NutriPlan Privacy Policy

Effective Date: September 26, 2026

1. Information We Collect

When you use NutriPlan, we collect the following information:

Account information — email address and name you provide at registration.
Dietary preferences — dietary restrictions, cuisine preferences, calorie and macro goals, and dietary filters (e.g. low-sugar, low-sodium) you set during onboarding or in your profile.
Meal plan data — the weekly meal plans we generate for you, including recipes, meal swaps, and grocery lists.
Pantry photos. If you use the pantry scanner, the photographs you capture of your pantry, refrigerator, or groceries are sent for food recognition (see Google in the table below). They are used only to identify food items, never for advertising.
Notification preferences— a device identifier used solely to deliver service notifications (e.g. “Your new meal plan is ready”). We do not use this for advertising or tracking.
Usage analytics — pseudonymized data about how you interact with the app (e.g. screens viewed, features used) to help us improve the service. These events are tied to an account identifier rather than to your name or email address.

2. How We Use Your Information

Generate personalized meal plans tailored to your dietary preferences and goals.
Recommend recipes based on your cuisine and dietary preferences.
Send service notifications about your meal plans.
Improve the quality and accuracy of our meal planning service.

3. Third-Party Services

We share specific data with the following third-party services solely to provide the NutriPlan service. We do not sell your data to any third party.

Service	Purpose	Data Shared
Supabase	Authentication and database storage	Email, profile, meal plan data
Google (Gemini)	Food recognition for the pantry photo scanner	Photographs you capture of your pantry, refrigerator, or groceries
Edamam	Recipe sourcing and filtering based on dietary preferences	Dietary filters
USDA FoodData Central	Ingredient-level nutrition data	Ingredient names only
FatSecret	Branded, restaurant, and takeout food lookups	The food or restaurant item name you search for
Instacart	Building an Instacart shopping-list link when you choose to shop your grocery list	Grocery-list item names, quantities, and units
RevenueCat	Subscription and in-app purchase management	Account identifier and purchase or subscription status
PostHog	Product analytics and session recording, to understand how the app is actually used and to fix what does not work	Account identifier, in-app activity events, and session recordings of your screen while you use the app. Screens that display your dietary restrictions, allergies and health flags are masked in those recordings, and the text you type is masked as you type it. Recordings are used only to diagnose and improve the app, and are not sold or used for advertising.
Sentry	Crash and error diagnostics	Diagnostic error reports (emails, tokens, and dietary data are removed before sending)
Firebase Cloud Messaging	Push notifications	Device identifier only
Upstash Redis	Temporary caching	Anonymized, auto-expiring cache data

4. Data Storage and Security

We take the security of your data seriously. Your information is protected using industry-standard practices at every layer:

All data is encrypted at rest in our database and encrypted in transit using TLS — the same encryption standard used by banks and financial institutions.
All communication between the app and our servers is over HTTPS. Your data is never transmitted in plain text.
Authentication uses short-lived access tokens and secure refresh tokens, so your session is protected even if a single token is compromised.
Temporary cached data auto-expires and is stored in an encrypted cache layer — it is never permanently retained.
We do not store passwords directly. All authentication is handled by Supabase, a trusted infrastructure provider with SOC 2 compliance.

5. Your Rights

You have the right to:

Access — request a copy of the personal data we hold about you.
Correction — update or correct inaccurate information in your profile at any time.
Deletion — request deletion of your account and all associated data.
Export — request a machine-readable export of your data.

To exercise any of these rights, contact us at vtreddy@umich.edu.

6. Children’s Privacy

NutriPlan is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.

7. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app and via email. Your continued use of NutriPlan after changes are posted constitutes acceptance of the updated policy.

8. Contact Us

If you have questions about this Privacy Policy or your data, contact us at vtreddy@umich.edu.

NutriPlan is not a substitute for professional medical advice.