Privacy Policy

Last updated: November 12, 2026

Suppa LLC ("Suppa," "we," "us," or "our") operates the Suppa mobile application and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service.

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

• Account Information. When you create an account, we collect your email address. Password credentials are handled by our authentication provider using one-way password hashing. If you sign in with Apple or Google, we receive your name and email from them when you authorize it. When you sign up with Google, we also use your Google profile photo, if available, as your initial Suppa profile photo. You can replace or remove it in Settings.
• Profile Information. Your display name and profile photo, if provided. Google profile photos load from Google's image servers when displayed.
• Dietary Preferences. Allergies, dietary restrictions, disliked ingredients, excluded ingredients, favorite cuisines, skill level, spice tolerance, default servings, maximum cook time, and the nights you usually cook.
• Setting Up Suppa. The questions you answer when you first open Suppa (who eats with you and how many of them are children, allergies, diets, tastes, how you cook, your kitchen equipment and staples, and notes for the chef) are kept on your device until you create your account. Then they are saved to your preferences and memory notes, such as "4 of us, 2 are kids" or "Kitchen has: oven, air fryer", where you can change or remove them. For children, we keep only how many there are, never names or ages.
• Recipes and Meal Plans. Recipes you create, import, save, or add to your meal plan, including ingredients, steps, equipment, images, notes, and recipe books. A photo you select for recipe import or upload is transmitted to our service and, when the operation succeeds, stored as part of the recipe until you remove it or delete your account. Photo-import images are also sent to Google Gemini to extract recipe details. When you import photos of cookbook pages in the iPhone app, the app first reads each page's text on your device, using Apple's built-in text recognition, and sends that text to our service with the photos. We may send those photos and that text to TypeSafe (Jev), which finds each recipe on the pages so they can be saved separately; Google Gemini may read the same photos as well, and reads them whenever Jev can't finish. When a page holds several recipes, each recipe saved from it keeps its own copy of the page photo. When you save a recipe from Suppa's in-app browser, or share a page to Suppa from Safari's share sheet, we send that page's content to our service and to Google Gemini to read the recipe; if you are signed in to that site, the page can include details from your account there. So that Suppa's share sheet, Siri and Shortcuts can work while the app is closed, Suppa keeps a token on your device that can only save shared recipes to your account and, for Siri and Shortcuts, read tonight's dinner and your grocery list and add to them; signing out removes it. If you import from Ollie, the app reads the export file you choose on your device and sends us its recipes and your star ratings, which we save in books named after your Ollie folders. If you choose the file while setting up Suppa, before you have an account, its recipes wait on your device with your setup answers until you create your account, and its food profile fills in your setup answers for you to check; what you keep is saved like any other setup answer. Otherwise the food profile in that file stays on your device unless you send it to the Assistant yourself. If you also choose the PDF cookbook Ollie sent, the app sends it to our service, which finds each recipe's photo by its title and stores it as a photo you uploaded to your imported Ollie recipe of that name; nothing else from the file is kept, and none of it is sent to an AI model.
• Grocery Lists. Items derived from your meal plan and any custom items you add, including check-off state. So the app can offer them again in one tap, it also keeps the last few items you typed onto a list on your device, and Siri on your device can recognize them ("Add milk to my Suppa list"); they are not sent to us, and signing out removes them.
• Connected Kroger Shopping. If you connect a Kroger account, we store encrypted Kroger access and refresh tokens, the access scopes you granted, and the Kroger-family store you select. We also store grocery brand, size, or attribute preferences you ask Suppa to remember, plus records of proposed Kroger baskets: product names, UPCs, quantities, sizes, prices, image links, and whether the cart update succeeded.
• Cooking Sessions. Session progress, step completion, timer usage, and ingredient substitutions.
• Feedback and Ratings. Recipe ratings, tags, and free-text comments you submit, photos of your dinner you choose to add to a rating, whether each rating is shared with friends, and thumbs up or down on assistant replies, including whether the rating shares that conversation for review (Section 2).
• App Feedback. Bug reports and suggestions you send from Settings or through the assistant, with your app version, device details, the screen you were on, and an optional screenshot.
