Maelivia
Maelivia Privacy Policy
Effective date: 2026-10-21
This policy explains what personal data the Maelivia app and its server ("Maelivia", "we", "us") process, why, who we share it with, and the rights you have. It applies to the Maelivia iOS app and the services behind it.
1. Who we are
The data controller is Ömer Faruk Şimşek, Ankara, Türkiye. Contact for privacy questions and requests: support@maelivia.com.
For users in Türkiye, we act as the data controller (veri sorumlusu) under Law No. 6698 on the Protection of Personal Data (KVKK). For users in the European Economic Area and the United Kingdom, we act as the controller under the GDPR and UK GDPR.
2. Summary
- You can cook without an account. The app then uses a random profile ID, not your name or email.
- When you talk to the assistant, your voice is streamed to our server and to our speech-to-text provider to be turned into text. We do not store recordings of your voice.
- The text of your conversations with the assistant, the recipes you import and your profile settings are stored on our server so the app works, and can be deleted by you at any time.
- We use AI providers to understand requests and write replies. They act on our instructions.
- We do not sell your data, do not show ads, do not track you across other apps or websites, and do not use third-party analytics or advertising SDKs.
3. Data we process
| Data | When | Why |
|---|---|---|
| Profile ID (a random identifier created on first use) | Always | To keep your settings, recipes and cooking sessions together without an account |
| Profile settings: app language, country (used for the emergency number), dietary preferences | When you set them | To show the right language, recipes and emergency number |
| Allergens you select | Only if you choose to add them | To warn you about ingredients that may contain them (see section 4) |
| Account data: email address, password (stored only as a one-way hash), email verification status, language | Only if you create an account with email | To sign you in, verify your email, reset your password and send account messages |
| Sign in with Apple data: Apple's user identifier for our app, the email Apple shares with us (which may be a private relay address), and a token we use to revoke the Apple sign-in when you delete your account | Only if you use Sign in with Apple | Same as above. We do not ask Apple for your name |
| Sign-in sessions: a hashed session token, creation and last-use time, and the device's user agent | While you are signed in | To keep you signed in securely and let you sign out |
| Voice audio | Only while hands-free mode or hold-to-talk is on | Streamed in real time to be transcribed. Not stored by us (section 5) |
| Cooking sessions: which recipe you cook, the progress of steps and timers, and the conversation (your transcribed speech or typed messages and the assistant's replies) | When you cook | To run the session, keep the assistant's context and let you resume. Also used to find and fix mistakes in the assistant (section 6) |
| Imported recipes: the text you paste and the recipe created from it | When you import a recipe | To create and save your recipe |
| Technical records of AI calls: time, model and provider used, latency, token counts, cost, outcome, and which app actions the assistant took | During cooking and imports | To operate the service, control cost and fix errors |
| Purchase information: subscription status, product, purchase and renewal dates, an anonymous app user ID, and the store transaction identifiers | Only if you subscribe or restore purchases | To unlock Maelivia Pro. We never see your card or payment details; Apple handles payment |
| IP address and request logs | Every request | To deliver the service, limit abuse (for example rate limits on sign-in) and keep it secure |
| Usage analytics: app opens/backgrounds, screen names and time spent, code-owned tap targets, recipe IDs, cooking progress counts, timer and voice usage durations, import categories, paywall and purchase events; profile/account IDs, a random app installation ID, an app-session ID, event times, app/OS version and locale | While you use the app | To understand feature use, funnels and where people leave, and improve app functionality |
| Notification permission | If you allow notifications | Timer alerts are local notifications scheduled on your device; no notification content is sent to us |
We do not collect your precise or approximate location, contacts, browsing history or advertising identifiers, and no health data apart from the allergens you choose to add (see section 4). The app does not use the camera and never reads your photo library on its own. If you choose a photo of a recipe to import, only that photo is sent through our server to an AI model (see section 5) to read the recipe's text; the photo is not stored, and the text read from it is kept as the source of your recipe. On iPhones where Apple's on-device speech recognition is turned on for Maelivia, your voice is turned into text on the phone and only that text reaches us.
4. Allergens (sensitive data)
Food allergies can be health information. Adding allergens is optional and the app works without them. We process them only with your explicit consent, which you give when you add them, and only to show allergen warnings in the app. You can remove them in Profile at any time; removing them withdraws your consent for future processing. Allergens are included in the context the AI assistant receives during a cooking session so that it can warn you.
Allergen warnings are a help, not a guarantee. An ingredient the app does not recognise is shown as "unknown", not as safe. Always read product labels and ask a medical professional about your allergies.
