Privacy Policy

Last updated: 2026-11-02

This policy explains what the Hello Meal Telegram bot (@hello_meal_bot) and its Mini App and web app do with data.

When a release changes what is kept, this page will say so before it does, and its date will change.

The short version: there is no account and no password, because Telegram already knows who you are. What the bot needs is stored on one server and used for nothing else. There is no analytics, no advertising, no profiling and no third party with a copy.

Who is responsible

Gabriele Proietti Mattia (https://gpm.name), reachable at apps@gpm.name, is the data controller. The server is in Germany.

What is stored

Everything below is stored because the bot cannot do its job without it, and nothing is stored that it can do its job without.

Who you are on TelegramYour Telegram numeric id, first and last name, username and language code, as Telegram gives them. The id ties what you do to you; the name is what the bot greets you by; the language sets which of the two translations you read.
When you were aroundThe last time you used the bot or the app, and which days you used them, through the bot or through the app. Also, for everybody together and not for you, how many requests the app received each day.
Where you are in the conversationThe screen you are on and the message the bot last sent you, so a button pressed tomorrow still knows what it refers to.
Your homesA home has a name, a time zone, the times of the evening-before message and of the expiry notice, which meals it counts (lunch and dinner, and breakfast and a snack if you switch them on), how many ovens and rings it has, and a short list of what is always in the house, such as salt and oil. It also has its members, each with a role (owner, editor or viewer) and switches for the messages they want, and the invitations still waiting.
Your recipesThe name, portions, ingredients (with the amount kept apart from the name) and steps, with their durations, of the recipes you write or copy. The built-in recipes are the same for everybody and are not about you.
Your plansThe recipes and portions of a plan, the days and meals they are put on, who eats each meal, and who took themselves off one. The answers to the questions the plan asks, such as which pantry product an ingredient is.
Your sessionsA session copies the steps of the recipes when you start it: which steps are done, which are running, who is cooking, and the time each timer ends. The message the bot keeps up to date in the cook's chat is remembered so it can be edited.
Your portionsFor each set of portions: the recipe, how many, whether in the fridge or the freezer, the day it was cooked, its expiry date or the estimate while frozen, the calories and macros per portion at the moment of the close, and a log of each time one was eaten, thrown away or moved, with who did it.
Nutrition valuesA value you type for an ingredient, or, if you confirmed a product on Open Food Facts for it, that product's barcode, name and values per 100 g. See Open Food Facts below. The table of common foods is not stored about you: it ships with the bot.
Your goalsIf you switch them on in Pro: a calorie goal and a protein goal for a day. They belong to you. Nobody else in a home sees them. Without Pro they are not shown, and they are kept for if it comes back.
Links to other botsWhen a link to Hello Pantry or Hello List exists: which home it is for, who asked for it, the name of the other home or list, its state, the last answer the other bot gave (kept to show when it does not answer), and the writes waiting to be sent. See below.
PurchasesWhether Pro is active and until when, whether it renews, and the payment identifier Telegram reports to the bot so that a refund is possible. Purchases made with Telegram Stars only.
BansIf you are banned for breaking the rules of use: when, until when, and the reason, which only the person running the service sees.
Pro given by handIf the person running the service gives you Pro: until when, and a note only they see. That, and every ban, is also in a log of who did what to whom, and when.
Reports you sendThe title and text of a bug report, and the language and the version you were using. An email address, if you chose to type one, is not kept here: it only travels with the report. See below.
Messages for youMessages the bot has to send to you, and for 30 days after they are sent. Invitations stay longer: the owner's list of who was invited reads from them whether the message was delivered. The messages are: invitations and their answers, that you were taken off a home, a timer, that the portions of a session are ready, that a cooking session was abandoned, what is for lunch, that a meal tomorrow is in the freezer, that portions are about to expire, that a link was answered or ended, that a call to Hello Pantry or Hello List failed, that a report could not be delivered, that Pro was given or taken back by hand, and a message from the person running the service to everybody. Only the timer comes with a sound.
A browser sessionIf you sign in to the web app with Telegram: a record that the browser is signed in, its type as the browser reports it, when it was last used and when it expires. The cookie itself is not stored, only a code derived from it. The session lasts 90 days from the last use, or until you sign out; then it no longer works, and the record stays.

Who can see it

Only you, for what is yours, and the bot and the apps on your behalf.
The members of a home you share. Everyone in a home, viewers included, reads what is in it: its recipes, plans, sessions and portions, and who else is in it. What each role may change is: a viewer reads and takes themselves off a meal; an editor also writes recipes and plans, runs a session and marks portions eaten, moved or thrown away; an owner also changes the home’s settings, invites and removes people, manages the links, exports and deletes. Sharing a home needs Pro. Nobody is put in a home without accepting an invitation.
Your goals are seen by nobody but you, not even the owner of a home you are in.
The person who runs the service can read the database. That is one person, who administers the server, and can therefore read everything stored. It is not looked at except to keep the service working or to answer a report you sent.
Nobody else. Nothing is sold or shared, and no third party holds a copy beyond the lookups on Open Food Facts described below.

