Privacy Policy

This Privacy Policy describes how Streamline Merch LLC (“NeatEat,” “we,” “us”) handles personal information when you use the NeatEat mobile app and website (the “Service”). It applies to users of the Service in the United States and, where applicable, to users protected by the GDPR and CCPA/CPRA. Effective date: October 10, 2026.

1. Information we collect

Information you provide

• Account details: your email address and name, and the OAuth identifiers we receive when you choose to sign in with Google or Apple (such as a unique account ID and the email you authorize).
• Planning data: the meal plans you build, recipes you save, your weekly budget, and preferences (e.g. dietary preferences and allergens you set, household size, and the store you choose).
• Recipe content and photos: recipes and links you import, photos you upload, and ingredient photos you choose to scan.
• Purchase information: subscription product, purchase and renewal dates, trial status, and entitlement. Apple and Google process payment details; we do not receive your card number.
• Communications: messages you send us for support or feedback.

Information collected automatically

• Device & usage data: device type and operating system, app version, language, general interaction events, crash logs, and approximate (non-precise) location inferred from your IP address.
• Advertising identifiers: because the app is supported by ads, we and our ad partners may process advertising identifiers (such as Apple’s IDFA or Google’s Advertising ID) where you permit it. See “Advertising” and “Your tracking choices” below.

Dietary choices, allergies, nutrition goals, and food logs can reveal health-related information. We use the information you provide to personalize meal planning. NeatEat does not provide medical advice.

2. How we use your information

• To create and maintain your account and sync your plans across devices.
• To generate and suggest meal plans and build your grocery list.
• To operate, secure, debug, and improve the Service.
• To show ads and measure their performance (with your permission where required).
• To respond to your support requests and send service-related notices.
• To comply with legal obligations and enforce our Terms.

Where the GDPR applies, our legal bases are: performance of a contract (running the Service), our legitimate interests (securing and improving the Service), your consent (for advertising tracking, optional AI sharing, and website analytics), and compliance with legal obligations.

3. Advertising and affiliate links

NeatEat offers paid subscriptions and may earn affiliate commissions. Ads may be served by third-party ad networks that use advertising identifiers and similar technologies to show and measure ads. Some links to grocery or product partners are affiliate links, which means we may earn a commission if you make a purchase. This never changes the price you pay, and affiliate relationships do not let partners read your plans.

4. How we share information

We do not sell your personal information for money. We share data only with service providers and partners who help us run the Service:

• Supabase — our backend host (authentication, database, storage), which stores your account and planning data on our behalf.
• Google & Apple Sign-In — identity providers when you choose to sign in with them.
• PostHog — product analytics linked to your account ID, including app interactions, searches, onboarding preferences, and subscription events. Website analytics require cookie consent.
• RevenueCat — subscription validation and management, including your account ID, store transactions, and entitlement status.
• OpenAI — ingredient recognition from food photos and extraction of recipes from pasted text or linked page content. The app provides feature-level permission controls in updated app versions. See Optional photo scans and recipe importsbelow for the data sent, retention, and your choices.
• TikTok — advertising attribution, including account/device identifiers and selected registration, login, trial, and purchase events. On iOS, collection requires App Tracking Transparency permission. Denial or withdrawal stops further TikTok events. TikTok attribution is disabled on Android.
• Affiliate partners — when you follow an affiliate link, that partner’s own privacy practices apply on their site.

Under certain privacy laws (e.g. the CCPA/CPRA), sharing data with ad partners for cross-context behavioral advertising may be considered a “sale” or “share.” You can opt out — see “Your tracking choices” and “Your rights” below. We may also disclose information to comply with law or protect rights, safety, and security.

Optional photo scans and recipe imports

Photo scanning and recipe import use OpenAI as an AI service provider. Content is sent through NeatEat’s backend when you choose to scan food photos or import a recipe. In app versions with a Privacy Policy checkbox, you must review and accept this policy before completing account creation. The acceptance record is associated with your own account on that device, including when you join a household.

