Privacy Policy

Coldbox stores the meal planning data you put into it and the email address you sign in with. There is no advertising, no analytics, and no tracking of any kind. Nobody buys or sells your data. The recipes and photos you hand to the AI features are sent to an AI provider to be read, and the text of those requests is kept in your household's history. You can delete your account and everything in it from Settings, at any time, without asking us.

Coldbox is a small independent app run by one person. In this policy, "we" means that person and "you" means whoever is signed in. Contact: support@meals.johnnylinsf.com.

• Your email address. It is how you sign in. We do not use passwords at all. You sign in with Apple, with Google, or with a code we email you. If you use Apple or Google, they tell us your email address and we do not receive your password.
• A display name. We start it off as the part of your email before the @ sign, and you can change it in Settings. Your household name starts the same way.
• What you put in the app. Recipes, weekly plans, grocery lists, pantry contents, meal ideas, the stores you shop at, prices you log, and equipment you own.
• A record of your AI requests. See the AI section below. This is the one place where something you typed is stored a second time.
• Your time zone. Stored in a cookie so that pages show your today rather than the server's.

We do not collect your location, your contacts, your device identifiers, or anything from other apps. We do not ask for your phone number.

Coldbox is built for a household to share one plan, so sharing is the default and it is thorough. Every member of a household can read and change every recipe, plan, list, pantry item, store and logged price in it, and can read the history of AI requests made in it, including the text of recipes anyone imported. Members see each other's display names. They do not see each other's email addresses.

Any member can create an invite link, and anyone who opens that link within seven days joins the household. Only the household owner can change the paid plan. Invite people the way you would hand someone a key.

Nothing is shared outside your household. You can belong to more than one household, and they never see each other.

Planning a week, importing a recipe, finding ideas, cooking from what you have, and scanning a fridge photo all work by sending a request to an AI model. We use Vercel AI Gateway to reach Anthropic's Claude models. Your request passes through both.

What actually goes in a request:

• Recipe text you paste, or the text we extracted from a page you linked.
• A short summary of your recipe box for planning: titles, categories, cuisines, tags, rough cooking times and equipment. Not the full ingredients or steps.
• What is in your pantry, what you have eaten in the last two weeks, and up to 25 of your saved meal ideas.
• Photos, only for the fridge scan, and only the ones you take in that moment.

We keep a record of each request in your household's AI history: the text of the prompt, the answer, how many tokens it used, and what it cost. We keep it so that the app can bill honestly against your quota, so that repeating the same request within ten minutes does not charge you twice, and so that we can debug a bad answer. Everyone in your household can read that history. Deleting your household deletes it.

We do not train any model on your data, and we have no ability to. Whether the providers above retain your request is governed by their policies, not ours.

A fridge scan photo is resized in your browser, sent to the AI provider to be read, and then it is gone. We never write it to a database or a file. The app has no photo storage of any kind. What we keep is the list of food the model found, plus a one-way fingerprint of the image used to recognise the same photo if you retry within ten minutes. That fingerprint cannot be turned back into a picture.

Take the photo of the food, not of the room. We cannot promise the AI provider ignores whatever else is in frame.

When you paste a link, our server fetches that page, not your browser. The site you linked sees a request from our server, identified as ColdboxBot. It does not see your IP address, your cookies, or anything that identifies you. For a TikTok link we ask TikTok's public oEmbed endpoint for the caption, which does tell TikTok that someone asked about that video.

Coldbox Plus is billed through Stripe. We never see, handle, or store your card number. Checkout and the billing portal are pages Stripe hosts. What we send Stripe is your email address, your household name, and your household's internal id. What we keep is your Stripe customer and subscription ids, whether the household is on the free or paid plan, the plan status, and the renewal date. Stripe's handling of your payment details is covered by Stripe's privacy policy.

When something breaks we send the error to Sentry so it can be fixed. Session replay is off. We do not turn on Sentry's personal-data collection, and we never attach your user id or email to an error. A report carries the route that failed, a request id, and the error message, and an error message can occasionally quote data that caused it. We also sample a small share of requests for performance timing, ten percent in the browser and twenty percent on the server.

So that the grocery list works in a shop with no signal, the app keeps a copy of the current list in your browser's storage, along with any check-offs made while offline that have not synced yet. The installed app also caches the rendered grocery page.

Both are wiped when you sign out. That matters on a shared phone or a shared computer: signing out is what stops the next person seeing your list. Close the tab and it stays.

There is no analytics in this app. No Google Analytics, no Facebook pixel, no product analytics, no heatmaps, no advertising. We set exactly two cookies: the one that keeps you signed in, and one holding your time zone. Neither follows you anywhere. That is why there is no cookie banner.

Fonts are served from our own domain, so loading a page does not tell Google anything.

• Supabase stores the database and runs sign-in.
• Vercel hosts the app and keeps standard server request logs.
• Vercel AI Gateway and Anthropic process AI requests.
• Stripe processes payments.
• Sentry receives error reports, when it is switched on.
• Apple and Google, only if you choose to sign in with them.

That is the whole list. We do not sell your data, we do not share it with advertisers, and we do not hand it to anyone else unless the law requires it.

Your data stays until you delete it. We do not expire old recipes, plans, or AI history on our own. Offline copies on your device are dropped after a day, or immediately when you sign out.

Open Settings and use Delete account, at the bottom. You type your email address to confirm, and then:

• For any household where you are the only member, the household and everything in it is deleted. Recipes, plans, grocery lists, pantry, stores, logged prices, invites and AI history all go. If that household was paying for Plus, the subscription is cancelled at the same time.
• For any household with other people still in it, your membership is removed and their data stays, because it is theirs too. If you were the only owner, ownership passes to whoever has been in the household longest, so that someone can still manage the plan.
• Your login is deleted from Supabase.

This is immediate and cannot be undone. There is no grace period and no way for us to restore it afterwards. Recipes you created in a household you shared stay with that household, with your name detached from them.

If you would rather ask a person, email support@meals.johnnylinsf.com and we will do it for you.

Depending on where you live, you may have the right to see a copy of your data, correct it, or have it erased. Deletion is built into the app. For anything else, email support@meals.johnnylinsf.com and we will sort it out. We are not going to make you fill in a form.

Coldbox is not built for children and is not directed at anyone under 13. If you believe a child has an account, email us and we will delete it.

Our database and the services above run on infrastructure in the United States. If you use the app from elsewhere, your data is transferred there.

If this changes in a way that matters, we will say so in the app rather than quietly editing the date at the top.