Privacy Policy

Effective October 21, 2026 · Applies to the Dinra iPhone app and the dinra.app website

1. Who we are

The Dinra app and the dinra.app website are provided by [OWNER_NAME], [OWNER_ADDRESS] (“Dinra”, “we”, “us”). We are the controller of the personal information described in this policy (the organization responsible for it).

• Privacy contact: [email protected]
• Person in charge of the protection of personal information (Quebec Law 25, PIPEDA accountability): [OWNER_NAME], reachable at [email protected]
• Data protection officer: Not appointed — at our size we are not required to have one. Privacy questions go to [email protected].

Our full company details are on the Legal notice page.

2. What stays on your iPhone

These things are saved only on your device. We don't receive them and can't see them:

• your full postal code or ZIP code (the app keeps only the first part, such as “M5V” or “770”), and the store you picked;
• household size, weekly budget, diet, allergies and foods you don't eat;
• your meal plan, shopping list, checked items, fridge items (“cook what you have”), dinners you cooked, favourites and dishes you marked “Never Again”;
• recipes or dish names you paste into the app to import favourites — they are read on your phone, not sent anywhere;
• prices you typed in yourself (an anonymous copy may be sent — see “Price corrections” in section 3);
• your settings, such as units, appearance, “Local Favourites First” and “Show Nutrition”.

Regional favourites, nutrition values and recipe photos come with the app or are calculated on your phone. They don't need your data to leave the device.

If you back up your iPhone (to iCloud or a computer), Apple includes this app data in your backup. You and Apple control that backup, not us.

Your own dish photos

If you add a photo of a dish you cooked, you pick it with Apple's photo picker. Dinra sees only the photo you choose, not your library, so it never asks for photo library access. The photo is saved in Dinra's own storage on your iPhone. It is never uploaded to us and is not public. If you tap Share, iOS shows its share sheet and you decide where the picture goes; the app or person you send it to then handles it under their own rules. Delete All Data erases your saved dish photos.

Apple Reminders

If you tap Add to Reminders and allow access, Dinra writes your shopping list into a Reminders list called “Dinra” on your device (and in your iCloud, if you sync Reminders). Dinra only looks up that one list and changes nothing else. Nothing from Reminders is sent to us. You can turn this off anytime in Settings › Privacy & Security › Reminders.

Widgets, Lock Screen and cooking timers

If you add a Dinra widget, the app saves a small copy of this week's dinners (dish names, nights, cook times, which ones you cooked, the next fridge item to use and dish photos) in a storage area on your phone that only Dinra and its widgets can read. Cook-mode timers alert you with notifications created on your phone; they show the dish name and the step. None of this is sent to us.

3. What leaves your iPhone, and why

To connect your subscription and notifications without an account, the app creates a random ID on your phone (we also call it your Support ID). It isn't connected to your name, email, Apple Account or advertising ID. Delete All Data replaces it with a new one.

Some of our service providers also receive technical data that every app sends when it connects to the internet: an Apple “ID for vendors” (IDFV — a code Apple gives each app maker on your phone, not your advertising ID), your IP address (used to work out your country), device model, iOS and app version, language and time zone. We say below which provider receives it.

None of these services receives your full postal code or ZIP code, your allergies, diet, budget amount, meal plan, dish names you import, fridge items or your own photos. We don't use GPS. The app works out your area only from the code you type.

Shop Together (iCloud sharing)

Only if you tap Shop Together in the List and invite someone, Dinra uses Apple's iCloud sharing so you can shop from one list. What is shared: the items on that week's list (name, amount and aisle, including items you typed in), the store name, the estimated “to buy” total, your first name as the list owner, and for each checkmark the time and the first name from the iCloud account of the person who checked it. What is not shared: your postal code or ZIP code, household, budget, diet, allergies, meal plan, fridge or item prices.

The shared list is stored in your own iCloud account and shown to the people you invited. Dinra has no access to it and never receives it. Apple's privacy policy applies to iCloud. To stop, tap the Shared button at the top of the List, then Stop Sharing — the list is removed from iCloud and from the other phones. A person you invited can tap Leave This List anytime. Delete All Data also stops sharing.

4. Tracking and your advertising ID

iOS asks whether Dinra may track you (App Tracking Transparency). Before that, Dinra explains why it asks. If you tap Allow, your advertising ID (IDFA) is sent to AppsFlyer so we can tell which ad or creator brought you here. If you tap Ask App Not to Track, your advertising ID is never used, and Dinra works exactly the same.

Apple's App Store privacy label lists the random ID, device IDs and purchase history as “used to track you”, because they can be linked with data from AppsFlyer and its ad partners to measure ads. You can change your answer anytime in Settings › Privacy & Security › Tracking › Dinra.

