Privacy Policy

Effective date: 16 October 2026
Controller: Pensy Group LLC, Tulsa, Oklahoma. Contact: foodoodle@pensygroup.com.

1. The 30-second version

We collect what you give us: your account, your household, your recipes and scans, and your My Food information.
Your My Food space is private by default. Planners in your household always see your dietary restrictions, and a planner can choose to show them to everyone in the household. Everything else leaves My Food only when you choose.
AI features send relevant text and images to OpenAI to do their job. OpenAI doesn't train on that data.
If you connect your own assistant, such as Claude, ChatGPT or Meta's Muse, it can read and do what you can in one household, as you, until you disconnect it.
If you connect a calendar you keep elsewhere, by its address or by signing in to Google, foodoodle reads the times, titles and places of its events into your household calendar and shows the household only "Busy" unless you choose otherwise. It never changes that calendar, and nothing from Google Calendar is used for advertising or to train AI.
We look at how foodoodle is used, such as when people sign in and which features they use, so we can make it better. That never includes what is in your meals, lists, notes or chats.
When email click tracking is on, we count clicks on links to foodoodle pages in our emails and record the first click time and number of clicks for each email. Unsubscribe links, other links that perform an action in foodoodle, and links to other sites aren't tracked; automated email-security checks may count as clicks. We keep these records for 30 days.
We don't sell your data. To measure our own ads on Facebook and Instagram, foodoodle.com and the web app use Meta's pixel, which tells Meta about your visits to our pages (sections 6 and 12). It stays off for a child's own login and when your browser sends Global Privacy Control or Do Not Track. Links to Amazon can earn us a commission, and we say so wherever they appear: As an Amazon Associate I earn from qualifying purchases. We never tell Amazon who you are.
You can export or delete your data in Settings.

