Privacy Policy

1. Who we are

Meal Planner (“we”, “us”) provides a web application for planning household meals around calorie and nutrition targets. We are the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at nathan@earlyasset.com. (Operator to add legal entity name and registered address.)

2. Data we collect

• Account data — your email address and, if you sign in with Google, the account identifier Google returns. Passwords are handled by our authentication provider and are never stored by us in readable form.
• Household member profiles — for each person you add: name, sex, birth month/year, height, weight, activity level, dietary pattern, eating-style preferences, macro calculator settings, carb-cycle schedule, optional Galveston macro phase and phase-review dates, and food preferences/exclusions. These body metrics are used only to estimate calorie and optional macro targets. You may enter data about family members, including children, on their behalf; Mediterranean and carb-cycling calculators are available only for adult profiles and the Galveston calculator only for eligible female profiles age 40+.
• Recipes and photos — recipes you create (names, instructions, notes, ingredients) and any recipe photos you upload.
• Saved meals and meal plans — the reusable meals you compose and the dated plans that assign them to household members.
• Billing identifiers — if you subscribe or buy a pass, we store your payment provider’s customer and subscription identifiers and your plan status. We do not store card numbers; those are held by our payment processor.
• Usage metering — counts of certain actions (e.g. AI generations) used to enforce plan limits and prevent abuse.

3. Why we use it, and our legal bases

• To provide the service (accounts, profiles, recipes, meal plans, billing) — legal basis: performance of our contract with you.
• To secure the service and prevent abuse (usage metering, troubleshooting) — legal basis: our legitimate interests.
• To meet legal obligations (e.g. tax and accounting records for payments) — legal basis: legal obligation.
• Where we ask for it (for example, any future optional AI feature) — legal basis: your consent, which you can withdraw at any time.

We do not use your data for advertising, and we do not sell it. The body metrics we collect are lifestyle/fitness inputs used to estimate calorie and macro needs; they are not used to infer health conditions. (Whether any of this constitutes special-category data under Art. 9 GDPR is a question for counsel.)

4. Service providers we share data with

We rely on the following processors, who act on our instructions:

• Supabase — database, authentication, and file storage (hosts your account, profile, recipe, and photo data).
• Stripe — payment processing (hosted checkout and billing portal). Stripe holds your card details; we do not.
• Google — only if you choose “Continue with Google” to sign in.
• Netlify — application hosting and delivery.
• Anthropic — planned, not yet active. If we enable AI AI recipe generation, your short request and the household/catalog context needed for that feature would be sent to Anthropic to produce the result. We will update this policy before enabling it.

5. International data transfers

Our processors are based in the United States, so your data may be processed outside the EEA/UK. Where required, such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses under each provider’s data processing terms. (Operator to confirm a signed DPA is in place with each processor.)

6. How long we keep your data

We keep your data for as long as your account is active. When you delete your account, we permanently erase your data from our systems without undue delay (see “Delete account” in your account settings). Payment records may be retained by our payment processor for the period required by law. Backups, if any, are cycled out on a rolling basis. (Operator to confirm concrete retention periods.)

7. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, and object to the processing of your data, and the right to data portability. You can:

• Access & export — download a machine-readable copy of your data from your account settings.
• Rectify — edit your household profiles, recipes, and meals directly in the app.
• Erase — permanently delete your account and data from your account settings.
• Withdraw consent — where we rely on consent, withdraw it at any time.

To exercise any right that isn’t self-service, email nathan@earlyasset.com. You also have the right to complain to your local data protection supervisory authority.

8. Cookies and local storage

We use only what the service needs to function, so we do not show a cookie consent banner:

• A session cookie to keep you signed in — strictly necessary, and exempt from consent.
• A theme preference saved in your browser’s local storage when you toggle light/dark mode — a functional preference that does not identify you.

We use no analytics, advertising, or third-party tracking cookies. Google (sign-in) and Stripe (checkout) may set cookies on their own domains, and only when you choose to use those features.

9. Children

The service is intended for adults and is not directed at children. An adult account-holder may add a child as a household member and enter that child’s details to plan meals; the account-holder is responsible for that information. We do not knowingly create accounts for children. (Operator/counsel to set an age threshold consistent with local law.)

10. How we protect your data

Data is encrypted in transit. Each account’s records are isolated at the database level so one user cannot read another’s data. Note: recipe photos are currently served from a publicly accessible storage location, meaning anyone with a photo’s link could view it. We are moving recipe photos to private, access-controlled storage; this policy will be updated when that change ships.

11. Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected in the version and last-updated date above.

12. Contact

Questions or requests: nathan@earlyasset.com.