Privacy Policy

Account information. Your name, email address and, if you sign in with Google, the basic profile Google shares with us. If you set a password, we store it only in hashed form.

Intake and preferences. What you tell us to build your meal plan: household size, dietary preferences and restrictions, allergies, foods you like and dislike, fitness goals, protein and calorie targets, bodyweight if you choose to provide it, where you shop, and what is already in your kitchen, including photos of your pantry or fridge if you upload them.

Activity in the app. Meals you mark as made or skipped, food you log, photos of meals you upload (we estimate what is in them and store the estimate along with the photo), grocery items you check off, and messages or photos you post to a cohort feed.

Trainer information. If you are a trainer at a partner gym: your name, email, mobile number, your text-message preference and the record of when and how you gave or withdrew consent, and the session schedule your gym or the Dishlist team enters for your clients.

Technical data. Device and browser type, IP address, approximate location derived from it, and logs of how the app is used, collected to keep the service running and secure.

To create and deliver your meal plan and grocery list; to build the grocery order you ask us to place; to show your progress back to you; to give trainers at your gym a summary of how your week went so they can coach you; to send trainers the pre-session texts described in our SMS program; to answer your questions; and to improve the product, including by reviewing how plans and estimates perform. We do not sell personal information and we do not use your data for third-party advertising.

Your gym and trainers. If you joined Dishlist through a partner gym, trainers assigned to your cohort can see your name, your meal plan, what you logged, and the coaching summaries we build from it. Anything you post to the cohort feed is visible to the other members and trainers of that cohort.

Service providers. Companies that process data on our behalf and under contract: cloud hosting and databases (Railway, MongoDB Atlas, Netlify), AI model providers we use to generate plans and to estimate the contents of meal and pantry photos (OpenAI, Anthropic), text-message delivery for trainers (Twilio), and grocery retailers or delivery services you ask us to order through (Instacart, Whole Foods). Each receives only what it needs for its task.

Legal and safety. When required by law, to enforce our terms, or to protect the rights and safety of members, trainers or Dishlist.

Business transfers. If Dishlist is acquired or merges, personal information may transfer to the successor, who will be bound by this policy.

We send SMS only to trainers who opt in, and only about their own scheduled sessions. Consent is recorded with the date, time, number and disclosure version. Replying STOP ends messages at once; HELP returns contact details. Mobile numbers and consent records are never shared with third parties for marketing. Full details are on the SMS program page.

Our systems run on servers in the United States. We keep your information while your account is active and for up to 12 months after it closes, unless a longer period is required by law or needed to resolve a dispute. Consent records for text messages are kept for as long as required to demonstrate consent. You can ask us to delete your account and data at any time.

You can view and update most of your information in the app. You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or withdraw consent to a use, by emailing team@dishlist.org. We respond within 30 days. If you are not satisfied with our response you may contact the Office of the Information and Privacy Commissioner for British Columbia or the Privacy Commissioner of Canada.

Data is encrypted in transit and at rest with our hosting providers. Access is limited to the people and systems that need it. No method of storage is perfectly secure, and we will tell you and the relevant regulators if a breach affects your information.

Dishlist is for adults. We do not knowingly collect information from anyone under 18; if you believe we have, email us and we will delete it.

We will post changes here and update the date at the top. For material changes we will also notify you in the app or by email.