• Friends. Mutual friendships formed through invite links, invite codes, hearts, recipe saves and plans attributed to a friend, blocks, and reports. Your invite page shows your name and eligible profile photo to anyone with the link. Avatar uploads have location metadata removed.
• Shared Recipe Books. When you share one of your recipe books by link, we store the link, its description, whether you show it in your kitchen, the notes you add for followers, and who follows the book. When you follow someone's shared book, we store that you follow it.
• Shared Recipe Links. When you share a recipe by link, we store the link and which recipe it is for. When you save a recipe from someone's link, we store that it came from their link.
• Memory and Preferences. Notes and preferences you ask the AI assistant, or ChatGPT if you connect it, to remember on your behalf, stored as user-controlled text. For each note we also record whether you wrote it, the assistant saved it, or ChatGPT saved it at your request, and, for a note the assistant saved, which household plans you were in and which of their members allowed AI sharing at the time, so the note isn't sent to AI providers after one of them withdraws AI consent or leaves those plans.
• Assistant Conversations. Messages you exchange with the AI planning assistant, including photos and files you attach and tool-use interactions.
• Shared Plans. When you create or join a shared household plan, we store plan membership, shared meal plan items, and shared grocery lists.
• ChatGPT Connection. If you connect Suppa to ChatGPT, we store the connection: the app's name, when you connected and last used it, and a one-way hash of its sign-in token. We also store which of your plans ChatGPT edits, a short-lived record of each change ChatGPT asked Suppa to make so a retried request isn't applied twice, and the results of recipe checks Suppa ran for ChatGPT. Recipes you save from ChatGPT are labelled "From ChatGPT", and a photo ChatGPT passes to Suppa is stored as that recipe's cover photo. A food preference you ask ChatGPT to remember is saved to your memory notes, where Suppa's assistant uses it like a note you wrote and you can change or delete it on the Memory screen; Suppa saves these only while AI Data Sharing is on.
• Country. The app sends the country of your App Store account with its requests, and on suppa.cooking we use the country of your IP address, to choose which grocery partners to offer (Instacart serves the US and Canada, Kroger the US) and which measurements, oven temperatures, ingredient names and seasons the assistant uses. If you connect ChatGPT, we use the country hint ChatGPT supplies for you to decide whether to offer Instacart there. We don't save any of these to your Suppa profile. The app does record your App Store country and the country set in your phone's Region settings with its usage analytics (PostHog), so we can see how Suppa works in each country; once you sign in, those analytics are linked to your account.
• Push Notifications. If you allow notifications, we store your device's push token and time zone to send you updates and reminders at your local time, such as changes to a shared plan, tonight's planned dinner, a note at a time you choose when tonight has no dinner planned yet, or a reminder before your free week or free trial ends. On iPhone, the first time your plan shows a dinner for today or tomorrow and Suppa hasn't asked about notifications yet, it turns on quiet notifications without asking, and we store your push token and time zone the same way. iOS delivers quiet notifications to Notification Center without a sound or banner; you can turn on alerts in Settings → Notifications, or turn notifications off in iOS Settings. You choose which kinds you get in Settings → Notifications. We keep the time you last used Suppa (in the app, on the web, from the share sheet or with Siri) with your account; when your last few scheduled reminders all arrived after it, we hold the rest until you use Suppa again. When you share a recipe to Suppa from another app, we also notify that device when it's saved; these come only after you share something, and iOS Settings turns them off.
• Web Purchases. If you buy a plan on suppa.cooking, you pay in Stripe's checkout, which opens on the page. Stripe usually sells the subscription as merchant of record, through its Link service ("Sold through Link"); a purchase that isn't eligible to be sold through Link is sold by Suppa directly, with Stripe processing the payment. Stripe and Link collect your payment details, billing address, and email address to process the payment, calculate tax, send receipts, and provide payment support. Suppa never receives your card number. Through RevenueCat, we receive the plan you bought, its status and renewal dates, and the email address you checked out with.
• Android Waitlist. If you ask on suppa.cooking to hear when Suppa is on Android, we store the email address you give and use it only to tell you when Suppa is available on Android. To be removed, email privacy@suppa.cooking. Deleting a Suppa account that uses the same email address also removes it.

