Privacy

Signing in happens through Google. The app never sees your Google password; what it receives back is your email address, the name on your Google account, and an account identifier. Those three are stored, along with the date you joined, whether your account has been approved, and how many times an incorrect access code has been entered for it.

It also stores your display preferences — how you like meal lists laid out, and whether you want the light or dark palette — because those belong to you rather than to your household, and your choice should not change what anyone else sees.

When you first open the app it reads your device’s time zone from the browser and stores it once, for your household, so that “today” means the right day. That is the only thing the app reads from your device that you did not type.

Everything the app is for: meals and their notes, ingredients, quantities and units, prices, which shop you buy each thing at, your own shopping categories, planned weeks, and shopping lists past and present. If you invite someone, the email address you type is stored until the invite is accepted or expires.

Photos you upload are kept in file storage. Each one is saved under your household’s folder with a random filename. Those files sit in a bucket that is readable by anyone holding the exact URL — the random filename is what keeps them from being guessed or listed — so treat an uploaded photo as something that could be seen by anyone you give the link to, and do not upload anything you would not want shared that way.

This is the point of the app rather than a side effect. A household is one shared kitchen: every member sees every meal, every staple, every price and every grocery run, and can edit or delete any of it. Items record who added them, so your name appears next to the things you add. There is no private area within a household.

People outside your household see none of it. Joining a household requires an invite sent to a specific email address, and signing in with that exact address.

Google handles sign-in. On the sign-in page only, your browser loads Google’s sign-in script directly from Google; no page inside the app loads any third-party script.

Supabase hosts the database, the file storage and the authentication service, and Vercel hosts the app itself. Between them they hold everything described above.

Kroger’s public API supplies product details and prices. Those requests carry the words you type when searching for an item, the product and store identifiers involved, and — only when you are looking up a shop — the postal code you enter to find one. They do not carry your name, your email address, your account identifier or anything identifying your household; the app authenticates to Kroger as itself, not as you.

x.ai powers the optional ingredient suggestions when you create a meal. If you use it, the dish name you typed is sent, and nothing else — no account details, no household data, no other ingredients. Pexels supplies stock meal photographs and receives the search term, usually the meal name.

Images are loaded by your browser from wherever they live — Kroger for product pictures, Pexels for stock photographs, Supabase for anything uploaded — and store logos come from Google’s favicon service. As with any image on any website, the company serving it can see that your browser asked for it.

There are no adverts, no analytics, no tracking pixels and no third-party measurement of any kind anywhere in the app. Nothing about you is sold, rented or shared with anyone beyond the services listed above, each of which is used only to make a specific feature work.

The only cookies set are the ones that keep you signed in. Because the app sets nothing for tracking, there is no cookie banner — one would imply a choice that is not being made behind your back.

Your household’s data is kept for as long as the household exists, because a meal planner whose point is what you cook on repeat is not much use if it forgets. Nothing is deleted on a schedule.

You can delete meals, ingredients and grocery runs yourself from inside the app at any time, and the operator can wipe a household’s meals, ingredients and runs outright. To have your account and everything associated with it removed, write to andywaddell98@gmail.com and say so. Bear in mind that a household is shared: removing your own account does not remove meals or staples your household is still using, because they belong to the household rather than to you alone.

If what the app does changes, this page changes with it and the date at the top moves. It is written and maintained by the same person who runs the app; questions, corrections and requests all go to the same address: andywaddell98@gmail.com.