Square Meal privacy policy

Who processes your data

Square Meal is published by AVELTEK, sole proprietorship of Florian Pasco, SIREN 892 119 454, headquartered at 56240 Inguiniel, France.

Data controller: Florian Pasco. Contact: hello@aveltek.com

There is no data protection officer: the structure is not subject to that requirement.

What the app collects, and why

To sign you in. Your email address, and your phone number if you choose that channel. They are used only to send you a six-digit code and to recover your account. The code is never stored in plain text: the database keeps only a cryptographic hash of it, as with the session token. No one, not even us, can read back a code that was sent. Legal basis: performance of the contract.

To compute your plan. Your sex, date of birth, height, weight, physical activity level and weight goal. These inputs go directly into computing your energy expenditure and your menus: without them the app has nothing to compute.

To track your plan. Your daily weigh-ins, the meals you report having eaten, the cooking sessions you have completed, and the items ticked off in your shopping list. Your weigh-ins are used to adjust your plan: it is their slope over fourteen days that tunes your calories. Your finished or abandoned plans are kept so you can look back on them.

Your weight and weight goals are health data. The European regulation gives them enhanced protection, and their processing rests on your explicit consent, which you give when you create your plan. You can withdraw it at any time by deleting your account, which erases this data.

What the app does not collect. No location data, no contacts, no access to your photos, no advertising identifier. No trackers, no ads, no resale to anyone. The app contains no analytics tool.

Who else sees this data

Brevo (Sendinblue SAS, France) delivers the sign-in codes by email or SMS. It only receives the destination address or number, and the code itself. It does not see your weight or your plan.

Google, only if you choose "Sign in with Google", and only to verify your identity.

OVHcloud (OVH SAS, France), which hosts the server where your data resides.

No other recipient. No data is sold, rented or transferred.

Where it is stored

On an OVHcloud server located in the European Union. Your data therefore never leaves the European Economic Area, and no transfer to a third country takes place. Communications between the app and the server go exclusively over HTTPS. Each account's data lives in a file of its own, separate from those of other users.

How long

• Your account and your plans: as long as your account exists. Deleting it erases them.
• Sign-in codes: ten minutes, then they expire.
• Sessions: one month, then you have to sign in again.
• Backups: fourteen days, then they are destroyed.
• The server's technical logs, which keep the IP address of every connection for security and diagnostics: fourteen days, then they are erased. Legal basis: the legitimate interest in protecting the service.

Your rights

The General Data Protection Regulation gives you rights of access, rectification, erasure, restriction, objection and portability over your data.

Your profile and your plans can be edited directly in the app.

To erase your account, go to Settings, then "Delete my account". The erasure is immediate and final: account, plans, weigh-ins, tracked meals, shopping lists, archived plans and open sessions leave together, and nothing is kept. If you no longer have access to the app, the procedure is described at aveltek.com/squaremeal/en/delete-account.

For anything else, write to privacy@aveltek.com, an address dedicated to these requests: we reply within one month.

If the reply does not satisfy you, you can lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, France, at cnil.fr/plaintes.

Minors

Square Meal is restricted to adults. Account creation is refused below 18, and this limit is enforced by the server, not merely displayed.

This is not a precaution of form. The app processes health data and offers weight loss: two topics on which a minor audience deserves protection we are not in a position to provide, starting with obtaining a parent's consent.

If you notice that an account has been created by a minor, write to us at privacy@aveltek.com and it will be deleted.

Changes

Any modification to this policy will be published on this page, with its date. A substantial change will be signalled to you in the app.

In case of discrepancy between the language versions of this policy, the French version prevails. Version française.