1.2 Information Collected Automatically

• Apple Ads Attribution. When Apple attributes an app download to one of our ads, RevenueCat can provide its campaign, ad group and advertising keyword, their identifiers, whether attribution came from an ad tap or view, and whether it was a first download or redownload. We may keep these details with your Suppa account in PostHog to understand which campaigns lead to useful app activity and subscriptions. Missing attribution stays unknown. We do not copy advertising identifiers, contact details or device identifiers into PostHog as part of this process.
• Device, Usage, and AI Trace Data. Device type (phone or tablet), operating system version, app version, the language the app shows (kept with your account, so notifications and emails can use it; when it is Spanish, the AI providers that write your replies, recipes and cooking tips are told to write in Spanish), product analytics events (PostHog), LLM analytics traces (PostHog), and crash/error diagnostics (Sentry). Product analytics events measure feature usage, activation, conversion, and reliability. When you import a recipe file, the events also note its size range, its page count and, from a fixed list of common apps (such as iPhone printing, Google Docs or Microsoft Word), the kind of app that made it, or "other". They never include the file's text or the names written in it. When you fill in the onboarding cards, some of your answers are also kept on your analytics profile in PostHog, even before you create an account, so we can see which kinds of households find Suppa useful: how many people you cook for, whether there are kids, how long a weeknight dinner can take, how you feel in the kitchen, how much cleanup is fine, how many nights you usually cook, and the kitchen equipment and staples you picked. Allergies, diets, foods you'd rather not eat, cuisines, the notes you write for the chef and anything you type are not sent. They also note whether the app may send you notifications, and what opened the app: a notification (its kind), a link (the first part of its address and, on links in Suppa's emails, the email's campaign name, never the full link), or Siri and Shortcuts. LLM analytics traces help us debug and improve AI features. They record the model used, token counts, latency, costs, and errors. New traces do not include prompts, conversation content, tool use, or model responses. Traces recorded earlier, during a limited debugging period, also include prompts, conversation context, tool use, and model responses until we delete them. The app does not use PostHog session replay. On suppa.cooking, Sentry records a replay of the page session around an error, with text and images hidden.
• Website Analytics. When you visit suppa.cooking, Vercel Web Analytics records page views: the page address, referring site, country, and browser, operating system, and device type. It does not use cookies or identify you across websites. When you tap an App Store button on suppa.cooking, we record the tap in PostHog with which button it was, your device type (iPhone, Android, other phone, or computer), and the site or tagged link that brought you to suppa.cooking (for example TikTok, Google, or a campaign name in the link), without cookies, IP-based location, or an identifier that links it to you or your other visits. To remember that source across pages, the site keeps it in your browser's session storage, which your browser clears when you close the tab. We also add the source's name to the App Store link, so Apple's App Store Connect reports can count downloads by source. If you create an account on suppa.cooking during that visit, we also record the same source (the site or campaign name only, never the full link) with your account in PostHog, so we can see which channels bring people who sign up.
• Network Information. We detect online/offline status locally on your device to enable offline queueing. Analytics events instruct PostHog not to retain or enrich them with IP-derived location. Our hosting and database providers (Vercel and Supabase) may still process and log IP addresses in standard server access logs for security and operations.
• Approximate Location (Weather Context). When you interact with the AI assistant, we derive your approximate location from your IP address (provided by our hosting provider) to fetch local weather and seasonal context for meal suggestions (for example, "it's a cold and rainy day — lean toward warming meals"). The latitude and longitude we store are rounded to one decimal place (roughly 11 km of resolution — neighborhood- or city-level, not address-level) and cached once per day per user. We do not access your device's GPS or precise location.
• Authentication Tokens. We issue JWTs and refresh tokens to maintain your session. These are stored on your device and rotated automatically.

1.3 Information We Do NOT Collect

• We do not collect precise geolocation data (we do not access your device's GPS). See Section 1.2 for the approximate, IP-derived location we use to fetch weather context.
• We do not access your contacts or precise calendar data. We access your camera or photo library only when you choose to take or pick a photo: to import a recipe, add a photo to a recipe, attach a photo in chat, add a photo of your dinner to a rating, or attach a screenshot to feedback. We access Reminders (iOS may ask for calendar access) only when you export a grocery list.
• Optional ChatGPT Ad Measurement. When this feature is enabled, suppa.cooking asks visitors who arrive from a ChatGPT ad before measuring it. If you allow it and arrive through an ad with a click reference, our server sends OpenAI that reference with signups, paid web subscription events (including plan and payment amount when available), and App Store button clicks. We do not load an advertising pixel or send contact details, browser identifiers, your IP address, recipes, dietary preferences, or conversations through this integration. You can decline or withdraw using Privacy choices in the website footer or at the top of this policy; we also honor Global Privacy Control.
• App Ad Measurement. The Suppa iPhone app uses AppsFlyer to measure our app ad campaigns, such as ads on Facebook and Instagram. AppsFlyer uses an installation identifier to record app opens, completed account creation, your first recipe import, and your first planned meal. RevenueCat sends AppsFlyer your subscription status, the plan you bought, and its revenue with your Suppa account ID and that installation identifier. AppsFlyer also receives your device's IP address with these reports and uses it to work out an approximate location (country, region, and city), along with technical details about your device: its model, iOS version, and language, the app's version, and the identifier iOS gives Suppa's apps on your device (IDFV). When you finish signing up, the app explains this measurement and iOS then asks whether Suppa may track you. If you allow it, AppsFlyer also collects your device's advertising identifier and can share it with the ad network whose ad you saw or tapped, such as Meta, together with your install, the steps above, and your subscription, so that network can tell whether its ad worked. If you don't allow it, or iOS doesn't let apps ask, the app does not collect the advertising identifier and we do not send these app events to ad networks: they see campaign results only through Apple's anonymous ad-attribution reports, which AppsFlyer also receives and which can show which of these steps happened after an ad, without identifying you. You can change your choice anytime in the iPhone's Settings app, under Suppa or Privacy & Security › Tracking. RevenueCat can also use Apple's ad-attribution token to connect subscriptions with Apple Ads campaigns. These reports contain no contact details, recipe content, dietary preferences, or conversations.
• We do not sell your personal information.

