Privacy Policy

Last updated September 30, 2026. This is a starting draft for Healthtrek and has not been reviewed by a lawyer. See the review checklist at the bottom before relying on it for a real launch.

What we collect

Using the quiz and getting a meal plan does not require an account and does not send your quiz answers anywhere beyond what's needed to generate that plan (see "How plan generation works" below). If you create an account or contact us, we collect:

Account data: email address and password (handled by Supabase Auth — we never see or store your plaintext password).

Saved content: meal plans, shopping lists, and recipes you choose to save; the household size, store, and budget you set for a saved plan.

Billing data: the core Healthtrek experience is free and collects no payment information. If you subscribe to the optional Healthtrek Plus tier, Stripe processes your payment method and card details directly — Healthtrek never receives or stores your full card number. We store your subscription status and renewal date.

Communications: your email address if you opt in to the monthly recipe email, and any email you send us.

Usage and device data: limited technical information such as page views, browser type, approximate location derived from IP, and error or security logs collected by our hosting provider and Vercel Analytics. We use this to operate, secure, and improve Healthtrek, not for third-party advertising.

Store lookups: if you search for a nearby store (e.g. a ZIP code to find a Kroger-family location), that search term is sent to the retailer's public location API to find nearby stores. We don't store precise device location, and we don't collect location without you typing it in.

How plan generation works

Your quiz answers (household size, budget, taste preferences, foods to avoid, etc.) are sent to Healthtrek's servers to select recipes and estimate a shopping list. If you choose a Kroger-family store and location, ingredient names are sent to Kroger's public Product API to look up current prices — no personal information is included in that lookup, only ingredient search terms and the store location you picked.

Cookies

Healthtrek uses necessary cookies to keep you signed in (set by Supabase Auth), protect sessions, and remember your cookie preference. We do not use advertising cookies. Vercel Analytics is used to understand aggregate site usage. If we add non-essential cookies, we will update this policy and request consent where required.

How we use your data

To operate the service you're using (generate plans, save them, process payment for Plus, send an email you asked for); to keep Healthtrek working and secure (fraud prevention, rate-limiting, debugging); to improve recipes, pricing accuracy, and the recommendation logic. We do not sell your personal information.

Who we share data with

Only the service providers needed to run Healthtrek: Vercel (hosting, delivery, logs, and analytics), Supabase (database, authentication, file storage), Stripe (Plus billing), Resend (transactional and opt-in email), Kroger (store search and product pricing, ingredient terms only), and Pexels/OpenAI (recipe imagery — no personal data is sent to these). Each acts as a processor under its own privacy and security terms; we don't sell or rent your data to anyone else, including for advertising.

Data retention and deletion

We keep account and saved-plan data for as long as your account is active. You can delete individual saved plans and recipes at any time from your account page, and you can delete your account entirely (this permanently removes your saved plans, recipes, and email preferences; an active Healthtrek Plus subscription must be canceled first).

Children

Healthtrek is not directed to children under 13, and we don't knowingly collect data from them.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to certain processing. Contact us at hello@healthtrek.store and we'll respond within a reasonable time.

Changes to this policy

We'll update the date at the top of this page whenever this policy changes and, for material changes, make that clear on the site.

Contact

hello@healthtrek.store. See also our Terms of Service.

Before real launch — review checklist

Have a licensed attorney review this page before relying on it, and confirm: (a) whether GDPR (EU/UK users) or CCPA/CPRA (California users) apply to you and add the specific disclosures those laws require (e.g. a "Do Not Sell/Share" link, a lawful basis for each type of processing, a designated data controller), (b) a real, monitored contact channel for privacy requests, (c) a data processing agreement with each subprocessor listed above if required, and (d) whether you need cookie-consent logging proof for your jurisdiction.