2. What we collect

Category	Examples	Why
Account	Email, name, password (hashed), avatar	To sign you in and identify you to your household
Signing in with Google or Apple	If you sign in with Google or Apple: your account id with that company, your email address and whether it has confirmed it, and your name (Apple sends it only the first time). For an account made with Google, the address of your Google profile picture, kept as your avatar until you change it, so the picture loads from Google wherever your avatar shows	To sign you in and link your account
Household	Household name, members, roles, invitations, settings, themes	To run the shared plan
Recipes and meals	Recipes you write, generate, link, or scan; planned meals; votes; ratings; notes	Core functionality
Calendar and chores	Events your household adds (title, date and time, place, notes, who it is for, whether it repeats, a reminder, and whether it is private), chores (who does them and when), check-offs and swaps	To run the household calendar, reminders and the weekly plan email
Connected calendars	If you connect one: the calendar address you paste (kept encrypted, and shown back to you only by its website's name), or for Google Calendar the address of your Google account's main calendar, the calendars you pick and the access Google grants us (kept encrypted). From each connected calendar, for events from a month ago to four months ahead: the title, the place, the start and end, and whether it lasts all day. Never descriptions, guests, organizers, meeting links, attachments or reminders. If you make a subscribe link: when it was made and when a calendar app last read it, with the link itself kept only as a one-way hash	To show those events on your household calendar, ask whether you'll be home when one runs into dinner, plan quicker dinners on busy evenings, and put your foodoodle calendar in the calendar app you use
Public recipes	A copy of each recipe a member makes public (only the member who added it, and never from a child under 13's own login): its title, picture, ingredients, steps, times, tags and nutrition, the name your household chose to be credited as, and the ratings other households give it (their stars only, as one number per household)	To show it on the public book and let other households add it
Reports about a public recipe	The reason, an email address if given, and a one-way hash of the network address the report came from	To act on the report
Oodle cards	Each member's card: their name, an age band derived from their birthday, their restrictions and notes, an optional note and contact; each version of the card, with its salted fingerprint; each link it was sent as, who it was for, where it was emailed, whether it carries their likes, dislikes and favorite meals, and how often it was opened	To let a member or their manager send the current card to a school, a camp or a host, and turn it off
Grocery	Inventory, shopping list, receipts and receipt images	Core functionality
Amazon links	When someone in your household opens Amazon from foodoodle: which kind of link it was (the whole list, one product, a search, or a piece of gear), the products it named, the app it was opened in, and when. Amazon doesn't tell us what anyone buys	To show which items on your list went to Amazon, and to count which links are used
Kitchen gear	The gear your household says it already has, and which piece the weekly email has suggested	So nobody is offered something they own, or the same thing twice
My Food	Dietary restrictions, preferences, goals, favorites, ideas, special requests, birthday date and birthday meal, personal plans, AI chats, and what foodoodle remembers from your chats (such as what you like to cook, your week, who you cook for, and health or training you mention) with a short note about you it writes from that	Personal features and, where you choose, household planning
Managed profiles	Name, avatar, optional birthday, restrictions, preferences, favorites, requests, birthday meal for members without accounts (including children, added by a parent or guardian)	To include them in the household plan
Images	Recipe photos, scans, receipts, generated images	Scanning and display
Device and usage	Browser or app version, platform, push token, IP address, request logs, error reports, background task status	Security, reliability, notifications
How you found foodoodle	Your answer to "How did you hear about foodoodle?", if you give one, and for a new account the kind of link or site that brought you (for example a link tagged for Instagram, or a search engine), the campaign name on that link, the first foodoodle page you opened and the app you signed up on	To see which places bring people to foodoodle
How you use foodoodle	When you last signed in and were last active, which days you used foodoodle and on which app, how many times you have signed in, and how often you use each feature (counts, such as meals planned or messages sent). Never what is in your recipes, meals, lists, notes or chats	To understand how foodoodle is used and improve it, and to help you when you contact us
Email activity	Which emails we send and their delivery status; when click tracking is on, whether a link to a foodoodle page in an email was clicked, the first click time, and the number of clicks. Automated email-security checks may count as clicks; unsubscribe links, other links that perform an action in foodoodle, and links to other sites are excluded	To operate and understand the use of our emails
Meta's pixel	What section 6 lists for Meta, sent from your browser straight to Meta when you open a page on foodoodle.com or in the web app	To measure our ads on Facebook and Instagram, and show them to people likely to want foodoodle
Support	Messages you send us	To help you
Billing	Your household's plan, subscription status, and billing history. Your card details go to Stripe, never to us	To take payment and manage the subscription
Referral link	If you arrived through an affiliate's referral link: which affiliate's code it was and when you clicked	So that affiliate is credited and your household gets its discount
Referral program	If we invite you to the affiliate course before you have an account: your email address, why we invited you and who sent the invitation, until you sign up with that address or we withdraw it. If you take the course: which lessons you confirmed and when, and whether you chose to join. When you join, from the course or by accepting an invitation: your country and the version of the Affiliate Agreement you accepted, with the date; if you joined before 9 October 2026, also what you told us then about who you'd share foodoodle with and how. Whether you joined for yourself or for an organization, and for an organization its legal name, the name it's known by, its kind, your role and that you certified you may accept for it. The kind of affiliate the course's quiz suggests for you, if you take it (never your answers). Then your referral code, daily click counts, the households your link brought, commissions and payouts, your 30-day probation, whether you promote foodoodle online and the accounts and sites you list on Pass the plate, with the changes you make to them, and whether you get the monthly affiliate digest. We look at what you post publicly about foodoodle on those accounts and sites. Stripe collects the identity, bank and tax details needed to pay you, and for an organization its tax ID and the details of the people who own or represent it	To check how the program is promoted, run the program, send the digest, and pay you

We don't collect precise location or contacts, and we never see or store your full card number.

3. How we use it

Run foodoodle: plans, lists, recipes, scanning, notifications, emails you asked for.
AI features: generate recipes and images, read scans and links, suggest meals, propose plans, answer questions.
Keep meals safe: check meals against the dietary restrictions in your household.
Connected calendars: show their events on your household calendar, ask about dinner when one clashes with it, and plan around busy evenings.
Improve suggestions: use favorites and preferences as de-identified signals within your household, unless you turn that off.
Security and reliability: logs, rate limits, abuse prevention, backups.
Understand and improve foodoodle: our team sees when people sign in and which days they use foodoodle, on which app, who is in which household and in what role, and how often each feature is used, so we can see what works and fix what doesn't. This never includes what is in your recipes, meals, lists, notes or chats, and it shows profiles for children and others without accounts by their place in the household, not by name.
Understand email use: when click tracking is on, count clicks on links to foodoodle pages in our emails. Unsubscribe links, other links that perform an action in foodoodle, and links to other sites aren't tracked; automated email-security checks may count as clicks. The email record and click data are deleted after 30 days (section 8).
Advertise foodoodle: measure our ads on Facebook and Instagram with Meta's pixel (section 6).
Legal: comply with law and enforce our Terms.

