Privacy Policy
Last updated 13 October 2026
The short version
Most of your meal-planning data, and every photo you add, stays on your device. If you send a review invitation, the shared week and the responses to it are stored on our server as described below. You sign in with Google or Apple through Google's Firebase Authentication. On our server we keep only your account record, your SupperKin Pro subscription status if you start a subscription or a store free trial, reviewer access if we have granted it, and any review invitation you choose to send, with the answers given on it. We have no ads, no advertising tracking and no AI, and we never sell your data.
What stays on your device
These are stored only on your phone or tablet, in SupperKin's private database, and are never uploaded, except for the names and dinners on a review invitation you send (see below):
- Your household and its members: their allergies and NEVER rules, tastes, eating styles and whether they eat eggs
- Who is eating each night, your meal plans and past weeks
- Pantry contents, staples and grocery lists
- Your budget, all price estimates and your settings
- Your own meals in My Meals, and any photos you add to them. A photo you take or choose is resized and stripped of its location and other hidden details on your phone, and only that copy is kept; it is never uploaded
- A short log of which features you used (the last 500 events), which never leaves your device
Apart from a review invitation you choose to send, SupperKin does not upload your household or planner data to its servers. If you use Android's own device backup, Android may include the app's planner data in your Google backup; sign-in keys, My Meals photos and the older version's copy are excluded. On an iPhone or iPad, SupperKin's planner data and photos are left out of iCloud and computer backups.
If you updated from an earlier version of SupperKin, the app copied that version's data into its new database once, on your device. Nothing was uploaded. The earlier version's own copy stays on the device, private to SupperKin, until you uninstall the app or clear its data. Deleting your account removes the copy your account imported, but not that earlier copy.
Your account
You sign in with Google or Apple. They confirm who you are, and Firebase Authentication, Google's sign-in service, keeps your SupperKin sign-in account. That sign-in account holds:
- a sign-in user ID that Firebase creates, which is not your Google or Apple ID
- which of the two you used, and the ID that Google or Apple gives SupperKin for you, so the same sign-in always reaches the same account
- your email address and name, as Google or Apple share them, and the link to your Google profile photo if Google shares one; Apple may give a private relay address in place of your real one
- when the sign-in account was created and when you last signed in
On an iPhone or iPad, Sign in with Apple uses Apple's own sign-in sheet. Where Sign in with Apple is offered on Android, it opens Apple's sign-in page in your browser; when you finish, Apple sends the result to a page on this website (supperkin.beamaze.in/auth/apple/), which immediately hands it back to the SupperKin app on your phone. That page saves nothing: it passes on only Apple's signed sign-in token, a check value the app created, and, the first time you sign in, the name Apple shares, and it never passes on Apple's one-time authorisation code. As with any web page, our web host may log page requests, IP addresses and basic browser and request information.
On our own server we keep:
- your account ID, which is that same sign-in user ID
- when the account was created and roughly when it was last used
- a one-way code made from your verified email address with a secret key, used only to find your account when you write to support; we do not store the address itself
Our server does not store your name, email address or profile photo. The app shows your name and email address, as Google or Apple share them, to show who is signed in. Firebase keeps your sign-in on your device and renews it as needed; signing out removes it from the device.
Checking the app is genuine
Each request the app makes to our server carries two short-lived tokens: one that proves you are signed in, and one from Firebase App Check. App Check asks Google Play Integrity on Android, or Apple's App Attest and DeviceCheck on an iPhone or iPad, to confirm the request comes from a genuine, unmodified copy of SupperKin. These checks look at the app and the device, never at your meals or household. The App Check token carries no name or email address, and our server checks it and does not keep it.
Server time, earlier trial records and reviewer access
The app asks our server for the current time, so it does not have to trust your phone's clock; that time is not stored. SupperKin's free trial is part of a SupperKin Pro subscription you start through Google Play or the App Store, and is handled as described under Subscriptions below. Earlier test versions of SupperKin started a free trial on our server instead; if your account had one, we keep that record, your account ID with the time that trial started, until you delete your account. If we give your account reviewer access, for example for an app store review, we also store when it was granted and by whom. None of these records contains anything about your meals or your household.
Review invitations
You can send someone a link and ask them to approve a week's dinners. This is the only planning data that leaves your device, and only when you send one. For each invitation SupperKin uploads:
- the invitation's status: when it was created, first opened and how many times, answered, revoked or settled, and when it expires
- your account ID, so only you can manage it, and SupperKin's internal ID for the person it is for
- your household's name and the name you gave the person you sent it to
- that one week: its dates, and for each planned dinner its name, cooking time, SupperKin's reference for the recipe and whether it is approved yet
- the recipient's yes or no for each dinner, and when they answered
Our server does not store the link itself, only a one-way code made from it. It never receives your other weeks, your history, anyone's allergies, NEVER rules or tastes, your budget or your pantry.
A link stops working after seven days, or as soon as you revoke it or settle the week. Revoking removes the week's dinners and names from the server straight away. After you settle a week, the person who answered can still see what they said until the seven days are up. Everything about an invitation, including the answers, is deleted automatically about 30 days after its link expires, or sooner if you delete your account. While a link is working, anyone who has it can open that week in SupperKin; only the first person to answer can answer.
