Privacy

What we never hold

A date of birth, a diagnosis, a medication list, a lab result, a blood sugar reading, anything from a wearable. There is no field for any of them, so none can be kept by accident.

What we keep, and why

• Your household: the goal you picked; the people you cook for, by the first names you gave and whether each is an adult, a teen or a child; what they won't eat and their allergies; your budget, your weeknight minutes, your store, your time zone and your reminder times. Every week is planned from these.
• Your weeks: each week's dinners and cart, every change you made, where you sent it and when, when you told us it came, and your four answers. Each change is a row in a log: it is how Undo works and how "Since last week" is written.
• The words you type: the first sentence and anything in the Ask box are read by an AI model (below). Our database does not keep the words themselves, only what they changed, as above. When something you type is turned away as medical or about money, our server log can note the few words that caused it.
• Your email address, once you send a cart: it is how you sign in, and where the Sunday cart and the Wednesday question go. Each sign-in also keeps the network address and the browser it came from.
• Cookies that only our server can read: one ties this browser to its household before there is an email, and the sign-in's keep you signed in. No advertising or analytics cookies. The landing page hands your first sentence to Start inside this browser tab, and Start deletes it once it has read it.
• The waitlist, if you asked to hear when your store is on: your email address, the ZIP code or store you gave, and the day you asked. To stop a flood of sign-ups, the server counts them per network address in its memory, and never writes the address down.
• A record of each call to the AI model: its size, what it cost, how long it took, which of our tools it used and whether it was refused. No words.
• Payment, if you subscribe: the state of your subscription and your customer number at Stripe. We never see your card.

Who else sees what

Each of these gets what it needs for its one job, and nothing else. We do not sell what you tell us, and we do not share it with food brands or advertisers.

• Amazon Web Services runs our servers and the database, in Ohio (us-east-2). Everything above is stored there, and the database is encrypted on disk.
• Cloudflare carries the traffic between your browser and our servers.
• OpenRouter receives the words you type, and what we send to plan your week: the goal you picked, in words (for the GLP-1 goal, the words "On a GLP-1"); the first names and age groups of the people you cook for, their rules and allergies; your budget and your weeknight minutes; your store's name; the week's dinners and items; and, from your last two weeks, which dinners were skipped or left uneaten and how the week felt. It passes them to the company that hosts the AI model, which writes back. We never send it your email address.
• AI model processing. To answer you, we send your content — the messages you send and the household information needed to answer them — to OpenRouter, a model routing service, which passes it to the AI providers that generate the responses. Those services' own terms and privacy policies govern how the content is processed and kept. We do not use your content to train AI models of our own.
• Kroger, the first store: we read its shelf and its prices from its own service. When you give us a ZIP code, we send it that ZIP code, and nothing else about you, to find its stores near you.
• Instacart, when you send a cart: the list of items with their barcodes and quantities, and a title with the week's date. Not your name, not your email address. You finish the order in Instacart, under its own privacy policy.
• Amazon SES sends our email: it receives your address and the text of each email we send you.
• Stripe, when you start paying: your email address and our number for your household. You type your card into Stripe's own page.

The printable list goes nowhere: your browser prints it.

How long we keep it

• Your household, its people, rules, weeks and carts: for as long as the household exists. A household nobody uses: kept only as long as needed for the purposes described.
• The log of changes: kept only as long as needed for the purposes described.
• Your four answers: kept while your household is open, and removed with it when it is deleted.
• The record of each call to the AI model: kept only as long as needed for the purposes described.
• The waitlist: kept only as long as needed for the purposes described.
• Sign-ins: kept only as long as needed for the purposes described. A sign-in code works once and dies ten minutes after it was sent.
• Our server logs, which note what failed and when: 14 days.
• Database backups: 7 days, then they roll over.

Deleting your household

"Delete my household" is in Settings. It asks once, then:

• At once, nothing reads your household again: no cart is built, no reminder is sent, and this browser forgets it and is signed out. If your household has an email address, an email to it confirms what you asked for and says when the rest goes.
• An hour later, and within a day at the latest, its rows come out of our database with everything under them: the people, the rules, the weeks, the carts, the answers and the log.
• Seven days after that, it has rolled out of the backups too.

What stays:

• Your email address and your sign-in: we keep them so the address can sign in again, to record that you asked us to delete, and to stop the same address signing up again and again for the free weeks.
• The records of calls to the AI model, with the link to your household taken out.
• The record of each payment event: its type, when it came, and the payment provider's own number for it, which the provider can match to your customer record there.
• Your place on the waitlist, if you asked for one: it is kept by email address, not by household.
• At Stripe, your customer record and the records of what you paid: the subscription is canceled when you delete the household, and the payment company keeps its own record of that under its own obligations (Terms, Money).
• Whatever Instacart and the store keep about orders you placed with them.

Seeing and changing it

People and store shows your people and your store, and you can change either there. Settings shows every rule we remembered, which you can undo; your reminders and your email address, which you can change; and where you are in the four planning weeks, which you can only read there. Anything else: [email protected] for privacy requests, and [email protected] for anything about the product.

Changes to this page: we announce material changes by email and in the app at least 30 days before they take effect. Changes that are not material — a typo, a clarification — go up when we post them, and the "Last updated" date moves. Using Everfoods after the effective date means you accept them. Where the law requires your explicit consent, we ask for it; if we must change something sooner to comply with the law or to prevent harm, we say so when we can.