Firebase never receives advertising signals: ad storage, ad user data and ad personalization are always switched off in the app.

5. Ad partners, “sale” and “sharing”

We don't sell personal information for money, and we don't let ad networks run ads inside Dinra. The app contains no Meta or TikTok software.

When we advertise Dinra on networks such as Meta or TikTok, AppsFlyer may pass those networks the install and in-app events it measured (for example “trial started”), so they can tell us which ads worked. This never includes your name, email, postal code, allergies, diet or meal plan. Under some US state laws this may count as “sharing” for cross-context behavioral advertising, “targeted advertising” or a “sale”.

How to opt out: turn on Me › Help & Privacy › Do Not Sell or Share My Personal Information. Then AppsFlyer forwards nothing to any ad partner. If you already chose Ask App Not to Track, the switch is on automatically. You don't need an account or to give any other information.

Ad partners get events only with your permission. AppsFlyer passes events to ad partners only if you allowed tracking when iOS asked — and in the EU/EEA, UK, Switzerland and Quebec, only if you also tapped Allow on Dinra's own question.

iOS has no browser-style Global Privacy Control signal for apps. We treat your iOS tracking answer as that signal. On our website, a Global Privacy Control signal is honored as an opt-out (the website shares nothing anyway).

6. Usage stats and install measurement

One switch, Me › Help & Privacy › Share usage stats, controls usage stats (Firebase Analytics) and install measurement (AppsFlyer, including what it passes to ad partners). Once it's off, nothing more is sent, and funnel events waiting on your phone are discarded.

• EU/EEA (including Norway, Iceland and Liechtenstein), UK, Switzerland and Quebec: off by default. When you finish setting up the app, Dinra asks once whether you agree. If you tap Allow, they start. If you tap Not now or skip the question, AppsFlyer is not started, Firebase Analytics collects nothing and nothing is passed to ad partners. You can change your mind anytime with the switch.
• Until we know where you are: we go by the country you chose in the app; before you choose one, by your iPhone's region setting. Nothing is sent while the rule is unclear (for example in Canada before you enter a postal code, because we can't yet tell whether you're in Quebec). Events wait on your phone and are sent or discarded once the rule is known.
• Elsewhere (for example the US, Canada outside Quebec, Australia and New Zealand): on by default. You can turn them off anytime.

7. Notifications

Dinra sends notifications only after iOS permission (it may start with “quiet” notifications that appear only in Notification Center). You choose which kinds you get in Me › Notifications, or turn them all off in Settings › Dinra › Notifications. Cooking-timer alerts are created on your phone and don't use OneSignal.

8. The dinra.app website

The website is a static site. It sets no cookies and uses no analytics or advertising trackers. Our hosting provider, Cloudflare, Inc. (Cloudflare Pages), processes your IP address and technical request data (such as browser type and the page requested) to deliver the pages and protect them against attacks. It keeps these logs only for a short time under its own retention rules.

Waitlist emails. If a page on dinra.app offers a waitlist or reminder sign-up and you join it, we collect your email address and, if you choose, your country, only to send what you signed up for. We keep the time you agreed and the consent wording you saw as a record of your consent, and which link brought you to the page. Sign-ups are handled by our form and email service provider on our behalf. Every email has an unsubscribe link. We keep your address until you unsubscribe.

9. Who helps us run Dinra

We share personal information only with the providers named in this policy: Google (Firebase and Google Cloud), Adapty, OneSignal, AppsFlyer, our email and hosting providers, and Apple. They process it for us under contracts and may not use it for their own purposes, except where this policy says otherwise (for example, AppsFlyer's forwarding to ad partners in section 5). We may also disclose information when the law requires it, or to a buyer if Dinra is sold or merged — the buyer would have to respect this policy.

10. Allergies, diets and health-related information

Allergies and diets help Dinra pick recipes. They are stored only on your phone. The app strips any allergy or diet value from analytics events before any service sees it. They are never sent to us or our providers, never sold and never used for advertising. This also covers “consumer health data” under laws such as Washington's My Health My Data Act.

11. Legal bases (EU and UK)

If the EU or UK GDPR applies to you, we rely on:

• Contract — to provide the app and the subscription you asked for (prices, Dinra Plus, restoring purchases);
• Consent — for usage stats and install measurement (asked once after setup), notifications, your advertising ID and Apple Reminders access. You can withdraw consent anytime with the switches above; this doesn't affect what was done before;
• Legitimate interests — to improve prices, prevent abuse and answer support emails. You can object at any time (see section 15);
• Legal obligation — to keep tax and accounting records and answer privacy requests.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

12. How long we keep data

• On your phone: until you delete it, use Delete All Data or delete the app.
• Individual price corrections: 60 days (plus up to about 7 weeks in rolling server backups). Combined averages stay and point to no one.
• Usage stats linked to the app instance ID: up to 2 months; after that only totals.
• Subscription records: while you subscribe, then as long as accounting, tax and refund rules require.
• Notification records: while the app needs them, then deleted by OneSignal.
• Install source records: up to 24 months, then deleted by AppsFlyer.
• Support emails: Up to 24 months after the last message, then deleted.
• Waitlist emails: until you unsubscribe.

