Privacy Policy
Last updated: October 6, 2026
Overview
PickyPlanIt ("we", "us") helps families plan meals around what their picky eaters already eat. We collect as little information as we can, we never sell it, and we designed the service so that everything sensitive stays on our servers — never in your browser's code.
Information you give us
- A family nickname (for example, "The Johnson Family").
- Profiles for each child: a first name or nickname, an age range, foods they eat, foods they refuse, and any allergies. We recommend using first names or nicknames only.
- "Wins" you log — foods a child has tried, with a date.
- If you sign in with Google: your name, email address, and Google account identifier. Signing in is optional.
Information collected automatically
- Cookies. We set two strictly functional cookies:
picky_browser_id (1 year) keeps your data separate from other visitors when you aren't signed in, and picky_session (30 days) keeps you signed in. Both are httpOnly, meaning scripts running in the page can never read them. We do not use advertising or cross-site tracking cookies. - Analytics. We use Vercel Analytics, which does not use cookies, and Google Analytics, which sets first-party cookies (such as
_ga) to count visits and understand how the site is used, like which pages people view and whether they create a meal plan. We do not use advertising cookies or sell this data. You can block Google Analytics with your browser's privacy settings or Google's opt-out add-on.
How we use your information
- To generate your meal plans and food-chain suggestions, the food profiles you enter are sent to Google's Gemini AI model for processing.
- To save your data, profiles, plans, and wins are stored in our database (hosted by Supabase).
- To keep you signed in across visits and devices.
- If you choose to share a meal plan, we save a read-only copy that anyone with the link can view. Kids' names are removed before it's saved, and it contains only the meals, not your profiles, allergies or wins. To have a shared plan deleted, contact us with its link.
- If you choose to share a win, we save a public card with only the food name (for example, "strawberries"). Your child's name, profiles and other wins are never included. To have a shared win deleted, contact us with its link.
- To improve autocomplete for everyone: food and allergy names typed into the suggestion fields may be added to a shared suggestion list. Only the food name itself is stored — never any link to you, your family, or your kids.
We do not sell your information, show ads, or share your data with anyone except the service providers above (Google for AI, sign-in and analytics, Supabase, and Vercel for hosting and analytics), each of which processes it only to provide their service to us.
Pinterest and social media
- We publish Pins of our own guides, meal plans and printables to our own Pinterest account (@pickyplanit) through Pinterest's official API. Our publishing tool signs in to that one account with Pinterest's OAuth and reads our own Pins only to avoid posting duplicates.
- The only Pinterest data we store is our own account's access tokens, kept in a private file on our server and never shared. We don't collect or store any information about you or other Pinterest users through Pinterest.
- The "Save to Pinterest" and share buttons on our pages are plain links: we don't load Pinterest's or any other social network's scripts. If you click one, that site's own privacy policy applies.
Children's privacy
PickyPlanIt is designed for parents and guardians, not for use by children. We do not knowingly collect information directly from children under 13. Information about your kids' food preferences is entered by you, the parent or guardian, and we encourage you to use first names or nicknames only.
Data retention and deletion
- If you use PickyPlanIt without signing in, your data is tied to an anonymous browser cookie. Clearing your cookies permanently detaches that data from you, and the app starts fresh.
- If you sign in, your data is tied to your Google account. To delete it, contact us at the address below and we will remove it.
Security
All traffic is encrypted with HTTPS. API keys and database credentials live only on our servers and are never included in the code that runs in your browser. Session cookies are cryptographically signed and unreadable to page scripts.
Changes to this policy
If we make material changes to this policy, we will update the date at the top of this page. Continued use of PickyPlanIt after a change means you accept the updated policy.