Thriftplate Privacy Policy
Effective date: October 25, 2026
Thriftplate (the "app") is made by Nguyen Thi Chi, My Dinh, Nam Tu Liem, Hanoi, Vietnam ("we", "us"). This policy explains what data the app and our website, https://thriftplate.tunacorp.app, collect, why, who we share it with, and the choices you have. Questions: tunacorp.app@gmail.com.
The short version
- You don't need an account. The app doesn't ask for your name, email, phone number, location, or contacts.
- To build your meal plans, swaps, and recipe imports, we send what you tell us (for example household size, budget, diet, allergies, food lists, and recipes you import) to our AI provider, Google (Gemini models on Google Cloud Vertex AI). We ask for your permission in the app before we send anything.
- We don't sell your data, and we don't use it for advertising or to track you across other apps or websites.
- You can delete your data at any time in Settings > Delete my data.
What we collect
| Data | Examples | Why | Where it's stored |
|---|---|---|---|
| Your answers and preferences | Household size, weekly meal budget, diet (vegetarian, vegan, etc.), allergies, foods you don't eat, foods you have, days, meals, and cook time | To make your meal plans and grocery lists | Our servers (Google Firebase) and sent to Google's AI service when you make a plan or swap |
| Recipes you import | Links, pasted text, photos of a cookbook or recipe card, and the recipe we read from them; your edits | To read and save your recipes | Saved recipes: our servers. Photos: sent to Google's AI service, then deleted from our servers once the recipe is read (see "How long we keep data") |
| Plans and lists | Meal plans, recipes, grocery lists, meals you marked as cooked, problem reports about a recipe | To show your plans and lists, offline too, and to fix wrong recipes | Our servers and your phone |
| App identifiers | A random app account ID created when you first open the app, app installation IDs | To keep your data together, check your free limits and subscription, and block abuse | Our servers, Google Firebase, RevenueCat |
| Purchases | Which plan you bought, trial and renewal status, transaction IDs. We never see your payment card; Apple or Google handles payment | To give you Pro and restore it | RevenueCat, Google Firebase |
| Usage and diagnostics | Which screens and buttons you use, how long a plan takes to make, crash reports, device model and OS version, approximate location (country/region) that Google Analytics derives from a masked IP address | To understand how the app is used, find bugs, and keep it stable | Google Analytics for Firebase, Firebase Crashlytics |
| Network data | IP address when your phone talks to our servers | Security and abuse prevention | Google Cloud logs |
| Emails you send us | If you tap Send feedback, we get your email address and whatever you write | To reply to you | Our email inbox |
We don't send the text you type (like food names or recipes) to analytics. Analytics only gets counts and categories (for example "2 allergies", "budget $50–99").
How we use AI (Google Gemini)
The app uses Google's Gemini models, through Google Cloud Vertex AI, to write meal plans, suggest swaps, write cooking steps, and read imported recipes. When you use these features, our servers send Google the data needed for that request:
- Plans and swaps: your answers and preferences (including allergies), meals already in your week, and your recent meal names so we don't repeat them.
- Recipe import: the link's page content (only when the page has no standard recipe data we can read ourselves), the text you paste, or your photos.
We ask for your permission before the first plan and before your first recipe import. If you don't agree, we don't send anything, but those features can't work without it.
Google processes this data on our behalf to provide the service to us, under the Google Cloud terms and data processing addendum. Google does not use this data to train or fine-tune its AI models. Google may keep requests in temporary memory for up to 24 hours to answer faster. If Google's automated safety systems flag a request as possible abuse, Google may keep that request for up to 90 days so authorized Google staff can review it. Google may also keep data longer if the law requires it.
AI can make mistakes. See "About AI recipes" in the app and our Terms of Use.
Our website
This section covers our website, https://thriftplate.tunacorp.app.
Website visits. Our website is hosted by Google (Firebase Hosting). To deliver pages and keep the site secure, Google processes technical data such as your IP address, your browser, and the pages you request. We haven't turned on visit logs or analytics for our website, and it uses no cookies, ad pixels, or session recording. We don't track you across other websites.
Do Not Track and Global Privacy Control. Because we don't track you across other websites or apps and don't sell or share your data, our website works the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.
Who we share data with
We share data only with service providers that help us run the app and our website, and only for that purpose:
| Provider | What for |
|---|---|
| Google (Vertex AI, Gemini models) | AI meal plans, swaps, cooking steps, recipe reading |
| Google (Firebase: Authentication, Cloud Firestore, Cloud Functions, Remote Config, App Check, Analytics, Crashlytics, Hosting) | Hosting, website hosting, storage, app settings, abuse protection, analytics, crash reports |
| RevenueCat | Managing subscriptions and restoring purchases |
| Apple and Google | App Store and Google Play payments, subscriptions, and refunds (under their own privacy policies) |
We may also share data if the law requires it, to protect people's safety, or as part of a merger or sale of our business (the buyer would have to follow this policy).