We don't sell your data, and the only advertising we use it for is our own, through Meta's pixel. Meta also uses what the pixel sends it under Meta's own terms and privacy policy. Gear suggestions, on a recipe, on the week's plan and in the weekly email's Kitchen find, are picked inside foodoodle from the recipes on your own plan. Nothing about your household goes to Amazon to pick them, and you can turn the Kitchen find off in Settings → Notifications or from the email itself.

4. Who sees what inside your household

Everyone in the household sees the confirmed plan, recipes, the grocery list, votes counts, member names and avatars, and the household calendar and chores.
An event you mark private shows to everyone else in the household, planners included, as "Busy" at its time, with no title, notes or place. You and whoever looks after you see it in full.
A calendar you connect shows its events to everyone else in the household, planners included, as "Busy" at their times, with no title or place, unless you choose Details. You and whoever looks after you see them in full. A calendar connected for a child, or by a planner for everyone, always shows in full to the household, as a child's events always do.
Whoever has your subscribe link sees what you see in your foodoodle calendar: the planned dinners, the household's events and yours, and your chores. Events from connected calendars are left out of it.
Planners also see members' dietary restrictions, submitted special requests, shared birthday meals, vote details, and anything a member sets to "Planners". A planner can choose to show members' dietary restrictions to everyone in the household as well (Settings → Planning rules).
Only you see your private My Food information, unless you change its visibility in Settings → Privacy.
Managers of a managed profile see that profile's My Food, because they operate it on that member's behalf.
Your AI chats, and what foodoodle remembers from them, are never shared with anyone in your household.
Whoever holds an Oodle card link you sent sees that card — name, age band, restrictions, notes, contact, and their likes, dislikes and favorite meals unless you sent just the rules — until you turn the link off. Never the birthday, never an email, never anyone else in the house.
An affiliate whose referral link you used sees counts and amounts only: how many households their link brought and what they earned. Never your name, your email, your household, or anything you do in foodoodle.
Anyone on the internet can see a copy of each recipe a member has made public — the recipe only. Never names, notes, votes, ratings, restrictions or anything from My Food. A public copy is permanent and is not deleted with your household or account; the household name on it is.

5. AI processing

AI features are provided using OpenAI's API. Depending on the feature, we send: recipe text, images of recipes and receipts, member first names, dietary restrictions, preferences and goals you have made visible to planning, your own My Food information and what foodoodle remembers about you for your personal AI, chat messages, and household context such as upcoming meals and inventory. When you ask foodoodle about your calendar or chores, it answers with the entries you may see, events from a connected calendar included, and those entries are sent to OpenAI the same way. OpenAI does not use API data to train its models and retains it for up to 30 days for abuse monitoring, per its API policies. AI output is stored in foodoodle as recipes, proposals, and messages. You can delete AI chats at any time. What foodoodle remembered from a chat stays when you delete the chat: ask foodoodle in the chat what it remembers, and tell it to forget anything you don't want it to keep using.

The microphone. If you dictate into the chat with the microphone, your browser's or phone's own speech service turns what you say into text (in Chrome, for example, that's Google's, and on an iPhone, Apple's). foodoodle receives only the text, when you send it.

