Ad
Ad

Privacy Policy

Last updated: July 23, 2026

Overview

Toeta (“we,” “our,” “us”) is a meal suggestion app at toeta.app. We collect minimal data and never sell your personal information. This policy covers what we collect, the legal basis for doing so, how long we keep it, and your rights under GDPR, UK GDPR, and CCPA.

Data Controller

The data controller is the individual operating Toeta. For any privacy request, use the contact form. We respond to all requests within 30 days.

What We Collect & Why

  • Analytics data — We use Google Analytics 4 to understand how visitors use Toeta (pages visited, session length, general device and country). IP addresses are anonymized before storage. We do not use this data to identify individuals. Legal basis: consent (GDPR Art. 6(1)(a)).
  • Advertising cookies — Free-tier users may see ads via Google AdSense. AdSense may set cookies for ad personalization and measurement. Premium subscribers are fully excluded — the AdSense script is never loaded for their sessions. Legal basis: consent (GDPR Art. 6(1)(a)).
  • Account data — If you create a Toeta account, we collect your email address and a securely hashed password via Supabase. We also store your subscription status, member-since date, and any meal preferences (diet type, allergens) you choose to set. Legal basis: contract (GDPR Art. 6(1)(b)).
  • Payment data — Premium subscriptions are processed by Stripe. We store only a Stripe customer ID — never card numbers, bank details, or full payment information. Legal basis: contract & legal obligation (GDPR Art. 6(1)(b)(c)).
  • Browser cache (localStorage)— Today’s meal suggestion and your 30-day meal history are stored in your browser’s localStorage. This data never leaves your device; we cannot access it. You can clear it from Account → Reset history, or via your browser developer tools. This is not a cookie and does not require consent under ePrivacy.

Cookies

We only set tracking cookies after you give consentvia the banner shown on your first visit. You can withdraw consent at any time by clicking “Cookie preferences” in the footer.

  • Google Analytics — Sets _ga (2-year retention) and _ga_* session cookies. Used to count unique visitors and understand usage patterns.
  • Google AdSense — Sets various cookies (up to 13-month retention) for ad personalization, frequency capping, and conversion measurement. Only set for free-tier users who have given consent.
  • Supabase auth — Sets a session cookie (sb-*) strictly necessary to keep you logged in. This cookie is set only when you create an account or sign in, and is exempt from consent requirements as a technically necessary cookie under ePrivacy.

What We Do NOT Collect

  • We never collect your full name, phone number, or physical address.
  • We do not sell, rent, or broker any user data to third parties.
  • We do not build behavioral profiles for advertising outside of what Google AdSense does directly.
  • We do not track you across other websites outside of standard GA4 / AdSense behavior.
  • We never store raw payment card numbers.

Data Retention

  • Analytics data — Retained by Google for up to 14 months (GA4 default), then automatically deleted.
  • Account data — Retained until you request deletion. Contact us via the contact form to delete your account.
  • Stripe payment records — Retained as required by financial regulations (typically 7 years).
  • Server logs (Vercel) — Retained per Vercel’s policy (typically 30 days).
  • Browser localStorage — Persists until you clear it or use the Reset History feature in your account.

Third-Party Services

  • TheMealDB — Free-tier recipe data. No user data is sent to them.
  • Spoonacular — Premium recipe data. Your diet and allergen preferences are sent as anonymous query parameters — no account identifier is shared with Spoonacular.
  • Supabase — Authentication and database. Stores your email and profile data. See Supabase’s Privacy Policy.
  • Stripe — Payment processing. See Stripe’s Privacy Policy.
  • Google Analytics — Behavioral analytics. See Google’s Privacy Policy.
  • Google AdSense — Advertising (free tier only). See Google’s Ad Policy.
  • Vercel — Hosting. Standard server logs (IP address, request path, timestamp) per Vercel’s Privacy Policy.
  • Resend — Email delivery for contact form messages. Your name and email are included in messages you send us. See Resend’s Privacy Policy.

International Transfers

Toeta is operated from the United States. Our service providers (Google, Supabase, Stripe, Vercel) may process data in multiple countries. Where data is transferred outside the EU/EEA, our providers rely on Standard Contractual Clauses or equivalent transfer mechanisms under GDPR Chapter V.

Your Rights

Under GDPR (EU/UK) and CCPA (California) you have the right to:

  • Withdraw cookie consent— Click “Cookie preferences” in the site footer at any time. This resets your choice and no further tracking cookies will be set until you re-consent.
  • Access your data — Request a copy of the personal data we hold about you.
  • Correct inaccurate data — Ask us to fix incorrect information.
  • Erase your data — Request deletion of your account and all associated personal data. Contact us via the contact form.
  • Restrict processing — Ask us to pause processing of your data in certain circumstances.
  • Data portability — Request your data in a machine-readable format.
  • Object to processing — Object to processing based on legitimate interests (we do not rely on this basis for analytics or ads).
  • Lodge a complaint— If you believe we have handled your data unlawfully, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your EU member state’s DPA).
  • Clear your local data— Open your browser’s developer tools → Application → Local Storage → toeta.app, and delete any entries. Or use Account → Reset history.

Children’s Privacy

Toeta is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will delete it promptly.

Changes to This Policy

We may update this policy as Toeta grows. The “Last updated” date at the top reflects the most recent revision. For material changes, we will update the date and note the change.

Contact

Privacy requests, data deletion, or questions: contact form.