Privacy Policy

1. Scope and who we are

Nurieat (“Nurieat,” “we,” “us,” or “our”) provides personalized meal planning, nutrition calculations, recipes, and grocery lists. This policy covers information processed when you visit our site, create an account, complete onboarding, generate or save a plan, subscribe, or contact us.

Nutrition and body-profile information can be sensitive. Please also read our Consumer Health Data Privacy Policy, which provides additional detail and rights for consumer health data.

2. Information we collect

Information you provide

• Account information: name, email address, and login credentials. For password accounts, we store a one-way password hash and salt—not your readable password.
• Nutrition and profile information: age, sex at birth, height, weight, activity level, calorie and macro targets, goals, food preferences, allergies, excluded foods, and plan length.
• Plan information: generated meal plans, selected meals, swaps, portions, grocery lists, start dates, and plan history.
• Support information: feedback, feature requests, bug reports, and messages you send us.

Information collected automatically

• Session and security data: session identifiers, authentication state, and short-lived OAuth state used to keep you signed in and protect login flows.
• Usage and campaign data: landing-page visits, calls to action, signup, onboarding, and subscription milestones; a random visit identifier; timestamps; and campaign parameters such as UTM source, campaign, and content. After signup, we may associate these milestones with your internal account identifier to understand conversion.
• Technical request data: our hosting and security providers may process IP address, browser, device, and request information to deliver and protect the service.

Information from other services

If you sign in with Google, we receive your Google account identifier, name, email address, and email-verification status. If you subscribe, Stripe provides billing and subscription details such as customer and subscription identifiers, plan, status, renewal date, and cancellation status. We do not receive or store your full card number.

3. How we use information

We use information to:

• create, calculate, personalize, validate, save, and update meal plans and grocery lists;
• authenticate accounts and maintain sessions;
• process subscriptions, confirm access, and provide billing management;
• respond to feedback and support requests;
• understand whether our site and onboarding work and improve the service;
• detect, prevent, and investigate misuse, security incidents, and technical problems; and
• comply with law and enforce our Terms.

Nurieat uses the profile information you provide and values derived from it—such as calorie estimates and nutrient targets—to generate recommendations. This is automated personalization, but it does not make decisions with legal or similarly significant effects.

Where applicable law requires a legal basis, we rely on performing our contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where required. For sensitive information, we rely on the basis permitted by applicable law and the service you expressly request.

4. How we disclose information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

• Service providers: Cloudflare for hosting, database, security, and delivery; Stripe for checkout and subscription billing; Google when you choose Google sign-in; and infrastructure providers that operate Nurieat’s nutrition solver.
• Legal and safety: when reasonably necessary to comply with law, legal process, or valid government requests, or to protect users, Nurieat, or others.
• Business transactions: as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and notice where required.
• With your direction: when you ask us or clearly authorize us to disclose information.

We do not use third-party advertising trackers on the service.

5. Cookies and local storage

Nurieat uses first-party technologies needed to run the service:

• an HTTP-only session cookie that can last up to 30 days;
• short-lived HTTP-only cookies used for Google OAuth security;
• a first-party random landing-visit cookie that lasts up to 24 hours; and
• browser session storage that temporarily keeps an in-progress onboarding or checkout state until the tab session ends or the data is cleared.

You can clear cookies and site storage in your browser, but doing so may sign you out or remove in-progress data. Because there is no uniform Do Not Track standard, we do not currently respond to Do Not Track signals. We do not sell or share personal information for targeted advertising, so a Global Privacy Control signal does not change those practices.

6. Retention and security

We keep account, profile, and plan information while your account is active and as reasonably needed to provide the service. We may retain limited records longer when needed for billing, fraud prevention, dispute resolution, legal compliance, or enforcement. Session records expire after 30 days. Retention periods may vary by record type and legal requirement.

We use administrative, technical, and organizational safeguards designed to protect information, including one-way password hashing, HTTP-only authentication cookies, access controls, and encrypted network connections. No service can guarantee perfect security. If a breach triggers notification duties, we will provide notice as required by applicable law.

7. Your choices and rights

You can review and update many profile choices in the app and manage or cancel an active subscription through the Stripe customer portal. You may request access, correction, deletion, or a portable copy of personal information, or object to or restrict certain processing where applicable.

To make a privacy request, email support@nurieat.com from the address associated with your account. State the request you want to make. We may need to verify your identity. You may also use an authorized agent where local law permits. We will not discriminate against you for exercising a privacy right.

Residents of California and other U.S. states with applicable privacy laws may have rights to know, access, correct, delete, and obtain a copy of covered information, and to appeal a refusal. Nurieat does not sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information to infer characteristics for unrelated purposes.

If you are in the EEA, United Kingdom, or Switzerland, you may also have rights to withdraw consent and complain to your local data-protection authority.

8. International users

Nurieat is operated from the United States. If you use the service elsewhere, your information may be processed in the United States and other locations where our providers operate. Where required, we use recognized safeguards for international transfers.

9. Children

Nurieat is intended for adults age 18 or older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, contact us so we can investigate and delete it where appropriate.

10. Changes and contact

We may update this policy as the service or law changes. We will revise the effective date and provide additional notice when a change is material and applicable law requires it.

For privacy questions or requests, contact support@nurieat.com.