Privacy Policy

Effective July 3, 2026

Who we are

This Privacy Policy explains how DeliveryDish LLC ("DeliverDish," "we," "us"), the operator of the DeliverDish app and website, collects, uses, and shares your information, and the rights you have. For privacy purposes, DeliveryDish LLC is the data controller. This policy is effective as of July 3, 2026.

Information we collect

Account information you provide at sign-up (email address, display name, and, if you sign in with Google, basic profile details from Google). Preferences and content you create: meal preferences, saved plans, and shopping lists. Location input: a ZIP code you enter to find nearby stores. Feedback you send us. Limited technical/usage data (such as server logs and an authentication session token) needed to operate and secure the Service.

Health-related and sensitive information

To estimate calorie targets and tailor plans, you may provide dietary restrictions, food allergies, and body metrics (age, sex, height, weight, activity level, and weight goals). This information can reveal details about your health, so we treat it as sensitive. We use it only to provide the Service — to generate and personalize your plans and lists — and never for advertising. Please do not enter sensitive information you are not comfortable having processed as described here; providing it is your choice and, where required by law, is done with your consent.

How we use your information

To provide and improve the Service: generating meal plans and shopping lists, estimating nutrition and calorie targets, matching products to your local Kroger store, saving your plans, emailing your list to your own account email when you ask, responding to feedback, and maintaining the security and reliability of the Service.

AI processing and your data

To generate plans and lists, your preferences and meal-plan inputs — which may include your dietary restrictions, allergies, and derived calorie targets — are sent to our third-party AI provider, DeepSeek (operated by Hangzhou DeepSeek Artificial Intelligence Co.), via its API. DeepSeek processes this data under its own terms and privacy policy, and its processing may occur on servers located outside your country, including in China. We encourage you to review DeepSeek’s privacy policy. Do not enter information you would not want processed by a third-party AI provider in this way.

How we share information

We share data only with service providers that help us run the Service, each acting on our behalf or under its own terms: Supabase (authentication, database storage, and hosting); DeepSeek (AI generation, as described above); Kroger (product, price, and cart lookups when you use those features); our application hosting provider; and an email provider such as SendGrid (to send your list to your own email). We may also disclose information if required by law or to protect our rights, users, or the public. We do NOT sell your personal information, and we do not share it for cross-context behavioral advertising.

International data transfers

We are based in the United States, and our providers may process your data in the United States and other countries. As noted above, our AI provider may process inputs in China. These countries may have data-protection laws different from those where you live. Where required (for example, for users in the EEA or UK), we rely on appropriate safeguards such as standard contractual clauses; by using the Service you understand your information will be transferred and processed as described.

Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process your information on these legal bases: performance of our contract with you (to provide the Service); your consent (for processing health-related/special-category data and sending it to our AI provider, which you may withdraw at any time); our legitimate interests (to secure and improve the Service); and compliance with legal obligations.

Data retention & deletion

We keep your account data while your account is active. You can delete your account at any time from Account → Manage account → Delete account, which permanently removes your account and associated data (including saved meal plans and favorites). Backups and limited logs are purged on our normal retention cycle. We retain information longer only where required to comply with legal obligations or resolve disputes.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to restrict or object to certain processing, and to withdraw consent. To exercise these rights, contact privacy@trydeliverdish.com; you may also use an authorized agent where the law allows. We will not discriminate against you for exercising your rights. EEA/UK users also have the right to lodge a complaint with their local data-protection supervisory authority.

California residents (CCPA/CPRA)

California residents have the right to know the categories and specific pieces of personal information we collect, to delete or correct it, and to limit the use of sensitive personal information (which may include the health-related data described above). We do not sell or share personal information as those terms are defined under California law. To exercise these rights, contact privacy@trydeliverdish.com.

Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us information, contact privacy@trydeliverdish.com and we will delete it.

Security

We use industry-standard measures to protect your data, including encrypted connections and access controls. No system is perfectly secure, so we cannot guarantee absolute security.

Data breach notification

If a data breach affecting your personal information occurs, we will notify affected users and regulators as required by applicable law.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, in the app) and update the effective date above.

Contact

Privacy questions or requests can be sent to privacy@trydeliverdish.com, or by mail to DeliveryDish LLC, 2850 3rd Ave S, St. Petersburg, Florida.