Privacy Policy

This Privacy Policy explains what information PocketChef ("we," "us," or "our") collects, how we use it, and who we share it with. By using the Service, you agree to the collection and use of information as described here. If you do not agree, do not use the Service.

1. Information We Collect

We collect the following categories of information:

• Account information — your name, email address, and profile image, provided by Google when you sign in with Google, or your email address alone when you sign in via magic link.
• Meal planning inputs — dietary preferences, restrictions, servings, staples you already have at home, and how many meals you ask us to plan.
• Generated content — the meal plans, recipes, and shopping lists produced for you, and any recipes you save as favorites.
• Kroger connection data — if you connect a Kroger account, we store an access token and refresh token that let us search products and add items to your Kroger cart on your behalf, and the ID of the store you've selected. We do not receive or store your Kroger password, order or purchase history, payment method, or loyalty/ rewards data — none of that is ever shared with us by Kroger's login flow. We also don't store your selected store's name or address; we look that up from Kroger by its ID each time it's displayed, rather than keeping our own copy. Our Instacart and Walmart integrations don't involve connecting an account at all — we generate a list or links for you to use directly on those retailers' own sites, so there's no credential or account data to store for them. PocketChef is not affiliated with, endorsed by, or sponsored by Kroger, Instacart, or Walmart — see our Terms of Service for details.
• Usage data — how many AI meal-plan runs you've used, to enforce plan limits.
• Subscription and billing data — if you subscribe to a paid plan, Stripe (our payment processor) handles your payment details directly; we store only your subscription status, Stripe customer/subscription IDs, and renewal date. We never receive or store your card number.
• Contact form submissions — the name, email, and message you provide if you contact us.

3. Who We Share Information With

We share information with the following third parties, each solely to provide the Service:

• Anthropic — to generate and revise meal plans (see Section 2).
• Kroger — to search products and, only when you choose to, add items to your Kroger cart.
• Stripe — to process payment if you subscribe to a paid plan. Stripe handles your card details directly; we never see or store them.
• Google — if you sign in with Google, to authenticate you.
• Resend — to deliver sign-in (magic link) emails and respond to contact form submissions.
• Neon and Vercel — our database and hosting providers, who store and process data on our behalf to run the Service.

We do not sell your personal information, and we do not share it with third parties for their own independent marketing purposes.

4. Data Retention

We retain your account information, saved recipes, and meal plan history for as long as your account is active, so you can revisit past plans and re-shop them. You can delete individual saved recipes and past plans from within the Service. To delete your account and associated data entirely, contact us using the information in Section 8.

5. Cookies and Similar Technology

We use a session cookie to keep you signed in. We do not use third-party advertising or tracking cookies. Your theme preference (light/dark) is stored in your browser's local storage, not sent to our servers.

6. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. You can exercise most of these rights directly in the Service (removing favorites, deleting plans, disconnecting Kroger in Connections) or by contacting us — see Section 8.

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect and how it's used (see Section 1);
• Know whether we sell or share personal information — we do not sell your personal information, and have not in the preceding 12 months;
• Request deletion of your personal information;
• Request correction of inaccurate personal information;
• Not be discriminated against for exercising any of these rights.

To exercise these rights, contact us as described in Section 8. We'll verify your request using your account email before acting on it.

European/UK Residents (GDPR)

If you are in the European Economic Area or the UK, our legal basis for processing your information is: performance of a contract (providing the Service you signed up for), and legitimate interest (securing the Service and preventing abuse). You have the right to:

• Access the personal information we hold about you;
• Rectify inaccurate personal information;
• Erasure ("right to be forgotten");
• Restrict or object to certain processing;
• Data portability (receive your data in a portable format);
• Lodge a complaint with your local data protection supervisory authority.

Some of the third parties described in Section 3 (including Anthropic, Stripe, and Google) process data outside the EEA/UK, including in the United States. Where that happens, we rely on the safeguards those providers make available, such as Standard Contractual Clauses. To exercise any of these rights, contact us as described in Section 8.

7. Children's Privacy

The Service is not directed to, and we do not knowingly collect information from, anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

8. Contact

Questions about this Privacy Policy, or requests to access or delete your data, can be sent through our Contact page.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the effective date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.