2. How We Use Your Information

We use the information we collect to:

• Provide the Service. Generate meal plans, recipes, grocery lists, and cooking guidance tailored to your preferences.
• Power AI Features. Your dietary preferences, memory notes, past feedback, and conversation history are sent to third-party AI providers to generate personalized recommendations, parse recipes, provide cooking assistance, help with connected grocery shopping, and generate supporting recipe assets. The AI planning assistant and the onboarding chat use one model that we choose for the whole service, currently from DeepSeek; we may switch to a model from OpenAI, Google, Anthropic, or another developer offered through Vercel AI Gateway. The dish ideas under recipe search come from Suppa's own dish list; for a household with an allergy or diet that Suppa's own checks don't cover, TypeSafe Jev first checks Suppa's recipe for each idea against the household's allergies and dietary restrictions. Other features use Google Gemini, OpenAI, and, where applicable, TypeSafe Jev and Groq. Many AI requests are routed through Vercel AI Gateway, which may serve a model through any of Vercel's inference partners that has a zero-data-retention agreement with Vercel, including for automatic failover. Assistant and onboarding chat requests also carry a conversation key that stays the same within one conversation and differs between conversations. We compute it from the conversation's internal ID with a secret only we hold, so it doesn't reveal who you are or what the conversation says, and Vercel and the inference partner may use it to keep a conversation on the server that already processed its earlier messages. Features that call an AI provider directly follow that provider's own terms. We send only the minimum context needed for each request.
• Provide Local Weather Context. Once per day per user, we send your approximate (IP-derived, rounded) coordinates to Open-Meteo to fetch a local weather forecast. The resulting summary (for example, "cool and rainy, mid-spring") is included as context for the AI assistant so its meal suggestions can reflect the season and weather. No identifying information is sent to Open-Meteo.
• Enable Collaboration. Shared plan features let household members share meal plans and grocery lists. Friends can see your name, profile photo, and shared ratings, manual notes, dinner photos, and cook activity. New manual ratings and recipe notes are shared by default when sharing is enabled; each rating and note has a sharing control. Earlier private ratings and notes remain private. A shared note is shown to friends with your rating of that recipe. A friend can send you a recipe: the send carries the recipe and their name, nothing typed, and lets you open that recipe while you stay friends. When you send a recipe, the friends you choose see your name, the recipe, and your shared rating of it if there is one. Assistant conversations, assistant-written feedback, recipe notes saved by the assistant or in cook mode, memory, dietary preferences, and personal plans and grocery lists are not shared through Friends.
• Shared Recipe Books. If you share a recipe book by link, anyone with the link can see the book's name and description, your first name and profile photo, how many recipes it holds, and the titles and photos of up to 12 of them, without signing in. People who follow the link with a Suppa account, whether or not they are your friends, can read the book's recipes and the notes you add for followers, and save them to their own recipe book. Recipes captured from listed publishers show followers only their title, photo, your note, and a link to the publisher, and a recipe's imported description is not shown. You see how many people follow a book, not who they are. Your ratings, other notes, cook history, plans, grocery lists, memory, and preferences are not shared through a shared book. You can reset the link, which stops it working for new followers, or stop sharing, which removes every follower; blocking someone also ends their follow, or yours of their book. Recipes a follower already saved stay in their recipe book. You can also choose to show a shared book in your kitchen. Your friends then see it when they visit your kitchen, with its name, description, recipe count and a cover photo, and can follow it there without the link. It is off for every book until you turn it on. Turning it off or stopping sharing takes the book out of your kitchen; people already following keep it until you stop sharing or block them.
• Shared Recipe Links. If you share a recipe by link, anyone with the link can see the recipe without signing in, along with your first name. Recipes you wrote or Suppa made show in full. Recipes imported from a website or social post show their ingredients, steps, times and a link to the source, but not the imported description, and show a photo only if you added it or Suppa made it. Recipes captured from listed publishers show only their title and a link to the publisher. Recipes imported from a photo, file or pasted text can't be shared by link. Your notes, ratings, cook history, plans, grocery lists, memory, preferences and other recipes are not shared through a link, and you don't see who opened it. Anyone with a Suppa account can save the recipe from the link. Stopping sharing stops the link working; recipes someone already saved stay in their recipe book. Anyone can report a shared recipe from its page by email.
• Connecting ChatGPT. When this feature is available, you can connect Suppa to ChatGPT to plan in a ChatGPT conversation. You sign in to Suppa and approve the connection on Suppa's own page, and ChatGPT then reads and changes your Suppa data only when you ask it to in a conversation. Depending on what you ask, ChatGPT receives your name and email address, your saved weeknight cooking time, servings and skill level when AI Data Sharing is on, the names of your plans, your planned dinners and the notes on those days (including notes others in a shared plan wrote), recipes you saved, results of a search of your saved recipes, and your grocery list (item names, amounts, and the dinner each came from). Allergies, diets, dislikes, cuisines, spice level and saved free-text memory notes are not sent through the cooking-preferences profile. For recipes imported from a website, social post, photo, or file, ChatGPT receives the title, source link, times, servings, and ingredients, not the imported description, steps, or photo. If you ask ChatGPT to save a recipe link or a social video, Suppa reads the page or video the same way the app's import does (a video is read by the AI providers in Section 3, needs AI Data Sharing on, and counts toward your monthly video and photo imports). For a link, ChatGPT first receives a preview with the recipe's title, website, times, servings, number of ingredients and steps, and first few ingredient names; Suppa saves it only after you open the page and choose Save on the preview card, and doesn't read pages a website's robots.txt closes to ChatGPT. When you open Show steps on the recipe card, the card fetches your saved steps directly from Suppa using a recipe-specific link that expires after about ten minutes. Those steps are displayed inside the card, without being added to the conversation or the model's context. Disconnecting Suppa or losing access to the recipe stops further fetches. We record when imported steps are withheld from the model (chatgpt_recipe_steps_withheld) and when you open them in the card (chatgpt_recipe_steps_viewed), with the source website's domain and your account identifier, never the recipe text or access link. These usage events help us decide whether to improve cooking support in ChatGPT. ChatGPT never receives other household members' allergies, diets, dislikes, memory notes, or names, or who added an item to a shared grocery list. Before ChatGPT saves a recipe or adds one to a plan, Suppa checks it against everyone on that plan on its own servers, using the recipe-checking AI providers in Section 3, and tells ChatGPT only whether it fits; these checks need AI Data Sharing on. When ChatGPT asks Suppa to remember a food preference, ChatGPT is told the note it saved, or that it wasn't saved, never which of your saved notes or preferences it matched. Once information is in a ChatGPT conversation, OpenAI handles it under its own terms and privacy policy. You can disconnect at any time under Settings → Connected apps in the app, You → Connected apps on the web, or by removing Suppa in ChatGPT.