13. Where data is stored and international transfers

Our price server runs in Canada (Montréal). Google Firebase Analytics, Adapty, OneSignal and AppsFlyer may store and process data in the United States and other countries, where local laws may let authorities access it.

• From the EU/EEA and UK: Canada has an EU adequacy decision for organizations under PIPEDA. For transfers to the United States and other countries, we rely on the EU–US Data Privacy Framework (and its UK extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses (with the UK Addendum). Google, Cloudflare and AppsFlyer are certified under the Data Privacy Framework; for Adapty, OneSignal and our email providers we rely on Standard Contractual Clauses in their data processing agreements. You can ask us for a copy of the safeguards.
• From Canada and Quebec: information may be processed outside your province and outside Canada. Before transferring personal information outside Quebec, we assess whether it will be adequately protected, as Quebec law requires.
• From Australia and New Zealand: some recipients are overseas (mainly the United States). We take reasonable steps so they protect your information in a way comparable to the Australian Privacy Principles and the New Zealand Information Privacy Principles.

14. Your choices

15. Your rights, by region

To use any right below, email [email protected]. Dinra has no accounts, so the easiest way is to write from Me › Help & Privacy › Contact Us: the email then includes your Support ID, which lets us find records tied to your device. We may ask for more information only to confirm the request is yours. We reply within 30 days (or the shorter or longer time your local law sets, and tell you if we need an extension the law allows). Using your rights is free, and we won't treat you differently for using them. An authorized agent may contact us for you where the law allows.

EU, EEA and UK (GDPR / UK GDPR)

You can ask for access to your data, a copy in a portable format, correction, deletion, and restriction of processing. You can object to processing based on legitimate interests, and withdraw consent at any time. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office, ico.org.uk). In the EU, you can find your authority at edpb.europa.eu.

If you're in Switzerland, the Federal Act on Data Protection (FADP) gives you the same rights. You can complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

Canada (PIPEDA) and Quebec (Law 25)

You can ask to access and correct your personal information and withdraw consent, subject to legal limits. In Quebec you can also ask us to stop disseminating your information, to de-index it, and to receive computerized information in a structured, commonly used format. Our person in charge of the protection of personal information is named in section 1. We keep a register of privacy incidents. If an incident creates a risk of serious injury, we notify the Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada where required, and the people affected. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

United States (California and other states)

Depending on your state (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Washington and others with privacy laws), you can ask to know what personal information we collect, use and disclose; get a copy; correct it; delete it; and opt out of the sale or sharing of personal information and of targeted advertising (see section 5). We don't use sensitive personal information to infer characteristics about you, and allergies and diets never leave your phone. The categories we collect are identifiers (random IDs, IDFV, IP address, advertising ID only with permission), commercial information (subscription and purchase history), internet or app activity (usage stats), and approximate location (province or state, country). Sources and purposes are in section 3, and retention in section 12. If we decline your request, you can appeal by replying to our answer. If the appeal is denied, you can contact your state attorney general.

Australia (Privacy Act 1988)

We handle personal information under the Australian Privacy Principles. You can ask to access and correct your information. If you have a complaint, email us first; we will reply within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand (Privacy Act 2020)

You can ask to access and correct your information under the Information Privacy Principles. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

16. Children

Dinra is made for adults who plan family meals. It isn't directed to children under 13, or under 16 in the EU and UK (under 14 in Quebec), and we don't knowingly collect their personal information. If you believe a child has sent us information, email us and we'll delete it.

17. Security

Data sent from the app is encrypted in transit (HTTPS). Data on your phone is protected by iOS data protection. On our server we store only scrambled (hashed) identifiers and IP addresses for price corrections, and access is limited to the people who run Dinra. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you and the authorities as the law requires.

18. Changes to this policy

When we change this policy, we update the date at the top. If a change is important — for example a new kind of data, a new recipient or a new purpose — we'll tell you in the app before it takes effect and ask for consent where required.

19. Language

This English version is the binding version. Translations are provided for convenience. Where local law requires a version in your language to prevail (for example French in Quebec), that version applies to you.

20. Contact and complaints

Email [email protected] — we reply within 2 business days. Postal address: [OWNER_ADDRESS].

You can also complain to a privacy authority, such as the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, your EU data protection authority, the UK Information Commissioner's Office, the Office of the Australian Information Commissioner or the New Zealand Office of the Privacy Commissioner. We'd appreciate the chance to help first.