Privacy Policy

1. Introduction

Hearthlight ("we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Services").

This policy provides notice about our data practices. Where consent is required, Hearthlight asks for it separately. Using the site does not grant consent for optional analytics.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide to us, including:

• Account Information: Name, email address, password (encrypted)
• Profile Information: Dietary preferences, food allergies, kitchen preferences
• User Content: Recipes, meal plans, notes, shopping lists, pantry inventory
• Payment Information: Billing details processed through Stripe (we do not store full payment card details)
• Communications: Messages you send to us, feedback, and support requests

2.2 Automatically Collected Information

When you use our Services, we automatically collect:

• Usage Data: Public pages visited, referral sources, and general interaction patterns when you allow optional Google Analytics
• Device Information: IP address, browser type, operating system, device identifiers
• Location Data: General location based on IP address (for store locator features)
• Cookies and Tracking: Session tokens, preferences, analytics data

2.3 Third-Party Information

We may receive information from third-party services you connect to Hearthlight:

• OAuth Providers: Google (name, email, profile picture)
• Recipe APIs: Spoonacular, other recipe data sources
• Grocery Services: Store availability, product pricing

3. How We Use Your Information

We use the collected information to:

• Provide Services: Create and manage your account, store your recipes and meal plans
• Personalization: Customize your experience, provide relevant recommendations
• Communication: Send you updates, newsletters, and respond to your inquiries
• Payment Processing: Process subscription payments and prevent fraud
• Analytics: Understand how visitors use public marketing pages when they have allowed optional analytics
• Security: Protect against unauthorized access, fraud, and abuse
• Legal Compliance: Comply with applicable laws and regulations
• Marketing: Send promotional communications (you can opt out at any time)

4. How We Share Your Information

We do not sell your personal information. We may share your information with:

4.1 Service Providers

• Hosting: Vercel, Supabase (database)
• Payment Processing: Stripe
• Analytics and diagnostics: Google Analytics on public pages after consent. Sentry receives limited error diagnostics with session replay and client performance tracing disabled
• Email: Resend (transactional emails)
• APIs: Spoonacular (recipes), Google Places, grocery delivery services

4.2 Legal Requirements

We may disclose your information if required to:

• Comply with legal obligations, court orders, or government requests
• Enforce our Terms of Service and other agreements
• Protect our rights, property, and safety, or that of our users
• Prevent fraud, security issues, or technical problems

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide Services. If you delete your account, we will delete or anonymize your data within 30 days, except where we are required to retain it for legal purposes.

• Account Data: Until account deletion + 30 days
• User Content: Until deletion by you or account termination
• Payment Records: 7 years (tax compliance)
• Analytics Data: Google Analytics data follows the retention setting configured in the Google Analytics property. First-party GA cookies have a documented default life of 2 years

6. Your Privacy Rights

Depending on your location, you may have the following rights:

6.1 General Rights

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data
• Portability: Receive your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing communications

6.2 California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Opt-out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

6.3 European Residents (GDPR)

If you are in the European Economic Area, you have rights under GDPR including:

• Right to access, rectification, and erasure
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

To exercise any of these rights, please contact us at privacy@hearthlight.app.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Enable core functionality (authentication, security)
• Analytics Cookies: Measure use of public pages only after you select Allow analytics
• Preference Cookies: Remember your settings and preferences

The Cookie settings control lets you allow or withdraw optional analytics at any time. Necessary cookies continue to support security, authentication, checkout, and preferences. See the Cookie Policy for names, purposes, and retention.

8. Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Password hashing using bcrypt
• Regular security audits and monitoring
• Access controls and authentication
• Automatic security updates

However, no method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Children's Privacy

Our Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected information from a child under 13, we will delete it immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your jurisdiction. Where applicable, we use contractual and technical safeguards required for international processing and provide any separate consent request the law requires.

11. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a notice on our Services. The "Last updated" date at the top indicates when the policy was last revised.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: