Privacy policy

Information you provide

We store your sign-in email and account identifier, meal planning answers, dietary preferences, saved plans, shopping checklist selections, plan changes and preferred future subscription price. Google sign-in may provide profile information through our authentication provider. Please avoid putting medical records or other sensitive personal details in preference notes.

How information is used

We use this information to authenticate you, generate and save plans, apply usage limits, build shopping lists and operate the service. If you subscribe to Pro, Waffo processes payment and billing information. We send your account identifier and email to connect your subscription to your account, and store subscription status, billing period and payment confirmation. We do not receive or store your full payment card number. Server and hosting logs may include request information such as IP addresses, timestamps and technical errors for operation and security.

Service providers

Supabase stores account and plan data and handles authentication. Vercel hosts the website; Railway runs retailer price updates; Cloudflare serves images and network services. Resend delivers sign-in emails through our authentication configuration. When AI planning is used, OpenRouter and its selected model provider receive planning inputs, including goals and preferences, and recipe candidates. We do not intentionally include your email in the planning prompt. Providers process data under their own terms and may operate in countries other than yours.

Public sharing

Plans are private until you create a share link. Anyone with that link can view the selected meal overview. Calories are hidden unless you enable them. Share pages exclude your email and private preference notes. Public share visits are counted. Keep share links private if you do not want others to see the meals.

Error monitoring

If error monitoring is configured, Sentry receives error types and code locations to help us fix failures. The application removes error messages, request URLs, account data, headers, cookies and preference text before sending reports. Session replay and performance tracing are disabled. The provider receives technical connection information when a report is sent.

Cookies and optional analytics

Authentication uses cookies. Your browser stores an onboarding draft so you can resume and an analytics preference. If optional analytics is configured, we load Google Analytics only after you allow it. Events describe page categories and actions, such as generating a plan or opening a list; we exclude emails, private plan identifiers, preference text and URL query parameters. Google also receives technical connection data when its script is loaded. You can turn analytics off using the control at the bottom of the page. Turning it off stops future optional collection; previously collected data may remain with the provider.

Retention and your choices

Account information and saved plans are kept while your account remains active, unless removed as part of a deletion request. Provider backups and operational logs can remain for their retention periods. You can edit meal preferences when creating a plan and clear browser storage to remove the local draft. You may request access, correction or account deletion using the contact below.

Contact and changes

Contact support@nourishweek.com for privacy questions or account requests.

We will update the date on this page when this policy changes. The service is intended for adults.