Privacy policy

Nom Nom is a meal planner for a household: a shared cookbook, a plan of meals to cook, and a shopping list worked out from that plan. This page says what it stores, who processes it for us, and how to download or delete it.

What we store

Your account

Your email address, an account ID, and how you sign in: with Google, with Apple on iPhone, or with an email address and password. If you use a password, it's stored only as a hash. When you sign in, Supabase records the session's IP address and user agent, which names the app or browser that signed in. What Google and Apple give us is under Signing in with Google and Signing in with Apple.

For each household you belong to, we store the name you're shown as, your role, when you joined, and when you last opened the app with which version of it. The app records the last two each time it opens, whether or not you share usage data. Other members of the household can see when you were last active.

Your household's data

Everybody in the household can see this, as far as their role allows:

• recipes and takeout meals you add, import or copy from the shared library, with the web address a recipe was imported from and, for takeout, the place, area, phone number, website, price and order notes;
• recipes you share with a code: a copy of the recipe is kept with the code, and anyone signed in to Nom Nom who has the code can read it, even after you delete the recipe;
• the meals on your plan, with who added each and when. The plan has no days or times to cook them;
• your shopping list: items, quantities, which store each belongs to, who added an item and when, and who ticked it off and when;
• your stores, their categories and layout, and what you record against an ingredient: notes, allergen marks, substitutes, items the app suggests you buy regularly, and suggestions you've switched off;
• your pantry: what's on hand, by name, who last changed it, and meals you've marked as on hand;
• the household's name and its allergen and intolerance watch lists, its members and their roles, invite codes, and requests to join, with the name the person asking typed;
• members an admin adds by name without a sign-in, such as a child;
• meal history, if you use it: who ate what, who logged it, how much of it, and when, with its nutrition. An admin can make the history of a member without a sign-in visible to admins only, and viewers see meal history only if an admin allows it;
• member profiles, if you set them: a member's age group and sex, used only as context for that member's own meal history.

If you type an invite code that doesn't work, we record the attempt against your account, to limit guessing.

Feedback

If you send feedback from the help button, we store what you wrote, the screen you sent it from, the app's version number, and who sent it.

What's kept on your phone

Some settings are kept only on your phone: theme, text size, units, how the shopping list is grouped, dismissed tips, help and setup progress, and cook timers and cooking progress. Your sign-in session is kept there too. The app also keeps a copy of your household's data on the phone, for up to 7 days. On Android, the home-screen widget keeps the unticked items on your list. If your Android phone backs up apps to your Google account, or your iPhone backs up to iCloud, this can be part of that backup and come back when you restore it.

Cook timers

If you start a cook timer, the app has your phone alert you when it ends, even with your phone locked, and may show the timers you have running in your phone's notifications while they count down. They're created and shown on your phone, and nothing about them is sent to us. Cook timers are the only thing Nom Nom sends you notifications about. On Android, the app asks for permission to post notifications and to set exact alarms, so an alert goes off on time. On iPhone, it asks for permission to send notifications. It uses them for cook timers only.

Assistant activity

When a member's AI assistant connects to your household, we record which member it was, the name the assistant gives itself, and when it first and last connected. Admins see these records for every member; other members see only their own. Supabase also stores each assistant's registration, with the name, web addresses and logo it gave, and your consent to it: which assistant, what it may do, and when you agreed. If an assistant connects through the address that can switch between households, we store which household it last switched to, one choice per account. We don't store the conversations, the questions or the answers.

Purchases

Nom Nom is bought through Google Play on Android and through the App Store on iPhone. Google or Apple handles the payment, and we never receive card details.

Google Play. When someone buys it for a household, the app sends the purchase to our server, which checks it with Google. We store the product, its state, when it renews or ends, Google's order number, a hash of the purchase token, and who in the household bought it and when. The app sends the purchase token to our server, which uses it to check the purchase with Google. We also keep the token itself, encrypted, where only our server code and database administrators can read it. We use a yearly plan's token to re-check when it renews and to ask Google to stop its next payment in the cases described under "Your data, and getting rid of it". A lifetime purchase's token is kept but not used again. A token is deleted when the household is deleted or a new purchase replaces it, unless a request to stop that plan is still open, in which case it's kept until the request succeeds. When a plan is due to be stopped, we keep a record of it: the household's ID, the purchase token as a hash, the product, why, when we asked and how many times, the last error, and when the request succeeded. That record isn't deleted. Google tells our server when a purchase renews, is cancelled or is refunded, and we keep a log of those notices with the purchase token replaced by a hash.