Connected calendars. foodoodle reads a calendar you connect from its own servers, a calendar address about once an hour and Google Calendar about every half hour. It only reads: it never adds, changes or deletes anything in that calendar. If you connect Google Calendar, foodoodle asks Google for two read-only permissions, the list of your calendars so you can pick, and their events, and for nothing that says who you are. You can see and remove that access in your Google Account at any time, and disconnecting Google in foodoodle removes it too. foodoodle's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. So we use what comes from Google Calendar only to show your events in foodoodle and plan dinner around them. We don't sell it, use it for advertising, or send it to an advertising platform, Meta included, and we don't use it to train or improve any AI model, ours or anyone else's. It reaches OpenAI only when you, or someone in your household who may see it, ask foodoodle about the calendar, as part of that conversation, and an assistant you connected only when it reads your calendar as you. No one at foodoodle reads it unless you ask us to while we help you, for security, or when the law requires it.

Connected assistants. You can connect your own AI assistant to foodoodle from that assistant: for example Claude, ChatGPT or Meta's Muse, or any assistant that supports connecting to foodoodle. You choose one household and whether it may make changes. It can then read, as you, what you can see in that household:

the meal plan, votes and who is eating;
the grocery list, what's in the house, and receipts scanned in the app;
the recipe book, and the public recipes you can browse;
household members' names and roles, and the food restrictions and allergies the household shows you;
meal requests and birthday wishes shared with you, the activity feed and your notifications;
the household calendar and chores, events from connected calendars included, with another member's private events, and their busy-only connected calendars, shown only as busy;
your own My Food: favorites, likes and dislikes, your food restrictions and allergies, your goals and estimated nutrition, your personal plans, ideas and requests;
your food card and the links you sent it as.

If you allow changes, it can do what you can do there, as you: add to the list, vote, plan meals, add an event, check off a chore. It never gets another member's private My Food, members' email addresses or full birth dates, and it can't change who is in your household, what others can see, your payments, or remove or relax a food restriction. What it reads is sent to that assistant's provider and handled under your agreement with them, not ours; we receive the requests it makes, not your conversation with it. Everything it changes shows in your household's activity with its name on it.

Its access is an OAuth token, which we store only as a one-way hash, never the token itself. An access token lasts one hour; a refresh token lasts 60 days from its last use and is replaced every time it is used, except Alexa's, which is kept and starts its 60 days again. Disconnecting the assistant in Settings → Account → Connected assistants revokes its tokens at once, and so do changing or resetting your password, signing out everywhere, leaving the household, and deleting your account. Removing foodoodle inside the assistant, or disabling the foodoodle skill in the Alexa app, stops that assistant using foodoodle; it ends the connection on our side at once only if the assistant tells us, and otherwise its tokens stop working 60 days after it last used them.

6. Service providers

Provider	What they process	Purpose
OpenAI	Text and images described above	AI features
Resend	Email address, name, email content	Invitations, password resets, digests, support replies
Replit (hosting and PostgreSQL)	All application data	Running the service
Replit App Storage	Uploaded and generated images	Storing images
Expo, Apple, Google	Push tokens, notification text	Push notifications
Google, Apple	If you sign in with them: they confirm who you are and send us what section 2 lists for signing in. On the web app's sign-in and sign-up pages, Google's button loads from Google	Signing in
Google (Google Calendar)	If you connect it: our requests for your calendar list and your events, made with the access you granted, and Google's answers	Reading the Google calendars you connect
Wherever a calendar address points (such as TeamSnap, your school or iCloud)	Our requests to read that address, from foodoodle's servers, carrying nothing about you	Reading a calendar you connect by its address
Stripe	Billing name and email, card details, subscription and payment history; for referral affiliates, identity, bank and tax details	Payments, subscriptions, affiliate payouts, and tax reporting
Amazon	When you open an Amazon link: the visit, carrying foodoodle's tracking ID for the app or page it came from and nothing that identifies you. When product lookups are on: the names of grocery items and kitchen gear to look up, never who asked	Shopping on Amazon, matching items to products, and current prices
Meta (Facebook and Instagram)	Through Meta's pixel, from your browser when you open a page on foodoodle.com or in the web app: the page's address and title (a title can name what's on the page, such as a recipe), the page you came from, the buttons you click on foodoodle.com (never in the web app, where it doesn't collect clicks), your browser, device and IP address, the time, and the identifiers for your browser that Meta keeps in cookies (section 12); and, when you create a household, that a new household signed up. If you're signed in to Facebook or Instagram in the same browser, Meta can link these to your account there. The pixel stays off for a child's own login (section 7), on pages whose address carries a private code (an invitation, a join or card link, a password reset, an email confirmation, connecting an assistant), and when your browser sends Global Privacy Control or Do Not Track (section 9)	Measuring our ads on Facebook and Instagram, and showing them to people likely to want foodoodle
No third party. Page events on the marketing site go to our own server, with no cookies and no identifier	Aggregated, anonymous page events	Understanding site traffic

