Food Wins does not use cookies, advertising, or third-party analytics. It stores only the data needed to run the planner, sync your account if you sign in, create optional backups, create optional share links, and understand basic product usage.
Controller and contact
Food Wins is operated by David Lockie, based in Loulé, Algarve, Portugal.
For privacy questions or requests, email divydovy+foodwins@gmail.com.
What Food Wins collects
| Data | Where it comes from | Why it is used |
|---|---|---|
| Email address | You enter it when asking for a Supabase magic login link. | To sign you in and sync your planner across devices. |
| Food preferences, ratings, custom ingredients, custom meals, lunch choices, shopping checks, diet overlays, and generated meal plans | You create them while using the planner. | To build and save meal plans that match your household preferences. |
| Kid profile names | You type them into the planner. | To switch between household profiles. Use a nickname or initials if you prefer. |
| Analytics events | The app records limited events such as app loaded, plan generated, print, share, login link requested, and meal suggestions requested. Events can include event time, page path, referrer, limited feature details, a random session ID, and a short user-agent hash. | To understand whether the app is working and which features are used. These events do not include email addresses or account IDs. |
| Technical request data | Your browser and network provide normal request data when loading the app or calling its APIs. Login rate limiting may temporarily use IP address in server memory. | To host the app, prevent abuse, debug problems, and keep the service reliable. |
| Encrypted backup data | You enable cloud backup and choose a private backup code. | To let you restore planner data on another device. The backup is encrypted in your browser before upload. |
| Shared meal plan data | You choose to share a meal plan or shopping list. | To create a share URL that other people can open. Shared data can include the plan, shopping list, relevant preferences, ratings, custom meals, suggested meals, and profile name used for the shared plan. |
| Meal suggestion prompts and responses | You choose to request suggested meals. | To generate practical meal ideas from selected ingredients, blocked ingredients, region, existing meals, and meal feedback. |
Food Wins is intended for parents and guardians, not for children to use on their own. Please avoid entering sensitive information, full child names, health diagnoses, or allergy details that are not needed for meal planning.
Where data is stored
- Planner data is saved in your browser by default.
- If you sign in, your email address is handled by Supabase Auth and your planner state is stored in Supabase in the planner_states table as JSONB.
- Analytics events are stored in Vercel Blob without email addresses or account IDs.
- Cloud backups are encrypted in your browser and stored in Vercel Blob. Food Wins does not store your backup code and cannot read the encrypted backup without it.
- Shared meal plans are stored in Vercel Blob and are publicly accessible to anyone with the share URL.
- Vercel hosts the app and serverless API routes. Basic technical request data may be processed by Vercel to provide hosting and security.
Legal bases for processing
- Contract: account login, planner sync, backups, share links, and meal suggestions are processed to provide the features you ask to use.
- Legitimate interests: limited analytics, security, abuse prevention, debugging, and service reliability are processed to operate and improve Food Wins without intrusive tracking.
- Explicit consent: Food Wins is not designed to collect special-category data. If you choose to enter dietary information that reveals health, religion, or beliefs, it is used only for the meal-planning feature you requested and you can delete it.
- Legal obligation: some information may be kept or disclosed if required to comply with applicable law or valid legal requests.
Processors and external services
- Supabase: provides email magic-link authentication and account planner-state storage.
- Vercel: hosts Food Wins, runs API routes, and stores analytics, backup, and share-link data in Vercel Blob.
- OpenRouter: processes meal suggestion requests and routes them to google/gemini-2.5-flash-lite. Prompts can include selected ingredients, blocked ingredients, existing meal names, meal feedback, and region. They should not include your email address.
- Google Fonts: serves the typefaces used by the app.
These providers may process data outside Portugal or the European Economic Area. Where required, Food Wins relies on appropriate safeguards offered by those providers, such as standard contractual clauses, adequacy arrangements, or equivalent transfer mechanisms.
How long data is kept
- Browser data stays on your device until you clear it, reset the app, or clear browser storage.
- Supabase account data is kept while your account sync is active or until you ask for it to be deleted.
- Encrypted cloud backups keep the latest backup and up to five recent snapshots. Older snapshots are deleted automatically when new snapshots replace them.
- Shared meal plans remain available by share URL until they are deleted or the storage is removed. Email divydovy+foodwins@gmail.com with the share URL if you want one removed.
- Analytics events are kept only as long as needed to understand app usage, debug issues, and protect the service.
What is shared publicly
Food Wins does not sell personal data, use advertising networks, or use third-party analytics.
When you create a share link, anyone with that URL can view the shared meal plan and shopping list data. Share links do not include your account email, but they can include the household planning details needed to display the shared plan.
Your GDPR rights
If the GDPR applies to you, you can ask to access, correct, delete, restrict, object to, or receive a portable copy of your personal data. You can also object to processing based on legitimate interests.
To make a request, email divydovy+foodwins@gmail.com. You may need to provide enough information to confirm which account, backup, or share link your request relates to.
You also have the right to complain to a supervisory authority. In Portugal, that is the Comissão Nacional de Proteção de Dados: cnpd.pt.
Security
Food Wins uses HTTPS, server-side authentication checks for account sync, limited event data, browser-side encryption for cloud backups, and unguessable identifiers for backup and share URLs. No online service can guarantee perfect security, so avoid entering information that is not needed for meal planning.
Changes to this policy
This policy may be updated as Food Wins changes. The date below shows when it was last updated.
Last updated: 29 June 2026