App Store. When someone buys it for a household on iPhone, the app sends the purchase to our server, which checks it with Apple. We store the product, its state, when it renews or ends, Apple's original transaction ID, whether it was made in Apple's test environment, a hash of what Apple returned, and who in the household bought it and when. Apple tells our server when a purchase renews, changes or is refunded. We keep a log of those notices with Apple's signed data removed; it includes the transaction IDs, the product, and when the purchase was made, renews or ends, and it isn't deleted.

We also store when the household's free period started and ends.

Usage data

To learn which parts of Nom Nom people use, the app counts how many times each screen is opened — for example "the shopping list, 5 times" — and a fixed list of other actions, such as opening help, finishing a step of setup, or what was chosen on setup's last screen, which offers the two plans (the plans shown, the free trial chosen instead, a purchase started or completed, and Restore). It sends those counts to our database with the app's version number and the calendar date on your phone they belong to. Only names from that fixed list can be stored: nothing you typed, and no recipe, ingredient, list item, household or member name. The counts are stored against your household membership, so they're linked to your account. We use them only to decide what to improve. They're never shown in the app and never shared.

Turn this off at any time in Settings › You › Privacy › Share anonymous usage data. Turning it off stops the counting at once, deletes any counts your phone hasn't sent yet, and stops crash reports. It's on by default. It doesn't stop the last-opened time and app version described under "Your account".

Crash reports

If the app hits an unexpected error, it sends a crash report to Sentry (Functional Software, Inc., United States), the service we use to find and fix bugs. A report contains the type of error and its message, the place in the app's code where it happened, the app's version number, and the name of your phone's operating system. The message is written by the app's code to describe what went wrong, and can occasionally include a piece of what the app was handling at the time. Everything else is removed before a report leaves your phone, including any record of what you did beforehand.

Sentry works out the IP address each report came from and, unless we switch that off, stores it with the report. It also works out roughly where the report came from, from that address. Sentry keeps reports for 30 or 90 days, depending on our Sentry plan. No crash reports are sent while Share anonymous usage data is off.

Signing in with Google

If you sign in with Google, Google gives Nom Nom your name, your email address, your Google account ID and a link to your Google profile picture. On Android, you pick the account in your phone's own Google account picker. Nom Nom asks Google for nothing else: no contacts, calendar, files or other Google data.

• How we use it: your Google account ID and email address sign you in and identify your account. Your name fills in the name your household will see you as, and you can change it before it's saved. We don't use the profile picture link.
• How we store it: with your account in Supabase, our database provider, until you delete your account. The name you keep is shown to your household and to any AI assistant you connect.
• Who we share it with: only the services listed below. Supabase stores it, and Resend receives your email address to send your account emails and keeps them for 30 days, including after you delete your account. We don't use Google user data for anything else, including advertising, and we don't sell it.

Signing in with Apple

On iPhone, you can sign in with Apple. Apple gives Nom Nom your Apple user ID, an email address, and whether that address is a Hide My Email address. The first time you sign in, and only if you choose to share it, Apple also gives us your name. If you choose Hide My Email, the address is one Apple makes for Nom Nom.

• How we use it: your Apple user ID and email address sign you in and identify your account. If Apple gives us your name, the app uses it as the name your household sees you as, and doesn't ask you for one.
• How we store it: with your account in Supabase, our database provider, until you delete your account. The name you keep is shown to your household and to any AI assistant you connect. When you sign in, our server also gets a token from Apple. We keep it encrypted, where only our server code and database administrators can read it, and use it only when you delete your account.
• Who we share it with: only the services listed below. Supabase stores it, and Resend receives your email address to send your account emails, as under Signing in with Google. We don't use it for anything else, including advertising, and we don't sell it.
• When you delete your account: our server uses the token to ask Apple to revoke Nom Nom's access, and deletes the token once Apple accepts. We keep a record of the request, with your account ID, and it isn't deleted. If our server holds no token for your account, Apple isn't asked.

What we don't do

• No advertising. There are no ads and no ad networks.
• No advertising or marketing analytics. There is no advertising, marketing or profiling SDK in the app. It counts use and reports crashes, as described under "Usage data" and "Crash reports", and only while Share anonymous usage data is on.
• We never sell or share your data with anybody for their own purposes.
• No access to your phone's location, contacts, photos, camera or microphone. The app never asks for them and doesn't use them. Its Android manifest lists shared-storage permissions for Android 12 and older, which the app never requests. On iPhone, the app asks only for permission to send notifications. It also declares calendar access, for adding a meal to your calendar, which it never requests.

