Skip to content
SvorusSvorus

Legal

Sara Meal Planner — Privacy Policy

This privacy policy applies to the Sara Meal Planner mobile application, developed and published by Svorus. Last updated: October 28, 2026. Have qualified legal counsel review before final publication.

About this policy

  • This Privacy Policy governs the Sara Meal Planner mobile application ("App") available on Android, operated by Svorus ("we", "us", or "our"), registered at 119/2, Individual Building, Soc171199 Yogeshwardham Yogeshwer Nagar Street No 1, Near Gulabnagar Over Briz - 361005, Jamnagar, Gujarat, India.
  • By downloading or using the App, you agree to the collection and use of information as described in this policy. If you disagree with any part, please uninstall the App and discontinue use.
  • We reserve the right to update this policy at any time. Changes will be indicated by updating the 'Last updated' date above and, where material, by in-app notification. Continued use after changes constitutes acceptance.

Information we collect

  • Account information: email address used for OTP-based sign-in, account UUID generated on first authentication, and session tokens stored securely in platform secure storage.
  • Meal planning data: dietary preferences, food exclusions, serving sizes, meal schedule selections, household member counts, and nutritional targets you configure within the App.
  • Subscription and billing data: membership status, entitlement grants, and transaction identifiers provided by Google Play Billing and RevenueCat. We do not store raw payment card details; these are handled directly by the payment processor.
  • Usage data: in-app events, feature interactions, error diagnostics, and crash reports collected to maintain and improve App stability.
  • Device and technical data: device type, operating system version, App version, network type, and anonymised device identifiers required for secure session management and push notifications.
  • Local storage: meal plans, shopping lists, manual grocery extras, and settings are stored on-device via SQLite. This data is not uploaded to our servers unless you explicitly use cloud sync features.
  • We do not collect precise geolocation, contacts, camera, microphone, or health data unless you explicitly grant permission for a specific feature that requires it.

How we use your information

  • Authentication: your email and OTP are used solely to verify your identity and issue a secure rotating session. We do not share your email for marketing without separate explicit consent.
  • App functionality: dietary preferences and meal data power the meal generation, nutritional calculations, grocery list reconciliation, and sharing features you use within the App.
  • Subscription management: account UUID and entitlement status are passed to RevenueCat and Google Play to verify active membership before granting paid write access.
  • Security and fraud prevention: session tokens, device identifiers, and request audit logs are retained for a limited period to detect unauthorised access and enforce account policies.
  • Product improvement: aggregate, anonymised usage metrics (not individual profiles) may be used to prioritise features, fix bugs, and improve the App experience.
  • Legal compliance: we may process or disclose data as required by applicable law, court order, or government authority.

Data sharing and third-party processors

  • RevenueCat (revenuecat.com): manages in-app purchase verification, subscription entitlements, and purchase history on our behalf. Data transferred: account UUID, platform purchase tokens, and entitlement status. Servers: United States.
  • Google Play Billing (Google LLC): processes in-app purchases for Android. Data transferred: purchase tokens and transaction IDs. Governed by Google's Privacy Policy.
  • Hosting and backend infrastructure: our FastAPI backend and PostgreSQL database are hosted on Hostinger. Data transferred: session tokens, meal plan data where server sync is used, and API request logs. Servers: location disclosed in the active hosting agreement.
  • Amazon S3 (AWS): stores recipe media assets. Access is controlled via server-generated 900-second signed URLs; no client-side upload keys exist.
  • Email delivery provider (to be confirmed before launch): used exclusively to deliver OTP codes. Only your email address and the OTP token are transmitted.
  • We do not sell, rent, or trade your personal data to third parties for advertising or marketing purposes.

Data retention

  • Active account data (email, UUID, meal plans, preferences) is retained for as long as your account remains active.
  • Session tokens are rotated on each authenticated request and invalidated immediately upon sign-out.
  • API request logs and error diagnostics are retained for up to 90 days for security monitoring.
  • If you request account deletion, we will permanently delete your account data, meal plans, and associated preferences within 30 days of the confirmed request. Aggregated, anonymised usage statistics derived from your data may be retained.
  • On-device SQLite data is removed when you uninstall the App or perform a local reset from the Settings screen.

Your rights

  • Access: you may request a copy of the personal data we hold about you.
  • Correction: you may request that inaccurate or incomplete data be corrected.
  • Deletion: you may request deletion of your account and associated personal data by contacting us or using the in-app account deletion flow when available.
  • Restriction: you may request that we restrict processing of your data under certain circumstances.
  • Portability: you may request an export of your personal data in a machine-readable format.
  • Withdrawal of consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
  • To exercise any of these rights, contact us at info@svorus.com. We will respond within 30 days. Jurisdiction-specific rights under GDPR, UK GDPR, CPRA, and the India DPDP Act will be addressed in accordance with applicable law after legal review.

Children's privacy

  • Sara Meal Planner is not directed at children under the age of 13 (or the applicable age of digital consent in your jurisdiction).
  • We do not knowingly collect personal information from children. If we become aware that a child has provided personal information without verifiable parental consent, we will delete that information promptly.
  • Parents or guardians who believe their child has submitted personal data to us should contact info@svorus.com.

Security

  • Session credentials are stored in platform secure storage (Android Keystore-backed EncryptedSharedPreferences) and are never written to unprotected storage.
  • All communication between the App and our backend is encrypted via HTTPS/TLS. Cleartext HTTP is disabled in release builds.
  • Server-side secrets (JWT signing keys, database credentials, AWS keys, RevenueCat API keys) are never embedded in the App binary.
  • Despite our precautions, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a unique, strong password for your email account and to report any suspected security issues to info@svorus.com.

Contact

  • Data controller: Svorus, 119/2, Individual Building, Soc171199 Yogeshwardham Yogeshwer Nagar Street No 1, Near Gulabnagar Over Briz - 361005, Jamnagar, Gujarat, India.
  • Privacy enquiries: info@svorus.com. We aim to respond within 1 business day.
  • For the full Svorus website privacy policy, visit https://svorus.com/legal/privacy-policy.