Last updated 9 October 2026
Short version: signed out, the planner keeps everything on your device; the one thing that ever leaves is a report when the app's own code breaks, and it carries nothing you typed. Signed in, your household's lunches are also stored on our servers so a second phone can share them, and what we hold is your email address, that household and a few dates about it, all listed below. Like every website, the company that hosts it keeps ordinary server logs (the address your connection comes from, your browser type) for a short time.
Everything you enter — lunchbox names, food lists, recipes you keep, school rules, plans, shopping checkmarks — is stored in your own browser's local storage on the device you used. Until you sign in, it is never sent anywhere. (A plan bought in the iPhone app before you sign in stays on the phone too; Apple tells us only that a purchase happened, as under Paying, below.) That is also why reading a recipe off a web page asks you to sign in first: that one feature sends the address you paste to our server, which reads the page and sends you back the recipe. We keep neither the address nor the page. Pasting a recipe in as text is read on your phone and sends nothing, signed in or not. Clearing your browser data or deleting the installed app deletes it too. The planner's Account tab, under Account, has a copy-out button so you can keep your own backup or move to another phone.
If the planner's own code breaks on your phone, it tells us: what the error said, the trail of lines in the app's code it passed through, the app build, the time, and the browser and phone type as your browser reports them. That happens signed in or not, because a crash on the very first open is the one we most need to hear about. Never a lunch, a food, a name or an address: anything shaped like an email address, or like a link with a code on the end, is blanked before the report is kept, and the report is kept for thirty days. To stop anyone flooding us with reports, we keep a hashed form of the connection address one came from, for one day.
You can sign in with an email address so the same household works on more than one phone. There is no password: we email you a link that works once. Signed in, a copy of your household — the same data described above — is stored on our servers (hosted by Netlify, database by Neon, both in the United States) and shared only with the people you invite into it.
We keep your email address, the household, the sign-in sessions for your phones, the day you last used the app and a count of the days you have used it. We also keep six dates about the household: the day it was made, the day its first week was planned, the day it first came back in its second week, the day a second phone joined, the day you first went to pay and the day a plan was first paid for. Nothing else. The count is a single number and the six are dates: we do not keep a record of which days you used it, and nothing else you do inside the app is recorded. To limit sign-in abuse we keep that same hashed form of the connection address, and a hashed form of each email address a sign-in link is asked for, for one day; the sign-in link itself, with the address it went to, is deleted a day after it expires.
Signing out clears that phone; the household stays on our servers, and signing in again brings it back. Leaving a household leaves the lunches with it. Delete my account and data, under Account → Account and confirmed by typing DELETE, ends your sign-in and this email address; if you set the household up it also removes the household from our servers and from that phone and cannot be undone; if someone else you invited was in it, their sign-in ends too, and whatever their phone held stays on their phone. A caretaker you invite sees only the plan and the pack list, never the school rules, allergens or anyone's email address.
If you buy the Household plan on this website, payment is taken by Stripe on Stripe's own page. Stripe receives your card details, your email address and, for tax, your billing address; we receive only a customer reference, the plan you bought and whether it is paid. Stripe's own privacy policy covers what it holds.
If you buy it in the iPhone app, payment is taken by Apple through the App Store, under Apple's privacy policy. Apple tells us which plan was bought, when it renews or ends, and a transaction number; never your name, your Apple Account or your card. So that a purchase can be matched to your household, the app gives Apple a random code that means nothing outside Lunch Sorted: your household's if you are signed in, or one your phone made for itself if you are not. Bought before you sign in, the plan is kept on that phone; Apple's note of it reaches us but matches no one, and we keep only that a message came, for thirty days, and, if Apple refunds the purchase, its transaction number, for as long as we run the service, so that the refunded purchase can never switch the plan on again. When you sign in to a household you set up, the phone passes the purchase on and it joins that household; a household you join takes it only when you tap Restore purchases.
Either way we never see or store your card. The plan is recorded against your household, not against a person, so everyone you invite has it too; one bought in the iPhone app before you sign in stays on that phone until you sign in to a household you set up, or tap Restore purchases in one you joined. While a checkout is open on the website we note which of you opened it, for up to a day, so two of you cannot buy the same plan at once.
If you send the feedback form, what you typed and the email you gave are stored by Netlify, which hosts this site, and read by me; they are used to fix and improve the app and for nothing else. If you submit the form on the home page, your email address is stored by Netlify, so I can email you when the features mentioned there are ready. It is not sold, shared, or used for anything else, and every email includes a way to unsubscribe. Ask at the address below and I'll delete it.
The front page of this site, the lunch ideas pages under /ideas/ and the beta page at /beta (not the planner) use Google Analytics to count visits: which pages are read and roughly where from, with IP addresses shortened. It sets Google’s analytics cookies for that. The planner at /app/ loads no analytics, no advertising pixels and no third-party cookies, ever. What we do count is on our own server and is the six dates described under Signing in; that is the whole of it. Fonts are loaded from Google Fonts, which means Google receives the request for the font files; nothing else about you is sent with it. If you open the planner inside the Claude app rather than in a browser, a “Save a backup file” button appears under Account → Account; it hands your lunches to that app’s own save dialog, and nowhere else.
The planner is set up and run by an adult. The one part a child touches is the “kid’s pick” screen, which shows the week's lunchboxes and never asks them for anything. A photo you add to a food is stored with the rest of the household, shrunk to a thumbnail, and shown only inside the app. A child's name and any allergens you enter are personal information about a minor: they stay on your device unless you sign in, in which case they are stored with the rest of the household as described above, never shared beyond the people in it, and never used for anything else. You are welcome to use initials or a nickname instead — the app never needs a real name to work.
Questions, or a request to delete an email address: hello@lunchsorted.app.
← Back to Lunch Sorted · Help