Privacy Policy

Last updated: 19 August 2026

Prep+Eat is a meal-planning app for families: you collect recipes, plan the week's meals, and share a shopping list that updates on everyone's phone at once. This policy explains what the app stores, why, and what you can do about it.

It is written to match what the app actually does. If you find something here that does not match your experience, that is a bug in one of the two – please tell us.

Who is responsible

Thomas Sebell, Denmark, is the data controller for Prep+Eat.

Contact: hello@prepeat.app

What we collect, and why

To sign you in

• Your email address. Sign-in works by sending a one-time code to your email; there is no password to store or lose.

To make the app work as a shared family tool

• Your first name, so the rest of your household can tell who added a recipe or ticked something off the list.
• Your household: its name, who belongs to it, and the invite codes used to join.
• Your recipes: titles, descriptions, ingredients, steps, serving counts, the web address you imported from (if any), and any photos you add. Each recipe records which member added it.
• Your meal plans: which meals are planned for which day, and for how many servings. Over time this builds a history of what your household eats.
• Your shopping lists: items, quantities, categories, and which member ticked an item off.
• Learned categories: when you move "Milk" to Dairy, the app remembers that for your household so it guesses better next time.

To stop abuse

• A record of invite-code attempts (which account tried, and when), so a code cannot be guessed by brute force.

Automatically

• Standard technical logs kept by our hosting provider, such as IP address and timestamps of requests. These are a by-product of running a server, not something the app reads or uses.

What we do not collect

The only device permission the app asks for is access to your photo library, and only when you choose to add a picture to a recipe.

Our legal basis (GDPR)

• Providing the service you signed up for – planning meals and sharing lists with your household – is performance of a contract (Art. 6(1)(b)).
• Preventing abuse of invite codes is our legitimate interest in keeping households secure (Art. 6(1)(f)).

What your household can see

This is the most important thing to understand about Prep+Eat: a household shares everything inside it. Every member of your household can see the household's recipes, meal plans and shopping lists, including your first name against the recipes you added and your initial against the items you ticked off.

Only invite the people you want to share a kitchen with.

Sharing a recipe outside your household

You can create a link to a recipe and send it to anyone. This is the only way anything from your kitchen becomes readable outside it, and it only ever happens because you tapped Share.

What the link shows. The recipe's title, its prep and cook times, and your first name – "Thomas shared a recipe with you". It shows the photo and the description only if the recipe is your own. If you added the recipe from a website, both are left out, because they belong to that site.

What it never shows. The public page never shows the ingredients or the method. Not for any recipe, ever.

Who can see it. Anyone who has the link – no account, no app needed. The link contains 32 random characters, so it cannot be guessed, and we do not list these pages anywhere. But it is an ordinary web address: anyone you send it to can pass it on, and a link posted somewhere public could be found by a search engine.

Someone with the app can take the whole recipe. If a person opens your link in Prep+Eat, they can save a copy into their own kitchen – and that copy includes the ingredients and the method, not only what the public page shows. So share with people you are happy to give the recipe to.

A link is a snapshot. It records the recipe as it was when you tapped Share. Editing the recipe afterwards does not change a link you have already sent.

How long a link lasts. A share link stops working 30 days after you created it. You do not have to do anything – it simply stops.

Turning a link off sooner. Open the recipe and choose Stop sharing. Every link you have made for that recipe stops working straight away, and so does deleting the recipe. One thing it does not do: anyone who already saved the recipe into their own kitchen keeps their copy. Stopping sharing ends the link, it does not take the recipe back.

Why we are allowed to publish it. Because you asked us to: the page exists only because you chose to create it, and it stops existing when you say so.

Who else handles your data

We use three companies to run the service. All of them act on our instructions.

• Supabase – the database, sign-in, file storage and live sync behind the app. Your account, recipes, plans, lists and photos are stored there.
• Resend – delivers the sign-in emails. It handles your email address and the one-time code, and nothing else.
• Apple – distributes the app through the App Store and TestFlight.

We do not use any other processors, and we do not transfer your data to anyone else except where the law requires it.

Where your data is stored

Your data is stored in the European Union – on servers in Stockholm, Sweden (AWS region eu-north-1), operated on our behalf by Supabase. Your recipes, plans, lists, photos and account details do not leave the EU in normal operation.

Two of our providers are US-headquartered companies. If Supabase staff need access from outside the European Economic Area – for example to investigate a fault – that access is covered by the European Commission's Standard Contractual Clauses. Sending you a sign-in code means your email address is processed by Resend, which is also covered by those clauses.

How long we keep it

• Your account data is kept for as long as your account exists.
• Items you delete inside the app – a recipe, a shopping item, a planned meal – are hidden immediately but kept in the database for a short period so that undo works and so a household member's deletion can be reversed. They are not visible to you or anyone else once deleted.
• If you delete your profile, your account and personal data are erased immediately and permanently. There is no grace period and no hidden copy. Recipes you added to a shared household stay with that household, but your name is removed from them.
• If you leave a household, you keep a copy of its recipes in a new personal kitchen, and the household keeps its own copy. The two are separate from that point on.
• A share link and its snapshot stop working 30 days after you create the link, or sooner if you stop sharing or delete the recipe. Copies other people saved into their own kitchens are theirs and stay with them.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you,
• have inaccurate data corrected,
• have your data erased – the app does this for you under Delete profile,
• restrict or object to how we use your data,
• receive your data in a portable form.

Write to hello@prepeat.app and we will answer within one month.

If you are unhappy with how we have handled your data, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark – datatilsynet.dk.

Children

Prep+Eat is a family app, but accounts are meant for adults. We do not knowingly create accounts for children under 13, and we do not target the app at them. If a child has an account, a parent can delete it from inside the app or by writing to us.

Changes to this policy

If we change how the app handles your data, we will update this page and move the "Last updated" date. Significant changes will also be announced in the app.

Contact