MorselNote Privacy Policy

MorselNote works without an account. Your library stays on your device unless you choose encrypted sync, and it is never sent to the advertising SDK.

Effective and last updated: July 20, 2026

Data stored on your device

Your food diary, goals, custom foods, meals, recipes, favorites, and settings are stored locally. Morningstar Garden does not receive or sell readable diary data.

Optional end-to-end encrypted sync

If you turn on MorselNote Sync, the app encrypts your diary, recipes, meal plans, pantry, shopping lists, goals, meals, custom foods, and favorites on your device before uploading an encrypted manifest and encrypted data blocks to Cloudflare R2. After the first upload, MorselNote transfers only blocks containing changed records. Morningstar Garden and Cloudflare do not receive the encryption key and cannot read the manifest or blocks.

The sync service stores the encrypted manifest and blocks, a one-way hash of the vault access token, their sizes, update times, and storage metadata. Standard network information such as an IP address is processed to deliver and rate-limit requests. MorselNote application logs omit vault identifiers, access tokens, recovery codes, and vault contents. A recovery code contains the key and should be protected like a password; Morningstar Garden cannot recover it.

Optional Shared Kitchens

If you create or join a Shared Kitchen, MorselNote stores its recipes, menus, meal plans, grocery items, kitchen name, member display names, and membership roles in a separate end-to-end encrypted vault. Personal diary entries, nutrition goals, custom foods, and settings are not copied into a Shared Kitchen. The kitchen invitation contains its encryption key. Anyone who receives the invitation can read and change that kitchen, so it should only be shared with intended household members.

A kitchen owner can rotate access. Rotation creates a newly encrypted vault, invalidates the previous invitation, and stops previously connected devices from receiving future changes. Intended members must join again with the new invitation. Rotation cannot erase kitchen information that another device downloaded before access was rotated.

Advertising

MorselNote displays light, non-personalized banner advertising using the Google Mobile Ads SDK. Ads are not selected from your food diary, goals, searches, or past activity. MorselNote disables Google's publisher first-party identifier and marks every ad request as non-personalized.

Google and its advertising partners may still process your IP address (which can indicate approximate location), device or advertising identifiers, ad interactions, diagnostic and performance information, and advertising data to deliver ads, prevent fraud, limit repetition, and produce aggregated reports. This information may be shared with advertising partners. MorselNote uses Google's User Messaging Platform to request consent where required and displays a Privacy choices control when Google requires an ongoing privacy entry point.

Food searches and barcodes

When you search for food or look up a barcode, the search term or barcode is sent to MorselNote's nutrition-search service and food-data providers so the app can return matches. MorselNote's service forwards USDA searches to FoodData Central and uses Cloudflare for hosting, rate limiting, and response caching. Successful USDA responses, including the normalized search term used as their cache key, may remain in Cloudflare's cache for up to six hours.

MorselNote's application logs omit search terms, barcodes, IP addresses, and USDA credentials. They contain request status, cache state, timing, and a random request ID. Cloudflare, USDA FoodData Central, and Open Food Facts process standard network information under their own policies. MorselNote does not associate searches with an account or send search terms, barcodes, diary entries, or goals to the advertising SDK.

Recipe imports

When you import a recipe, MorselNote requests the web address you provide from that recipe website. The site receives standard network information associated with the request.

Optional personal USDA key

If you enter a personal USDA API key in Settings, it is stored in the Apple Keychain or Android encrypted preferences. Searches made with that key go directly to USDA FoodData Central. Secure credential files are excluded from Android cloud backup and device transfer.

Camera

Camera access is used to recognize food barcodes and encrypted sync or Shared Kitchen QR codes. Code recognition happens on the device. MorselNote does not save or upload camera photos or video.

Retention, backups, and deletion

Search-cache entries expire automatically after no more than six hours. MorselNote has no user accounts. A personal sync vault is retained until you delete it from Settings → Encrypted sync → Delete Encrypted Vault. A Shared Kitchen is retained until an owner chooses Delete kitchen for everyone. Leaving a kitchen removes its key and local copy from that device but does not delete the kitchen for other members. You can remove local diary entries and other personal app data with Settings → Delete all local data. Deleting MorselNote removes local data and keys from that device but does not by itself delete cloud vaults. Apple or Google may retain device backups according to your backup settings; you control those copies through your platform account.

Children and health information

MorselNote is not directed to children under 13. Nutrition values are estimates for general wellness and are not medical advice, diagnosis, or treatment.

Contact

For privacy questions, use MorselNote's support page and the developer contact shown in the App Store or Google Play listing for your platform.