• Photo scans: the food photos you select are sent to OpenAI to identify ingredients. NeatEat does not save these raw scan photos in its photo-storage service. Detected ingredients can be used in your app, and usage and consent records are retained to operate the feature.
• Recipe imports: pasted recipe text, or recipe text extracted from a link you provide, is sent to OpenAI to identify the recipe, ingredients, instructions, and other recipe details. Following a link also requests content from the source website. Recipe details and associated images you save are stored with your account.
• Your choices: scanning and importing are optional. You can enter ingredients by hand and use existing recipes without submitting photos or recipe text to OpenAI. To request withdrawal of your processing choices or discuss a privacy concern, contact privacy@neateat.app. Stop using scanning and importing while your request is handled. Policy acceptance is not permission for advertising tracking, which uses a separate system permission where required.

Existing sessions that have not accepted the current policy or previously approved the relevant feature are directed to a policy review before submitting content in updated app versions. Earlier app versions may use a separate sharing prompt or send content when you start a scan or import. Use manual ingredient entry and existing recipes if you do not want to send content to OpenAI.

Photos and recipe text may contain personal information, so include only the food or recipe content you want processed. OpenAI’s published API policy states that API content is not used to train its models by default unless the customer opts in. It also describes default abuse monitoring retention of up to 30 days, legal exceptions, and additional retention rules for some features and flagged image inputs. Provider retention depends on the API feature and applicable account settings; withdrawal prevents future transfers and does not undo processing that has already occurred. Read OpenAI’s API data controls for the provider’s current terms.

Household sharing

If you share a household invite code, people who join can access the original account’s shared app data, including plans, grocery lists, recipes, and preferences. Share the code only with people you trust. Membership does not give another person access to the owner’s sign-in credentials or owner-only account settings and deletion controls.

5. Data retention

We keep your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we delete or de-identify your personal data within a commercially reasonable period (typically within 30 days), except where we must retain certain records to comply with legal, accounting, or security obligations. See our Account & Data Deletion page.

Account deletion removes account records and associated stored uploads, and requests erasure of account-linked analytics and subscription-provider profiles. Processor requests may finish asynchronously. Apple sign-in authorization is revoked as part of deletion. Legally required transaction records and protected backup copies may remain for their applicable retention periods. Deleting an account does not cancel an App Store or Google Play subscription: cancel separately to stop future charges.

6. Your rights

Depending on where you live, you may have the right to access, correct, export (portability), or delete your personal data, to object to or restrict certain processing, and to withdraw consent. If you are in the EEA/UK (GDPR) or California (CCPA/CPRA), these rights apply to you, including the right not to be discriminated against for exercising them.

• Access & export: request a copy of your data.
• Deletion: delete your account in-app or by request — see Account & Data Deletion.
• Opt out of ad tracking / “sale” or “share”: use your device tracking controls and the choices described below.

To exercise any right, email privacy@neateat.app. We may need to verify your identity first.

7. Children’s privacy

NeatEat is not directed to children. The Service is intended for users aged 13 and older, and we do not knowingly collect personal information from children under 13 (consistent with COPPA). If you believe a child under 13 has provided us personal information, please contact privacy@neateat.app and we will delete it.

8. App Tracking Transparency & tracking choices

On iOS, we ask for your permission through Apple’s App Tracking Transparency (ATT) prompt before tracking you across apps and websites owned by other companies for advertising. If you decline, we will not use TikTok to collect your identity or app activity for advertising measurement. You can withdraw iOS tracking permission in Settings → Privacy & Security → Tracking. TikTok attribution is disabled on Android. On the web, non-essential analytics load only after you consent via our cookie banner.

9. International data transfers

We may process and store information in countries other than where you live, including the United States. Where required, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) to protect your information when it is transferred internationally.

10. Cookies and similar technologies

Our website uses essential cookies to function and, with your consent, analytics cookies. For details and your choices, see our Cookie Policy.

11. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy from time to time. We will revise the “last updated” date above and, for material changes, provide additional notice where required.

13. Contact us

Questions or requests about privacy? Email privacy@neateat.app, or write to Streamline Merch LLC, the State of Wyoming, United States.