Effective date: September 28, 2026 · Last updated: October 12, 2026
This Privacy Policy (the “Policy”) describes how information received from users of the “Mera” mobile application and website (the “Service”) is collected, processed, stored, and protected. By using the Service, you agree to the terms of this Policy.
1. Operator
The operator of your personal data is Individual Entrepreneur Shagabutdinov Renat Khannanovich (the “Operator”, “we”), State Registration Number 324774600675720, Taxpayer Identification Number 773389350806, email: contact@mera-api.ru.
2. What data we collect
2.1. Data provided by the user
- Registration data: email address, password (stored as a hash).
- Profile data: gender, age, height, weight, target weight, activity level, rate of weight change, diet type, time zone.
- Nutrition data: meal names, portion weights, calories, proteins, carbohydrates, fats, notes, meal times, ingredients.
- Food photographs: images uploaded for AI analysis (processed transiently and not retained on our servers after analysis).
- Weight data: the history of weigh-ins with their dates.
- Support requests: subject, description, application version, operating system version, device model.
- Acquisition source: how the user learned about the Service (captured during onboarding).
2.2. Data collected automatically
- Device tokens: push token and platform (iOS/Android) for the purpose of delivering notifications.
- Usage data: number of AI requests (photo, text, assistant), activity dates, streaks.
- Payment data: subscription identifier, plan, status, period dates, amounts charged, currency; for App Store subscriptions, the Apple transaction identifier. Bank card data is processed by the payment provider YooKassa and is not stored on our servers.
- Installation and onboarding data: the application installation identifier (a random identifier the application keeps on the device) and onboarding steps, including those completed before registration. At registration the identifier is stored in the account.
- App usage data: usage events (linked to the installation identifier and, once you sign in, to your account): which screens are opened, which features are used (for example, recognising a meal from a photo), when the app is opened and sent to the background, which notifications are opened, and the app version. We use them to improve the product. The events are stored on Mera's servers for 13 months and are not shared with third parties; meal names, typed text and photos are never part of them.
- Abuse-prevention data: a bank card hash (fingerprint) computed from the first 6 and last 4 digits of the card number, the expiry date and the card type passed to us by YooKassa (the digits themselves are not stored), and the application installation identifier sent at registration. See the Personal Data Processing Policy for details.
2.3. Data from third-party services
- OAuth authentication: when you sign in through Google or Apple, we receive your user identifier and email address. Your third-party password is never transmitted to us.
3. Purposes of processing
- Providing the core functionality of the Service: calorie counting, nutrition and weight tracking, goal calculation.
- Operating AI features: analysis of food photographs, text-based meal input, the personal assistant.
- Calculating personalised goals using the Mifflin–St Jeor equation from your profile data.
- Producing analytics: averages, trends, and projections toward the target weight.
- Sending notifications: meal reminders, daily reports, nutrition tips, water reminders.
- Processing payments and managing subscriptions via YooKassa.
- Analytics of installations, onboarding completion and registrations.
- Checking eligibility for the trial period and for the “Invite a friend” programme terms, and preventing abuse.
- Handling support requests and improving the Service.
- Complying with applicable law and legal obligations.
4. Legal bases for processing
- Performance of a contract — processing necessary to provide the Service (Article 6(1)(5) of Federal Law No. 152-FZ).
- User consent — for sending push notifications and marketing communications (Article 6(1)(1) of Federal Law No. 152-FZ).
- Legitimate interest — for improving the Service and ensuring its security.
5. Transfer of data to third parties
We do not sell personal data and do not transfer it to third parties except in the following cases:
- YooKassa (LLC “YuMoney”) — processing of payments and recurring charges.
- AI model providers — processing of photographs and text requests (data is transmitted in a de-identified form).
- Apple — purchasing and verifying App Store subscriptions (a technical identifier linking the purchase to the account).
- Google / Apple — when OAuth authentication is used.
- Public authorities — on request, in accordance with the law of the Russian Federation.
6. Storage and protection of data
- Data is stored on secure servers with appropriate technical and organisational safeguards.
- Passwords are stored as hashes and cannot be recovered.
- API access is protected by JWT authentication with a token-refresh mechanism.
- Rate limiting is applied to mitigate abuse.
- Food photographs are processed in real time and are not retained after analysis.
7. Retention periods
Personal data is retained until the user deletes their account. Upon account deletion, all data is erased permanently, except bank card hashes, onboarding events and app usage events sent before sign-in: the hashes are kept without any link to the account so that the same card cannot obtain a trial period or a first month under the “Invite a friend” programme again, onboarding events are stored separately from the account, and usage events sent before sign-in (not linked to an account) are kept for up to 13 months. Usage events linked to an account are deleted with it. Payment history is retained for the periods prescribed by applicable law.
8. Your rights
Under Federal Law No. 152-FZ “On Personal Data”, you have the right to:
- Obtain information about the processing of your personal data.
- Update or correct your data through your profile settings.
- Change your email address (with a confirmation code).
- Disable push notifications and configure your notification preferences.
- Delete your account together with all associated data.
- Withdraw your consent to the processing of personal data.
9. Cookies
The Service’s website may use technical cookies to support authentication and the correct operation of the site. We do not use cookies for tracking or advertising.
10. Changes to this Policy
We reserve the right to amend this Policy. The current version is always available on this page. In the event of material changes, we will notify users by push notification or email.
11. Contact
For questions relating to the processing of personal data, please contact us: