•

Account. Your email address and a password, or, if you choose “Continue with Google”, the basic profile Google shares with your permission (see section 5). Authentication is handled by Supabase Auth. Sign-in with Apple is not offered.

•

Profile and preferences (from onboarding and your Profile): a display name, diet types, allergens, dislikes, household size, and a calorie target. Optionally, your ZIP/postal code, SNAP/EBT budget details, and body metrics (height, weight, birth date, sex, activity level), which we use only to set your nutrition targets.

•

Things you create: meal plans and their slots, shopping lists and items, pantry items, recipe favorites, ratings, comments, cook logs, and optional cook photos (stored in Supabase Storage).

•

Recipes you import: the recipe text or link you paste.

•

A sample plan by email. If you ask for a sample plan on our website without an account, we keep your email address, the name you give, your household size and diet choice, how you found us (see section 2), and when we sent it. The email has seven dinners from our catalog with links to their recipe pages, and an unsubscribe link.

•

Settings: scheduled-order settings and email preferences, and — only if you connect a Kroger account — your Kroger store selection.

•

Usage events. Which pages and features you use. When you are signed in, these events are tied to your user id.

•

How you found us. On your first visit, your browser keeps a short note of the page you landed on, the name of the website that sent you (for example google.com, never the full address), any campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the ad network’s click identifier if you came from an ad (for example gclid from Google Ads or fbclid from Meta), a share-link code if you came through a share link, and the time. A second note keeps the same details for your latest visit through a tagged or shared link. The notes stay in your browser until you create an account; then they are saved with your account, so we can see which pages and channels bring people who use Grocerplan. If you ask for a sample plan, a one-line summary of them is saved with that request. For an account that came from an ad, they are also used for the ad report described in section 3.

•

Instacart handoff records. When you use “Shop on Instacart” we record the shopping-list or recipe link we created, the time you left, the retailer you selected, and the time you returned.

•

Server logs. Our host (Vercel) keeps standard request logs: IP address, browser type, requested URL, and timestamp.

•

Analytics. We use Plausible, which is cookieless and does not store personal identifiers. Google Analytics 4 also loads on grocerplan.com and may set cookies or identifiers. We do not currently show a cookie-consent banner. You can opt out of Google Analytics with Google’s browser add-on.

•

To generate your meal plans and shopping lists and tailor them to your diets, allergens, dislikes, household, budget, and calorie target.

•

To build an Instacart shopping-list or recipe page, or add items to your Kroger cart, when you ask us to.

•

To send account emails (for example sign-in, confirmation and password messages, and one welcome email after you confirm your email address), the sample plan you ask for, and, if you leave it on, the weekly digest.

•

To let Grocerplan’s operator know, by an internal email, when someone signs up, plans a week, builds a grocery list, or opens Instacart. The notice lists the step, the time, how the person found us, and a masked email address (the first two letters and the domain). We use it to see whether Grocerplan works for people and to help when someone gets stuck.

•

Measuring our ads. If you came to Grocerplan from one of our ads on Google, Meta, or ChatGPT and then confirm your account, we tell that ad network a sign-up happened, so we can see which ads work. Each report carries the ad’s click identifier, the time you confirmed, and a reference made from your Grocerplan account id so a sign-up is counted only once. Reports to Meta and to OpenAI (for ChatGPT ads) also carry the page you landed on and, unless you signed in with Google, a one-way (SHA-256) hash of your email address, which those networks use to match the sign-up to the ad click. Google Ads receives no email address, hashed or otherwise. We never send your name, your preferences, your plans or lists, or your email address in readable form, and accounts that did not come from an ad are not reported.

•

To understand how the service is used and improve it, keep it secure, prevent abuse, and meet legal obligations.

•

Supabase — database, authentication, file storage, and edge functions (US region).

•

Google — only if you choose “Continue with Google”: Google confirms who you are and shares your basic profile with us (see section 5). Your Google account itself is governed by Google’s own privacy policy.

•

Vercel — hosting and CDN; keeps request logs.

•

Resend — delivers our emails (account emails, the welcome email, sample plans, the weekly digest, and the operator’s notices), sent from hello@grocerplan.com. Replies go to support@merchant-dash.com.

•

Plausible — cookieless analytics.

•

Google Analytics 4 — analytics; may set cookies or identifiers (see section 2).

•

Google Ads, Meta, and OpenAI — receive the ad reports described in section 3, only for sign-ups that came from their ads.

•

OpenRouter / Anthropic-hosted models — parse the ingredients of recipes you import. They receive recipe text only, never your personal data.

•

Instacart Developer Platform — when you use “Shop on Instacart” we send ingredient names and quantities to create a shopping-list page — or, for a single recipe, a recipe page with its title, ingredients, steps, and photo. The retailer you selected is added to the link you open, and to list stores near you we send Instacart your ZIP code. Checkout happens on Instacart and is governed by Instacart’s own privacy policy. Instacart® is a registered trademark of Maplebear Inc.

