Privacy & Cookie Policy

Who we are

Dinr (dinr.co.uk) is a meal-planning app for recipes, a weekly dinner plan, a shared shopping list and a household pantry. This policy covers both our website and the app itself.

What we collect

Account details: your email address and display name (Supabase Auth).
Family/household membership: who's in your family group, their role (owner or member), and any invite email you send.
Content you create: recipes (name, ingredients, method, photos), pantry contents, meal plans and shopping lists. Content stays private to your family unless an admin approves a recipe you've chosen to share more widely.
Billing data (Basic/Pro only): Stripe handles your card details directly — we never see or store your full card number. We store your plan, subscription status, and renewal date against your family.
AI feature inputs: if you use “Generate recipe”, the text you type (or your current pantry contents, for the “from my pantry” option) is sent to Anthropic to draft a recipe. This doesn't send your account details alongside the content. A photo you upload for a recipe is not sent to any AI provider — it's stored directly and reviewed by an admin before it's shared publicly.
Technical data: sign-in timestamps and basic request metadata, kept briefly to protect the service from abuse (see Retention below).

Why we use it, and our lawful basis

We use your data to run the service you've signed up for: storing and syncing your recipes, plan and lists, sending the emails a household account needs (confirmation, password reset, family invites), and processing payment for Basic/Pro. That's performance of a contract with you. Keeping basic sign-in records and rate-limiting abusive requests is a legitimate interest in keeping the service secure and available. Removing long-dormant accounts (see below) is also a legitimate interest in not holding personal data longer than we need to.

Who we share it with

We use a small number of other companies to run Dinr. None of them get more data than they need to do their job, and we don't sell your data to anyone.

Who	What for	What they see
Supabase	Hosting, sign-in, database and file storage	Everything stored in the app — this is where it all actually lives
Vercel	Hosting the website and app	Standard request traffic; also runs our analytics (cookieless — see Cookies below)
Stripe	Payment processing (Basic/Pro)	Your payment details directly; we only receive your plan and subscription status back
Anthropic	AI recipe drafting; the admin review queue's optional AI assessment	The dish description or pantry contents you submit; a pending recipe's text, for an admin's own review
OpenAI	Admin-only: illustrating a shared recipe with no photo	The recipe's name, cuisine and ingredients — never your personal data
Resend	Sending the one warning email before a long-dormant account is removed	Your email address, only if this feature is active and your account qualifies

Supabase hosts Dinr's database and file storage in the UK (AWS, London) — your core app data doesn't leave the UK through Supabase. Vercel, Stripe, Anthropic, OpenAI and Resend may each process data in the United States; all five publish a Data Processing Agreement built on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum as the safeguard for that.

How long we keep it

We keep your account and content for as long as you use Dinr. If an account is completely inactive, we remove it automatically — but only when all of the following are true: it's the only member of its family (anyone sharing a family with someone else is never touched, however inactive they personally are); it's on the free plan with no active subscription (a paying customer is never removed for inactivity); it has no recipes, shopping-list items or pantry items anywhere in its family; and it hasn't signed in for 6 months.

If your account ever matches all of those, we email a warning first, and only delete it if nothing has changed 14 days later — signing back in, or anyone adding content, cancels the deletion at any point. We don't currently offer an instant self-service “delete my account” button; email hello@dinr.co.uk if you'd like your account removed sooner.

Basic request logs used for abuse protection are kept for 2 days, then purged automatically.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or port your personal data, and to object to how we use it. To exercise any of these, email hello@dinr.co.uk. We'll respond within 30 days. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Cookies

Dinr only ever sets strictly necessary cookies — the kind that make the app work, not the kind used to track you around the web. Because of that, UK cookie law (PECR) doesn't require us to show a cookie-consent banner, so we don't have one. If that ever changes — for example if we add analytics or advertising that uses non-essential cookies — this page and that decision will be revisited.

Cookie	What it's for	Expiry
Supabase session & refresh cookies	Keeps you signed in	Session / rolling
`dinr_tz`	Remembers your device's time zone, so “today” in the meal planner is correct	1 year

Separately, we use Vercel Web Analytics to see roughly how the site's used. It's cookieless and anonymised — it doesn't identify you or track you across other sites — but we're naming it here for transparency.

International transfers

See Who we share it with above for which companies may process your data outside the UK, and the safeguard each relies on for that.

Children

Dinr isn't directed at children and we don't knowingly collect data from anyone under 13.

Changes to this policy

We'll update the date at the top of this page whenever we make a change, and flag anything material here.

Contact

hello@dinr.co.uk