Privacy

Paid plans are not open yet. For now, everything in StrongPantry is free to use and nobody is charged. Where this page talks about a paid plan, the free first week or a charge, it shows how things work once paid plans open. Using the lists now does not use up your free first week.

In effect from October 15, 2026

The short version. StrongPantry keeps your email address, a record of your sign-ins (with the network address you signed in from: the number that identifies your internet connection), and what you enter about your household, your meals, your pantry and your shopping. It uses them to work out your days-of-meals number and your lists. If you start a free week or a paid plan, it keeps a record of that too. We never sell any of it.

What we keep

Your email address. It is your account. Your sign-in links go to it. There is no password.
Sign-in records. When your account was made and when you last signed in. They may also include the network address and type of browser you signed in from.
Your household, as numbers only. How many adults, teens, children 6 to 12 and children under 6 eat at home.
Your setup. Your weekly budget, how long you want your pantry to last, meals a day, and which pantry basics you chose.
Your time zone, as your browser names it, so your week starts on the right day.
Your meals. Which meals you ticked and how often you cook them.
Your pantry. How many packages of each item you have, and your days-of-meals number over time.
Your shopping. What you ticked, prices you corrected, your trip limit, what you spent each week, and any items you typed in yourself.
Your plan. When your free first week starts and ends. If you choose a paid plan: which plan, whether it is active, when it renews or ends, and two reference numbers from Stripe, our card payment company.

What we do not collect

No card numbers. You type your card details only on Stripe's pages. We never see or store them.
No names, birth dates or exact ages of anyone in your home.
We do not ask your phone or browser where you are. We keep your time zone, and the network address you sign in from, which can show the rough area you are in.
We do not ask for health, diet or allergy information.
No ad code. Visits to our public pages are counted by Google Analytics; see "Visitor counts" below. The check on the sign-in page keeps its own counts; see below.

Seeing, correcting or deleting your information

Correct it: change your setup, meals and pantry on their own screens at any time.
Get a copy, or have your account deleted: write to corporate@thestrongautomation.com from the email address you sign in with. We do it within 30 days, whether or not you have a paid plan.
Deleting your account removes your account and email address, your household, meals, pantry, shopping history and plan record from our database. If we have given you free access (see "People given free access" below), tell us and we take your email address off that list too. Copies in backups and logs kept by the companies that run our site, our database and our sign-in emails may stay for a time.
If you have a paid plan when your account is deleted, we cancel the plan and send back the money for the time you paid for and have not used, counted from the day you ask. The Refund page says the same. Stripe keeps its own records of payments.

How long we keep it

We keep your information for as long as you have an account. Nothing is deleted when a free week or a paid plan ends. We do not delete an account because it has not been used. Accounts that were never finished (nobody opened the sign-in email) may be removed by hand.

Who else handles your information

We use these companies to run StrongPantry.

Supabase stores your account and everything listed above, and runs sign-in. It keeps them in the United States (Ohio). supabase.com/privacy
Vercel runs the website. Almost everything you send passes through it, and it sees your network address and type of browser. vercel.com/legal/privacy-policy
Resend delivers your sign-in links, so it handles your email address. resend.com/legal/privacy-policy
Cloudflare runs the check on the sign-in page. See the next section. cloudflare.com/turnstile-privacy-policy
Google counts visits to our public pages. See "Visitor counts" below. policies.google.com/privacy
Stripe takes card payments. When you first choose a paid plan we send Stripe your email address and the ID of your StrongPantry account (not a bank or card number). Everything else you give Stripe yourself, on Stripe's pages. stripe.com/privacy
Anthropic makes Claude, the AI assistant that helps us run StrongPantry. When it works in our database it can read and remove any account. anthropic.com/legal/privacy

We give your information to nobody else, and we never sell it.

The check on the sign-in page

The sign-in page, and only that page, shows a box from Cloudflare that checks you are a person and not a robot. To do that, Cloudflare's code runs on the sign-in page and sees your network address and details about your browser and connection. Because it runs there, it is able to read what is on that page, including the email address you type. Cloudflare says it does not. We do not hand Cloudflare your email address or anything about your household. Cloudflare says it uses what it sees to detect and block robots and to improve that detection, not to identify people or build a picture of who you are.

When you ask for a sign-in link, Supabase asks Cloudflare whether the check was passed, and may send it your network address with that question.

Cloudflare shows us totals for that box: how often it was shown and passed, and what it saw most, such as countries, browsers and the website it ran on.

Visitor counts

Our public pages (the home page, the price outlook, pricing, and these policy pages) use Google Analytics. It shows us how many people visit, which pages they read, which site sent them, and roughly which city they are in. When you open one of those pages, Google's code runs in your browser and sends Google the page's address (without anything after a "?"), the name of the site you came from, your network address, and details about your browser and device. It also notes when you press "Sign in" or "Pricing".

It does not run on the sign-in page or anywhere inside the app, so Google never sees your email address, your household or anything you enter. We do not tell Google when you sign up or pay. Google's advertising features and its link to Google accounts are switched off. It does not run at all for visitors in the European Union, the United Kingdom, Iceland, Liechtenstein, Norway or Switzerland.

Google shows us totals, not who you are.

Cookies and what is stored on your device

A sign-in cookie (a cookie is a small file a site keeps in your browser), set by us, so you stay signed in. It may be stored in two or more parts, and may last up to 400 days. It is renewed while you use the app, and is removed when you press "Sign out".
Small cookies may be set by Supabase's sign-in code when you ask for a sign-in link. They may last up to 400 days, or until you press "Sign out".
Cloudflare's box may store an item of its own in your browser.
Google Analytics cookies, on our public pages only: one named "_ga" and one named "_ga_" followed by our ID. Google's code sets them to tell a returning visitor from a new one. They last up to 2 years. They are not set for visitors in the countries named under "Visitor counts". You can block or clear them in your browser and every page still works.

We do not follow you across other websites, so a "Do Not Track" setting (a browser setting that asks sites not to follow you) has nothing of ours to switch off.

Emails we send

Sign-in links, each time one is asked for with your email address. A notice before a price change. A notice when the Terms change what you pay or get. Nothing else: no newsletter and no marketing.

If you choose a paid plan, Stripe emails you a receipt for each payment and for any refund, a reminder before your plan renews, and a note if a card payment fails or your card is about to expire.

If you got an email from us that you did not ask for

Most likely someone typed your email address into our sign-in form. If you have no account, the first time makes an unfinished account for your email address and sends one email. Each later time may send one more email, up to a limit. Nobody can get into an unfinished account without opening that email. If you already have an account, you get a sign-in link and nothing else changes.

You can ignore the email, or write to us and we remove the account.

When we remove an unfinished account we keep no list of the email addresses removed. A removed email address can still appear in our own working notes, and for a time in backups and logs kept by the companies that run our site, our database and our sign-in emails.

People given free access

We can give a person this week's list and the shopping list at no charge. To do that we keep their email address, and sometimes a short note of our own, on a private list, sometimes before they have signed up. Nobody who uses StrongPantry can see that list, not even the people on it. If your email address is on it and you want it off, write to us.

Children

StrongPantry is for adults 18 and over. All we keep about children is how many eat at your home, in each age group.

Changes to this page

When we change this page we change the date at the top. If we change what we collect or who handles it, we change this page first.

Who we are

StrongPantry is run by Jennifer Strong. Write to us at corporate@thestrongautomation.com.