Privacy Policy

Bunch is a meal planner for households. It's offered by Dioteck LLC, an Alabama limited liability company doing business as Bunch ("Bunch", "we", "us"). This policy explains what we collect, why, who we share it with, how long we keep it, and the choices you have. It covers the Bunch app at app.bunchmeals.com and this website.

Allergies and diets get extra protection. Our Consumer Health Data Privacy Policy explains how we handle them, and it's part of this policy.

The short version: we collect what it takes to plan your meals, we never sell it, we never use it for advertising, and you can download or delete it yourself at any time.

What we collect

Your account. Your email address, which we use to sign you in with a one-time code. If you sign in with Google, Google tells us your email address and name. We don't use passwords.

Your household. What you and the people you plan with enter: the household's name, time zone, measurement system and planning settings; the names of the people you cook for and when they usually eat at home; who's away and when; who is a member of the household and their role; and invitation links (we keep only a scrambled form of each link).

Allergies, diets and dislikes. Allergies and diets are covered by our Consumer Health Data Privacy Policy. We ask for your consent before you record any.

Your plans and recipes. The meals you plan, who's eating each one, leftovers and cooking ahead, your grocery lists and staples, the recipes you write, save or change, and the tasks you tick off.

What you ask the AI features. When you ask Bunch's assistant for a suggestion, or ask it to draft a recipe, we send your request to our AI provider to answer it (see "AI features" below). We don't keep what you typed or what the model wrote. We keep the structured changes it suggested, so you can apply or undo them, and counts of how many requests your household made.

Technical information. To keep Bunch running and secure, our servers record each request's time, an anonymous request ID, your account and household IDs, what was done and whether it worked. These records never contain your email, names, allergies, diets, notes or anything you typed.

Payments. When you subscribe, our payment processor, Stripe, collects your payment details. We never see or store your full card number. We receive your subscription status, plan and billing period, and a customer reference.

We don't collect your precise location, your contacts, or information from other apps, and we don't buy information about you from anyone.

Cookies

Bunch uses a few cookies, all first-party and all needed for the app to work: your sign-in session (which page scripts can't read) and which of your households you're looking at. We don't use advertising or analytics cookies, and no third party sets cookies through Bunch. This website uses no cookies of its own.

How we use it

• To provide Bunch: sign you in, keep your household's plans, work out grocery lists, and show which meals suit each person.
• To make suggestions you ask for, with or without AI.
• To keep Bunch secure and working: preventing abuse, enforcing fair-use limits, fixing errors.
• To send the emails the service needs: sign-in codes, and for subscribers, receipts, renewal reminders and important notices. We don't send marketing email unless you ask for it, and every marketing email will let you unsubscribe.
• To comply with the law and enforce our Terms of Service.

We don't sell your personal information, we don't share it for cross-context behavioral advertising, and we don't use it to build advertising profiles.

Who we share it with

The people in your household. Bunch is shared planning: members of a household can see that household's people, plans, lists, recipes, and the allergies and diets recorded there. Your own allergies and diets are visible to the households you belong to, so they can cook safely for you.

Service providers who run Bunch for us. They process data only on our instructions and only to provide their service:

• Supabase stores our database and runs sign-in.
• Vercel hosts the app, and Cloudflare hosts this website.
• Resend delivers our emails.
• OpenAI answers AI requests (see below).
• Stripe processes payments.
• Sentry receives error reports, with personal information removed before they're sent.
• GitHub stores our encrypted backups, which it can't read.

When the law requires it, or to protect someone's safety, or our rights, after careful review. If Bunch is ever sold or merged, your information may transfer to the new owner under this policy's protections, and we'll tell you first.

We don't share your information with anyone else.

AI features

Bunch's assistant suggests changes to your plan, and it can turn a description or a pasted recipe into a draft for you to check. Here's what happens to your data:

• We send OpenAI your request and the least context it needs to answer: the meals in question, recipe names, and a first name only when your request mentions someone. We never send allergies, diets, dislikes or email addresses. Bunch's own code, not the AI, checks every suggestion against each person's allergies and diets.
• We ask OpenAI not to store the requests. OpenAI may keep them for up to 30 days to monitor for abuse, under its own policies, and doesn't use API data to train its models.
• Nothing the AI suggests changes your plan until someone in your household approves it, and you can undo it.
• A household's Owner or Admin can turn AI suggestions off for the household.

How long we keep it

• Your account and household data: for as long as you keep them. Delete them yourself any time (see "Your choices").
• A household you delete: hidden at once, kept for 14 days so its Owner can restore it, then deleted for good.
• AI suggestions: 90 days. Counts of AI requests: 13 months.
• Server records: up to 30 days.
• Backups: nightly and encrypted, each kept for 7 days. Something you delete is gone from every backup within 7 days.
• Payment records: as long as tax and accounting law requires. Your agreement to automatic renewal: 3 years, or a year after your subscription ends if that's later, as California law asks. We keep it even if you delete your account, without linking it to you.

Your choices and rights

You can do these yourself in Bunch, at any time:

• See and correct your information: everything you entered is in the app, and you can change it there.
• Download everything in your account and households, as a file: Your account → Download your data.
• Delete your account: Your account → Delete your account. A household you share stays with its other members; households that are only yours are deleted with your account.
• Delete a household (Owners): Household → Delete household.
• Withdraw consent to recording allergies and diets: Your account → Allergies and diets.

You can also email privacy@bunchmeals.com for any of these, or to ask what we hold about you or who we've shared it with. We'll confirm it's you (usually by a code sent to your account's email address), respond within 45 days, and tell you if we need up to 45 more. We won't charge you or treat you differently for using your rights. If we decline a request, you can appeal by replying to our answer with "Appeal"; we'll respond within 45 days, and tell you how to contact your state attorney general if you're still not satisfied.

Depending on where you live, your state's law may give you these rights and others. We extend them to everyone who uses Bunch.

Children

Bunch is for adults. You must be 18 or older to create an account. Parents and guardians can add their children as people in a household, with their names, schedules, allergies and diets; that information comes from the parent, not from the child, and the parent can change or delete it at any time. We don't knowingly collect information directly from children under 13. If you think a child has created an account, email us and we'll delete it.

Security

Everything travels encrypted (HTTPS), and our database is encrypted at rest. Each household's data is walled off in the database itself, so one household can never see another's, and our tests check this. Access to production systems is limited to the people who run Bunch and protected with strong authentication. No system is perfectly secure; if a breach ever affects your information, we'll tell you as the law requires.

Where your data lives

Bunch is offered in the United States, and we store your data in the United States.

Changes to this policy

We'll post any change here with a new date. If a change is significant, we'll tell you by email or in the app before it takes effect, and we'll ask for your consent again where the law requires it, including before using allergies and diets in any new way.

Contact

Dioteck LLC, doing business as Bunch, Alabama, USA. Email privacy@bunchmeals.com.