Melu

Privacy Policy

Last updated: April 26, 2026

Disclaimer

Melu is an informational tool. It is not medical, nutritional, or allergy advice. Our scores are designed to help you think about packaged food choices for your child — they are not a substitute for reading the actual product packaging or consulting your pediatrician.

Melu does not identify allergens or evaluate products for allergen safety. Product data comes from third-party sources and may be incomplete or out of date. Always verify ingredient and nutrition information on the actual packaging, especially if your child has food allergies.

When you first open the app, you are asked to acknowledge this disclaimer before proceeding.

What Melu Does

Melu helps parents evaluate packaged food for their children. You scan a product barcode or take a photo of a nutrition label, and Melu returns an age-appropriate score with a plain-language explanation.

Information We Collect

We want to be specific about this, because vague privacy policies are annoying. We split this into what we collect from everyone vs. what we collect only if you choose to sign in.

Always (signed in or not)

Product barcode numbers — When you scan a product, the barcode number (e.g., 012345678901) is sent to our servers to look up nutritional data. This is a product identifier, not personal information.

Photos of nutrition labels — If a product isn't in our database, you can photograph the label so we can analyze it. The photo is sent to a third-party AI service for text extraction and analysis. The photo is processed in real time and is not stored by Melu after the response is returned. We do not retain, archive, or use these images for any other purpose.

Anonymous usage signals — The app sends lightweight usage signals to our servers, such as scan events and product interactions. These signals include a randomly generated device identifier but do not contain your name, email, or any personal information. If you later choose to sign in, these signals may be associated with your account. Usage signals are never shared with third parties.

Only if you choose to sign in

Sign-in is optional. The app is fully functional without it. If you sign in (using your Google or Apple account), we collect and store the following on our servers so your data follows you across devices:

• Email address — used to identify your account and link it to your synced data. We do not use it for marketing or share it with third parties.
• Child profile data — the age group (e.g., "toddler") and optional initials or nickname you entered for each child.
• Scoring preferences — your additive, sugar, and processing preferences.
• Scan history — the products you've scanned and the scores generated.

If you don't sign in, none of the above is sent to our servers — child profiles, preferences, and history stay on your device only.

What we never collect

• Your phone number or physical address
• Your location
• Advertising identifiers (IDFA, ad IDs, etc.)
• Third-party usage analytics or cross-app behavioral tracking
• Health, biometric, or financial information about you or your child
• Contacts, calendar, microphone, or any data outside what's described above

How We Use Product Data

When you scan a barcode, we look it up against third-party food nutrition databases to retrieve nutritional information. If the product is found, the nutritional data is used to generate an age-appropriate score.

If you submit a label photo, it is processed by a third-party AI service to extract nutritional facts and ingredients. The extracted product data (not the photo) is cached on our servers for up to 30 days so that future scans of the same product are faster and don't require another photo. This cached data contains only product information — never anything about you or your child.

Third-Party Services

Melu uses the following third-party services to function:

Google Sign-In — If you choose to sign in with Google, Google authenticates you and shares your email address with Melu. We do not receive your password or any other Google account data. See Google's privacy policy.

Apple Sign-In — If you choose to sign in with Apple, Apple authenticates you and shares your email address (or a private relay address) with Melu. We do not receive your password or any other Apple account data. See Apple's privacy policy.

Anthropic — Processes label photos and analyzes nutritional information. Data sent via their API is not used to train their models. See Anthropic's privacy policy.

Food nutrition databases — We use third-party databases to look up product nutrition data by barcode. Only product identifiers are sent — never personal information. These include FatSecret, Open Food Facts, and USDA FoodData Central.

Cloud infrastructure — Our app and data are hosted by cloud infrastructure providers. Account data is encrypted in transit (TLS) and at rest. These include Vercel, Upstash, and Neon.

We do not use any third-party advertising SDKs, analytics platforms, crash reporting tools, or social media tracking pixels. The anonymous usage signals described above are collected by our own servers and never shared.

Children's Privacy

Melu is designed for parents to use on behalf of their children. The app is not intended to be operated by children directly, and we do not knowingly collect data from children.

Child profile information (optional initials or nickname + age group) is entered by the parent. If you are not signed in, this information stays only on your device. If you choose to sign in, it is stored on our servers and associated with your account so it syncs across your devices. Either way, it is never sold, shared with advertisers, or used for any purpose other than generating age-appropriate scores for you.

When we generate a food score, only the age group category (e.g., "toddler" or "preschool") is used in the scoring logic — not your child's initials or any identifying information.

We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that threshold applies). If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

Camera and Photo Library Access

Melu requests access to your device camera to scan barcodes and photograph nutrition labels. Melu may also request access to your photo library so you can select an existing photo of a label. These permissions are used solely for food product identification. We do not access your camera or photos for any other purpose.

Data Storage and Security

Server-side data (cached product info and, for signed-in users, your account data) is stored using cloud-hosted databases with encryption in transit (TLS) and at rest. We do not maintain long-term databases of user activity.

Child profile data and scan history stored on your device are subject to your device's own security settings (passcode, Face ID, etc.). If you delete the app, local data is deleted with it.

Data Retention

• Label photos: Not retained. Processed in real time and discarded.
• Cached product data: 30 days, then automatically deleted.
• Local device data (not signed in): Persists until you delete the app.
• Account data (signed in): Retained while your account is active. Deleted within 30 days of an account deletion request.
• Server logs: Minimal server logs may be retained for up to 7 days for debugging. These logs do not contain personal information.

Your Rights and Choices

You have the following rights regardless of where you live:

• Use the app without an account. Sign-in is optional.
• Sign out at any time. Sign out from the Profile screen in the app. Local data on your device is preserved; synced data remains on our servers tied to your account until you request deletion.
• Delete your account and all associated data. Open the app and go to Settings → Delete Account. You can also email support@heymelu.com from the address you used to sign in. All account data — child profiles, preferences, and scan history — will be deleted immediately.
• Access or correct your data. Email us and we'll provide a copy of the data tied to your account, or correct anything that's wrong.
• Delete all local data by deleting the app from your device.
• Revoke permissions (camera, photo library) at any time through your device settings.

If you are in California, the EU/UK, or another jurisdiction with specific privacy laws (CCPA, GDPR, etc.), the rights above apply to you. We do not sell personal information.

Changes to This Policy

If we change how Melu handles data, we will update this page and note the date of the change at the top. If we ever start collecting personal information (we have no plans to), we will notify users within the app before doing so.

← Back to home

© 2026 Melu. All rights reserved.