Privacy Policy

About Mero

Mero is a performance meal system that provides personalized meal planning, macro-based nutrition guidance, and meal preparation tools, offered through the Mero website and the Mero mobile app. The app is available for iPhone through Apple’s App Store, and an Android version is in closed testing through Google Play. Different parts of the Service collect different information, as described below, depending on whether you use the website, create an app account, or subscribe. Website and waitlist data handling is described separately from mobile-app data handling throughout this Policy.

What We Collect, At a Glance

This table summarizes our data practices. The sections that follow explain each one in full; where the table is shorter than the text, the text governs.

Scroll the table sideways to see every column

Anonymous onboarding you never finish is handled separately: access expires after 24 hours, and the encrypted session and any generated draft are deleted seven days after that expiry.

Information We Collect on the Website

On the Mero website, we collect your email address when you join the waitlist or contact us, a name only if you choose to provide one, and, when you arrive through a tagged link, the campaign source of your visit (such as the newsletter or post that brought you here). Website analytics are described in the website section below and are separate from mobile-app data handling.

The free macro calculator also asks for your weight, height, age, sex, activity level, and goal. Those values are sent to our website host, used to calculate the estimate, and returned to your browser. Mero does not store them, does not attach them to your email address, and does not include them in analytics or send them to our email provider; the analytics event records only that a calculation finished. If you join the waitlist from the calculator page, we record that the signup came from the calculator, not the numbers you entered. Because these are health-related inputs, they are also covered by our Consumer Health Data Privacy Policy.

Information We Collect in the App

Account and access information: a provider-specific account identifier from Apple or Google and, when the provider gives them to us, your name and email address. If you use Apple’s Hide My Email, we receive a private relay address rather than your personal one. Mero uses Sign in with Apple and Sign in with Google; the app does not use separate Mero account credentials.

A Mero account may hold more than one authentication identity. On iPhone you sign in with Apple. On Android you sign in with Google, and if you already have a Mero account created with Apple you can sign in to it through Apple in a browser. Each provider identity belongs to one underlying Mero account once you link it. Linking a second identity requires you to be signed in to the existing Mero account first, and we never merge two accounts simply because Apple and Google report the same email address.

Profile inputs you provide for meal planning: exact date of birth, sex selection, height, weight, goals, allergies, training schedule, and meal preferences.

Plans and activity: your weekly plans, meal activity such as meals checked off and logged, shopping and prep progress, and weight check-ins you enter.

Product feedback: when you choose to respond to an in-app check-in or use Send feedback, we collect the source of the response, optional sentiment and categories, your comment, whether you allow us to contact you, the app version and build, and the related weekly plan identifier when applicable. Feedback comments are encrypted at rest.

Subscription and purchase state: whether you are on a free trial or paid subscription, renewal and expiration status, and restore-purchase activity. Apple’s App Store processes purchases, trials, renewals, cancellations, and refunds on iPhone, and Google Play does the same on Android. RevenueCat, our subscription and entitlement provider, processes purchase and entitlement status on both platforms. Mero receives the purchase and entitlement information needed to grant and restore your access. We do not receive or store your payment card details from Apple or Google.

Support and deletion requests: the contents of requests you send us, including the email address and details you provide so we can respond and act on them.

Device and technical data: device type, operating system, app version, a random installation identifier used for session and device management, and failed-update diagnostics. IP addresses may be processed transiently by network infrastructure for request delivery, security, abuse prevention, and rate limiting; Mero does not persist derived location in its application data.

What We Do Not Collect

Mero does not collect your location, whether precise or coarse. Mero also does not collect contacts, photos, audio, advertising identifiers, browsing history, or cross-app tracking data. The mobile app contains no advertising SDK and no general behavioral-analytics SDK, and it does not access HealthKit; health and fitness inputs are entered manually by you.

How We Use Information

We use personal information to operate the waitlist, provide the Service, create and adapt meal plans, generate grocery lists and preparation guidance, manage subscriptions, free trials, and restore-purchase requests, improve Mero from optional product feedback, maintain account security, communicate with users, respond to support, privacy, and deletion requests, troubleshoot technical issues, and comply with legal obligations.

How We Share Information

We do not sell your personal information. On a few marketing pages of the Mero website we do share limited information for advertising measurement and retargeting: the Meta advertising pixel described in the website section below. Under California law that counts as sharing for cross-context behavioral advertising, and you can opt out of it. We do not share app data, health-related data, or anything you enter in the app for advertising. Apart from that pixel, we share personal information only in the following circumstances: with the service providers described below who process data on our behalf to operate the Service; with Apple, Google Play, and RevenueCat to process and verify subscriptions, depending on the store you bought through; when required by law, legal process, or a valid government request; to protect the rights, safety, and security of Mero, our users, or others; in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy; and with your consent or at your direction.

