Privacy Policy
Last updated: 3 August 2026
This policy covers two separate things: the Zmittag Android/iOS app, and this website at mensa.davidemarcoli.dev. They do not handle data the same way, so they are described separately below. If you are here from the Google Play listing, the section that applies to you is The Zmittag Android/iOS app.
Both are operated privately by Davide Marcoli. This is an independent, unofficial project. It is not affiliated with, endorsed by, or connected to the operators of the restaurants whose menus it shows.
The Zmittag Android/iOS app
The app has no accounts and no sign-up. It contains no analytics, no advertising, no crash reporting and no third-party tracking SDKs. Nothing you do in the app is profiled, sold or shared.
Location
The app has one optional setting called “Only when I'm at work”. It is off by default, and the app asks for your explicit agreement before requesting any location permission.
When you turn it on, the app checks your device's location at the moment the daily menu notification is due — including when the app is closed or not in use. That is why Android/iOS asks for background location access. The check exists for one purpose: to skip the notification when you are not at the office.
Your location is compared on your device against two fixed addresses (Hardturmstrasse 201 and Pfingstweidstrasse 110 in Zurich). Only the yes/no result of that comparison is used, and it is used immediately to decide whether to post a notification. Your coordinates are never stored, never written to a log, and never sent to any server — not to us, not to anyone else.
Turning the setting off stops all location access. You can also revoke the permission at any time in Android under Settings → Apps → Zmittag → Permissions.
What the app sends over the network
To show menus, the app requests them over HTTPS from the menu API operated for this project. Those requests contain only what is needed to answer them: which restaurant, which day, which menu language, and for the statistics screen a date range. They contain no account, no device identifier and no advertising ID.
As with any request on the internet, the server necessarily receives your IP address in order to send a reply. It is used to operate and protect the service and is not used to build a profile of you or to identify you as a person.
What stays on your device
Your settings (chosen restaurant, theme, accent colour, menu language, notification time) and a cache of recently loaded menus are stored locally so the app works offline. This data never leaves your device and is deleted when you uninstall the app or clear its storage.
Notifications are generated on your device. No push service is involved and no server is told when or whether you received one.
Permissions and why they exist
- Internet / network state — to load menus and to know whether you are offline.
- Notifications — to show the optional daily menu notification.
- Location (approximate, precise, background) — only if you enable “Only when I'm at work”, and only as described above.
This website
Unlike the app, this website does use analytics. This section applies only when you visit mensa.davidemarcoli.dev in a browser. None of it is present in the Android/iOS app.
Umami (self-hosted on our own infrastructure) records aggregate usage: page views, referring site, approximate country, browser and operating system. It is cookieless, does not track you across other websites, and is not used to identify individual visitors. Because it is self-hosted, this data is not passed to an external analytics company.
Vercel Speed Insights collects anonymous performance measurements (such as page load timings) so the site can be kept fast. Vercel Inc. processes this data as our hosting provider.
The website is also served by our hosting provider, which processes connection data such as IP address as a technical necessity of delivering the page.
Sharing, retention and your rights
No data from the app or the website is sold, rented, or shared with advertisers or data brokers. Data is disclosed only if we are legally required to do so.
Menu data itself is public information and contains nothing about you. Because the app stores no personal data on any server, there is no account to delete — uninstalling the app removes everything it kept. Website analytics are retained only in aggregate form.
Under Swiss data protection law (FADP) and, where it applies, the GDPR, you have the right to information about, correction of, and deletion of personal data concerning you, and the right to lodge a complaint with a supervisory authority. Given how little data this project handles, most such requests can be answered simply by pointing at this page — but you are welcome to ask.
The app is not directed at children and does not knowingly collect data from them.
Changes
If this policy changes in a way that affects what the app does with your data, the updated version will be published here with a new date, and the change will be reflected in the app's Play Store listing.
Contact & Support
For questions about privacy, or to exercise any of the rights above, contact: [email protected]
For general support, bug reports, and app feedback, visit our Support page or reach out directly at [email protected].