•

Impact.com — operates Instacart’s affiliate program. It reports the orders attributed to our “Shop on Instacart” links to us: the order amount, our commission, and the date. Those reports are not linked to your Grocerplan account — we cannot tell which user placed an order — and we send Impact no personal data.

•

Kroger API — only if you connect a Kroger account: we store your Kroger OAuth token to add items to your cart and remember your store selection. Kroger handles pricing, payment, and fulfillment; we never see your payment details.

•

Stripe — we do not offer paid plans today. If we introduce them, payments would be processed by Stripe and we would never store card numbers.

•

Expo push notifications — mobile apps only; not used on the web.

•

What we receive. With your permission, Google shares your basic profile with Grocerplan: your name, your email address and whether Google has verified it, and a link to your profile picture. We ask only for these basic permissions (openid, email, and profile). We never receive your Google password, and we do not request access to Gmail, Google Contacts, Calendar, Drive, or any other Google data.

•

How we use it. Only to create your account, sign you in, and run Grocerplan for you. Your email address identifies your account and is where we send the emails described in section 3. Your name fills in your display name, which you can change in Profile. Supabase Auth keeps the profile-picture link with your login, but Grocerplan does not show or use it.

•

An existing account. If you already have a Grocerplan account with the same email address, signing in with Google connects Google to that account.

•

Sharing. We do not sell information we receive from Google, and we never send it to an advertising network, hashed or otherwise. We share it only with the service providers in section 4 that run Grocerplan (for example, Resend receives your email address to deliver our emails).

•

Keeping and removing it. We keep it while your account exists and delete it with your account (see section 8). You can remove Grocerplan’s access at any time in your Google Account’s third-party connections. That stops future Google sign-ins but does not delete your Grocerplan account; to delete it, use Profile → Delete Account.

•

What the connection can share. With your permission, ChatGPT can request your saved diet and allergy preferences, disliked ingredients, household size, grocery budget, pantry entries and grocery lists you own or have explicitly accepted access to. Shared-list access includes its title and grocery items, not the owner’s account preferences, pantry records or budget. View-only access cannot edit the shared original. Tool results return the requested information to your conversation. The integration does not request your full chat history, and it does not share your Grocerplan password or payment details.

•

What we keep. We keep the account connection and its granted permissions, expiry and revocation information; planning previews and the grocery drafts you save; and request records needed to avoid duplicate saves or shopping links. Saved grocery lists remain part of your Grocerplan account. Information returned to ChatGPT is also subject to your ChatGPT settings and OpenAI’s policies.

•

Connection retention. Unsaved previews expire after one hour. Our hourly cleanup removes expired previews, authorization requests and access-token hashes after a further 24 hours, and clears expired Instacart link URLs after 24 hours. Connection records and refresh-token replay records are removed seven days after the connection expires or is revoked. Cleanup runs in bounded batches, so a backlog or service interruption can delay removal. Saved lists and their owner-draft duplicate-save records remain until the list or account is deleted. Sharing request records, which can include submitted grocery changes, remain until the acting account is deleted, even if the shared list is removed. Registered app-client metadata remains while the integration operates; it contains app details, not your grocery content.

•

Shopping. When you choose to prepare an Instacart link, we send the selected grocery items and amounts to Instacart, as described in section 4. This does not place an order, charge you or reserve delivery.

•

Disconnecting. In the Grocerplan website, go to Profile → Connected apps to remove access. This stops new requests through that connection. It does not delete your saved Grocerplan lists or remove information already included in ChatGPT conversations. Manage those conversations in ChatGPT.

•

Account data is kept while your account exists.

•

After you delete your account we delete your data within 30 days, except for backups (which age out within a further 30 days) and records we are legally required to keep.

•

Usage and analytics events are kept for up to 24 months.

•

Delete your account at any time in the app: Profile → Delete Account. This removes your profile, meal plans, shopping lists, uploads, and your login. Some aggregate or anonymized usage rows may remain.

•

Weekly digest. Turn it off with the “Weekly digest email” switch in Profile, or use the unsubscribe link in any digest email.

•

Other emails. The welcome email and the sample plan carry an unsubscribe link. Using it stops every Grocerplan email to that address except sign-in, confirmation and password messages.

•

Copy of your data. There is no self-serve export yet. Email us at support@merchant-dash.com and we will send you a copy.

•

Access, correction, deletion, and objection. Wherever you live, we honor CCPA- and GDPR-style requests to access, correct, delete, or restrict the use of your personal information. We may need to verify your identity first. We will not treat you differently for exercising these rights. We do not sell personal information.