We may also create and use de-identified or aggregated information that cannot reasonably be used to identify you, for purposes such as research and improving the Service.

Feedback you submit may be linked to your Mero account. Mero sends a private notification for operational follow-up, delivered by Resend, our email delivery provider. That notification does not include your weight, calories, allergies, meals, grocery list, prep activity, training details, or plan contents. Your account email is included only when you explicitly allow us to contact you. Each submitted response is saved even if notification delivery fails, and delivery may be retried asynchronously. Internal launch reporting shows aggregate response counts, response rates, sentiment distribution, and category trends; it does not display feedback comments or identities.

Automated Processing and AI

Mero uses automated systems and rule-based calculations to turn the information and preferences you provide into macro targets, meal plans, grocery lists, and preparation guidance. The app itself does not run on artificial intelligence; your plans are produced by standard, deterministic computation. We do not send production personal data to general-purpose AI tools. Development and support work may use synthetic fixtures, de-identified examples, or aggregate findings that cannot reasonably identify a person. Automated outputs may be incomplete or unsuitable for your circumstances, and you remain responsible for reviewing them before relying on them.

Website Cookies and Analytics

On the Mero website, we use cookies and similar technologies to operate the site, remember preferences, and understand how the site is used. The website loads Google Analytics for visit and campaign measurement and is served through Cloudflare for hosting, content delivery, and security. This website analytics activity is separate from the mobile app and is not app telemetry. You can control cookies through your browser settings.

A small number of pages also load the Meta advertising pixel, so we can measure whether our ads reach people who are actually interested and show follow-up ads to people who have visited. It runs only on the marketing pages that carry the waitlist form. It does not run on the free macro calculator, on any article, or on this policy or the other legal pages. It records that one of those marketing pages was viewed and that a waitlist signup succeeded, along with which of the three forms was used. Meta also receives the technical information any web request carries, such as your IP address, browser, and the page address. We do not send your email address or name to Meta, and we do not use Advanced Matching. The pixel never runs in the Mero app, and it does not receive anything you enter in the app.

The pixel is deliberately limited. It loads only on the marketing pages described above, and only on getmero.co itself, never on development or preview versions of the site. It loads only for visitors in the United States, where the advertising runs, so visitors elsewhere are not pixeled at all. And it does not load for any browser sending a Global Privacy Control signal. Blocking it, or opting out, has no effect on the waitlist form or anything else on the site.

Global Privacy Control has an agreed meaning, so we honor it. The older "Do Not Track" header does not, so we do not currently respond to it.

In the Mero app, there is no advertising SDK and no general behavioral-analytics SDK. The app uses a random installation identifier for session and device management, RevenueCat processes your Mero account ID and purchase history for entitlement and purchase analytics, and Expo processes failed-update diagnostics for update reliability.

Third-Party Service Providers

For the mobile service, our current providers are Apple (app distribution, Sign in with Apple, and App Store purchase processing), Google Identity services (Sign in with Google), Google Play Billing (Android purchase processing), RevenueCat (subscription and entitlement management on both platforms), Laravel Cloud (application hosting and database), Expo (app updates and failed-update diagnostics), and Resend (delivery of private feedback and support notification emails only). Google Analytics is used on the website only and is not part of the mobile app.

For the website and waitlist, our current providers are Cloudflare (hosting, content delivery, and security), Google Analytics (website analytics), Klaviyo (email and waitlist), and Meta (advertising measurement and retargeting on the marketing pages only, through the pixel described above). Meta is an advertising company rather than a processor acting only on our instructions, which is why the pixel is limited and can be opted out of.

We engage these providers to run parts of the Service for us, under each provider’s written terms. We do not sell your information, and we do not give any of them permission to use it to build their own products, profiles, or advertising. We are reviewing the operative terms with each provider against the processor obligations that apply to health-related data, and we will state the outcome here.

Marketing Communications

If you join the waitlist or opt in, we may send you product updates and marketing emails. You can unsubscribe at any time using the link in any marketing email or by contacting us. We may still send you non-marketing messages about your account, subscription, security, or support requests.

Data Retention

We retain personal information on the following schedule, which is enforced by the product:

• Incomplete anonymous onboarding: access expires after 24 hours. The encrypted session and any generated draft are deleted seven days after that expiry.
• Active accounts: profile, plans, logs, shopping, prep, and support records are retained while the account remains active and are deleted with the account.
• Product feedback: account-linked sentiment, categories, encrypted comments, contact permission, and app/build metadata are retained while the account remains active and are deleted with the account.
• Feedback and support notification emails: Resend delivers these messages and may retain limited delivery records in line with its own provider obligations and retention practices.
• Provider credentials: retained only while needed to operate the account and, where the provider supports it, revoke the authorization. They are deleted during account deletion.
• Completed deletion audit: a minimal, de-identified operational record is retained for 730 days, then deleted. It contains no profile, email, meal, weight, allergy, or support content.
• Pending or retrying deletion work: retained until provider and local deletion steps finish.
• Backups: deleted records disappear from Laravel Cloud backups as the configured backup rotation expires, within its supported 1 to 30 day lifecycle.

