Privacy Policy
Last updated: 2026-07-23
What we collect
- Account info — email, display name, optional avatar, and birth year (collected at signup and used solely to enforce the 18-and-over minimum age).
- Household profile — dietary preferences, allergies, diet types, budget, household size, kitchen equipment, cuisine preferences, per-meal schedule. Collected via the questionnaire so the AI can plan for your household.
- Plans, recipes, grocery lists generated for you.
- Cookbook ratings (favorites, never-again) and usage counts that drive the palate model.
- Plan-generation requests (free or paid plan): your profile + ingredients are sent to our AI provider using our key so the AI can generate your plan. Your prompt content reaches the provider; your data never trains anyone's AI model.
What we don't collect
- We don't sell your data. Ever.
- We don't have a third-party analytics SDK on this site. (You won't see Google Analytics, Facebook Pixel, etc.)
- We don't ask for or store any AI provider key from you — we run the AI for you using our own key.
Children (13-17) on Pro plans
MealPrep is intended for users 18 and over. The one exception is the Pro plan child-invite flow:
- An adult on a Pro plan may invite a minor aged 13-17 by providing the minor's email address and birth year. The inviting adult attests, under penalty of perjury, that they are the parent or legal guardian of the named minor, and consents on the minor's behalf to the processing described in this policy.
- The child receives an invitation email and sets up their own login. Their account is marked as a child account; the birth year on the child's signup form is ignored — we use the year the parent attested to.
- What we collect from child accounts: the same cookbook ratings, planning preferences, and allergen data we collect from adults. Child accounts CAN edit their own food preferences + allergens; they cannot edit Diet Goals (parent manages).
- What we don't do with child data: children are automatically opted out of all marketing and weekly recap emails. Diet Goals data is read-only for child accounts — they can see what the parent has set but not modify it. Children cannot be targeted by any analytics (we don't run any third-party analytics at all, so this is moot, but stated for clarity).
- Child accounts have restricted features: no billing access, no ability to invite other users, no admin access. These restrictions are enforced server-side on every request, not just hidden in the UI.
- Deletion: a child can delete their own account (with the same 30-day soft-delete window as adults), and the inviting parent can remove the child at any time. We honor minor erasure rights under GDPR Article 17 and CCPA the same way we honor them for adults.
- We do not knowingly collect data from anyone under 13. If we learn an account belongs to a child under 13, we delete it promptly. To report such an account, email us at the Contact address below.
Sub-processors we share data with
- Our AI provider receives the meal-generation prompts that include your profile, so it can generate your plan.
- Resend (if configured by the operator) sends your password-reset emails.
- Instacart Developer Platform (if you click "Shop on Instacart") receives your grocery list as search terms.
Your rights (GDPR / CCPA)
You can:
- Request a copy of your personal data via Settings → Privacy & data → Email me my data. Self-serve: we generate a zip containing your profile, settings, cookbook, plans, grocery + pantry history, and any Diet Goals you've entered, then email a one-time download link valid for 24 hours. Rate-limited to one active export request per household per 24 hours. If you need a different export format or historical data outside this scope, email us at the Contact address below — we respond within 30 days as required by GDPR Article 15.
- Delete your account — /account/delete. Self-serve. Deletion is scheduled 30 days out so you can change your mind (log back in and click Cancel deletion in the banner); after 30 days, all data — cookbook, plans, grocery history, profile, household members — is permanently erased from the application database. Regulatory backups roll off on their own 30-day cycle thereafter.
- Correct your data via the questionnaire or Settings at any time.
Subscription-lapse data retention
If your subscription is canceled — by you, by us for terms violation, or by repeated payment failure that the payment processor can't recover — your kitchen data (cookbook, plans, grocery history, generated recipes, pantry carryover) is hidden from the UI immediately and permanently deleted 30 days after our payment processor formally terminates the subscription. The payment-processor retry window is typically ~21 days from first card decline, so the full timeline from initial payment failure to permanent erasure is approximately 51 days (~21 days of retries + 30 days hidden).
What's retained: your account record, profile, settings, and avatar — so resubscribing is straightforward. What's erased: all kitchen content. To preserve cookbook history before cancellation, request a data export (Settings → Privacy & data) at any time.
Our shutdown commitment
Yummly shut down in December 2024 with no warning and no way for users to export their saved recipes. PlateJoy shut down in mid- 2025 the same way. We've watched what happens when consumer apps in this category disappear, and we're committing in writing to do the opposite.
If MealPrep ever shuts down — for any reason — we commit to:
- At least 90 days advance notice, sent to the email on file for every active account.
- A bulk-export download link in that notice, valid for the full 90 days. The export includes everything we'd normally include in a self-serve data request (profile, settings, cookbook, plan history, grocery + pantry data, AI-generated recipes).
- No "use it or lose it" clock on the export. If you download the export, your data is yours forever. If you don't, we delete on schedule per the GDPR right-to-erasure on the shutdown date.
This commitment is binding and survives a change of ownership: any future acquirer / receiver / successor assumes this obligation as a condition of using the MealPrep name or codebase.
Diet Goals & preferences
If you fill in your Diet Goals (on the Diet Goals page), you may give us: body-composition goals, target body-fat %, weight-loss/gain rate, the eating styles you want to follow (low-sugar, low-sodium, heart-healthy, low-FODMAP, DASH, Mediterranean and similar diet types), job + exercise context, daily step counts, and free-text notes about your food preferences.
- Why we collect it. Only to bias your AI-generated meal plans toward the eating styles you pick (DASH, Mediterranean, low-FODMAP, low-sodium, etc.) and to render the daily/weekly tips on the Diet Goals dashboard. Nothing else.
- How it's stored. Industry-standard symmetric encryption
at rest. The master key (
APP_ENC_KEY) lives in environment secrets — never in the database — so a database leak alone does not expose this data. Plaintext is held only transiently in memory during a request, never logged, never persisted. - What we don't do with it. We do NOT sell it. We do NOT use it for advertising (we have no advertisers). We do NOT share it with any third party, including analytics or telemetry services. If you use our AI, the relevant subset (just what's needed to bias the prompt — your diet types and preferences) is sent to our AI provider in the meal-plan prompt; we do not retain those prompts after the response is returned.
- Deletion. Empty the form + save to clear it immediately, or delete your whole account (also one click) and everything goes with it. Backups roll off on a 30-day window.
Important disclaimers
- This is not medical, dietary, or nutritional advice. AI-generated meal plans are starting points, not prescriptions — informational only. If you have specific dietary needs, allergies, or health considerations, or are planning meals during pregnancy or for children, verify with a registered dietitian, physician, or other qualified professional.
- Allergen verification is your responsibility. Product ingredients change without notice. Check labels before eating.
- AI accuracy is not guaranteed. Recipes, nutrition estimates, and substitutions may be wrong.
Contact
Questions about your data, or a data-access request: email [email protected].