Privacy Policy

Last updated: 2026-09-07

1. Who we are

NourishKit is a household meal-planning app. This policy explains what data we collect, why, what we share, and the rights you have over it. It applies to everyone who uses NourishKit.

2. What we collect

• Account details — your name and email address (password is stored by our authentication provider as a secure hash, never in plain text).
• Household data you enter — members, meal plans, recipes, pantry stock, grocery lists, and health tracking you log (weight, food, wellness, cycle).
• Technical data — basic server logs, kept on our own servers, so we can find and fix problems.
• We do not sell your data, and we do not use advertising trackers.

3. Why we use it

• To run the app — planning, grocery lists, insights, and everything else you asked for.
• To advise you — with your consent (the checkbox at signup), our team can read a household's plans and health tracking to review and publish coach notes and check the planner is working. Coach notes combine our team's best-practice guidance with AI-generated suggestions; they are not written by a nutritionist. Every staff view or change is recorded in your household's activity log.
• To keep it working — security, error fixing, and improving the product.

4. What we share

• Supabase — your data is stored on our hosting provider (Supabase). Their terms and privacy policy apply to the infrastructure they run.
• Instacart — when you tap an Instacart button, we send your shopping list or recipe ingredients to Instacart to create the shopping page. Instacart's privacy policy governs what they do with it.

5. How long we keep it

Your data stays until you delete it. You can download a copy of your household's data at any time (Account → Your data) and delete your account and its data permanently from the same place. Some records — such as activity-log entries about staff access, or rows required by law — may be kept where the law or security requires it.

6. Your rights

Depending on where you live (including under UK GDPR and the GDPR), you have rights to:

• access your data and get a portable copy (export is built in);
• correct inaccurate data;
• delete your data (account deletion is built in);
• object to or restrict certain processing;
• withdraw consent for the staff-access permission at any time.

To exercise any of these, use the built-in export and delete tools first — they are the fastest route — or email [email protected].

7. Security

Data is encrypted in transit, access to data is scoped per user and per household (row-level security), staff access is logged, and only the minimum number of people can ever see household data.

8. Cookies and local storage

We use essential cookies and local storage for authentication (keeping you signed in) and for small preferences. We do not use third-party advertising cookies.

9. Changes to this policy

If we change how we handle data, we will update this page and the date above. Significant changes will also be announced in the app.

10. Contact

Questions about this policy or your data? Email [email protected].