1. Who is responsible
Cameron Austin, trading as NRTRE, based in Pennsylvania, United States, is the data controller responsible for personal information processed to provide the NRTRE food search. For privacy requests, contact nrtrecoach@gmail.com. This notice covers the NRTRE service, not independent providers’ websites.
2. Information and purposes
- Account and sign-in information: email, account identifiers, authentication credentials managed by our sign-in provider, and information supplied through social sign-in. We use this to create accounts, authenticate users, recover access and communicate about the service.
- Conversations (only if you use the optional Ask Cal add-on): your prompts, generated replies, conversation titles and timestamps. We save these to provide chat history and send relevant conversation context to the AI service to generate replies. Goals, budgets, allergies or health details you choose to share can appear in this content.
- Subscription records: customer and subscription identifiers, checkout references, plan, payment status and billing dates. We use these to manage access, reconcile purchases and resolve billing problems. Payment details are handled by Paddle under its own notice; do not send card information to Cal.
- Premium pantry and usual items: if you use NRTRE Premium, the catalog foods you save as “my pantry” or “usual items” (with servings). We use these only to build your automatic shopping cart and match recipes for you; they are visible only to you and you can remove them in the app.
- Favorites and searches: the foods, brands, kitchen tools and stores you save as favorites, and your food searches (query text with emails and phone numbers removed, filters and result counts). Favorites are visible only to you and personalize your own results and Cal's suggestions; you can remove them or download them from My favorites. Administrators see only anonymous totals (for example, how many members saved a food, shown only when at least 3 members did), never who saved what.
- Support messages: your email, message and any attachments you send us, used to answer questions and handle requests.
- Technical and security information: service/error logs and information such as IP address, device or browser identifiers that service providers may process to deliver, secure and troubleshoot the service. We do not currently implement advertising or marketing analytics in the app.
Please share only what is necessary. Cal is not a medical-record system; avoid uploading identifiable medical records or information about others.
3. Grounds for processing
Where laws require a legal basis, account operation, saved conversations and subscription access support performance of our service agreement; security, fraud prevention, reliability and support rely on legitimate interests, balanced against your rights; legally required records rely on legal obligations. We seek consent where required for optional processing, including sensitive information where applicable. Choosing to disclose health details does not waive your privacy rights.
4. Sharing and AI processing
Service providers process information as needed for hosting, account authentication, storage, AI responses, email/support and operational diagnostics. NRTRE is hosted on Vercel and stores account and app data with Supabase. If the optional Ask Cal AI chat is enabled, prompts and relevant saved conversation context are sent to the AI model provider that generates the response. Google sign-in processes authentication information if you choose that option. Support email is handled through Gmail.
Paddle acts as Merchant of Record for sales, subscription management, payments, tax compliance and invoicing, and processes information under its privacy notice. We may share necessary information with professional legal or accounting advisers, and with authorities where required by law or to protect legal rights. We do not sell personal information.
Provider-side logs, backups and AI retention follow the relevant providers’ practices; this draft does not promise zero retention or that providers never use information for model improvement.
5. Retention and deletion
Account information and saved conversations are retained while needed to provide your account and history. You can delete individual conversations in the app; this removes them and their messages from the active app database. Cancellation alone does not delete your account or history. Account-wide deletion is not self-service; email support to request it.
We retain billing, security and support records only as needed for their purposes, legal obligations, disputes and fraud prevention, then delete or anonymize them where applicable. Provider backups and required transaction records may persist beyond active-data deletion. Exact operational retention periods and provider backup schedules still require owner confirmation before this draft is finalized.
6. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection to processing, and withdraw consent without affecting prior lawful processing. Contact the privacy email above; we may verify your identity and explain any lawful exceptions. Where GDPR applies, you may complain to your supervisory authority, and we generally respond within one month, subject to permitted extensions. Other requests are handled within applicable legal deadlines. We do not currently sell information or share it for cross-context behavioral advertising.
7. Security and international processing
We aim to maintain appropriate technical and organizational protections, including encrypted connections, authenticated access and account-scoped access controls. No system is entirely secure. Protect your account and report concerns to support.
NRTRE is based in the United States, and service providers may process data in the United States or other countries. Where legally required, transfers must use appropriate safeguards such as adequacy decisions or standard contractual clauses. Specific provider locations and contractual transfer safeguards remain to be verified before this draft is finalized.
8. Cookies and browser storage
The app uses browser storage to persist your sign-in session; this is essential to keep you signed in. Authentication and checkout providers may also use essential cookies or similar technologies under their own notices. We have not added optional analytics or advertising cookies to the app. You can clear or block storage through your browser, but sign-in and checkout may stop working. Optional tracking, if introduced, will be described and offered with preference controls where required.
Grocery planning and retailers
Grocery list entries, preferred store and preferred delivery time stay on your device and are not saved to your account (Premium pantry and usual items are, as described above). Copying a list writes it to your device clipboard. Lists you discuss with Cal are saved as conversations. No grocery list is automatically shared with Walmart or another retailer, and no retailer checkout is connected. If you use your list in a retailer’s own app, the retailer processes your account, payment, address and order information under its own privacy notice. Any future connected sharing will be described before launch.
9. Changes and contact
We will update this notice as practices change and give appropriate notice of material changes. Send privacy questions or requests to nrtrecoach@gmail.com.