What is never stored

No payment details. Pro is paid in Telegram Stars. Telegram tells the bot that a payment happened and gives it an identifier for it; a card number, a name on a card or a billing address never reach the bot, because Telegram never sends them.
No password, and no email address to sign in. Signing in is done with Telegram only. The one address the bot can receive is the one you choose to type in a report.
No location, no contacts, no files.
No analytics and no advertising identifiers. There is no third-party SDK anywhere in this bot: nothing measures how you use it and nothing reports on it. The counts above are kept by the service itself, on its own server.
No message history. The bot reads a message to act on it and keeps what that message was about, not the message.

Reports and purchases: apps-management

apps-management is the service that handles licences and feedback for the apps in this family. Two things reach it from Hello Meal:

Pro purchases. A purchase made with Telegram Stars is recorded there under the Telegram payment identifier, which is how a licence is checked and a refund traced. No card or billing details are involved, because there are none.
Bug reports. What you send from the information section of the bot or of the app is forwarded there, together with the version you were using and, if you typed one, your email address, which is the only way an answer can reach you. Hello Meal does not keep that address. With the report goes a key derived from your account, which tells the reports of one person from those of another without saying who that person is. When the app talks to apps-management, for a report or for the list of ideas, your IP address goes too, for the limits on how much can be asked. There is no list of your reports, and the ideas of other people can be read but not proposed or voted on from here.

Open Food Facts

Calories and macros per portion are worked out from the ingredients. For an ingredient, Hello Meal takes the first of these that has values: a value you typed; the Open Food Facts entry of the exact product, when you searched for it or scanned its barcode and confirmed it; otherwise the table of common foods.

What is sent. Only when you ask: the words you typed to search, or the barcode, go from the server to Open Food Facts, with your language, and nothing that says who you are or which home it is for. The request also carries the name and version of this service and a contact address, as Open Food Facts asks of whoever uses it. For a product that is not food, Open Food Facts can pass the code on to its sister projects. What comes back is shown to you to confirm. Nothing is sent about a recipe, a plan or a portion. Open Food Facts handles the request under its own privacy policy and terms of use, not this one.

What is stored. When you confirm a product, its barcode, its name and its calories, protein, carbohydrates and fat per 100 g are stored for that ingredient of that recipe, and nowhere else. They are not copied into the table of common foods and they are not shared with anybody. They go when the recipe or the home does.

Attribution. The values taken from Open Food Facts are information from Open Food Facts, made available under the Open Database Licence (ODbL). Where one is shown, it is marked as coming from there.

The table of common foods

For the foods people use every day, “chicken breast” and “onion” rather than a package, Hello Meal has a table that ships with the bot, with calories, protein, carbohydrates and fat per 100 g of raw food, and of basics as sold, such as oil, dried pasta and milk (canned legumes and tuna are the drained weight). Its values come from USDA FoodData Central, the United States Department of Agriculture’s food composition database, which is in the public domain (CC0) and asks to be credited. This is the credit. USDA does not endorse Hello Meal. Nothing about you is sent anywhere to use it: the table is part of the bot.

Because the values are for raw food or as sold and the amount of a piece is often a guess, a number built from them is an estimate, which is why it is marked “≈”.

Links to Hello Pantry and Hello List

Hello Meal can be linked to Hello Pantry and to Hello List, two other bots of this family. Neither link is available yet. They arrive after the first release, one at a time, and this page already says what they do so that you can decide beforehand.

Consent comes from the other side. From Hello Meal you ask to link. The other bot sends you a message with two buttons, and there you choose the home or the list. Until you do, nothing is shared. The only thing compared between the two bots is your Telegram account. A person who has not started the other bot is told so.
The link acts for you, with your rights and no more. If you are not allowed to do something in the other bot, a link does not let Hello Meal do it. Anybody else in the Hello Meal home acts through you, which is what being in the same home means.
Either side can end it, and deleting your data ends the links you asked for. The other bot never calls Hello Meal: it learns nothing about Hello Meal that Hello Meal does not send in a call you caused.
The other bot keeps a record of the link too: which Hello Meal home it is for, whose consent it is, its state, and the calls it received, so that a call sent twice is done once.

Hello Pantry. This link is not available yet.

