Privacy Policy

Last updated: 13 October 2026

This Privacy Policy describes how Twenty Four Hour Preparing Meals (commercial registration #282892, trading as "24meals" / "Twenty Four Meal Prep" — referred to here as "we", "us", "the Company"), based in Doha, Qatar, collects, uses, and protects personal information from customers who use the 24meals mobile and web applications and associated services (the "App").

1. Information we collect

We collect only what we need to deliver meals to you and operate the service. We do not sell your data.

You provide directly:

• Account info — first name, last name, email, password (stored as a one-way hash, never visible to us in plaintext).
• Phone number — used for WhatsApp delivery notifications and one-time login codes.
• Delivery address — building number, street, zone, latitude/longitude (only when you pin a location on the map), and any delivery instructions you choose to add.
• Health & dietary preferences — diet type (e.g. classic / keto / vegetarian), allergens, calorie target, weight goal. Used to filter meal options for you.
• Payment details — when paying by card we use a third-party payment gateway; we never store card numbers, only a token returned by the gateway.

Collected automatically:

• Usage logs — meal selections, order history, delivery dates, timestamps. Used to operate the subscription and reconcile invoices.
• Device info — operating system, app version, language preference. Used for support and crash diagnostics.
• Push-notification tokens (if you opt in) — Firebase / APNs identifier so we can notify you about deliveries.

From connected devices and health apps (only if you connect them):

• Which services — Apple Health (on iPhone), WHOOP, Oura and Withings. Garmin and Strava reach the App only through Apple Health. You choose each one in Profile → Connected devices; nothing is read until you approve it on that service's own screen.
• What we read — steps, active and resting calories, exercise minutes, sleep duration, resting heart rate, heart-rate variability (HRV), the device's recovery / readiness score, workouts the device recorded (type, time, duration, distance, heart rate), and scale readings (weight, body fat, muscle, water).
• What we use it for — showing it to you, inside your own account: your activity and sleep beside your meals, your workouts in your training history, your scale readings in Body. That is all. It never changes your meals, portions, calorie target or deliveries, and it is never used for advertising.
• Not used for AI — data from connected devices and health apps is never sent to our AI assistant or any AI model, and is never used to train one.
• Who can see it — you. And, only if you choose to share it, your coach: the 24 coaching team, or a coach you link to your account in the App (for example by entering the coach's code). Sharing is off unless you switch it on, covers only what you choose (activity, sleep, workouts, scale readings, progress photos), and you can stop sharing or unlink the coach at any time — access ends at once. A coach sees it inside 24 only, to coach you, and may not copy, sell or pass it on. Our kitchen and drivers never see it, and it is never sold.
• How it is kept — the access keys a service gives us are stored encrypted; the data sits in our own database.
• Stopping — tap Remove on the device in Profile → Connected devices (or revoke access in that service's own app): we stop reading and delete everything that device sent. Deleting your account deletes it too.

2. How we use it

• Process subscriptions, prepare meals to your dietary requirements, and deliver them.
• Send you transactional messages — order confirmations, delivery updates, invoices — via email and WhatsApp.
• Provide customer support when you contact us.
• Comply with Qatar tax and accounting law (invoices and payment records are retained for the legally required period even after account deletion).
• Improve the App — never using identifiable data, only aggregated metrics like "X% of customers chose option 1 on Tuesday".

3. Sharing

We share information only with parties needed to run the service:

• Our delivery drivers (name + address + phone, for the day's deliveries only).
• Your coach — only if you link one or switch on sharing, only what you choose to share, and only while you stay linked (see "From connected devices and health apps" above).
• The payment gateway you use at checkout (e.g. Tap, Dibsy) — they handle card data under their own privacy terms.
• Email and messaging providers (e.g. Meta WhatsApp Business, Cloudflare email routing) — recipient address only.
• Hosting infrastructure (servers in our chosen region; we do not transfer data outside what's needed for hosting).

We do not share your data with advertisers, marketing networks, or any party that uses it for profiling or sale.

4. Your rights

• Access — see what we hold about you. Email support@24meal.qa.
• Correction — fix any field directly in the app, or email us.
• Deletion — delete your account in-app at Profile → Delete my account, or by emailing us. On deletion we anonymize your name, phone, and email; cancel any live subscriptions; and revoke all sessions. Past invoices are retained for accounting/tax requirements as required by law.
• Portability — request a copy of your data in a machine-readable format.
• Withdrawal of consent — opt out of WhatsApp / push notifications anytime from your device settings or by replying STOP.

5. Security

Passwords are stored as one-way bcrypt hashes. Sessions use short-lived JWTs with rotating refresh tokens. Traffic between the app and our servers is encrypted via TLS. Database access is restricted to authorised staff. We will notify affected customers within 72 hours of becoming aware of any incident that exposes personal data.

6. Children

The App is intended for users 13 and over. We do not knowingly collect data from children under 13. If you believe a child has provided data to us, contact support@24meal.qa and we will delete it.

7. Changes to this policy

We may update this policy occasionally. Material changes will be announced in the App or by email at least 14 days before they take effect. The "Last updated" date at the top reflects the current version.

8. Contact

Questions about this policy or your data?

• Email: support@24meal.qa
• Business: Twenty Four Hour Preparing Meals · CR #282892 · Doha, Qatar