Providers act on our instructions under contracts that protect your data. Amazon, and Google and Apple when you sign in with them, are different: they are independent companies, and what reaches them is handled under their own terms and privacy notices, as it would be if you used them yourself. So are Google when you connect Google Calendar, and the service behind a calendar address you connect. So is Meta: what its pixel sends is handled under Meta's terms and Meta's Privacy Policy.

7. Children

Signing up on your own is for people 13 and over (16 where required). A child under 13 uses foodoodle only through a parent or legal guardian in their household, in one of two ways:

A managed profile. We collect only what the adult enters: a name, optional avatar and birthday, food preferences, restrictions, favorites, requests, and a birthday meal.
The child's own login. A parent or guardian who plans the household gives the child's profile a login, and the invitation goes to the email address they enter. That step is the parent's consent, and nothing is collected from the child before it. The login adds the child's email address and password, what they do in the household (votes, requests, list items, ratings and notes, events they add for themselves and chores they check off), and the device and usage data in section 2.

Anyone under 13 has no foodoodle chat, no personal food plans and no connected assistants, so none of the child's own information is sent to an AI provider for those. A child's name, food restrictions, requests, ratings and notes on meals, and an upcoming birthday with its birthday meal are part of the household information that foodoodle's AI works with when others in the household use it, and that an assistant one of them connects can read as far as that person may see it, under that person's agreement with its provider (section 5). Household features a child uses, such as scanning a recipe, are processed by the providers in section 6 in the same way as everyone's. We use a child's information only to run their household's foodoodle. We don't sell it or use it for advertising, and a child's own login is never shown Amazon shopping or affiliate links. Meta's pixel (section 6) never loads on a child's invitation link, and it is turned off as soon as foodoodle sees a child's own login or a child's invitation in a browser, and stays off in that browser from then on, for whoever uses it. A child's own login can't send its Oodle card to anyone outside the household, by email or as a link; a parent or guardian sends it. A parent or guardian can connect a calendar for a child they look after, such as a team's schedule, and its events show in full to the household, as a child's events always do. A child's own login can't connect a calendar or make a subscribe link.

A parent or guardian who looks after the child can see and edit the child's profile and food rules at any time, remove the child from the household, and ask us to review or delete the child's information by writing to foodoodle@pensygroup.com. A child can also delete their own login from its Settings: the login is deleted as section 8 describes for any account, while the child's profile, with their food rules, stays in the household with the parent or guardian who looks after them, and the household's planners are told. The limits above end on the child's 13th birthday. If you believe we hold information about a child without a parent's consent, contact foodoodle@pensygroup.com and we will delete it.

