Privacy policy

If you create an account with an email and password, we store that email address and a password. Your password itself is never stored — better-auth, the library that runs sign-in, turns it into a one-way hash before it reaches the database, so nobody here can read your original password back out.

If you use Continue with Google instead, we store the name, email address and profile photo Google hands us, plus the connection tokens Google issues so the sign-in keeps working. We never see your Google password.

Signing in sets a cookie — __Secure-better-auth.session_token — marked HttpOnly and Secure, so no script on this or any other site can read it, and it only ever travels encrypted. It expires automatically (seven days by default) and renews itself while you keep using the site.

Each sign-in also creates a row in our database recording the IP address and browser/OS string (“user agent”) the session started from, and when it was created and last used. That is a security record, not a tracking one — we do not use it for anything else. We do not yet run a job that deletes old session rows once they expire; we'll update this page (and add one) when that changes.

Two more cookies, both HttpOnly so no script can read them:

• rr-list — an unguessable id for your shopping list, which works even before you have an account. Kept up to a year.
• rr-units — remembers whether you prefer US or metric ingredient amounts. Kept up to a year.

A few small values live in your browser's own storage, never on our servers:

• theme — light or dark, so pages don't flash the wrong one on your next visit.
• pantry:have — ingredients you've typed into the pantry tool before signing in. The first time you sign in, these move into your account's pantry and this copy is cleared.
• rr-list-ticks — which shopping-list lines you've ticked off. Kept on this device only; it does not sync to your account or any other device.
• rr-just-signed-in — a one-time flag, cleared the instant it's read, used only to show the “Signed in” confirmation right after you sign in. It never leaves your browser.

None of this is third-party advertising or tracking storage. Everything above is written and read only by this site.

Your shopping list and pantry items are tied to your account once you're signed in. Signed out, your shopping list lives against the anonymous rr-list cookie instead, until you sign in and it's attached to your account.

Saved recipes, meal plans and submitted videos are planned, not shipped — this page will get its own section for each, describing exactly what's stored, before any of them go live.

To stop the sign-in form, the pantry tool and the publisher takedown form from being hammered by a script, we briefly hold each request's IP address in server memory, just to count how many requests it's made in the last few seconds or minutes. That counter lives only in memory, resets on every deploy or restart, and is never written to a database or a file.

Our web server and CDN produce their own operational logs as a side effect of serving traffic. We don't currently have a defined retention period for those logs — we'll update this page once we do, and we've filed a follow-up to set one.

We don't sell your data. We don't run advertising. We don't use any third-party analytics or tracking today.

We're planning to add product analytics (PostHog) so we can see which features actually get used. This page will be updated, before that ships, to say exactly what it tracks.

• Hosting. Amazon Web Services — Postgres (RDS), file storage (S3) and our CDN (CloudFront). AWS hosts the infrastructure; it doesn't see your account beyond that.
• Google. Only if you choose Continue with Google — see Account data, above.
• The publishers we link to. Every recipe sends you to the blog that published it. Their own privacy policy applies once you're there; we don't control what they do with your visit.

Email admin@thesupperbell.com to ask what we hold about you, to get a copy of it, or to have it deleted. We'll respond within 30 days. There's no self-serve delete button yet, so a request is handled by a person, by hand, until an admin tool for that ships.

The Supper Bell is not directed at children under 13, and we don't knowingly collect data from anyone we know to be under that age. If you believe a child has an account here, email us and we'll remove it.

When this page changes in a way that matters, we'll update the date at the top and describe the change here, not just in a changelog nobody reads.

Questions about this policy, or a rights request: admin@thesupperbell.com.