Privacy Policy

Last updated: October 2026

Supperly ("we", "us", "our") is a meal-planning app. This policy explains what data we collect, why, and how you can control it.

1. What we collect

• Account data: email address and (if you use Google Sign-In) your Google account ID and display name. We never store your Google password.
• Recipes: recipe titles, ingredients, instructions, and images you import or enter manually. Images are stored in Cloudflare R2.
• Meal plans and grocery lists: the meal plans and shopping lists you create inside the app.
• Usage analytics: event data (e.g. "recipe imported", "grocery list generated") collected via PostHog. Events are linked to a random account ID (never your email address) so we can understand how the app is used over time; they do not include the content of your recipes. You can opt out by contacting us.
• Error data: technical error information (stack traces, request context) used to fix bugs.
• Device push token: if you allow notifications, a token identifying your device to the Apple or Google push service, so we can send you notifications. It is deleted with your account.
• Subscription data: if you subscribe, your purchase and subscription status (plan, trial status, renewal and expiry dates, store transaction identifiers) is processed by RevenueCat on our behalf. We never receive or store your card details — payment is handled entirely by Apple or Google.

2. How we use your data

• To provide the app's core features (recipe storage, planning, shopping lists).
• To improve the product, using usage analytics reviewed in aggregate.
• To send transactional notifications if you opt in (e.g. household invite accepted).
• To send account emails you ask for, such as a password reset link.

3. Data sharing

We do not sell your data. We share it only with the following sub-processors:

• Neon (database hosting) — your recipes, meals, and account data.
• Cloudflare R2 (image storage) — recipe images you import.
• PostHog (analytics) — usage events linked to a random account ID.
• Google Gemini (AI enhancement) — recipe text is sent to Google's Gemini API to clean, structure, and translate imported recipes.
• Google (authentication) — only if you use Google Sign-In.
• Resend (transactional email) — your email address and the email content, only when we send you an account email such as a password reset link.
• Fly.io (API hosting) — processes all API requests.
• Expo (push notification delivery) — your device push token and the notification text, relayed to Apple or Google to deliver notifications.
• RevenueCat (subscription management) — purchase and subscription status, so we know whether your household has access. Card details are never shared with us or with RevenueCat.
• Apple / Google (payment processing) — if you subscribe, your payment is processed by the app store you bought through, under its own privacy policy.

4. Data retention

Your account data and recipes are retained until you delete your account. Analytics events are retained for 12 months. You can request deletion at any time (see Contact below).

5. Your rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete your data. To exercise these rights, contact us.

6. Security

Passwords are hashed with Argon2id. All data is transmitted over HTTPS. Refresh tokens are stored hashed and rotated on each use. Password reset links work once, expire after 30 minutes, and are stored hashed.

7. Children

Supperly is not directed at children under 13. We do not knowingly collect data from children.

8. Changes

We will update this policy when we add new data types or change how we use existing ones. The "last updated" date above will reflect any changes.

9. Contact

Questions or requests: mealtime890@gmail.com