The person who opens a link does not need an account, and we do not create one for them. When they first answer, their device makes a random key and keeps it in its secure storage. Our server keeps only a one-way code made from that key, so only that device can change the answers. The key has no name, email or password attached. It stays on their device so they can come back to the same link, and is not deleted automatically, even when an account on that device is deleted.
Who processes your data
Our service providers are Amazon Web Services (AWS), Google and RevenueCat.
- AWS runs SupperKin's server in its Asia Pacific (Mumbai) region: Amazon API Gateway and AWS Lambda handle each request, Amazon DynamoDB stores the records above, AWS Key Management Service and AWS Secrets Manager protect our keys, and Amazon CloudWatch keeps our logs.
- Google runs Firebase Authentication, which keeps your sign-in account, and Firebase App Check, which checks the app is genuine, with Google Play Integrity on Android. Google may process this data outside India. We use no other Firebase service: none of your planning data, subscription status or invitations is stored with Firebase.
- RevenueCat (RevenueCat, Inc., United States) operates SupperKin Pro subscriptions for us. It receives your SupperKin account ID; your purchase and subscription information from Google Play or the App Store, such as the product, whether you are in a free-trial period or a paid period, purchase, renewal and expiry dates, and any cancellation or refund; and limited technical information needed to operate subscriptions, such as the app version and the type of device and operating system. RevenueCat does not receive your meal or household data.
- Apple confirms your identity when you sign in with Apple, on its own sign-in sheet on an iPhone or iPad or on its sign-in web page on Android, and runs App Attest and DeviceCheck on an iPhone or iPad. On Android, our website only relays Apple's answer back to the app and keeps none of it.
AWS, Google and RevenueCat process this data on our behalf. Like any online service, they also handle technical information such as IP addresses to deliver and secure the service. Data is encrypted in transit and when stored.
Our server keeps operational logs, such as which request was made, whether it worked and how long it took, for 30 days. They never contain sign-in or App Check tokens, email addresses, invitation links or what an invitation shows. Our account and sign-in records are also kept in automatic backups for 35 days, so that they can be recovered after a fault.
What we do not do
- No advertising and no advertising SDKs
- No advertising tracking
- No AI: your plans are worked out on your device and never sent to an AI service
- No selling or sharing of personal data
- No reading of your meal plans on any server: the only week there is one you chose to share in an invitation
Subscriptions
SupperKin Pro subscriptions, including any 14-day free trial the store offers you, are bought through Google Play or the App Store. The store handles the payment, the free trial, renewals and refunds. We never see your card or bank details.
To know what you have bought, the app gives RevenueCat, our subscription service, your account ID, and RevenueCat receives the store's record of your purchases: the product, whether you are in a free-trial period or a paid period, when you bought, renewed or started a trial, when the current period renews or expires, and any cancellation or refund. RevenueCat then tells our server, which keeps the subscription status it receives in one record with your account ID: your plan, which store it came from, whether it is active, whether the current period is a free trial or paid, whether it will renew, and when it ends. None of these records contains anything about your meals or your household.
Deleting your account does not cancel a subscription, including one in its free trial. Cancel it in Google Play (Payments & subscriptions → Subscriptions) or, on an iPhone or iPad, in Settings → your name → Subscriptions. The stores keep their own purchase records under their own privacy policies.
Deleting your data
In the app: Settings → Delete account. If you last signed in more than a few minutes ago, the app first asks you to sign out and sign in again, and our server refuses a deletion more than ten minutes after sign-in; nothing is deleted until you do. Our server then deletes, in this order: every invitation you sent, with its week and the answers given on it; your subscription record, any trial record from an earlier test version, any reviewer access and your account record; and it asks RevenueCat to permanently delete your customer record, which RevenueCat completes on its side shortly afterwards. Last, your sign-in account at Firebase Authentication is deleted, with the name and email address it holds. Only then does the app remove the account's data from that device, including anything it imported from an earlier version.
If you signed in with Apple: deleting your account does not withdraw SupperKin's permission in your Apple Account. You can remove it at any time: on an iPhone or iPad, Settings → your name → Sign-In & Security → Sign in with Apple; or at account.apple.com, under Sign-In and Security.
The app reports success only when every step is done. If a step fails, it stops, tells you what is incomplete, and you can try again; your account is never deleted while its server data is left behind. If a deletion stops after your account record has gone, a daily job on our server finishes deleting your server data, and we remove any sign-in account left behind. Deleted account records can remain in our automatic backups for up to 35 days.
Answers you gave on someone else's link: these belong to that person's week and carry no account ID, so they are not deleted with your account. They are deleted when that person deletes their account, or automatically about 30 days after that link expires.
People you sent links to: the keys on their devices are not part of your account and are not deleted with it; they carry no name or contact details. Our server's one-way code of each key is deleted with the invitation.
Other devices: each phone or tablet keeps its own copy of your plans. Uninstalling SupperKin removes what it stored on that device. On an iPhone or iPad, iOS may keep the items in SupperKin's secure storage, such as your sign-in and reviewer keys, after the app is removed.
By email: if you can't use the app, email us from the address you signed in with and we will delete your account and its server data for you.
Full instructions are on our delete your account page.
Children
SupperKin is designed for adults who plan meals for themselves or their household. It is not directed at children.
Changes
If we change what SupperKin stores or where, we will update this page and the date at the top before the change takes effect.