• The Suppa App Clip. On an iPhone without the Suppa app, a recipe link may open the Suppa App Clip. The App Clip loads the recipe from the link, with no account, sign-in, analytics or advertising identifiers. If you start a cook-mode timer, it uses iOS's temporary notification permission (up to eight hours, without asking) to alert you when the timer ends; the timer runs on your device. If you tap Save to Suppa, the App Clip keeps the link on your device so the full app, once installed, can open the recipe and save it after you sign in. iOS removes the App Clip and its data after a period of non-use.
• Siri, Shortcuts and Spotlight. On an iPhone, you can ask Siri or a shortcut what's for dinner tonight, add to or show your grocery list, find a recipe, or save a recipe link, and use Suppa's Control Center controls. Suppa answers from the plan you have open in the app; Siri shows and reads the answer on your device, and Apple handles your Siri requests under its own terms. To make your saved recipes searchable from the iPhone's search, Suppa adds each recipe in your recipe book to the device's Spotlight index with its title, cook time, where you saved it from, when you saved and last cooked it, and a few ingredient names. These stay on your device, along with which plan you have open; signing out removes them. Nothing is sent to an AI provider for these features beyond what the same action in the app sends.
• Friends Controls and Notifications. You can turn rating sharing or friend activity notifications off in Settings (Notifications), make an individual rating or note private, remove a friend, block someone, reset an invite link, and report a person, shared take, shared note, or a recipe a friend sent you. Followers of a shared recipe book can also report the book or a note in it. Turning sharing off stops friend access to your ratings and notes. Removing or blocking ends access through that friendship. Information someone already saw or saved cannot be recalled. Reports are used to investigate and moderate abuse. A report preserves a private copy of the reported rating, note, shared book's name and description, and available photo, or of a sent recipe's sender, title, link, photo link and time, for moderation, even if the author later edits or deletes them or deletes their account. This evidence is available only to Suppa moderators. Reports and their evidence are retained for 90 days after submission and then automatically purged.
• Ask Suppa About Friends' Recipes. When you ask the AI planning assistant about your friends' recipes, it reads the titles of recipes friends shared with you, each friend's first name, their star rating, whether they would make the recipe again, and how many times they have made it, and these go to the AI providers that run the assistant. It never reads friends' notes, comments, or dinner photos. A friend's recipes are included only while that friend allows AI Data Sharing, and a recipe only while everyone who saved it allows AI Data Sharing. Before the assistant shows you one of these recipes as a card, its ingredients and steps are checked against your household's allergies and dietary restrictions by the recipe-checking AI providers, as your own saved recipes are. Turning off rating sharing, or AI Data Sharing, keeps your ratings out of your friends' assistant. A friend's details are looked up for the reply that asked for them and aren't sent again in later turns of that conversation, apart from what the assistant wrote in that reply, and conversations that used friends' recipes are left out of Help improve Suppa review.
• Improve the Service. Aggregated usage patterns and diagnostic data help us fix bugs, understand activation/conversion, measure reliability, and prioritize features.
• Review Chats to Improve Suppa. If Help improve Suppa is on, we may review assistant conversations you start after we first tell you about this setting (with a notice in the app or on the web, or when you change it yourself) to find problems and to write tests that make the assistant better. It is on by default; you can turn it off at any time under Settings → AI Data Sharing in the app, or You → AI on the web. The setting applies to all those conversations, so turning it off takes them all out of review. Before review, we remove your name and email address and the names of people in your shared plans, and we try to mask phone numbers, street addresses, and ZIP codes. Photos and files you attached are always left out. This removal is automatic and can miss details you typed, such as a family member's name or a name you used before changing it. AI coding assistants from Anthropic or OpenAI, used with model training turned off, may help us review them. Tests we keep are rewritten examples, not your messages. We do not use your conversations to train AI models. Review only covers people who allow AI data sharing and whose app has shown them this setting (or who changed it themselves). For a shared plan, it covers conversations only while everyone in that plan meets the same conditions and has Help improve Suppa on, since their details can appear in your conversations.
• Review Chats You Rate. When you rate an assistant reply with a thumbs up or down, the app first tells you that rating shares the conversation. Once you agree, we may review that conversation up to the reply you rated, in the same way as above, even if Help improve Suppa is off. A rating shares a conversation only while you allow AI data sharing and haven't deleted your account. In a shared plan, it also needs everyone else in the plan to meet the conditions for Help improve Suppa above and have it on, since their details can appear in your conversations. Conversations that used friends' recipes are never included. To take a conversation back out of review, remove your rating (tap the thumb again) or delete the conversation. Ratings you gave before the app showed this notice don't share anything.
• Communicate with You. Send sign-in codes, password reset emails, account emails (such as a reminder before a free week or free trial ends), push notifications you allow, and essential service notifications. If you haven't turned on notifications, or your iPhone delivers them quietly, we may also email you in your first few days about a dinner you planned, and with a few dinner ideas if you turned on Dinner ideas by email in Settings → Notifications. We may also email you now and then about what's new in Suppa. If you created your account after this policy took effect, these emails are on unless you turn off What's new in Suppa in Settings → Notifications; if you created it before, we send them only if you turn that on. These emails can be tailored to you, for example to what's changed since you last used the app or to features you haven't tried yet, using when you last used Suppa and which features you've used. Each of these emails has a link to turn it off; for the dinner you planned, that also turns off the matching notification.
• Maintain Security. Rate limiting and SSRF prevention protect your account and our infrastructure.

