Privacy Policy

Effective August 27, 2026

Who we are

This Privacy Policy explains how DeliveryDish LLC ("DeliverDish," "we," "us"), the operator of the DeliverDish app and website, collects, uses, and shares your information, and the rights you have. For privacy purposes, DeliveryDish LLC is the data controller. This policy is effective as of August 27, 2026.

Information we collect

Account information you provide at sign-up (email address, display name, and, if you sign in with Google, basic profile details from Google). Preferences and content you create: meal preferences, saved plans, and shopping lists. Location input: a ZIP code you enter to find nearby stores. Feedback you send us. Limited technical/usage data (such as server logs and an authentication session token) needed to operate and secure the Service. Analytics and usage data on our website: pages and screens viewed, features used, approximate location inferred from your IP address by our analytics providers, device and browser type, and — once you sign in — an account identifier that links this activity to your account. See "Analytics and affiliate tracking" below and our Cookie Policy for details, including where analytics are switched off entirely.

Health-related and sensitive information

To estimate calorie targets and tailor plans, you may provide dietary restrictions, food allergies, and body metrics (age, sex, height, weight, activity level, and weight goals). This information can reveal details about your health, so we treat it as sensitive. We use it only to provide the Service — to generate and personalize your plans and lists — and never for advertising. Please do not enter sensitive information you are not comfortable having processed as described here; providing it is your choice and, where required by law, is done with your consent. Body metrics are collected only inside the optional “Calculate for me” panel and only after you tick the separate consent box shown there — this consent is not bundled into your acceptance of the Terms. We do not store those metrics: they are used on your device to compute a calorie target, and only that target is saved. You can withdraw this consent at any time under Account → Legal & privacy, which clears the calculated target and stops any further use; meal plans you have already generated are left in place.

How we use your information

To provide and improve the Service: generating meal plans and shopping lists, estimating nutrition and calorie targets, matching products to your local Kroger or Walmart store, saving your plans, emailing your list to your own account email when you ask, responding to feedback, and maintaining the security and reliability of the Service.

AI processing and your data

To generate plans and lists, your preferences and meal-plan inputs — which may include your dietary restrictions, allergies, and derived calorie targets — are sent to our third-party AI provider, DeepSeek (operated by Hangzhou DeepSeek Artificial Intelligence Co.), via its API. DeepSeek processes this data under its own terms and privacy policy, and its processing may occur on servers located outside your country, including in China. DeepSeek’s privacy policy states that it may use the information it receives to train and improve its models, and it does not publish a fixed retention period for that data. We do not send your name, email address, or account identifier alongside these inputs — what is transmitted is the meal-plan request itself, not a record tied to you. We encourage you to review DeepSeek’s privacy policy. Do not enter information you would not want processed by a third-party AI provider in this way. We also use a second AI provider, fal.ai, to generate illustrative photos of meals. What is sent to fal.ai is limited to the name of the dish and a generalized dietary descriptor drawn from a fixed list (for example "vegan," "dairy-free," or "nut-free") where your restrictions call for one. This descriptor is derived from your dietary restrictions, but it is category-level only, is never accompanied by your account identifier, email, or body metrics, and the resulting photo is cached and reused for every user with the same dish and dietary profile rather than being tied to you.

How we share information

We share data with the service providers listed here, each acting on our behalf or under its own terms. Supabase provides authentication, database storage, file storage, and hosting. Railway hosts our backend application. DeepSeek provides AI meal-plan generation and fal.ai provides AI meal-photo generation, both as described above. Kroger provides product, price, and cart lookups when you use those features. Walmart provides product and price lookups, and affiliate links, when you use those features. SendGrid delivers your shopping list to your own account email when you ask us to send it. Pexels supplies stock meal photography. Google Analytics 4 and PostHog provide website and product analytics, and Impact.com provides affiliate attribution for the Walmart program — these three are described under "Analytics and affiliate tracking" below. We may also disclose information if required by law or to protect our rights, users, or the public. We do not sell your personal information for money, and we do not use your health-related information for advertising.

Analytics and affiliate tracking

On our website we use Google Analytics 4 and PostHog to understand how the Service is used. These two providers set their own identifiers in your browser and receive your IP address, the pages and screens you view, and the actions you take. We also participate in Walmart’s affiliate program through the affiliate network Impact.com, but Impact.com does not run any tracking script on our site and does not observe your browsing here. Our affiliate links point to a redirect on goto.walmart.com that carries our own publisher and campaign identifiers and the contents of the basket you asked us to build — never your account identifier, email, or any health information. Impact.com receives information about you only if and when you choose to follow one of those links, at which point it receives what any website receives from a visit — your IP address, browser details, and the referring page — and sets its own cookie on its domain to attribute the referral. Once you sign in, PostHog also receives an account identifier, so your product activity can be linked to your account; Google Analytics is kept anonymous. We do not send your body metrics, allergies, dietary restrictions, saved plans, or shopping-list contents to any analytics or affiliate provider — where we measure these at all, we send only counts and yes/no flags. None of these tools are loaded for visitors in the European Economic Area or the United Kingdom. See our Cookie Policy for what is stored and how to clear it.

International data transfers

We are based in the United States, and our providers may process your data in the United States and other countries. As noted above, our AI provider may process inputs in China. These countries may have data-protection laws different from those where you live. Where required (for example, for users in the EEA or UK), we rely on appropriate safeguards such as standard contractual clauses; by using the Service you understand your information will be transferred and processed as described.

Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process your information on these legal bases: performance of our contract with you (to provide the Service); your consent (for processing health-related/special-category data and sending it to our AI provider, which you may withdraw at any time); our legitimate interests (to secure and improve the Service); and compliance with legal obligations.

Data retention & deletion

We keep your account data while your account is active. You can delete your account at any time from Account → Manage account → Delete account, which permanently removes your account and associated data (including saved meal plans and favorites). Backups and limited logs are purged on our normal retention cycle. We retain information longer only where required to comply with legal obligations or resolve disputes.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to restrict or object to certain processing, and to withdraw consent. To exercise these rights, contact privacy@trydeliverdish.com; you may also use an authorized agent where the law allows. We will not discriminate against you for exercising your rights. EEA/UK users also have the right to lodge a complaint with their local data-protection supervisory authority.

California residents (CCPA/CPRA)

California residents have the right to know the categories and specific pieces of personal information we collect, to delete or correct it, and to limit the use of sensitive personal information (which may include the health-related data described above). We do not sell personal information for money. We use the analytics and affiliate providers described above, which set identifiers in your browser; we do not use them for cross-context behavioral advertising, we do not run advertising on the Service, and we never disclose your health-related information to them. If you would like us to stop any processing that qualifies as "sharing" under the CPRA, or to exercise any of the rights above, contact privacy@trydeliverdish.com and we will honor the request. You may also use an authorized agent, and we will not discriminate against you for exercising your rights.

Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us information, contact privacy@trydeliverdish.com and we will delete it.

Security

We use industry-standard measures to protect your data, including encrypted connections and access controls. No system is perfectly secure, so we cannot guarantee absolute security.

Data breach notification

If a data breach affecting your personal information occurs, we will notify affected users and regulators as required by applicable law.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (for example, in the app) and update the effective date above.

Contact

Privacy questions or requests can be sent to privacy@trydeliverdish.com, or by mail to DeliveryDish LLC, 2850 3rd Ave S, St. Petersburg, Florida.