Privacy

Last updated 2026-09-25.

What we collect

  • Account email and name when you register, so we can sign you in and reach you about your account.
  • Pantry, recipe, and grocery data you enter, stored on the servers we operate.
  • Waitlist email, if you submit one on this site, plus a hashed (sha256) form of your IP address used purely to detect signup abuse. We do not store the raw IP address.

Who we share it with

  • Resend — sends our transactional and confirmation emails. They see your email address and the contents of the message we sent you.
  • Cloudflare — hosts this site and the API and provides cookieless web analytics on the marketing site (no GDPR banner; no cross-site tracking).
  • PostHog (US region) — our product analytics and error tracking. On this marketing site we use it in cookieless mode (no cookies, no session or local storage, no session replay, and no cross-site identity) to understand which pages visitors read. Once you are signed in to the product app, we also use it for session replay and storing the feedback you send us, so we can understand how the app is used, find bugs, and act on what you tell us. Data is sent through our own domain (/ph-relay, on this site and in the app) and retained for 30 days by default. See the section below for what is and is not recorded.

We do not sell your data. We do not share it with advertisers.

Analytics, error tracking, and feedback in the product app

We use PostHog inside the signed-in product app for four things, from one SDK:

  • Product analytics — anonymous-by-design interaction events (page views, clicks, custom events such as “recipe imported” or “grocery list generated”). Events are attributed to your user account and to your household so we can answer questions like “how many households use meal planning?” without singling out individuals.
  • Error tracking — uncaught exceptions, failed API requests, and route loader failures. We use these to fix bugs.
  • Session replay — a reconstructed view of the page that plays back the interactions during your session. Passwords, email, and numeric/telephone input fields are masked at the browser before anything is sent. The Login, Register, Settings, and Billing pages are not recorded at all. Other personal data the app displays (member emails, household names, invitee emails) is wrapped to be masked in replays. Payment card entry happens inside Stripe's own iframe and is never sent to PostHog.
  • In-app feedback — when you use the “Send feedback” option in the app to send us a note, the message you write is stored in PostHog, along with the type you picked (general, bug, or idea) and which screen you sent it from. Unlike the interaction events above, which are counts and IDs rather than anything you type, a feedback note is the text itself — we keep it so we can read it and fix what you flagged. Your note is masked in session replay and retained for 30 days like everything else here. Please don't put anything in a note you wouldn't want us to store; the email opt-out below removes it along with the rest of your PostHog data.

We respect the browser-level Do Not Track signal — if you have it on, the SDK will not initialize and no events or replays are sent. We do not currently show an in-app consent banner; if you would prefer to opt out, email hello@pntrypal.com from the address on the account and we will exclude you and delete any existing PostHog data tied to your account.

Cookies

The marketing site uses no cookies — its analytics (Cloudflare and PostHog) both run in cookieless mode. The product app uses one session cookie to keep you signed in.

Deleting your account

You can delete your account yourself, in the app: go to Settings, then Account, and choose Delete your account. Your account locks right away and we sign you out everywhere.

You have 30 days to change your mind

When you confirm, we show you the date your account will be deleted, 30 days out. Until that date you can sign in and restore it, and we delete nothing. We email you a reminder a week before. After the date, our nightly cleanup deletes the account, usually within a day, and we email you once it's done.

Restoring brings back everything we were going to delete, with two exceptions. If you handed a household to someone else, it stays theirs and you come back as a member. And if your plan ran out during the 30 days, you'll need to subscribe again.

What we delete

  • Your account — your name, email, password, Google sign-in link, sessions, and preferences.
  • Any household you own, and everything in it: pantry, recipes, lists, meal plans, and photos. If other people share your household, you pick one of them to take it over before you can delete, so it's never deleted out from under them.
  • Your billing details at Stripe, including any saved card. If you hand a household to someone else, your card comes off it as soon as you confirm, not 30 days later.
  • Your PostHog profile, which holds your name and email, and everything PostHog recorded under it: events, error reports, session replays, and feedback notes. PostHog removes the profile soon after and the rest in its weekly cleanup.
  • Invites sent to your email address, from any household.
  • Your waitlist signup, if you left one on this site.

What stays

Deleting your account doesn't erase every trace of it. Here's what's left.

  • What you added to a shared household. Recipes, lists, and the rest belong to the household, so they stay for the people still in it. We take your name off the recipes you added. We can't take your name out of text someone wrote, like a recipe note that mentions you, a household named after you, or what you typed to generate a recipe the household saved.
  • Products and ingredient names you added. Products you entered by hand and the names you taught us for ingredients go into a catalogue every household shares. They stay, with no link back to you.
  • Emails we already sent. They stay in the inboxes they went to, including invites that carry your name, and in Resend's logs.
  • Billing history. Stripe keeps invoices and payment records, and we keep our log of the billing events Stripe sent us, as tax and accounting rules require.
  • A record that we deleted your account. It holds your account and household IDs, the dates, your Stripe customer IDs, and a one-way hash of your email. If you ask us later whether we deleted your account, we can check your address against it. Anyone who already has your address can do the same check, so it isn't anonymous. We keep it for good.
  • Your email, for up to 7 days. We hold on to it only to send the email saying the deletion is done, and erase it as soon as that sends. If it can't be sent, we erase it after 7 days.
  • Bounce and complaint records. If mail to your address bounced, or you marked it as spam, we keep a note of that so we never email the address again. It's a fact about the address, not your account. It also means we can't send you the email saying the deletion is done.
  • Backups. Our database backups still hold your data until they expire and get replaced by newer ones.

Contact

Questions: hello@pntrypal.com.