Privacy Policy

1. Who we are

Sofrella (“we”, “us”) provides a web application for planning household meals around calorie and nutrition targets. We are the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at nathan@earlyasset.com. (Operator to add legal entity name and registered address.)

2. Data we collect

• Account data — your email address and, if you sign in with Google, the account identifier Google returns. Passwords are handled by our authentication provider and are never stored by us in readable form.
• Household member profiles — for each person you add: name, sex, birth month/year, height, weight, activity level, dietary pattern, eating-style preferences, macro calculator settings, carb-cycle schedule, optional Galveston macro phase and phase-review dates, and food preferences/exclusions. These body metrics are used only to estimate calorie and optional macro targets. You may enter data about family members, including children, on their behalf; Mediterranean and carb-cycling calculators are available only for adult profiles and the Galveston calculator only for eligible female profiles age 40+.
• Recipes and photos — recipes you create (names, instructions, notes, ingredients) and any recipe photos you upload.
• Saved meals and meal plans — the reusable meals you compose and the dated plans that assign them to household members.
• Billing identifiers — if you subscribe or buy a pass, we store your payment provider’s customer and subscription identifiers and your plan status. We do not store card numbers; those are held by our payment processor.
• Usage metering — counts of certain actions (e.g. AI generations) used to enforce plan limits and prevent abuse.
• Optional product analytics — only if you allow analytics, we collect page and feature usage, selected product actions, basic browser/device details, and privacy-masked session replays. URLs have query strings and record identifiers removed. Replays mask inputs and all visible text, and do not record console logs, request or response bodies, headers, or canvas content. When you are signed in, we associate these events with your internal account ID, not your email address.
• Anonymous operational diagnostics — API completion and server failure records used to keep the service reliable. These can include a sanitized route, request method and status, duration, deployment and region details, a random Netlify request ID, and exception type and stack frames. Log payloads do not include raw error messages, query strings, bodies, headers, IP addresses, user agents, emails, meal-planning content, or user or household IDs. These diagnostics are not linked to a PostHog person or session and are collected independently of your optional analytics choice.

3. Why we use it, and our legal bases

• To provide the service (accounts, profiles, recipes, meal plans, billing) — legal basis: performance of our contract with you.
• To secure and keep the service reliable (usage metering, troubleshooting, and anonymous operational diagnostics) — legal basis: our legitimate interests.
• To meet legal obligations (e.g. tax and accounting records for payments) — legal basis: legal obligation.
• To improve the product (optional product analytics and masked session replay) — legal basis: your consent, which you can withdraw at any time. Analytics stays off until you allow it.

We do not use your data for advertising, and we do not sell it. The body metrics we collect are lifestyle/fitness inputs used to estimate calorie and macro needs; they are not used to infer health conditions. (Whether any of this constitutes special-category data under Art. 9 GDPR is a question for counsel.)

4. Service providers we share data with

We rely on the following processors, who act on our instructions:

• Supabase — database, authentication, and file storage (hosts your account, profile, recipe, and photo data).
• Stripe — payment processing (hosted checkout and billing portal). Stripe holds your card details; we do not.
• Google — only if you choose “Continue with Google” to sign in.
• Netlify — application hosting and delivery.
• PostHog — optional product analytics and privacy-masked session replay, only after you allow analytics, plus anonymous operational server logs processed under our legitimate interests. Browser analytics traffic is routed through our s.sofrella.com subdomain using PostHog’s managed proxy, which uses Cloudflare infrastructure. Operational logs are sent directly to PostHog’s US ingestion service after source-side sanitization.
• Anthropic — optional AI recipe generation. When you use that feature, your short request and the limited household/catalog context needed to produce a recipe are sent to Anthropic.

5. International data transfers

Our processors are based in the United States, so your data may be processed outside the EEA/UK. Where required, such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses under each provider’s data processing terms. (Operator to confirm a signed DPA is in place with each processor.)

6. How long we keep your data

We keep your data for as long as your account is active. Deleting a non-owner login removes that person’s account and personal settings, while shared plans and profiles stay with the household. An owner must transfer ownership before deleting a login from a household with collaborators. Deleting a sole-owner household permanently erases its shared data without undue delay. Payment records may be retained by our payment processor for the period required by law. Backups, if any, are cycled out on a rolling basis. Optional analytics events are retained for up to one year, and privacy-masked session recordings are retained for up to 30 days. Both are included in the account-erasure process. Anonymous operational logs are retained for PostHog’s default 14-day period and cannot be associated with an account for self-service erasure.

7. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, and object to the processing of your data, and the right to data portability. You can:

• Access & export — download a machine-readable copy of your data from your account settings.
• Rectify — edit your household profiles, recipes, and meals directly in the app.
• Erase — permanently delete your account and data from your account settings.
• Withdraw consent — where we rely on consent, withdraw it at any time using the analytics controls below. This stops new analytics collection. You can delete previously collected analytics with the rest of your account data by deleting your account, or contact us for a separate request.

To exercise any right that isn’t self-service, email nathan@earlyasset.com. You also have the right to complain to your local data protection supervisory authority.

8. Cookies and local storage

We use browser storage for necessary app functions and, only with your permission, optional analytics:

• A session cookie to keep you signed in — strictly necessary, and exempt from consent.
• A theme preference saved in your browser’s local storage when you toggle light/dark mode — a functional preference that does not identify you.
• Offline app data saved locally so an installed Sofrella app can show and update your shopping list without a connection.
• If you allow analytics, our analytics provider uses browser storage for a random analytics identifier, your consent choice, and session state. We configure the service not to use analytics cookies. If you decline, analytics event capture and session replay remain off.

We do not use advertising trackers and do not sell analytics data. Google (sign-in) and Stripe (checkout) may set cookies on their own domains, and only when you choose to use those features.

9. Children

The service is intended for adults and is not directed at children. An adult account-holder may add a child as a household member and enter that child’s details to plan meals; the account-holder is responsible for that information. We do not knowingly create accounts for children. (Operator/counsel to set an age threshold consistent with local law.)

10. How we protect your data

Data is encrypted in transit. Household records are isolated at the database level and are available only to that household’s owner, editors, and viewers. Editors can change shared content; viewers have read-only access. Optional session replay is configured to mask every input and all visible text before replay data leaves your browser. Operational logs are sanitized before export, and PostHog’s ingestion-side PII scrubbing provides an additional safeguard. Note: recipe photos are currently served from a publicly accessible storage location, meaning anyone with a photo’s link could view it. We are moving recipe photos to private, access-controlled storage; this policy will be updated when that change ships.

11. Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected in the version and last-updated date above.

12. Contact

Questions or requests: nathan@earlyasset.com.