We do not sell or share your personal data for cross-context behavioral advertising, as those terms are used in US state privacy laws. The app doesn't use the advertising identifier (IDFA/AAID) and doesn't track you.
Allergies and consumer health data
Allergies you choose may be considered health data under some laws (for example the Washington My Health My Data Act, Nevada SB 370, and Vietnam's Personal Data Protection Law, which treats health data as sensitive personal data). We use allergy information only to leave those ingredients out of AI meals and to warn you about your own recipes. We collect it only when you choose it, send it only to Google (our AI and hosting provider) to provide this service, and never sell it or use it for ads. You can change it in Settings or delete it with Delete my data. You can ask us what consumer health data we have, who received it, or to delete it at tunacorp.app@gmail.com.
How long we keep data
- Your plans, recipes, lists, and preferences: while your app account exists. The app shows your last 4 weekly plans. When you make a new plan, older plans are deleted from our servers.
- Photos for recipe import: deleted from our servers as soon as the recipe is read. Google may keep a temporary copy for up to 24 hours, or up to 90 days if flagged for abuse review, as described above.
- After Delete my data: we delete your plans, recipes, lists, preferences, and app account from our servers right away, and from backups within 30 days. We keep only:
- A subscription record, if your subscription is active. It holds your old app account ID, whether you have Pro, which plan, and when it renews or ends. It has none of your plans, recipes, or preferences. We keep it so Restore purchases can move Pro to your new app account. We delete it when you restore, when your subscription ends, or when it's refunded.
- A note that your app account was deleted (the ID and the time), for 30 days, or until the subscription record is deleted if that's later, so the deletion can finish and isn't undone.
- Analytics events, crash reports, and server logs, which are deleted on the schedule below.
- Website: see "Our website".
- Analytics events: 14 months (Google Analytics and our analytics export). Crash reports: 90 days. Server logs: 30 days.
- Purchase records: as long as needed to provide your subscription and to meet tax and accounting law. RevenueCat keeps your subscription and purchase history under your app account ID after Delete my data, so Restore purchases works and for tax and accounting. Apple and Google keep their own records under their privacy policies. To ask us to delete the RevenueCat record too, email tunacorp.app@gmail.com.
Your choices and rights
- Delete your data: Settings > Delete my data removes your plans, lists, recipes, and preferences from your phone and our servers, and deletes your app account. It does not cancel your subscription; cancel in your App Store or Google Play settings. If your subscription is active, tap Restore purchases to get Pro back later; we keep a small subscription record so this works (see "How long we keep data").
- Change your answers: Settings > Preferences.
- Notifications: you can turn reminders off in Settings or in your phone's settings.
- Requests: you can ask to access, correct, or delete your data, or ask what we shared, at tunacorp.app@gmail.com. Because there's no login, we may ask you to send the app account ID shown in Settings so we can find your data. We will reply within 30 days, or sooner if the law where you live requires it. If we deny your request, you can appeal by replying to our answer. Depending on where you live (for example California, Colorado, Connecticut, Virginia, Washington, and other US states), you may have these rights by law, and we won't treat you differently for using them.
If you're in the EEA, UK, or Switzerland
The app is not offered in the European Economic Area, the United Kingdom, or Switzerland.
If you live outside the United States
Many countries give you rights over your personal data, for example Brazil (LGPD), Canada (PIPEDA and provincial laws such as Quebec's Law 25), Australia (Privacy Act 1988), and Vietnam (Personal Data Protection Law). Because we are based in Vietnam, we also handle all personal data under Vietnam's Personal Data Protection Law. Wherever you live, you can ask us at tunacorp.app@gmail.com to access, correct, or delete your data, to tell you what we shared and with whom, or to withdraw your consent, and we'll handle your request under the law that applies to you. If you're not satisfied with our answer, you can complain to your local data protection authority (for example the ANPD in Brazil, the Office of the Privacy Commissioner of Canada, or the OAIC in Australia).
Your data is processed in the United States, where our providers run their services. Privacy laws there may differ from the laws where you live. Our providers are bound by contracts to protect your data and use it only to provide their services to us. Where the law requires your consent for this transfer, you give it when you agree to send your data to our AI provider in the app.
Children
The app is for adults 18 and older (or the age of majority where you live, if higher). It is not directed to children or teens, and we don't knowingly collect data from anyone under 18. If you think someone under 18 has given us data, email tunacorp.app@gmail.com and we will delete it.
Security
Data is encrypted in transit (HTTPS). Calls to our AI provider and payment checks run on our servers, never in the app. No system is perfectly secure, but we limit who can access your data and keep only what we need.
Changes to this policy
The current version of this policy is always at https://thriftplate.tunacorp.app/privacy. If we change it, we'll update the effective date above. If a change affects what we send to our AI provider or how we use your data in a meaningful way, we'll tell you in the app and ask for your permission again where needed.
Contact
Nguyen Thi Chi · My Dinh, Nam Tu Liem, Hanoi, Vietnam · tunacorp.app@gmail.com · Support: thriftplate.tunacorp.app/support