Privacy Policy for MyMensa

Last updated: 26 September 2026

Complete before publication: The provider’s full legal name, postal address and contact email, plus the actual retention periods for hosting and backend logs. This draft reflects the current app code and planned hosting setup.

Controller

Using the website

This website provides information about MyMensa and its legal notices. It currently has no account registration, contact form or first-party analytics. When the site is served through the planned Vercel hosting, technically necessary connection data is processed. This may include your IP address, the time of access, the requested file, and browser and device information. The purpose is to deliver and protect the site (Article 6(1)(f) GDPR). The actual retention period and any transfers outside the EEA must be checked against the hosting configuration before launch. [CHECK RETENTION PERIOD / INTERNATIONAL TRANSFERS]

See Vercel’s privacy notice. The font used for icons is served with this website; displaying these icons does not connect to Google Fonts.

The website reads your browser’s preferred languages to show the German or English version. If you switch languages manually, your choice is saved in your browser’s local storage. This saved preference is not sent to us and can be removed by clearing your browser data.

Using the iOS app

MyMensa displays publicly available canteen and meal information. The current app does not require an account. It retrieves canteen and menu data from the MyMensa backend hosted by Convex. Depending on the source, images may be loaded from that backend or the original image server. The service receiving a request also receives technically necessary connection data, such as your IP address. This processing is needed to provide the app (Article 6(1)(b) GDPR). The configured Convex deployment is in the eu-west-1 region. The provider’s logging practices and retention periods must be confirmed before publication. [CHECK CONVEX LOGS AND RETENTION]

Some menu information comes from Studentenwerk Dresden. Its own privacy information applies when you open links to its websites.

Data stored on your device

Favourite canteens, downloaded menu data and cached images are stored on your device so content can load faster and, in part, remain available offline. Under the current app setup, this local data is not synced with an account. You can remove it by deleting the app. Allergen selections currently last only for the active app session.

Maps and location

The app displays canteen locations using Apple MapKit. If you use the map’s location feature and grant permission in iOS, Apple processes location data under its own terms. You can change location access in iOS settings. The canteen list works without location access. See Apple Maps and Privacy.

Analytics, advertising and notifications

The current app and website code contains no first-party analytics or advertising platform and uses no tracking cookies. MyMensa currently has no personalised advertising or user accounts. This notice will be updated before any such features are introduced.

Recipients and security

Vercel may receive data to host the website, Convex to provide the backend, and Apple to provide map features. Network requests use encrypted HTTPS connections. Other recipients receive data only where needed to operate the service or meet a legal requirement. Any processing outside the EEA and the safeguards that apply must be documented against the actual contracts and settings before publication. [CHECK PROCESSING AGREEMENTS / INTERNATIONAL TRANSFERS]

Your rights

Subject to the GDPR, you may request access, correction, erasure, restriction of processing and data portability, and you may object to certain processing. You can also complain to a data protection authority. Contact [CONTACT EMAIL] to exercise your rights. You can delete locally stored app data by removing the app.

Changes

We will update this notice when the app, website or service providers change. The current date is shown at the top of this page.