3. Third-Party Services

For AI request routing, provider details, and your choices, see How AI uses your data.

We use the following third-party services that may process your data:

Each third-party service is governed by its own privacy policy. We encourage you to review them.

Buying a plan on suppa.cooking is optional. Stripe and Link handle the payment under the Stripe Privacy Policy and Link Privacy Policy. If you save your details with Link at checkout, Link keeps them for future purchases under its own terms.

Using the Instacart shopping option is optional. To create a shopping link, Suppa shares the list information described above with Instacart. When available in the ChatGPT connection, this happens only when you ask to send a grocery list to Instacart, including by choosing Shop on Instacart on the grocery card. Creating a link does not place an order. When you open the shopping page, Instacart handles its own account, shopping, and checkout experience under the Instacart Privacy Policy.

Connecting a Kroger account is optional. It is available to Suppa Plus subscribers and works with Kroger and Kroger-family stores such as Ralphs, Fred Meyer, and QFC. You sign in on Kroger's own authorization page, so Suppa never sees your Kroger password. Suppa asks only for permission to search Kroger's product catalog and to add items to your Kroger cart. It does not ask for access to your Kroger profile, loyalty account, or purchase history. Kroger gives Suppa access and refresh tokens. Suppa encrypts them (AES-256-GCM) before storing them and uses them only for requests you make through Suppa.

To find nearby stores, Suppa sends Kroger the ZIP code you give. To build a basket, Suppa sends Kroger grocery search terms and your selected store ID. Kroger returns product details such as descriptions, sizes, prices, availability, ingredient and allergen information, and image links, and your device loads product images directly from Kroger. Kroger shopping runs through the AI assistant. Your grocery items, related messages, Kroger product results, and food preferences are therefore processed by the AI providers described above, including TypeSafe (Jev) for product matching and purchase quantities, Groq, with Google Gemini as a backup, for turning ingredients into store search terms, and an OpenAI model that checks product choices without changing your basket. Suppa adds items to your Kroger cart only after you confirm a proposed basket, and it sends only product UPCs and quantities for store pickup. Suppa cannot read or remove items already in your Kroger cart. You review your cart and check out with Kroger, under the Kroger Privacy Policy. The app does not yet have a disconnect option. To remove your Kroger connection and stored tokens without deleting your account, email privacy@suppa.cooking.

Before Suppa first transfers your information to an AI provider, the app asks for versioned, explicit consent describing the providers, data categories, purposes, and consequences of declining. You may decline and continue using manual planning, grocery, and cooking tools. You may withdraw or restore consent at any time under Settings → AI Data Sharing; after withdrawal, Suppa blocks new AI transfers and the affected AI features remain unavailable until you consent again. When a household member withdraws consent, memory notes the assistant saved while they were in one of your household plans are no longer sent to AI providers, unless the note's owner marks the note as their own on the Memory screen.

