Privacy Policy

This Privacy Policy explains how Jordan Rabidou, doing business as MealDay (“MealDay,” “we,” “us,” “our”), handles information on the MealDay platform — mealday.app and the organization-branded sites it powers (the “Service”). It is part of our Terms of Service.

Each camp, school, or program on the platform (an “Organization”) is an independent business. When you order from an Organization, the Organization receives and uses your family’s information for its own operations under its own policies. This Policy covers MealDay’s handling of information; it does not govern what an Organization does with information once it has it.

• Account information — your name, email address, optional phone number (used so Organizations can reach you about your orders), password credentials, and organization memberships.
• Child profiles you create— a child’s name, date of birth, allergies and allergy severity, and dietary preferences. You provide this information voluntarily so Organizations can serve your child.
• Order information — meals ordered, dates, programs, amounts paid, coupons used, and refund or modification history.
• Payment information— handled by Stripe. Your card number never touches MealDay’s servers; we store only non-sensitive references (such as a Stripe customer identifier) and transaction records.
• Communications and technical data — emails we send you (and delivery logs), authentication cookies, and standard server logs such as IP address and browser type.

The Service is for adults. We do not knowingly collect information directly from children under 13, and children may not create accounts. All information about children on the platform is provided by a parent or legal guardian (or by the Organization the family belongs to), with that adult’s consent, for the purpose of meal service. A parent or guardian may review and update a child’s profile at any time through the dashboard, and may ask us to remove a child’s information by contacting us at the address in Section 12. Removed profiles are deactivated so they no longer appear in the Service; the underlying records are then retained or deleted as described in Section 8.

Allergy and dietary information is sensitive, and we treat it that way: we use it solely to operate the Service — showing it to you, transmitting it to the Organizations you order from, and generating the kitchen, roster, and allergy reports those Organizations use to serve children safely. We do not use it for advertising and we do not sell it.

• to provide, operate, secure, and improve the Service;
• to process orders and payments and to send transactional email (order confirmations, reminders, receipts, kitchen and vendor reports);
• to communicate with you about your account and the Service;
• to enforce our Terms and comply with legal obligations.

We do not sell personal information or share it for third-party behavioral advertising.

• With Organizations and their staff and vendors— the Organization you order from sees your family’s profile, orders, and the allergy/dietary information you provided, so it can prepare and serve meals and run its program.
• With service providers that host and power the platform — including Stripe (payments), Supabase (database and authentication), Resend (email delivery), and Vercel (hosting) — which process data on our behalf.
• For legal reasons — to comply with law, enforce our Terms, or protect the rights, safety, or property of MealDay, our users, or others.
• In a business transfer — if MealDay is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

We use cookies that are necessary to operate the Service — chiefly authentication/session cookies that keep you signed in across MealDay hosts. We do not use third-party advertising cookies.

We retain information for as long as your account is active and as needed to run the Service, resolve disputes, meet financial and record-keeping obligations, and enforce agreements. Order and payment records may be retained after account closure where required for accounting, tax, or legal purposes.

We use reasonable technical and organizational safeguards, including encryption in transit, hashed credentials, and role-based access controls that limit each Organization to its own data. No system is completely secure, and we cannot guarantee absolute security; you are responsible for keeping your login credentials confidential.

• You can review and update your account, family, and child-profile information at any time from your dashboard.
• You can manage reminder and digest email preferences in your account settings; transactional emails (such as receipts) are sent as part of the Service.
• You may request access to, correction of, or deletion of your personal information by emailing mealdayapp@gmail.com. Where you have rights under applicable state or national privacy laws, we will honor them as the law requires. Deletion is handled by deactivating the relevant profiles and removing information we no longer need; we retain records we are legally required or permitted to keep — including order, payment, and food-safety records — as described in Section 8.

We may update this Policy from time to time. Material changes will be posted here with an updated effective date, and your continued use of the Service after that date constitutes acceptance.

Privacy questions or requests: mealdayapp@gmail.com. For questions about how a specific Organization uses your information, contact that Organization directly.