Privacy policy

What we store

• From Google, when you sign in: your name, email address and profile picture. Google is the only way to sign in, and we don't see your Google password.
• What your household enters: the household's name and the people who eat there (including children without an account), their allergies, diets, likes and dislikes, portion sizes and any protein or calorie targets; recipes, the meal plan, ratings, the pantry, equipment and grocery lists; and invites, which hold the invited person's email address.
• Who did what: who added a recipe, planned or cooked a meal, or checked something off, so the household can see it.
• Sign-in cookies that keep you signed in and remember which household you're looking at. There are no advertising or tracking cookies.

Health information

Allergies, diets and protein or calorie targets are health information. Tablecount uses them only to leave out or flag recipes, check substitutions, and work out nutrition for your household. They're never used for anything else, and never shared outside your household.

Who can see it

• The people in your household can see everything in it, including every eater's allergies and diets. Owners can also see pending invites. Other households can't see any of it: the database enforces this for every request, and we test it.
• Whoever runs Tablecount can technically reach the database to keep the service running. We only look at a household's data to fix a problem or when you ask us to.

Services we use

• Supabase stores the database and handles sign-in, on servers in the United States (us-east-1).
• Vercel hosts the app. Like most hosts, it keeps short-lived server logs (such as IP address, browser and time) for security and to keep the service working.
• Google signs you in. Google learns that you signed in to Tablecount, and nothing about your household.
• GitHub stores the weekly backups. They're encrypted before they leave our systems, so GitHub can't read them.
• USDA FoodData Central (the U.S. Department of Agriculture's nutrition database) gets ingredient names when someone looks up an ingredient's nutrition, and nothing about you or your household.
• Recipe websites: when you import a recipe from a link, our server fetches that page, so the site sees our server rather than you. Recipe photos load in your browser straight from the recipe's site, without telling it which of our pages showed them; like any image on the web, the site sees your IP address.

What we don't do

We don't sell or rent your data, show ads, use analytics or tracking tools, or send your data to AI services. We don't send email. If installed on your phone, the app keeps only a "you're offline" page on your device, never your household's data.

How long we keep it

• Your data is kept while your account and household exist.
• Invites are deleted 30 days after they're accepted, revoked or expire.
• When you delete something, it leaves the database right away. We make an encrypted backup of the database once a week, and before changes to it, and keep each one for up to 90 days, so deleted data can stay in a backup until that backup is deleted. Backups are only used to recover from a mistake or an outage; only the person who runs Tablecount holds the key to read them.
• Server logs are kept by our hosting providers for a limited time.

Your choices

• Download your data from Household & people: one JSON file with your account and everything in each household you belong to.
• Delete your account from Household & people. Households you're the only person in are deleted with everything in them. In shared households you're removed, along with your own eater profile and its allergies and diets, and the rest stays for the others; if you're the only owner, make someone else an owner first.
• Owners can delete a household, and anyone in a household can delete an eater, such as a child, along with their allergies and diets.
• Information about you that someone else entered (for example, your allergies added by a family member): ask an owner of that household to change or delete it, or write to us.
• For anything else, including corrections or questions about your data, write to hello@tablecount.app.

Children

Children can be listed as eaters by an adult in the household, with no account of their own. Accounts are for adults: children under 13 shouldn't sign in themselves.

Security

Everything travels over HTTPS. Each household's data is kept apart by database rules that are checked on every request, and the app checks what you send before saving it. No service is perfectly secure; if something goes wrong that affects your data, we'll tell the people affected.

Changes

If this policy changes, we'll update it here and change the date at the top.