4. Data Retention

• Account Data. Retained while your account is active. When you delete your account, access is disabled and sessions are revoked immediately. Sign in with Apple authorization is revoked when applicable. The account and associated data are permanently purged by an automated cleanup process about 30 days after you delete your account, except moderation reports and evidence, which follow the 90-day period above.
• Cooking Sessions. Sessions inactive for four hours are closed automatically, and their logs are cleared after 90 days. Session records are kept until you delete your account.
• Chat Review Copies. Copies made to review chats (Section 2) are deleted within 30 days, and sooner if you turn off Help improve Suppa or AI data sharing, remove the rating that shared a conversation, delete the conversation, or delete your account, or if someone in your shared plan withdraws AI data sharing or leaves it. Parts of a chat that an AI coding assistant reads while helping us review it may be kept by that provider for up to 30 days under its terms, and we can't delete that copy sooner. It is not used to train AI models.
• Conversations. Assistant conversations, including photos and files you attach, are kept until you delete the conversation or your account.
• Cookbook Page Text. The text your device reads from cookbook page photos is used for that import only. We don't store it, apart from the recipes you save from it. TypeSafe keeps the photos and text it receives under its own terms: they say it doesn't use them to train AI models, and they set no fixed period for deleting them. TypeSafe may keep request data to provide its service, to watch for fraud and abuse, and to meet legal obligations. See its privacy policy and data processing agreement.
• Ratings and Dinner Photos. Ratings, notes, and dinner photos are kept until you change or remove them or delete your account. A dinner photo is stored privately, with location and camera details removed, and the app shows it through links that expire after an hour.
• App Feedback. Feedback you send is kept until you delete your account. A copy filed in our GitHub issue tracker contains no email address and may remain after your account is deleted.
• Authentication Tokens. Mobile session tokens are stored in the iOS Keychain, rotate automatically, and are invalidated when the account is deleted.
• Kroger Connection Data. If you connect Kroger, your encrypted tokens, selected store, saved grocery shopping preferences, and Kroger basket records are kept until you ask us to remove them or delete your account. Kroger access tokens are short-lived and are refreshed as needed. A Kroger basket shown in an assistant conversation is also part of that conversation's history.
• Purchase Records. Your subscription records (plan, status, and dates) are kept until you delete your account. Stripe, Link, Apple, and RevenueCat keep their own payment and tax records as the law requires.
• Advertising Measurement. Website choices last up to 180 days. Ad-click references expire after 30 days in browser storage and on our server. A browser may temporarily hold up to ten unsent App Store click events for retry on a later visit; these become ineligible after seven days. Withdrawing website permission clears local references and pending clicks and attempts to synchronize withdrawal with our server. Offline requests may delay synchronization. Server conversion payloads expire after seven days, and matching payloads are cleared after successful delivery or recorded withdrawal. Already sent events cannot be recalled through this integration. Operational event metadata is retained for up to 30 days and consent records for up to 187 days; scheduled cleanup enforces these windows. Account deletion prevents further delivery and the account purge removes these records. OpenAI’s retention is governed by its own policy.
• App Ad Measurement. AppsFlyer, RevenueCat, and any ad network that received your advertising identifier keep app measurement data under their own retention policies. The app remembers only which of the three measured steps it has already reported, and when, so it reports each once per installation, and that it has shown its explanation before iOS's tracking question, so it shows it once; deleting the app clears that record.
• ChatGPT Connection. The connection is kept until you disconnect it or delete your account; deleting your account stops it working immediately. Records of changes ChatGPT asked for are deleted after seven days, and recipe check results after 30 days. OpenAI keeps what was in your ChatGPT conversations under its own retention policy.
• Shared Recipe Links. A link is kept until you stop sharing it or delete your account. It stops working while the recipe isn't in your recipe book.
• Rate Limiting Records. Expire automatically after their time window closes.
• Product and AI Analytics. PostHog product events and LLM traces (recorded only for people who allowed AI data sharing) may be retained for up to seven years under the current project configuration unless they are deleted or anonymized earlier. We periodically review this window and may shorten it as operational needs mature.

