Privacy Policy

Information we collect

Account and profile information

We process your email address, authentication identifiers, household size, dietary preferences, allergies, cooking preferences, prep day, onboarding choices, notification settings, and similar profile data. An anonymous mobile identity may be created before permanent sign-in; creating that identity does not start a trial.

Meal planning and content

We process meal plans, shopping lists, prep plans, task completion, favorites, ratings, notes, feedback, and recipes or source URLs you submit. This can include dietary or allergy information you choose to provide. Please avoid entering sensitive health information that is not needed to use the service.

Product use, diagnostics, and notifications

We process page and feature interactions, device and app information, crash reports, performance data, coarse network information, and push notification tokens. We do not collect precise location, contacts, SMS, or photos from your camera roll for the current service.

Purchases and entitlements

We receive product, transaction, renewal, cancellation, expiration, refund, and entitlement status from Google Play, RevenueCat, and Stripe for web purchases. Rootd does not store full payment-card numbers.

Attribution and advertising

On web surfaces, we may process UTM parameters, ad click identifiers, and conversion events through Google, Meta, Pinterest, and TikTok when the required consent is available. On Android, Singular may process install and campaign attribution data, including the Android Advertising ID when available under your device settings and applicable consent choices.

How we use information

• Provide, personalize, secure, and synchronize the service.
• Generate meal plans, recipe processing, shopping lists, and prep guidance.
• Manage trials, purchases, subscriptions, restores, and account access.
• Send requested, transactional, lifecycle, and push communications.
• Measure product performance, diagnose failures, and improve reliability.
• Measure campaigns and prevent abuse, fraud, and duplicate transactions.
• Respond to support, privacy, safety, and legal requests.

Service providers and processing

We do not sell personal information. We use providers that process limited data on our behalf or provide services you request:

• Supabase for authentication, database, and backend functions.
• Vercel for website and web-application hosting.
• PostHog for product analytics and, where enabled, privacy-configured session replay.
• Firebase Analytics for mobile product measurement.
• Sentry for application errors and performance diagnostics.
• RevenueCat for mobile subscription and entitlement management.
• Google Play for Android purchases, billing, and subscription management.
• Stripe for web checkout and subscription billing.
• Singular for Android install and campaign attribution.
• Expo and Firebase Cloud Messaging for mobile push delivery.
• Resend for transactional and lifecycle email.
• OpenAI and configured AI routing providers for server-side meal-plan and recipe processing.
• Linear when you submit product feedback that is routed to our team.

AI processors receive only the content and preferences needed for the requested meal-planning or recipe task. We use server-side controls to restrict access and do not send full payment-card details to AI providers.

Processing versus marketing sharing

Supabase, Vercel, Sentry, RevenueCat, Google Play, Stripe, Expo, Firebase Cloud Messaging, Resend, AI providers, and similar vendors process data to operate services for us or complete a transaction you request. Google advertising, Meta, Pinterest, TikTok, and Singular may receive limited attribution or conversion data for advertising measurement. Web advertising and analytics tags follow Rootd’s consent controls, and mobile attribution follows applicable platform permissions and device settings.

Storage, security, and retention

We use access controls and encryption in transit and at rest. We keep active account and meal-planning data while your account exists and as needed to provide the service. Diagnostic records are generally kept for up to 90 days. Retention by our providers may vary under their documented service policies.

When an account is deleted, active personal data and user-authored or imported recipe content are removed. Encrypted provider backups may contain deleted data until the configured recovery window expires; they are isolated from normal product access and used only for recovery and security. We may retain minimal transaction, tax, fraud-prevention, chargeback, and legal records for as long as reasonably required. Retained provider event records are disconnected from the Rootd profile where our systems permit.

Your choices and rights

Depending on where you live, you may request access, correction, deletion, or a copy of personal data and may object to or limit some processing. You can unsubscribe from marketing email using the link in the message. On the website, use “Privacy choices” in the footer to accept, reject, or revise optional analytics and advertising consent.

The mobile app does not use browser cookies. Mobile SDKs may store identifiers needed for analytics, attribution, crash reporting, purchases, and notifications, subject to platform settings and law.

Account deletion

In the mobile app, go to Profile → Settings → Danger Zone → Delete Account. If you cannot access the app, use our public deletion request page and email from the address associated with your account. If you started without an email, contact us while you still have access to Rootd so we can verify the anonymous account. We do not offer web Settings self-service deletion at launch.

Rootd cancels an associated Stripe web subscription as part of account deletion. Deleting a Rootd account does not automatically cancel a Google Play subscription. Manage cancellation separately in Google Play.

Children’s privacy

Rootd is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information.

Changes to this policy

We may update this policy as the service changes. We will revise the effective date and provide additional notice when required.

Contact

Rootd is operated by PINGIT LLC. For privacy questions, data requests, or support, email support@rootdapp.com. Copyright notices may be sent to legal@pingit.ai.