Hello Meal reads what the home holds, as totals per product and as lots with their expiry and place. The last answer is kept, so that if Hello Pantry does not answer Hello Meal shows it with its age.
Hello Meal writes, after you confirm a screen that lists every line: the ingredients taken from the pantry, and the portions of a session as lots in the fridge or freezer you chose, with their name, how many, and their expiry. Afterwards, eating, moving or throwing a portion in Hello Meal changes that lot. A write that cannot go through waits and is sent again, with the same key so that it cannot be done twice. The close can be undone for ten minutes.
Hello Pantry’s own rules apply: if it says no, for instance because the free plan has no freezer, the portions stay in Hello Meal, counted here, and the screen says why.
If the link ends, the portions already in Hello Pantry stay there, and Hello Meal counts the ones it knows about itself.

Hello List. This link is not available yet.

Hello Meal reads the list you chose, to see what is already on it and not ticked.
Hello Meal writes what is missing from a plan to that one list, each item with its amount written out, such as “500 g”, when you press the button.

Deleting a home that is linked sends the other bot a revocation first. What is in the other bot belongs to the other bot’s home and stays there; it is governed by that bot’s privacy policy.

Session timers

A timer is a row with the time it ends. When that time comes, the bot sends the cook one message in the Telegram chat, with a sound and the buttons Done and “5 more minutes”. The bot checks every few seconds, so a timer can arrive a few seconds late. What is sent is the step and the recipe it belongs to; it goes through Telegram, like everything in the chat, and to nobody else. The chat is kept quiet on purpose: apart from the timer, nothing the bot sends makes a sound. A session nobody has touched for 24 hours is abandoned and stops sending.

Telegram’s part

You are talking to this bot through Telegram, and Telegram carries what you send. What Telegram does with that is covered by Telegram’s own privacy policy, not by this one.

Two consequences worth stating plainly:

Telegram knows you use this bot, and when.
A Telegram chat with a bot is not end-to-end encrypted. Telegram can read it, the same way it can read any cloud chat.

The Mini App and the web app

The Mini App is a page served from https://hello-meal-tg.gpm.name. Inside Telegram, every request it makes carries the session Telegram signs for it, which is what proves the request is yours.

The web app at https://hello-meal-app.gpm.name is the same page, opened in a browser, with the Telegram sign-in. It keeps a session cookie in the browser so that you stay signed in until you sign out.

The page loads its fonts from Google Fonts and two scripts from Telegram: the one every Mini App needs and, in a browser, the sign-in button. Google and Telegram therefore see the request for those files. Nothing about you is sent with it beyond what any browser sends when it fetches a file.

Deleting your data, and how long things stay

Your data stays until you delete it. Nothing of yours is deleted on a schedule, except the following, which is housekeeping:

the record of a call to Hello Pantry or Hello List is removed after 30 days, in Hello Meal and in the other bot;
a browser session stops working 90 days after its last use, though the record of it stays;
a message the bot has sent is removed after 30 days, except an invitation;
a session of cooking nobody has pressed for 24 hours is marked abandoned. Its steps are not deleted: they go with the home.

Export is a button for Pro: the owner of a home gets its data.

Delete a home is a button for its owner. The home disappears at once, for every member, after a confirmation, and cannot be restored. It takes with it its members, invitations, recipes, plans, sessions, timers, portions and links, and the messages not yet sent. The lots in Hello Pantry stay: they belong to that kitchen. The one call that ends an open link in the other bot still goes out after the home is gone.

Delete all data is a button in the bot and in the app, for everybody. It deletes, permanently and at once, in one go: the homes you are alone in, with everything in them; you from the homes you share (a home you own that has other members passes to the one who joined first); the times you took yourself off a meal; your goals; your invitations; the reports you sent; the messages waiting for you; and the screens the bot had stored for your chat. A link you asked for is ended, and its portions are counted by Hello Meal from then on. It is not a request that gets processed: it is gone when the confirmation comes back. Recipes and plans you made in a home that stays remain in it, no longer tied to your name.

Some things stay, so that the bot still works afterwards and the service can be run: your profile and the conversation, with the days you were around; the record of purchases (a charge in Stars is the proof of a payment, and keeps Pro) and the licence; Pro given by hand; your browser sessions; any ban, and the log of what was done to your account. What had already reached apps-management stays there. Deleting those too is a request to the address above.

Backups of the server exist for disaster recovery and are retained for a limited period. Data deleted from the live database is not restored from them.

Performance of a contract for everything the bot needs to work for you.
Legitimate interest for the operational logs the server keeps to stay working and to investigate abuse, and for the counts of use.
Legal obligation for the records a payment leaves behind.

Your rights

You may ask for a copy of your data, its correction, or its deletion, and you may object to its processing. Deletion of most of it needs nobody’s help: Delete all data does it. For anything else, write to apps@gpm.name.

You also have the right to complain to a supervisory authority.

Children

Hello Meal is not directed at children and asks for nothing that would identify one.

Changes

This page carries the date it was last substantively changed. A change that affects what is collected will be said in the changelog as well, rather than only here.