5. Who receives your data (processors)
We use the service providers below. They process data on our behalf and under contract, only to provide their service to us.
| Provider | What it receives | Purpose |
|---|---|---|
| OVHcloud (Canada) | All server data listed in section 3 | Hosting our server and database |
| OpenRouter, Inc. (USA) and the AI model providers it routes our requests to (for example Together AI, OpenAI, Google, Anthropic, and ElevenLabs for the assistant's voice; the exact provider can change) | The text of your request, recent conversation, the current recipe and session state, your language, allergens and preferences; recipe text you import, and a recipe photo you choose to import | Understanding requests, writing replies, compiling imported recipes, and generating the assistant's voice (text-to-speech, by default with ElevenLabs via OpenRouter; the text of the assistant's reply is sent) |
| Deepgram, Inc. (USA) | Your voice audio while the microphone is on, and the session language | Speech-to-text. Audio is processed in real time; we have opted out of Deepgram's model improvement program |
| Cartesia AI, Inc. (USA), if enabled | The text of the assistant's reply | Text-to-speech |
| RevenueCat, Inc. (USA) | An app user ID, purchase receipts and subscription events | Managing subscriptions and restoring purchases |
| Apple Inc. | Payments, Sign in with Apple, and app distribution, under Apple's own privacy policy | App Store purchases and sign-in |
| Resend (Plus Five Five, Inc., USA) | Your email address and the content of account emails | Sending verification, password reset, welcome and account deletion emails |
AI providers do not receive your email address or account details. We ask our AI providers not to use your data to train their models, and we request only providers that do not train on it and choose settings accordingly. Some AI model providers may keep prompts for up to about 30 days for abuse monitoring before deleting them. OpenRouter does not store the content of our requests, only metadata such as usage. We do not sell or rent your personal data, and we do not share it for advertising. We may disclose data if the law requires it, or to protect the safety of people or the service.
6. Legal bases (GDPR) and purposes (KVKK)
- Performance of a contract (GDPR art. 6(1)(b); KVKK art. 5(2)(c)): running the app, the assistant, voice, recipe import, your account and your subscription.
- Legitimate interests (GDPR art. 6(1)(f); KVKK art. 5(2)(f)): security, abuse prevention, cost control, understanding product use and improving the app and assistant. To improve the assistant we may review conversation text from cooking sessions and turn it into test cases. We keep this to what is necessary and you can object (section 9).
- Explicit consent (GDPR art. 9(2)(a); KVKK art. 6): allergens.
- Legal obligation (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)): records we must keep by law, such as records linked to purchases.
First-party usage analytics
We send a limited set of usage events to our own server and PostgreSQL database. They are linked to your profile and, when signed in, your account. Analytics events never include your search terms, typed or spoken messages, recipe text, email or allergen selections. The installation ID is random and specific to this app; we do not use IDFA, IDFV or fingerprinting. We use these events to understand screens, cooking flows and drop-offs. We do not sell them, share them with analytics vendors or use them for ads or tracking across apps. You can object using the contact in section 1.
7. How long we keep data
- Profile, cooking sessions, conversation text, imported recipes and AI call records: until you delete them, delete your data or delete your account.
- Usage analytics: 395 days from receipt on our server by default, removed by daily cleanup (normally within one additional day), or sooner when you delete your profile/account. Unsent events are kept on your device for up to seven days.
- Account data: until you delete your account.
- Sign-in sessions: they expire after 60 days without use and are removed when you sign out or delete your account.
- Email verification and password reset links: they expire after a short time (hours).
- Voice audio: not stored by us. Our speech-to-text provider processes it in real time.
- Server logs (including IP addresses): rotated automatically by size; at most the most recent 50 MB of logs are kept, and older entries are overwritten.
- Backups: the database is backed up nightly on our server. Deleted data can remain in a backup for up to 14 days, until that backup is deleted.
- Purchase records: RevenueCat and Apple keep transaction records as required by tax and accounting law.
8. Deleting your data
- With an account: Profile > Account > Delete account. This permanently deletes your account, your profile, allergens, cooking sessions, conversations, imported recipes and AI call records from our database, signs you out on all devices and revokes Sign in with Apple. We send a confirmation email.
- Without an account: Profile > Delete my data. This deletes your profile and everything linked to it.
- Deleting your account does not cancel an App Store subscription. Cancel it in your Apple Account settings (Settings > your name > Subscriptions).
- You can also email support@maelivia.com and we will delete your data within 30 days.
9. Your rights
Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, withdraw consent at any time (without affecting earlier processing), and complain to a supervisory authority. Under KVKK art. 11 you can also ask whether your data is processed, for what purpose, to whom it was transferred, and ask for the consequences of unlawful processing to be remedied.
Send requests to support@maelivia.com. We answer within 30 days. We may ask you to confirm that the account is yours. In Türkiye you can complain to the Personal Data Protection Authority (KVKK, kvkk.gov.tr); in the EEA, to your local data protection authority; in the UK, to the ICO.
10. International transfers
Several providers are in the United States. Where data leaves Türkiye, the EEA or the UK, we rely on the safeguards the law allows: the EU-U.S. Data Privacy Framework where the provider is certified, the European Commission's Standard Contractual Clauses, and, for transfers from Türkiye, the standard contracts under KVKK art. 9 notified to the Authority as required, or your explicit consent where no other basis is available.
11. Security
Data is encrypted in transit (HTTPS/TLS). Passwords are stored only as salted hashes, and sign-in tokens are stored only as hashes. Access to the server and database is limited to people who need it. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.
12. Children
Maelivia is not directed at children under 13, or under 16 in the EEA, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact support@maelivia.com and we will delete it.
13. Changes
If we change this policy, we will update the effective date above and, for significant changes, tell you in the app before they apply.
14. Contact
Ömer Faruk Şimşek, Ankara, Türkiye, support@maelivia.com