Privacy Policy

1. Introduction

Hearthlight ("we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Services").

This policy describes our data practices. The analytics controls and regional defaults are explained in section 7.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide to us, including:

• Account Information: Name, email address, password (encrypted)
• Profile Information: Dietary preferences, food allergies, kitchen preferences
• User Content: Recipes, meal plans, notes, shopping lists, pantry inventory
• Payment Information: Billing details processed through Stripe (we do not store full payment card details)
• Communications: Messages you send to us, feedback, and support requests

2.2 Automatically Collected Information

When you use our Services, we automatically collect:

• Public Visit Counts: Aggregate visits to eligible public pages through Vercel Analytics without cookies
• Google Analytics Data: Public pages visited, referral sources, and general interaction patterns when Google Analytics is enabled under the settings in section 7
• Device Information: IP address, browser type, operating system, device identifiers
• Location Data: General location based on IP address for store locator features and selection of regional Google Analytics defaults
• Cookies and Tracking: Session tokens, preferences, the consent region category, and Google Analytics data when enabled

2.3 Third-Party Information

We may receive information from third-party services you connect to Hearthlight:

• OAuth Providers: Google (name, email, profile picture)
• Recipe APIs: Spoonacular, other recipe data sources
• Grocery Services: Store availability, product pricing

3. How We Use Your Information

We use the collected information to:

• Provide Services: Create and manage your account, store your recipes and meal plans
• Personalization: Customize your experience, provide relevant recommendations
• Communication: Send you updates, newsletters, and respond to your inquiries
• Payment Processing: Process subscription payments and prevent fraud
• Analytics: Count eligible public visits without cookies and understand public page use through Google Analytics when enabled
• Security: Protect against unauthorized access, fraud, and abuse
• Legal Compliance: Comply with applicable laws and regulations
• Marketing: Send promotional communications (you can opt out at any time)

4. How We Share Your Information

We do not sell your personal information. We may share your information with:

4.1 Service Providers

• Hosting: Vercel, Supabase (database)
• Payment Processing: Stripe
• Analytics and diagnostics: Vercel Analytics counts eligible public visits without cookies. Google Analytics measures public page use when enabled under the settings in section 7. Sentry receives limited error diagnostics with session replay and client performance tracing disabled
• Email: Resend (transactional emails)
• APIs: Spoonacular (recipes), Google Places, grocery delivery services

4.2 Legal Requirements

We may disclose your information if required to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service and other agreements
• Protect our rights, property, and safety, or that of our users
• Prevent fraud, security issues, or technical problems

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide Services. If you delete your account, we will delete or anonymize your data within 30 days, except where we are required to retain it for legal purposes.

• Account Data: Until account deletion + 30 days
• User Content: Until deletion by you or account termination
• Payment Records: 7 years (tax compliance)
• Analytics Data: Google Analytics data follows the retention setting configured in the Google Analytics property. Cookies set by Google Analytics have a documented default life of 2 years. Aggregate visit reporting follows Vercel Analytics retention

6. Your Privacy Rights

Depending on your location, you may have the following rights:

6.1 General Rights

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data
• Portability: Receive your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing communications

6.2 California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Opt-out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

6.3 European Residents (GDPR)

If you are in the European Economic Area, you have rights under GDPR including:

• Right to access, rectification, and erasure
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

To exercise any of these rights, please contact us at privacy@hearthlight.app.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Enable authentication and security, record your Google Analytics choice, and store the consent region category
• Analytics Cookies: Support Google Analytics when enabled under the regional defaults or your saved choice
• Preference Cookies: Remember your settings and preferences

Vercel Analytics counts aggregate visits to eligible public pages without cookies in every region, regardless of your Google Analytics choice. Both analytics services skip dashboard, admin, login, registration, password reset, and invitation pages. Query strings are removed from page URLs sent to Vercel Analytics.

Google Analytics requires consent in the 27 European Union countries, Iceland, Liechtenstein, Norway, the United Kingdom, and Switzerland. Without a saved choice, it stays off and a banner asks you to opt in. The same rule applies when the region cannot be determined. Google Analytics is enabled by default in other known regions.

Your saved choice to allow or reject Google Analytics takes priority in every region. If your browser sends Global Privacy Control (GPC) and you have no saved choice, Google Analytics stays off in every region. GPC does not open an automatic consent banner.

Cookie settings is available on eligible public pages. You can allow or disable Google Analytics there. Disabling it stops future Google Analytics loading and clears accessible _ga cookies set by Hearthlight.

The necessary hearthlight_region cookie stores only consent or open. It lasts one day and is refreshed when the category changes. Your choice is stored in hearthlight_consent_v1 for up to 180 days. See the Cookie Policy for names, purposes, and retention.

8. Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Password hashing using bcrypt
• Regular security audits and monitoring
• Access controls and authentication
• Automatic security updates

However, no method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Children's Privacy

Our Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13, we will delete it immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your jurisdiction. Where applicable, we use contractual and technical safeguards required for international processing and provide any separate consent request the law requires.

11. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a notice on our Services. The "Last updated" date at the top indicates when the policy was last revised.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: