Privacy policy

Who is responsible

Responsible for the data processing (controller) is Jan Kolberg (JayKayCooperations), the operator of Mensa Menu. Postal address: c/o Online-Impressum 11291, Europaring 90, 53757 Sankt Augustin, Germany.

For all questions about data protection, write to [email protected].

Visiting this website

The website is hosted on Firebase Hosting, a service of Google. When you open a page, the server processes the technical data your browser sends, in particular your IP address, the date and time, the requested page, and your browser and operating system. This is necessary to deliver the website and to protect it against attacks (Art. 6(1)(f) GDPR). We do not create user profiles from this data.

The website uses no cookies, no analytics tools and no content from third parties. Fonts and images are served by this website itself. If you choose a language or an appearance, your choice is saved only in the local storage of your browser, so that it is kept for your next visit; it is never sent to us.

Links to Google Play, the App Store and jaykaycooperations.com lead to other providers, whose privacy policies apply there.

Using the app without signing in

When the app starts for the first time, it creates an anonymous account with a random ID at Firebase Authentication. You do not provide any personal details for this. The ID links the following data to your installation:

• your answer to the setup question how you heard about Mensa Menu,
• the dishes you mark as eaten (date, dish, course, portions, time of marking and, if used, time of the health export),
• usage data for the notifications: time of your last app use, number of sessions, platform and app version, time of your last rating and of your last marked meal,
• your notification settings and, if notifications are on, the push token of your device together with platform, language and app version.

The menu, your filters, your language, the colour theme and all other settings are stored only on your device.

Signing in

To rate dishes, you sign in with an email address and password or with Google, Apple, Microsoft or GitHub. Firebase Authentication then stores your email address, the sign-in method and, depending on the provider, your name and profile picture as the provider transmits them. If you sign in with a provider, it learns that you use Mensa Menu; its own privacy policy applies. If you sign in with email and password, the app keeps these sign-in details on your device to sign you in again.

Your ratings (taste, appearance and value for money per dish and day) are stored with your account. Other users only see the average rating of a dish, never who rated it.

Notifications

Notifications are only sent if you allow them on your device and in the app, and every kind can be switched off separately (Art. 6(1)(a) GDPR). To decide which notification to send, our server compares your ratings with the upcoming menu and takes the time of your last app use into account. Notifications are delivered via Firebase Cloud Messaging and, on iPhones, the Apple Push Notification service. Which notifications were sent is logged for seven days, so that you receive at most one per day.

Health Connect and Apple Health

If you enable the health export, the app writes the nutrition values of the dishes you mark as eaten to Health Connect (Android) or Apple Health (iOS) on your device (Art. 6(1)(a) GDPR). The app does not read any health data, and nothing from the health app is sent to us. You can revoke the access in the health app at any time; entries that were already exported stay there until you delete them.

Protection against abuse

To make sure that requests to our servers come from the genuine app, the app uses Firebase App Check, which relies on Google Play Integrity on Android and Apple App Attest on iOS. These services check the integrity of the app and the device without us receiving personal data from them (Art. 6(1)(f) GDPR).

Service providers

The app and the website run on Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the data on our behalf. The database is located in Belgium (europe-west1). Google may also process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has determined an adequate level of protection.

The images and translations of the dishes are generated on our server from the names of the dishes only; no personal data is involved. We do not sell your data and do not use it for advertising.

Legal bases

• Providing the app and its features, including your account, ratings and marked meals: Art. 6(1)(b) GDPR.
• Notifications and the health export: your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time in the app or in the system settings.
• Operating and securing the website and the app, and the question how you heard about Mensa Menu: our legitimate interest under Art. 6(1)(f) GDPR.

How long data is kept

Data linked to your account is kept until you delete your account; see Delete your account. Push tokens of devices are removed when you sign out, when they become invalid or after 60 days without use. The log of sent notifications is deleted after seven days. Google deletes the server logs of the website after a short time.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to object to processing based on legitimate interests. You can withdraw a consent at any time with effect for the future. Write to [email protected] to exercise these rights. You also have the right to lodge a complaint with a data protection supervisory authority.

Children

Mensa Menu is intended for students, employees and guests of the University of Stuttgart and is not directed at children.

Changes

We update this privacy policy when the app or the website changes. The date at the top shows the current version.