Privacy Policy

1. Introduction

Dishcount LLC ("we", "us", "our") operates the websites dishcount.co and dealstomeals.co (the "Service"). This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

(a) Information You Provide

• Your ZIP code and selected stores, used for nearby-store searches, caching and search logs. Search choices may also be saved in your browser or with a newsletter subscription.
• Account information if you register (name, email, dietary preferences, favorite recipe types, preferred store)
• Saved recipes, shopping lists, cooking preferences and any profile photo you upload
• Your email address and ZIP code when you subscribe to email updates
• Contact form submissions
• Pantry photos: If you use the pantry scan feature, your photo is sent to our third-party AI provider for ingredient identification. Dishcount does not store your photo — we retain only the identified ingredients. Handling of the image by our AI provider is governed by that provider's own data handling and retention practices, which may include limited retention for safety and abuse monitoring. We do not control those practices.
• Receipt photos: If you use the receipt scan feature, your photo is sent to our third-party AI provider to extract the store name and total amount. Dishcount does not store your photo — we retain the receipt discount amount and a one-way image fingerprint to avoid counting the same photo twice. As with pantry photos, handling of the image by our AI provider is governed by that provider's own retention practices.
• Family member data: If you add family members, their names, age groups, dietary preferences, and food dislikes are stored in your profile to personalize recipes. These details support your account and recipe personalization and may be processed by our service providers for those purposes.
• Shared plans: If you share a meal plan, the plan data is accessible via a unique link for 7 days. The link then expires; the stored record is not automatically deleted by that expiration check.
• Recipe ratings: If you rate a recipe, your rating (taste, ease, would make again) is stored and displayed anonymously to other users.
• Recipe interactions: We track which recipes you save, cook, and skip to improve your future recommendations. We use this information to provide account personalization. Optional product analytics follow your privacy choices and do not include recipe titles or the contents of your list.

(b) Information Collected Automatically

• Basic usage data (pages visited, features used)
• Authentication tokens and local browser storage to maintain your login, meal choices and shopping list

Optional tracking stays off until you give permission. You can allow each category separately:

• Usage analytics: Google Analytics and PostHog help us understand page visits, feature use and where a meal-planning attempt fails. We also measure page scrolling, selected form starts and submission attempts, retailer-link clicks and walkthrough playback milestones. Our custom events exclude ZIP codes, account contact information, dietary choices, recipe titles and typed requests.
• Session recordings: With separate permission, PostHog records navigation and interactions. Inputs and page text are masked, except selected public navigation labels. Images and private account screens are excluded; recording of console logs and network request contents is disabled.
• Advertising measurement: With your permission, Meta Pixel receives page views and selected action events. We do not supply your account email address, phone number, dietary choices or shopping-list contents. Automatic matching and automatic event configuration are disabled in our integration.

We do not sell personal information for money. When you allow advertising measurement, we share selected activity information with Meta. Advertising disclosures may be considered sharing or sale under some privacy laws. You can turn advertising off in Privacy choices.

(c) Information from Third Parties

If you connect your Kroger account, we receive a temporary access token to add items to your cart. We do not store your Kroger password, and we do not access your Kroger purchase history.

3. How We Use Your Information

We use the information we collect to:

• Find nearby grocery stores and current deals
• Generate personalized recipe suggestions using AI
• Save your preferences and favorite recipes
• Improve and maintain the Service
• Respond to your inquiries and support requests

We explicitly do NOT:

• Sell your personal information to third parties
• Share your data with data brokers
• Use your data for any purpose other than providing the Service, improving the Service, and measuring the performance of our own advertising

4. Third-Party Services

We integrate with the following third-party services, each of which has its own privacy policy. Each service receives only the minimum data necessary to provide its function.

5. Data Storage & Security

Your data is stored on Supabase, which runs on Amazon Web Services (AWS) infrastructure. We protect your data using:

• HTTPS encryption for all data in transit
• Supabase-managed authentication and server-side account authorization checks
• Row-level security policies on our database
• Environment variables for all API keys and secrets

While we take reasonable measures to protect your information, no method of electronic storage or transmission is 100% secure.

6. Data Retention

We remember your privacy choices for up to 180 days, then ask again. New PostHog session recordings are retained for 30 days under our current setting. Google Analytics event data is retained for 2 months and user data for 14 months; the user-data period resets with new activity. These settings do not determine how long aggregated reports remain available. Our current PostHog free plan has a one-year event window. PostHog is rolling out enforcement by project, so we do not promise automatic deletion at that point. Event retention is separate from recording and browser-cookie expiry. Contact us to request removal of previously collected events.

• Zip code search results are cached for up to 30 days
• Deal-cache freshness depends on the source; cache records and archived recipes may remain after an offer expires
• Account data is retained while your account is active
• Saved recipes are retained until you delete them

You can download your account data or permanently delete your account from My Account. Account deletion removes your saved records and shared links, and disconnects the stored Kroger connection. Your Kroger account and separate newsletter subscription remain. Use the unsubscribe link in a newsletter to stop those messages. For separate analytics or email-provider records, or if you cannot access your account, contact privacy@dishcount.co. We aim to complete verified privacy requests within 30 days. Restricted backups remain until they expire under the provider’s retention schedule.

7. Your Rights

You have the right to:

• Access the personal information we hold about you
• Update or correct your account information
• Delete your account and associated data
• Opt out of Kroger integration at any time
• Request a copy of your data

To exercise any of these rights, email support@dishcount.co.

8. Children's Privacy

The Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected information from a child under 13, we will delete it promptly.

If you believe a child under 13 has provided us with personal information, please contact support@dishcount.co.

9. Cookies & Analytics

Manage privacy choices

We use browser storage for sign-in and app state, and the analytics and advertising services described above:

PostHog and Meta may also use cookies or browser storage. Meta processes information under its own privacy policy, including for advertising measurement. Optional trackers remain off until you choose to enable them. Analytics, session recordings and advertising have separate controls. Rejecting them does not prevent account access, meal planning or shopping lists. Use Privacy choices on any page to change or withdraw permission. Withdrawing permission stops new optional collection; it does not automatically delete previously collected data. Contact us to request deletion. We honor Global Privacy Control by keeping advertising tracking off.

With analytics consent, Google Analytics receives the referring website's origin (for example, https://www.google.com/), without the referring page path, search query or fragment, so we can understand how visitors find Dishcount. Recognized sign-in providers are excluded from this referral value.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: