Privacy

Signing in happens through Google. The app never sees your Google password; what it receives back is your email address, the name on your Google account, and an account identifier. Those three are stored, along with the date you joined, whether your account has been approved, and how many times an incorrect access code has been entered for it.

If you ask for access without a code, the app stores the moment you asked and, if you wrote one, the short note you typed. The note is optional, it is capped at 280 characters, and it is visible only to the person who runs the app — it is never shown to your household, to other members, or anywhere in the app itself.

If you ticked the box offering to receive occasional email, the app stores the date and time you ticked it. It stores a date rather than a yes/no precisely so that it can say when you agreed. Nothing is being sent: this app has no mailing list and no way to send email at all. Being approved does not email you either — you simply find you are in the next time you open it. If that ever changes, this paragraph changes with it.

It also stores your display preferences — how you like meal lists laid out, and whether you want the light or dark palette — because those belong to you rather than to your household, and your choice should not change what anyone else sees.

When you first open the app it reads your device’s time zone from the browser and stores it once, for your household, so that “today” means the right day. That is the only thing the app reads from your device that you did not type.

Everything the app is for: meals and their notes, ingredients, quantities and units, prices, which shop you buy each thing at, your own shopping categories, planned weeks, and shopping lists past and present. If you invite someone, the email address you type is stored until the invite is accepted or expires.

Photos you upload are kept in private file storage, each under your household’s folder with a random filename. The app shows them only to people signed in to your household. A link to one of your photos does not open for anyone else, signed in or not. Stock photos the app picks for you come from a public photo library and are shared by everyone who uses the app.

If you send a report from the account menu, it is stored with your words, the screen you were on and your name and email address. The person who runs this app reads reports from every household — that is how they get fixed. Nobody else in your household sees yours.

The screen is recorded automatically, with anything identifying stripped out of it: an invite link records as /invite/[token], a meal as /meals/[id].

This is the point of the app rather than a side effect. A household is one shared kitchen: every member sees every meal, every staple, every price and every grocery run, and can edit or delete any of it. Items record who added them, so your name appears next to the things you add. There is no private area within a household.

People outside your household see none of it. Joining a household requires an invite sent to a specific email address, and signing in with that exact address.

Google handles sign-in. On the sign-in page only, your browser loads Google’s sign-in script directly from Google; no page inside the app loads any third-party script.

Supabase hosts the database, the file storage and the authentication service, and Vercel hosts the app itself. Between them they hold everything described above.

Kroger’s public API supplies product details and prices. Those requests carry the words you type when searching for an item, the product and store identifiers involved, and — only when you are looking up a shop — the postal code you enter to find one. They do not carry your name, your email address, your account identifier or anything identifying your household; the app authenticates to Kroger as itself, not as you.

x.ai powers the optional ingredient suggestions when you create a meal. If you use it, the dish name you typed is sent, and nothing else — no account details, no household data, no other ingredients. Pexels supplies stock meal photographs and receives the search term, usually the meal name.

Images are loaded by your browser from wherever they live — Kroger for product pictures, Pexels for stock photographs, Supabase for anything uploaded — and store logos come from Google’s favicon service. As with any image on any website, the company serving it can see that your browser asked for it.

There are no adverts, no analytics, no tracking pixels and no third-party measurement of any kind anywhere in the app. Nothing about you is sold, rented or shared with anyone beyond the services listed above, each of which is used only to make a specific feature work.

The only cookies set are the ones that keep you signed in. Because the app sets nothing for tracking, there is no cookie banner — one would imply a choice that is not being made behind your back.

Your household’s data is kept for as long as the household exists, because a meal planner whose point is what you cook on repeat is not much use if it forgets. Nothing is deleted on a schedule.

You can delete meals, ingredients and grocery runs yourself from inside the app at any time, and the operator can wipe a household’s meals, ingredients and runs outright. To have your account and everything associated with it removed, write to andywaddell98@gmail.com and say so. Bear in mind that a household is shared: removing your own account does not remove meals or staples your household is still using, because they belong to the household rather than to you alone.

If what the app does changes, this page changes with it and the date at the top moves. It is written and maintained by the same person who runs the app; questions, corrections and requests all go to the same address: andywaddell98@gmail.com.