This page summarises, in plain language, the disclosures we file in the Google Play Data Safety form for the MealMatrix member Android app. It mirrors the app's actual data handling. For the full legal detail, see the Privacy Policy.
Security & privacy practices
- Data is encrypted in transit. All API traffic uses HTTPS / TLS 1.2+. Cleartext traffic is disabled and only system certificate authorities are trusted on release builds.
- Data is encrypted at rest on the device. Authentication cookies and session tokens are stored in Android EncryptedSharedPreferences (AES-256-GCM, Android Keystore / StrongBox where available). Credential data is excluded from OS backups.
- You can request that your data be deleted — in-app at More → Privacy → Delete account, which schedules server-side erasure (with a cancellation window). See Account deletion.
- Families policy: the app is not directed at children; the Play target audience excludes Children categories.
Data the app collects or shares
“Shared” means transmitted to a third-party processor. Purposes: App functionality, Account management, Analytics, Developer communications, Fraud prevention & security.
| Data type | Collected | Shared | Purpose | Optional |
|---|---|---|---|---|
| Name | Yes | No | App functionality, Account management | No |
| Email address | Yes | No | App functionality, Account management, Developer communications | Sometimes (varies by facility) |
| Phone number | Yes | No | App functionality, Account management, Fraud prevention & security | No |
| User IDs (member ID) | Yes | No | App functionality, Account management, Fraud prevention & security | No |
| Approximate location | Yes (opt-in) | No | App functionality | Yes |
| User payment info (card/UPI) | No — handled by the payment gateway's checkout | — | — | — |
| Purchase history | Yes | No | App functionality | No |
| Other financial info (wallet, loyalty, gift-card balances) | Yes | No | App functionality | No |
| App interactions | Yes | No | App functionality, Analytics | Yes (opt-in) |
| Other user-generated content (feedback, ratings) | Yes | No | App functionality | No |
| Crash logs | Yes | Yes (Firebase Crashlytics) | App functionality, Analytics | Yes (opt-in) |
| Diagnostics | Yes | Yes (Firebase) | App functionality, Analytics | Yes (opt-in) |
| Device or other IDs (FCM push token, Play Integrity verdict) | Yes | No | App functionality, Fraud prevention & security | No |
Not collected by the app
The app does not collect: card/UPI/banking credentials (entered into the payment gateway's hosted checkout), precise (GPS) location, your SMS inbox or mailbox contents, device contacts, gallery photos or videos, audio, arbitrary files, calendar, installed-apps list, in-app search history, web browsing history, or the Android Advertising ID. The camera is used only to scan QR codes for pickup; images are processed on-device and not stored or transmitted. One-time passcodes are sent by email, so the app never reads your SMS.
Data deletion
You can request deletion in the app at More → Privacy → Delete account, or as a fallback by emailing mealmatrix.privacy@gmail.com from your registered address. Some financial records are retained where Indian tax law requires (see Retention). Full details: Privacy Policy → Account deletion.