Mero does not copy access or application logs into its product database. Platform logging is limited to operational metadata; sensitive request bodies, tokens, receipts, and raw provider payloads are not intentionally logged. Waitlist information is retained until you ask us to remove it or it is no longer needed. When you request account deletion, we process it as described in our data deletion policy.

Your Privacy Rights and Choices

Depending on where you live, you may have rights over your personal information. The request methods below are available to all Mero users, and we do not ask you to prove where you live before we act on a request. The legal rights that apply to you may depend on where you live.

• Know and access. Ask what personal information we hold about you, where it came from, why we have it, and who we have shared it with.
• Get a copy. Ask for a copy of the information you provided to us.
• Correct. Ask us to fix information that is wrong. Most profile information you can correct yourself under Me in the app, which is usually faster.
• Delete. Ask us to delete your account and the information tied to it. You can start this yourself under Me, or write to us. Our data deletion page sets out exactly what deletion covers.
• Withdraw consent or ask us to stop. Ask us to stop collecting or sharing your information. Because your profile is what Mero uses to build a plan, stopping collection generally means closing the account; we will tell you so directly rather than leaving you with a service that no longer works.
• Opt out of sale or sharing. We do not sell personal information. The Meta advertising pixel on the website does involve sharing for cross-context behavioral advertising, and you can opt out of it in any of three ways: turn on Global Privacy Control in your browser or extension, which the website honors automatically and which stops the pixel loading at all; block the pixel with any tracker blocker; or write to [email protected] and we will confirm what to do. Opting out never affects your ability to join the waitlist or use Mero.

How to make a request. Email [email protected], or use the in-app account-deletion request under Me. Tell us what you want us to do. We will acknowledge the request, act on it as quickly as we can, and in all cases within the time applicable law allows; if we need longer, we will tell you why before that time runs out.

Verifying who you are. Before acting on a request about a specific person’s data, we need to be reasonably sure you are that person, so that we do not disclose your information to someone else. Usually that means writing from the email address associated with the account, or making the request from inside the app while signed in. If we cannot verify you, we will tell you and explain what would let us proceed.

Authorized agents. Where the law allows, you can ask someone to make a request on your behalf. We will ask for evidence that you authorized them, and we may also ask you to confirm the request directly.

If we decline. If we cannot do what you asked, we will tell you which part we declined and why. For example, we may not be able to verify your identity, or a specific legal obligation requires us to keep something. We will complete the parts of a request we can rather than refusing all of it.

Appeals. If we refuse a request, you can appeal by replying to our decision or writing to [email protected] with “Appeal” in the subject line. A person will review the decision again and write back with the outcome and the reasoning. If we deny the appeal, we will tell you how to raise it with your state attorney general.

No retaliation. We will not discriminate against you for exercising any of these rights. You will not get a worse plan, a worse price, or worse support for asking.

You may also unsubscribe from marketing at any time, and you can manage or cancel a subscription through the store you bought it from, either your Apple subscription settings or Google Play. Deleting your Mero account does not cancel an App Store or Google Play subscription.

Health and Wellness Information

Some of the information you provide, such as weight, sex selection, goals, and allergies, relates to your health and wellness. You provide this information voluntarily so Mero can personalize your plan. It is self-reported wellness information used to operate the Service; it is not medical record information, and Mero is not a covered entity under HIPAA. We treat this information as sensitive, store it encrypted at rest, and use it only for the purposes described in this Policy. Our Consumer Health Data Privacy Policy describes this information in more detail, including who processes it and the specific rights you have over it.

Minors' Privacy

Mero is intended for users in the United States who are at least 18 years old. The Service is not directed to children, and we do not knowingly collect personal information from minors under 18. If we learn that we have collected personal information from a minor, we will delete it.

International Users

Mero is operated for users in the United States, and information we collect is processed in the United States and other countries where we or our service providers operate. If you access the Service from outside the United States, you understand that your information may be transferred to and processed in the United States, where data protection laws may differ from those in your location.

Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. Sensitive planning data is encrypted at rest, authentication credentials and session material are held in platform-backed secure storage, which is Keychain-backed storage on iOS and the equivalent protected storage on Android, and data is encrypted in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us at [email protected].

Changes

We may update this Privacy Policy from time to time. The effective date above shows when it was last updated. If we make material changes, we will take reasonable steps to notify you, such as by posting a notice on the website or in the app or by email. Before we collect a new category of health-related data, use it for a new purpose, or disclose it to a new kind of recipient, we will give you notice first and obtain your consent where the law requires it. We will not treat your continued use of the Service as consent where consent is legally required.

Contact

For privacy questions, contact [email protected]. For general support, contact [email protected].