Privacy

What we have no field for

A date of birth, a diagnosis, a medication list, a lab result, a blood sugar reading, anything from a wearable. The app has no field for any of them. But we read what you tell us about your household as you say it: if you mention a condition, such as "my daughter has celiac", those words can be kept with the rule it became, and in the log of changes.

What we keep, and why

• Your household: the goal you picked; the people you cook for, by the first names you gave and whether each is an adult, a teen or a child; what they won't eat and their allergies; your budget, your weeknight minutes, your store, your time zone and your reminder times. Every week is planned from these.
• Your weeks: each week's dinners and cart, every change you made, when you took the list and in what form (today, always the printable list), when you told us you had shopped and whether you told us with a tap or by replying to our reminder, and your four answers. Each change is a row in a log: it is how Undo works and how "Since last week" is written.
• The words you type: the first sentence and anything in the Ask box are read by an AI model (below). When something you say becomes a rule, we can keep your own words for that rule, such as "no dairy" or "my son can't have gluten", and the log of changes can keep the sentence you said when part of it did not become a rule. When you ask to swap a dinner, the log of changes can also keep what you asked, up to 200 characters. When something you type is turned away as medical or about money, our server log notes that it was turned away and which of our rules did it. It names the rule, and the name can say what the message was about (for example, a rule named for medication), or it gives a category such as "medical". That note does not include the words you typed.
• Your email address, the first time you take your week's list from the app: it is how you sign in, and where the Sunday cart and the Wednesday question go. Each sign-in also keeps the network address and the browser it came from.
• Cookies that only our server can read: one ties this browser to its household before there is an email, and the sign-in's keep you signed in. No advertising or analytics cookies. The landing page hands your first sentence to Start inside this browser tab, and Start deletes it once it has read it.
• The waitlist, if you asked to hear when your store is on: your email address, the ZIP code or store you gave, the store we matched it to, which form you used, and the day you asked. To stop a flood of sign-ups, the server counts them per network address in its memory, and never writes the address down.
• A record of each call to the AI model: its size, what it cost, how long it took, which of our models it used, which of our tools it used and whether it was refused. No words.
• A record of each week we plan for you: the plan the model proposed and our checks of it. These can repeat parts of what we sent the model, such as your household's rules, but the record does not keep a copy of what we sent.
• Payment, if you subscribe: the state of your subscription and your customer number at Stripe. We never see your card.

Who else sees what

Each of these gets what it needs for its one job, and nothing else. We do not sell what you tell us, and we do not share it with food brands or advertisers.

• Amazon Web Services runs our servers and the database, in Ohio (us-east-2). Everything above is stored there, and the database is encrypted on disk.
• Cloudflare carries the traffic between your browser and our servers.
• OpenRouter receives the words you type, and what we send to plan your week: the goal you picked, in words (for the GLP-1 goal, the words "On a GLP-1"); the first names and age groups of the people you cook for, their rules and allergies; your budget and your weeknight minutes; your store's name; the week's dinners and items; and, from your last two weeks, which dinners were skipped or left uneaten and how the week felt. It passes them to the company that hosts the AI model, which writes back. We never send it your email address.
• AI model processing. To answer you, we send your content — the messages you send and the household information needed to answer them — to OpenRouter, a model routing service, which passes it to the AI providers that generate the responses. Those services' own terms and privacy policies govern how the content is processed and kept. We do not use your content to train AI models of our own.
• Kroger, the first store: we read its shelf and its prices from its own service. When you give us a ZIP code, we send it that ZIP code, and nothing else about you, to find its stores near you.
• Amazon SES sends our email: it receives your address and the text of each email we send you.
• Stripe, when you start paying: your email address and our number for your household. You type your card into Stripe's own page.

The printable list goes nowhere: your browser prints it.

