MealCaddie Privacy Policy

Who is responsible

MealCaddie is operated by LaDarius Hooks in an individual capacity. Privacy and support contact: support@mealcaddie.app. Hooks Legacy LLC is the intended holding company, with registration pending; MealCaddie LLC is the intended operating subsidiary and has not been formed. Neither is the current registered operator. Any later operator change will be identified and explained before taking effect, with any consent required by law.

Information we process

Applications contain email, planning frequency, planning challenges, testing interests, Free/Plus preference, feedback willingness, consent choices and application source/campaign. These support application review and beta organization. Do not include medical details or other unnecessary sensitive information in application answers. Applications do not automatically create an account or add you to the separate Formspree updates list.

Accounts and sign-in use verified identity and account/profile information. Supabase handles authentication; Google supplies identity information when you choose Google sign-in. Invitations, acceptance, participation dates, cohort, temporary privileges and administrative history are recorded to operate secure invitation-only access. We do not ask for payment information for beta participation.

Planning requests may include dietary text, budget, household settings and pantry information. Dietary entries can reveal sensitive health or religious information; provide only what is necessary. Planning settings are retained in the browser, and inputs/results may also persist in generation-job records and saved menus. Pantry and Recipe Vault data persist under owner access controls. It is not accurate to say all dietary information stays on your device.

Security processing includes verification data and rate-limit identifiers derived from a network address. Hosting/security providers may separately process network addresses, request metadata and their own operational logs. Invitations use hashes rather than stored plaintext acceptance tokens.

Feedback contains the category, feature, message and associated participation identity. Optional reporting records minimal successful-planning and feedback counts, not recipe content, ingredients, dietary entries, prompts or device fingerprints. Feedback is available without optional analytics or marketing consent.

Purposes, consent and providers

We use information to provide and secure MealCaddie, review applicants, operate participation, process requests and improve the service. Required application consent is distinct from optional marketing and optional engagement reporting. Neither optional choice affects selection. The existing general-updates form is separate, uses Formspree, and is not automatically populated by beta applications.

Authorized beta administrators can view applications and feedback. Supabase stores application/account data, Vercel hosts the service, Cloudflare Turnstile provides abuse verification, and Resend delivers separately authorized authentication and beta messages. OpenAI processes dietary/planning inputs when a permitted AI request is made; application answers are not sent to meal-generation AI models. We use these providers to deliver the relevant service, not to publicly disclose your answers. Provider security, logs, backups and retention must be considered separately from our database records.

We do not sell application or dietary information or use it for targeted advertising. We do not use dietary entries to build marketing audiences or engagement telemetry. Contact support to withdraw optional marketing permission. Removing analytics consent stops optional reporting and removes related prior usage records under the implemented participant controls. No automatic marketing or invitation delivery follows application submission.

Retention

Under the beta retention policy, unselected applications are eligible for deletion 90 days after recruitment closure is recorded; selected applications, feedback and aggregate reports 90 days after beta end is recorded. Withdrawn applications become eligible after five days, with a seven-day removal target and monitored follow-up. Automated daily cleanup is disabled. Administrators review due records daily and handle removal within the applicable schedule after verifying identity, scope and any documented legal obligation. Linked invitation, participation and application-history records are removed with an application; feedback/reporting may therefore be removed earlier after withdrawal.

Raw optional engagement events are eligible after 30 days, and abuse counters generally expire after 48 hours and are removed in cleanup. Minimal program audit events are eligible after 180 days, while application-linked histories follow their application's earlier removal. These periods do not mean every record must be held for that entire interval.

The daily automated schedule is disabled. Recruitment close and beta end are manually recorded; the participation end boundary does not automatically start all retention timers. Existing beta cleanup does not delete your account, stored plan, saved menus, pantry or Recipe Vault content.

Account and planning content remain for service use until the applicable verified deletion/retention process is completed. Export/account deletion, controlled test-email evidence, agreement/privacy-request evidence and provider/support records require administrator handling; they have no new automatic purge in this policy. Planning-job records currently have no automatic deletion schedule and may include retained inputs and results until a verified deletion request is handled. Provider logs/backups follow the provider terms and configured controls; they are not erased immediately with a database record. Support requests are reviewed manually. We review the necessity of these records regularly and explain any applicable retention limitation when handling a request rather than promise a uniform provider deletion period. Controlled email-test records follow a 90-day post-test manual review/removal schedule. Privacy-request evidence is retained 90 days after resolution unless a documented legal obligation requires otherwise. Agreement evidence is kept only while reasonably necessary for account/participation administration or justified post-deletion recordkeeping, with necessity reviewed when the account/participation ends. Requests and confirmed deletions are tracked so restored data can be reconciled before service resumes.

Requests and your choices

Contact support@mealcaddie.app to request access/export, correction, deletion, withdrawal or a review of a request decision. State what you want changed; do not send passwords, login links or unnecessary identity documents. We verify ownership using reasonable information and explain any necessary additional verification. Requests are handled manually, within applicable deadlines; export/deletion are not instant self-service operations. If a request is refused, we will explain the decision and provide a review route. Where applicable, the response will explain further complaint or appeal options.

Participation withdrawal removes temporary beta privileges and optional reporting; it does not itself delete your account or saved recipes. Application withdrawal and marketing withdrawal do not automatically delete an account. An account deletion request is not authorization to alter someone else's records. Applicable rights are not waived by these notices.

Security and updates

We use ownership controls, verified identities, invitation hashes and restricted administrator access. No system can guarantee security. Material changes to purposes, consent or operator identity will be disclosed, with fresh consent when required. Prior notices/consent histories are preserved rather than silently rewritten. Contact support@mealcaddie.app about privacy or security concerns.