on your device

Only what you need or chose: your sign-in, the appearance you picked (light or dark), the codes of the invitations opened on it (so an invitation comes sealed in its envelope only the first time), the cities the map offered you a trip pass for today (so it offers one once a city a day), and, once you seal, the random number of this installation (above). On an iPhone, also the key App Attest made for the app; on phones, the pictures you add to your story, in the app’s cache. For the widgets you add to your phone’s home screen, what they show, only while that widget is there: the last places you saw near you (above) and how many courses you crave, with their dishes’ names, kept on your phone only, read by nothing else, never sent anywhere by the widgets, and forgotten when the widget is taken off, when you sign out or when you delete your account. Nothing on your device is used for advertising or to follow you across other sites.

How long we keep it

Your account and everything in it, including the past versions of your Last Meal and every photo you uploaded: until you delete your account.
A comment: until you delete it, the owner of the Last Meal it is under deletes it, one of you blocks the other, or either of you deletes your account; one we removed stays the same way, seen only by you. The note of when you posted it, for the day’s limit: a day.
The note of when you changed your name, your picture or the lines about you, for the day’s limit: a day.
The lines about you: until you change or empty them, or delete your account.
The count of your account’s requests, for the read limit: two days at most.
Your picture: until you replace it or remove it, or delete your account; then it is deleted within minutes.
The fingerprints of each seal’s device and network: 30 days.
The fingerprints of networks joining the Pro waitlist, and the receipts for notifications sent: a day.
Your place on the Pro waitlist: until you take yourself off, or delete your account. It stays after the email, so that nobody is written to twice.
A message you send us, with our reply: 12 months, or until you delete your account if you sent it signed in. The fingerprints counting messages: a day.
Reports: after we decide, with what we decided and who did. A report you made stays when you delete your account, without your name.
A website you told us is wrong: until we decide whether it is, or you delete your account.
What else you told us is wrong at a place: after we decide, with what we decided and who did, until you delete your account.
If someone invited you, the day you sealed stays on their invitation after you delete your account, with nothing that names you.
What Claude cost us each day: it names no one, and we keep it.
Your orders, without your name, for as long as tax law asks us to keep a record of each sale: [For the lawyer: how long, in each country we sell to (often 6 to 10 years)]. Deleting your account unlinks them from you; they stay for our accounts. Stripe, Gelato and Printify keep what they got for as long as their own policies and the law ask.
Your answers to our test’s survey, at Tally and in our notes: for as long as they help us shape Last Meal, and never published with your name. They aren’t linked to your account, so deleting it doesn’t remove them: write to us and we will delete them.
Logs of requests and sign-ins, which hold IP addresses (and, for a sign-in, the email address): 7 days at Supabase; at Cloudflare, [To fill in: as long as its plan keeps them; the founders confirm how long].
Analytics at PostHog: [To fill in: as long as PostHog keeps events on our plan], or until you delete your account (below).

Deleting your account

Delete your account in Settings, under “Delete your account”, or at lastmeal.app/delete-account. If you can’t sign in any more, write to us and we will delete it for you. It happens at once:

Your sign-in, profile, handle, picture, the lines about you and links go; so does every Last Meal of yours, every version, and their photos. Your sealed Last Meal stops counting everywhere.
So do whom you follow and who follows you, your cravings and your collections of them, your comments everywhere and every comment under your Last Meals, your invitations, what you shared, your notifications and phones, your settings, whom you blocked, your place on the waitlists, the messages you sent us signed in, and reports about you, your Last Meals or your comments.
Places you added that we haven’t confirmed go, unless someone else added or chose them too. Places we confirmed stay on the map, without your name.
Your record at RevenueCat goes, and your person and events at PostHog. Should anything of yours stay at PostHog, write to us and we will delete it.
If you signed in with Apple on an iPhone, Apple’s sign-in for Last Meal is withdrawn too. Otherwise you can remove Last Meal in your Apple ID’s settings, under Sign in with Apple.

What stays, for a while, without your name:

A coded fingerprint of your email address, and the day you last sealed, for 90 days after that day: if you sign up again with the same address, your new account waits out the same 90 days before it can seal.
The fingerprints of the devices and networks you sealed from, for the rest of their 30 days, so that they keep counting.
The day you sealed, on the invitation of whoever invited you; the reports you made; what Claude cost us.
Your orders of a printed card, for our accounts (above), without your name or your Last Meal.
If you had the week of Pro we give at a first seal: a coded fingerprint of your email address, for 12 months, so that a new account with that address isn’t given a second week.
If we had suspended your account: a coded fingerprint of your email address and the day we suspended it, until we lift the suspension. A new account with that address starts suspended.

If we kept a handle for you, it stays kept, with our note of who it was for, until we release it.

Reports, blocks and suspension

When you report something, we keep what you reported, why, your note, and that you sent it. The people who look at reports see why and your note, never who sent it, and the person reported isn’t told.

You can report a comment as you report a Last Meal or a profile, and we keep the same. When we remove a comment, only the person who wrote it still sees it, marked as removed by Last Meal.

When you block someone, we keep that you did, and when. They aren’t told. The comments each of you wrote under the other’s Last Meals go.

When we suspend an account, we keep that it is suspended, and refuse its sign-in until we lift it. Its links and comments aren’t shown meanwhile.

When we clear a profile someone reported, its name, picture, the lines about it and links go, the picture deleted within minutes.

Deleting a suspended account doesn’t lift the suspension: we keep a coded fingerprint of its email address until we lift it, and a new account with that address starts suspended.

Your rights

You can ask to see what we keep about you, to have it corrected or deleted, to receive it in a common format, to have its use limited, and to object to how we use it. Write to us at support@lastmeal.app.

Much of it you can do yourself: change or take back your Last Meal, delete your comments (one under a Last Meal its owner has since chosen again by writing to us) and turn comments off on your Last Meals, set your language in Settings, turn notifications off, unblock people, and delete your account.

You may also complain to a data protection authority: [For the lawyer: Which one (the ICO in the UK, the FDPIC in Switzerland, the authority of your country in the EU)].

Children

Last Meal isn’t for anyone under 16. If you think someone under 16 has an account, write to us and we will take it down.

Changes

When this policy changes in a way that matters to you, we will say so in the app before the change applies, and date it here.

Contact

Questions about your data, or anything else: lastmeal.app/contact, or support@lastmeal.app.