Skip to main content
EatPal

Privacy Policy

Last Updated: August 18, 2026

1. Introduction

Welcome to EatPal ("we," "our," or "us"). We are committed to protecting your privacy and the privacy of your children. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our meal planning application and services.

2. Information We Collect

Personal Information

We collect information that you provide directly to us, including:

  • Account information (name, email address, password)
  • Child profiles (name, age, dietary preferences, allergens)
  • Food preferences and meal planning data
  • Grocery lists and pantry information
  • Payment and billing information (processed securely through Stripe)
  • Photos you choose to upload or capture: child profile photos, and photos of food, grocery receipts, or your fridge submitted to our photo-recognition features

Automatically Collected Information

When you use our services, we automatically collect:

  • Device information (type, operating system, browser)
  • Usage data (features used, time spent in app)
  • Log data (IP address, access times, pages viewed)

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our meal planning services
  • Generate personalized meal plans and food recommendations
  • Process your transactions and manage your subscription
  • Send you important updates, newsletters, and marketing communications (with your consent)
  • Respond to your inquiries and provide customer support
  • Monitor and analyze usage patterns to improve user experience
  • Protect against fraud and unauthorized access

4. Children's Privacy (COPPA)

EatPal is a service for parents, guardians, and caregivers — not for children. Our accounts and features are intended for adults (18+). Children do not create accounts, log in, or interact with EatPal directly, and we do not knowingly collect personal information directly from children under 13.

To provide meal planning, a parent or guardian may create child profiles containing information about a child (such as first name or nickname, age or date of birth, dietary preferences, and allergens). This information is entered and controlled entirely by the adult account holder, who is responsible for the accuracy of the information they provide and confirms they are the child's parent or legal guardian, or are otherwise authorized to provide it.

  • Child-profile information is used only to power meal planning, allergen tracking, and recommendations for that child.
  • A parent/guardian can view, edit, or delete any child profile at any time from within the app, and can delete all child data by deleting the profile or the account.
  • We do not require a child to disclose more information than is reasonably necessary, and we do not condition participation on disclosing unnecessary information.

If you believe a child under 13 has provided us information directly, or you wish to review or delete child information associated with your account, contact us at [email protected] and we will act promptly.

5. Information Sharing and Disclosure

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising. We disclose information only in the following circumstances:

  • Service Providers / Subprocessors: With the trusted vendors listed below who process data on our behalf under contract.
  • Legal Requirements: When required by law or to protect our rights and safety.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets.
  • With Your Consent: When you explicitly authorize us to share information.

Our Subprocessors

We use the following third-party service providers to operate EatPal. Each processes only the data needed for its function:

  • Supabase — application database, authentication, and backend hosting (stores your account and app data).
  • Stripe — payment and subscription processing (payment and billing information).
  • Sentry — error and performance monitoring to keep the app reliable (diagnostic and, where you consent, session-replay data, with text and media masked).
  • Google Analytics — usage analytics, loaded only where you consent (device and usage data, with IP anonymization).
  • Resend — transactional and (with your consent) marketing email delivery (email address).
  • AI providers (Anthropic, OpenAI, and/or Google) — power AI meal planning and coaching features (see Section 6).

6. AI Features and Automated Processing

Some features (such as AI meal plans and the AI coach) use third-party large-language-model providers (Anthropic, OpenAI, and/or Google). When you use these features, we send the information needed to generate a response — which may include a child's first name or nickname, age, allergens, and food preferences — to the AI provider that fulfills the request.

  • We share only what is necessary to produce the requested output.
  • We do not use these features to make legal or similarly significant automated decisions about you.
  • You can avoid this processing by not using the AI features; core meal-planning features remain available.

Photos submitted to AI features

When you use a photo feature — identifying a food from a picture, scanning a grocery receipt, or recognizing what is in your fridge — the image is transmitted to the AI provider that fulfills the request so it can read the contents. We do not store these images on our servers: the photo is passed through, used to generate the result, and not retained by us afterward. We access these providers through their business APIs, whose standard terms do not use submitted content to train their models.

Child profile photos are different: those are stored, because they are part of the profile you created. They are deleted when you delete the child profile or your account, and they are not sent to AI providers.

6a. Where Our Food Data Comes From

Nutrition and product information in EatPal is drawn from public food databases. These are sources we read from, not partners, and none of them endorse EatPal:

  • Open Food Facts — barcode and packaged-product data, licensed under ODbL.
  • USDA FoodData Central and the USDA Food Plans — nutrient data and the grocery-budget estimates. US government work, in the public domain.
  • FoodRepo — additional barcode data, licensed under ODbL.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. When you delete your account, we delete or de-identify your account and app data (including child profiles) within a reasonable period, except where we must retain limited information to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements. Backups are retained on a rolling basis and are overwritten in the ordinary course.

8. Data Security

We implement industry-standard security measures to protect your information, including encryption, secure servers, and regular security audits. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

You have the right to:

  • Access, update, or correct your personal information
  • Opt out of marketing communications at any time
  • Request a copy of your data (data portability)
  • Delete your account and associated data
  • Object to or restrict certain processing of your information

You can exercise most of these rights directly in the app: go to Account Settings to export your data as a file or to permanently delete your account and all associated data. You can also manage email preferences from your account. For any other request, or if you need help, contact us at [email protected] and we will respond within the timeframe required by applicable law. We will not discriminate against you for exercising these rights.

10. Cookies and Tracking

We use cookies and similar technologies in two categories:

  • Essential (always on): Strictly necessary to run the service — for example, keeping you signed in and remembering your preferences. These cannot be switched off.
  • Analytics (consent required): Help us understand how the app is used so we can improve it (e.g., Google Analytics and Sentry session replay). These load only after you opt in via our cookie banner and stay off until then.

When you first visit, we ask for your choice and set non-essential cookies only if you accept. You can change your decision at any time:

11. International Data Transfers

If you access our services from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where we or our subprocessors operate. Where such transfers are subject to data-protection law (e.g., from the EEA or UK), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) with the receiving parties. You may contact us for more information about these safeguards.

12. Your European Privacy Rights (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, EatPal is the "controller" of your personal data. We process your data on these lawful bases:

  • Contract — to provide the meal-planning service you sign up for.
  • Consent — for analytics cookies and marketing communications (which you can withdraw at any time).
  • Legitimate interests — to secure, maintain, and improve the service, balanced against your rights.
  • Legal obligation — where we must process data to comply with law.

In addition to the rights in Section 9, you have the right to withdraw consent at any time, and the right to lodge a complaint with your local supervisory authority (in the UK, the ICO). Where we rely on consent, withdrawing it does not affect processing already carried out. Contact us at [email protected] to exercise any of these rights.

13. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know, access, correct, and delete the personal information we hold about you, and to be free from discrimination for exercising these rights.

In the past 12 months we have collected the following categories of personal information: identifiers (name, email), customer records (account and billing details), commercial information (subscription history), internet/usage activity (app and analytics data), and — for the child profiles you create — limited information about your children. We collect it for the purposes described in Section 3 and share it only with the subprocessors listed in Section 5.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" opt-out is required; if that ever changes, we will provide one. You may exercise your California rights in the app (Account Settings) or by contacting [email protected], and you may use an authorized agent to submit a request on your behalf.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.

15. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

Email: [email protected]
Subject Line: Privacy Policy Inquiry