8. Retention

Data	Kept
Account	Until you delete it, then 30 days grace, then deleted
Household data	While the household exists; 30 days grace after deletion
Your My Food after leaving a household	30 days, exportable, then deleted
Your private calendar events after leaving a household	Deleted when you leave. Household events you added stay with the household
Connected calendars	Their events are replaced each time the calendar is read, kept from a month ago to four months ahead, and deleted when you remove that calendar, disconnect Google, leave the household or delete your account. A calendar address is deleted with its calendar. Google's access is revoked at Google and deleted when you disconnect Google or delete your account
Subscribe link	Stops working at once when you make a new one, end it, leave the household or delete your account. Its hash is kept, unusable, with your membership
Scans and receipt images	12 months by default (household setting 3–24 months), then images deleted
AI chats	Until you delete the thread
What foodoodle remembers from your chats	Stays when you delete the chat it came from. Tell foodoodle to forget something and it stops using it, keeping it marked as forgotten so it isn't learned again. Deleted with the rest of your My Food: 30 days after you leave the household or delete your account
Application and email logs, including per-email click data	30 days
Days you used foodoodle	13 months, then deleted, or sooner if you delete your account
How you found foodoodle	With your account, and deleted with it
Backups	30 days, encrypted
Email opt-outs	An unsubscribe, or an email you turn off in Settings, is kept as a setting with your membership of that household, or with your account for affiliate emails, and is deleted with it
Public recipe copies	Permanent, by design: a recipe made public was given to the commons. Not deleted with the household or the account; the household's name on it is removed with the household. Taken down only by us, on a report
Reports about a public recipe	Until acted on, then 12 months
Billing and referral records	As long as tax and accounting law requires us to keep financial records
Referral cookie	30 days in your browser, removed once your household is created
Meta's pixel cookies	`_fbp`, and `_fbc` when you arrive from a Meta ad: 90 days in your browser. What Meta keeps is set by Meta's own policy
Oodle cards, versions and links	Deleted with the member, each version's fingerprint included
Connected assistants	Tokens are stored as one-way hashes: access tokens last 1 hour, refresh tokens 60 days from last use, and both stop working the moment you disconnect. The record of a connection (which assistant, which household, when it was made and last used) is kept with your account and deleted with it

9. Your rights

Depending on where you live you may have the right to access, correct, export, delete, or restrict use of your data, to object to processing, and to complain to a data protection authority. In foodoodle: Settings → Account → Export my data / Delete account. Or email foodoodle@pensygroup.com. We respond within 30 days.

California residents: Meta's pixel (section 6) can count as sharing personal information for cross-context behavioral advertising under California law. To opt out, turn on Global Privacy Control in your browser: foodoodle treats it as your request to opt out of sharing, and the pixel stays off. Rights under the CCPA can be exercised through the same channels.

Do Not Track and Global Privacy Control. If your browser sends either signal, our pages don't load Meta's pixel, so nothing about your visit goes to Meta (section 6). Everything else in foodoodle works the same either way.

10. Security

Passwords are hashed. Sessions use secure tokens. A calendar address you paste and the access Google grants us are stored encrypted, and your subscribe link only as a one-way hash. Data is encrypted in transit and at rest. Pictures of your household, such as recipe photos, scans and receipts, are served only to its signed-in members; a profile photo you upload is served only to people signed in to foodoodle, at an address nobody could guess; and the picture on a recipe made public is public. Access inside the company is limited to people who need it to run the service. No system is perfectly secure; if there is a breach that affects you we will tell you as the law requires.

11. International transfers

Our providers may process data in the United States and other countries. Where required we use approved safeguards such as standard contractual clauses.

12. Cookies

The web app uses one strictly necessary cookie for your session. If you arrive through an affiliate's referral link, we also set one first-party cookie, fd_ref, for 30 days. It holds the referral code and the time you clicked, and nothing about you or your device, so that the affiliate who sent you is credited and your household gets its discount. It is removed once your household is created. Email link click tracking (section 2) uses a signed redirect through our server and does not set a cookie. Our hosting provider also sets one load-balancing cookie on every foodoodle.com page, the app's included: GAESA, for 30 days, which routes your requests and holds nothing about you. Our own analytics on the marketing site are cookieless. If you arrive by a tagged link, the site passes that tag along in its own links to the sign-up page, and nothing is stored on your device to do it. The one advertising tracker on our pages is Meta's pixel, on foodoodle.com and in the web app, which works as section 6 says. Where it runs, it sets a cookie, _fbp, that identifies your browser to Meta for 90 days, and _fbc, also for 90 days, when you arrive from a Meta ad; and your browser may send Meta its own cookies too if you use Facebook or Instagram in it. In your Facebook or Instagram settings, under Your activity off Meta technologies, you can see and disconnect what businesses send Meta. Nobody promoting foodoodle may place a pixel, script or tracker on our pages. foodoodle sets no cookie for its Amazon links. Once you are on amazon.com, Amazon's own cookies and privacy notice apply, as they would if you had gone there yourself.

13. Changes

We'll post updates here. An update takes effect on the day we post it, and carries that date as its effective date. We'll tell you about material changes in the app or by email.

14. Contact

foodoodle@pensygroup.com · Tulsa, Oklahoma