5. Data Export and Deletion

• Export. You can request a copy of your personal data by emailing privacy@suppa.cooking. We may need to verify your identity before providing your data. Authenticated API access is also available via the /api/profile/export endpoint.
• Deletion. You can delete your account in the app or on suppa.cooking; Delete your Suppa account has the steps. If your account uses Sign in with Apple, delete it from the Suppa iPhone app, because Apple's approval of the deletion currently works only there; without the iPhone app, email privacy@suppa.cooking from any address and ask us to delete it. Access is disabled immediately and the permanent purge runs about 30 days later. The purge removes your profile, preferences, saved recipes and recipe books, recipe photos you uploaded, meal plans, grocery lists, cooking sessions, feedback (including dinner photos), meals you swapped away, memory, and conversation history, including attachments. The text of recipes you created or imported is kept without any link to your account. Grocery lists in a shared plan someone else owns stay with that plan. Moderation reports about the account, including snapshotted text and photos, remain private to moderators until their 90-day retention period expires.
• Kroger Connection. The purge also deletes your Kroger connection, including its encrypted tokens and selected store, along with your saved grocery shopping preferences and Kroger basket records. It does not remove items already added to your Kroger cart or information Kroger holds under its own privacy policy.
• Shared Plans. If you are the owner of a shared plan, deleting your account will delete the shared plan and its associated data for all members. Members should be notified before you delete your account.
• App Ad Measurement. When you delete your account, we remove its AppsFlyer installation identifier from RevenueCat, so RevenueCat stops sending AppsFlyer subscription events for it, including renewals of an App Store subscription you haven't cancelled. Deleting your account does not delete measurement reports AppsFlyer or ad networks already received. To ask AppsFlyer to delete them, email privacy@suppa.cooking.
• Subscriptions. Deleting your Suppa account cancels a plan you bought on suppa.cooking, so it stops renewing. It does not cancel a subscription billed by Apple; cancel that separately in your Apple ID subscription settings to prevent renewal.

6. Data Security

We implement reasonable technical and organizational measures to protect your data:

• Password credentials are managed by Supabase Auth using one-way hashing.
• Authentication uses short-lived access tokens and rotating refresh tokens; mobile session material is stored in the iOS Keychain.
• API routes enforce authentication checks before processing requests.
• Rate limiting protects against brute-force attacks.
• SSRF prevention guards against server-side request forgery on URL imports.
• Input sanitization prevents XSS and injection attacks.
• Database connections use encrypted channels (TLS).

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6.1 Where Your Information Is Processed

Suppa is run from the United States, and we store your information there: our database (Supabase) and application hosting (Vercel) are in the United States. The services listed in Section 3 process the information they receive in the United States or in other countries where they or their own providers operate. Vercel AI Gateway chooses the inference partner for each AI request, and may switch to another one if the first fails, so we can't list in advance every country where an AI request may be processed; Vercel lists its current partners.

If you live outside the United States, your information is transferred to and processed in the United States and those other countries, whose privacy laws may not protect it the way the laws where you live do. To limit this, we send each service only the information Section 3 lists for it, we send nothing to AI providers until you agree under Settings → AI Data Sharing (You → AI on the web), and AI requests sent through Vercel AI Gateway go only to inference partners that have zero-data-retention agreements with Vercel.

7. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, please contact us. If you tell Suppa that children eat with you, we keep only how many, as a memory note for planning your household's meals; we don't ask for their names or ages.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (see Section 5).
• Export your data in a portable format (see Section 5).
• Object to or restrict certain processing of your data.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at the address below.

8.1 California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of any sale of personal information. We do not sell personal information for money. Optional advertising measurement can involve sharing personal information for advertising purposes. You can decline or withdraw website measurement through Privacy choices. We honor Global Privacy Control on the website. In the app, AppsFlyer measures our ad campaigns as our service provider. It shares your advertising identifier and app events with an ad network only if you allow tracking when iOS asks; you can turn that off anytime in the iPhone's Settings app.

8.2 European Residents (GDPR)

If you are in the EEA/UK, our legal bases for processing are: (a) performance of our contract with you (providing the Service), (b) legitimate interests (security, improvement), and (c) your consent (where applicable). You may lodge a complaint with your local data protection authority.

8.3 Australian and New Zealand Residents

• Access and correction. You can ask to see or correct the personal information we hold about you (Australian Privacy Principles 12 and 13; New Zealand Information Privacy Principles 6 and 7) by emailing privacy@suppa.cooking. Most of it you can also see, change or delete yourself in the app, and you can ask us for a copy of it (Section 5). We answer requests within 20 working days.
• Overseas disclosure. As Section 6.1 explains, your information is stored and processed in the United States, and some AI requests may be processed in other countries. The United States is not a country New Zealand recognises as having comparable privacy protections, so the services there may not be required to protect your information the way Australian or New Zealand law does.
• Information you give us about other people. Only tell Suppa about someone else (for example, a household member's allergy or diet, or what someone you cook for doesn't eat) if they're happy for you to, or you're their parent or guardian. Please let them know and point them to this policy. They can ask us at privacy@suppa.cooking to see, correct or remove it.
• Complaints. Tell us first at privacy@suppa.cooking. We'll look into it and, within 30 days, tell you what we found and what we'll do about it. If you're not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or New Zealand's Privacy Commissioner (privacy.org.nz).

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy in the app and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at:

• Company: Suppa LLC
• Mail: 2226 Eastlake Ave E #1106, Seattle, WA 98102, United States
• Email: privacy@suppa.cooking