How long we keep it

• Your household, its people, rules, weeks and carts: for as long as the household exists. A household nobody uses: we do not delete a household because it has gone unused, and there is no point at which we do. It stays, with everything in it, until you delete it.
• The log of changes: kept with your household, and it goes when your household goes. A copy stays in our backups for up to seven days after that, and then rolls over.
• Your four answers: kept while your household is open, and removed with it when it is deleted.
• The record of each call to the AI model: its size, what it cost, how long it took, which of our tools it used and whether it was refused. It does not hold what you wrote or what the assistant answered. It also records which of our models was used and what it was used for, and, until you delete your household, which household and which week it belongs to. It stays with no end date; when you delete your household we keep it with the links to your household and to your week taken out, so it no longer points at either.
• The record of each week we plan for you: removed with your household when it is deleted.
• The waitlist: the email address you gave, the ZIP code or store, the day you asked, the store we matched it to, and where the entry came from. Nothing removes an entry automatically and there is no point at which the list closes, so an entry stays with no end date, unless you ask us to remove it. If you want your entry removed, write to [email protected] and ask; we answer within one month.
• Sign-ins: a sign-in code works once and dies ten minutes after it was sent, and stops working after three wrong tries. An expired code is removed the next time a sign-in code is checked. A session lasts seven days and is renewed, at most once a day, when you use it. When a session expires it is removed the next time that browser asks for it; if that browser never comes back, the expired session stays in our database, and nothing else removes it.
• Our server logs, which note what failed and when: 14 days.
• Database backups: 7 days, then they roll over.

Deleting your household

"Delete my household" is in Settings. It asks once, then:

• At once, nothing reads your household again: no cart is built, no reminder is sent, and this browser forgets it and is signed out. Your other browsers are not signed out by this. A session on another browser lasts up to seven days from its last use, and is removed when that browser next asks for it; if it never comes back, the expired session stays in our database. If your household has an email address, an email to it confirms what you asked for and says when the rest goes.
• An hour later, and within a day at the latest, its rows come out of our database with everything under them: the people, the rules, the weeks, the carts, the answers and the log. If cancelling your subscription with our payment provider keeps failing, the rows stay until we clear it by hand.
• Seven days after that, it has rolled out of the backups too.

What stays:

• Your account: the email address you signed in with and whether the address is verified. Deleting your household does not delete your account. The account is separate from the household and you have not asked us to close it, so it stays, with no end date. If you want it closed, write to [email protected]: there is no button for it, and we answer within one month.
• The records of calls to the AI model, with the links to your household and to your week taken out: they stay, with no end date.
• The record of each payment event: its type, when it came, and the payment provider's own number for it, which the provider can match to your customer record there.
• Your place on the waitlist, if you asked for one: it is kept by email address, not by household.
• At Stripe, your customer record and the records of what you paid: the subscription is canceled when you delete the household, and the payment company keeps its own record of that under its own obligations (Terms, Money).

Seeing and changing it

People and store shows your people and your store, and you can change either there. Settings shows every rule we remembered, which you can undo; your reminders and your email address, which you can change; and where you are in the four planning weeks, which you can only read there. Anything else: [email protected] for privacy requests, and [email protected] for anything about the product.

Changes to this page: we announce material changes by email and in the app at least 30 days before they take effect. Changes that are not material — a typo, a clarification — go up when we post them, and the "Last updated" date moves. Using Everfoods after the effective date means you accept them. Where the law requires your explicit consent, we ask for it; if we must change something sooner to comply with the law or to prevent harm, we say so when we can.

Objecting, complaining, and where your data is

Right to object

Where we rely on our legitimate interests, you can object at any time, for reasons that are yours to give: write to [email protected]. We stop using your data for that purpose unless we can show grounds that outweigh yours, unless we need it to deal with a legal claim, or unless the law requires us to keep it. Objecting to a sign-in record or a server log usually means we can no longer keep the account safe, and we will tell you if that is what it comes to.

If you think we have handled your data wrongly, tell us first, at [email protected], and we will answer. You can also complain to a supervisory authority, the public body that oversees data protection: the one in the country where you live or work, or where you think the problem happened. You can do that at any time, and you do not have to write to us first.

Our servers and database are in the United States, and the providers listed above are based in the United States. If you live outside the United States, your data is stored and handled outside your country, under the law of the United States, with the commitments this page describes.