Privacy Policy

MealsList is run by Meals List, a sole proprietorship based in Utah, United States. This page explains what we store, why, and what you can do about it. It is written to be read rather than to cover us.

What we store

When you create an account we store your email address and a scrambled version of your password. We cannot read your password and neither can anyone else who gets hold of the database.

As you use the app we store the things you put into it:

• Your household name and the names of the stores you shop at
• Your grocery items, the prices you enter for them, and which are ticked off
• Your dish library and seven-day meal plan
• Which household each person belongs to

We also keep a session record while you are signed in, so the app knows it is you between one screen and the next, and a short-lived token when you ask for a password reset.

What we never receive

We never see your card number, bank details, or PayPal password. Payment is handled entirely by PayPal, who tell us only that a subscription exists and that it has been paid.

Why we store it

To run the app. That is the whole reason. Your list has to be somewhere for your household to share it, and your prices have to persist for the store comparison to mean anything.

We do not sell your data, share it with advertisers, or use it to build a profile of you. We do not use your grocery data to train anything.

Who can see it

Everyone in your household sees the same list, stores and prices. That is the point of a shared list, and it is worth being aware of before you add someone.

A household holds up to four people. Anyone in it can remove someone else from the Account page, which deletes that person's login immediately and emails them to say so. The list itself belongs to the household and is not affected.

Beyond that, access is limited to the people who maintain MealsList, and only when needed to fix a problem or answer a support request.

Cookies

The app sets one cookie, which keeps you signed in. It is not used for tracking or advertising. If you block it you will not be able to stay signed in.

Getting your data out

The Account page has an export that gives you everything your household has entered, as a file you keep. It can be pasted back in, so it is a real backup rather than a dead end. You do not need to ask us for it and you do not need a reason.

Deleting your data

When a trial or subscription lapses, nothing is deleted. The app becomes read-only and your data stays exactly where it is until you either subscribe again or ask us to remove it.

How long we keep it

For as long as the account exists. Sessions expire on their own. Password reset tokens expire within hours. Backups of the server are kept on a rolling basis and old ones are deleted automatically, so a deleted account may persist in a backup for a short period before aging out.

Where it lives

On a dedicated server in the United States. If you are outside the US, using MealsList means your data is stored there.

Security

The site and app run over HTTPS. Passwords are hashed. The database configuration sits outside the public web folder. Backups run daily.

That said, no service can promise it will never be breached, and we are not going to pretend otherwise. If something happened that affected your data, we would tell you.

Children

MealsList is not aimed at children and we do not knowingly create accounts for anyone under 13. If you believe a child has an account, contact us and we will remove it.

Changes

If this policy changes in a way that matters, we will update the date at the top and, for anything significant, email account holders rather than quietly editing the page.

Contact

Questions about any of this go through the contact page.