Who processes it for us

• Supabase, in the United States — the database and sign-in that hold everything above. It also runs the code that checks purchases with Google and Apple, asks Google to stop the next payment of a yearly plan bought through Google Play, and gets and revokes Sign in with Apple tokens. It's also the sign-in service an AI assistant uses to connect.
• Railway — hosts the connector that AI assistants talk to. It passes requests through to Supabase. Our code on it saves no files. It writes short logs of which tool was used, whether it worked and how long it took, and of sign-in and consent steps, with every ID masked and no content. Railway's own request logs keep each request's IP address, the name of the software that sent it, and the address it asked for, which includes your household's ID when the assistant uses the address the app gives you. Railway keeps logs for up to 30 days.
• Resend, in the United States — sends the app's account emails, such as sign-up confirmation and password reset, from hello@castleburyventures.com. It receives your email address and the message, which can contain a sign-in link. It keeps email and log data for 30 days, and its backups for 7 days. If we close our Resend account, Resend deletes what remains within 90 days.
• Sentry (Functional Software, Inc., United States) — crash reports.
• Namecheap — hosts our email inbox. If you email us, your message and address are stored there.

Other companies involved

• Google. Google Play takes the payment, and Google's privacy policy governs it. To check a purchase, and to stop a yearly plan's next payment, our server sends Google that purchase's token. Google sign-in is described above.
• Apple. On iPhone, the App Store takes the payment, and Apple's privacy policy governs it. To check a purchase, our server sends Apple its transaction ID. Sign in with Apple is described above.
• Vercel. It hosts this website. When you load a page, Vercel receives your IP address, works out roughly where you are from it, and receives details of your browser and device, under its own privacy notice. The site sets no cookies and loads nothing from anywhere else.
• Recipe websites. When you import a recipe from a link, your phone downloads the page straight from that website, which sees your phone's IP address, as with any visit.
• AI assistants. The company that runs an assistant you connect receives what the assistant reads, under that company's own terms.

AI assistants

Connecting an assistant is something you do yourself, from a computer. Nothing is connected by default. The address the app gives you connects the assistant to one household. It can read and change that household, as far as your role in it allows, and it can't read meal history or member profiles.

You disconnect it in the assistant's own settings, where you connected it. The app can't see that happen, so the list it shows is a record of activity, not a list of live connections.

Your data, and getting rid of it

• Download: Settings › You › Your account › Download your data. It saves CSV files of your recipes, your cookbook and your meal history.
• Delete: Settings › You › Your account › Delete my account. Step-by-step instructions are on the deletion page, including what to do if you can't get into the app.

Deleting your account deletes your sign-in and your membership of every household, and with it your usage counts, feedback, member profile and requests to join. If you were the last member with a sign-in, the household and everything in it are deleted too, even if it's paid for.

What happens to a yearly plan when its payer leaves, is removed or deletes their account, or when the household is deleted, depends on where it was bought:

• Bought through Google Play, on Android: we ask Google to stop the plan's next payment. This covers the household being deleted, including when its last member with a sign-in leaves or deletes their account. Google says a plan stopped this way can't be restored. If the household stays, it keeps the plan until the end of the period already paid for. From version 145, the app says so first, says when the paid period ends if it can, and offers Open Google Play. You can also cancel the plan yourself in Google Play.
• Bought through the App Store, on iPhone: none of these stops the plan, and we can't stop it. Apple keeps charging the person who pays until they cancel it, in their iPhone's Settings › their name › Subscriptions. If the household stays, it keeps the plan while they pay. If the household is deleted, they're still charged. The app says so first and offers Open Apple subscriptions. Refunds for App Store purchases are requested from Apple.

A lifetime purchase works the same way on both: it stays with a household its other members keep, and is lost with one that's deleted. The app says so first.

Some things stay after you delete your account:

• household data the other members still use;
• meals you logged, in the household's history, as eaten by a former member;
• assistant activity, without your name;
• Google's and Apple's purchase notices, and the household's purchase record for as long as the household exists;
• if you signed in with Apple, the record of our request to Apple to revoke Nom Nom's access, with your account ID, and the encrypted token until Apple accepts;
• the record of any Google Play yearly plan due to be stopped and, if the household was deleted, that plan's encrypted purchase token until the request succeeds;
• copies of recipes you shared with a code, until the household is deleted;
• failed invite-code attempts, until they're cleared, which happens once they're a day old and anyone next tries a code;
• crash reports at Sentry, until Sentry deletes them;
• Resend's copy of emails sent to you, for 30 days, and up to 7 more days in its backups;
• emails you've sent us.

Apart from that, we keep your data until you or your household delete it.

Children

Nom Nom isn't directed at children. A household admin can add a member by name without a sign-in, such as a child, and the household can then keep that member's profile and meal history, as described above.

Changes

If this policy changes, the date at the top changes with it.

Contact

hello@castleburyventures.com