Privacy Policy
Last updated October 28, 2026
Pantry Plan is run by Ryen. This policy explains what we collect, why, and your choices. Questions: support@pantryplan.page.
What we collect
- Account: your name, email address and a securely hashed password (we never see or store your password itself). If you turn on two-step login, an authenticator secret and backup codes.
- Health and nutrition information you enter: age, sex, height, weight, body-fat estimate, activity, goals, food preferences, allergies, diet, the foods in your kitchen, your meal plans, what you log as eaten, and weight history.
- Billing: handled by Stripe. We store your Stripe customer and subscription status, not your card number.
- Consents: when you agreed to these policies and consented to the use of your health information, and which version.
- Technical: a login session cookie, and the IP address and browser type recorded with each login session, used for security.
How we use it
Only to run the service: calculating your targets, building and adjusting meal plans, keeping you logged in, billing, sending account emails (verification and password reset), and preventing abuse. We don't sell your information or use it for advertising.
Who we share it with
Service providers that run parts of the app for us, only as needed: our hosting provider (Render), backup storage (Cloudflare), email delivery (Resend) and payments (Stripe). Searches for brand-name foods send only the search words to the U.S. Department of Agriculture's FoodData Central service. When you choose a password, we check it against known data breaches using the Have I Been Pwned service, which receives only the first five characters of a one-way hash, never your password or email. We may disclose information if required by law. We never sell or share your health information for advertising.
More about how we handle health information, including your rights in states like Washington, Nevada and Connecticut, is in our Consumer Health Data Privacy Policy.
Security and retention
Data is sent over encrypted connections (HTTPS), passwords are hashed, and each account can only access its own data. We keep your data while your account exists. Deleting your account (Settings → Account) permanently removes it from the app right away; encrypted backups roll off within 30 days. If a security breach ever exposes your information, we'll notify you and the authorities as the law requires (including the FTC's Health Breach Notification Rule), without unreasonable delay.
Your choices
You can view and edit your information in the app, download a copy of all of it (Settings → Account → Download my data), log out of all devices, and delete your account at any time. Depending on where you live (for example California or the EU/UK), you may have additional rights to access, correct or delete your data; contact us to use them.
Not medical advice
Pantry Plan gives estimates for general wellness. It isn't a medical device and isn't a substitute for advice from a doctor or registered dietitian. The service is only for adults 18 and older.
Changes
We'll update this page and the date above if this policy changes, and tell you by email about significant changes.