← Back to home

Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how Supa (the "App") collects, uses, shares, and protects information when you use Supa on Android, iOS, or the web. Availability of individual features and sign-in methods varies by platform.

1. Who We Are

Supa is developed and operated by Yeswelldone Creative Inc.("we", "us", "our"), a Canadian corporation located in Langley, British Columbia, Canada.

If you have questions about this policy or your data, contact us at [email protected].

2. What We Collect

We collect the information needed to provide the App’s core features (inventory tracking, recipes, meal planning, and account access).

  • Account information: email address, account identifiers, authentication details and an optional display name or avatar. Depending on your platform and chosen method, sign-in may use a password, email verification code, Apple, or Google.
  • App content you add: food items, quantities, notes, categories, expiration dates, and similar information you choose to store, including shopping and purchase history, recipe interactions, searches, meal plans, cooking records, household information and dietary preferences. If you enter an allergy or another health-related restriction, that information is used to personalize food suggestions.
  • Images and media: images you upload or associate with items/recipes (stored in our backend storage).
  • Approximate location and language: our delivery infrastructure processes IP addresses. We use the country inferred from your connection, device region or language to choose initial measurement-unit defaults. We do not request GPS location for this.
  • Email communications: when you request an authorization code, register, or reset your password, we send you transactional emails. If you opt in, we may also send project news updates or tester communications.
  • Device/technical data: basic device and app information (such as device type and operating system version) that may be logged by our infrastructure to keep the service reliable and secure. Authenticated API activity and diagnostic records may include an account identifier, endpoint, time, result and error details.

We do not intentionally collect precise location data or sensitive government identifiers.

3. How We Use Your Information

  • Provide and operate the App and your account
  • Store and sync your inventory and related content
  • Generate recipe suggestions and meal planning features based on your content
  • Send transactional emails (sign-in codes, registration, password reset)
  • Send optional communications you consent to (newsletters, tester updates)
  • Maintain security, prevent abuse, and debug issues
  • Understand feature usage and improve reliability
  • Share kitchen information with household members you choose to invite or join

4. Legal Basis and Consent

We process personal information with your consent or as needed to provide the App. You can withdraw consent for optional communications at any time (for example, by unsubscribing from emails).

5. Where Your Data Is Stored

Supa stores account data and uploaded images on infrastructure we operate using self-hosted Supabase database, authentication and storage software. Encrypted recovery backups are stored off-site in Google Drive. Our infrastructure and service providers may process information outside Canada. We take reasonable steps to protect your information regardless of where it is processed.

6. Sharing and Third Parties

We do not sell your personal information. We share information only as needed to operate the App, comply with law, or protect our rights.

  • Hosting and backups: our infrastructure runs self-hosted Supabase software. Google Drive stores encrypted recovery backups; Cloudflare delivers and protects connections.
  • Apple and Google: if you choose Sign in with Apple or Google, those providers process authentication and provide us with certain account identifiers and profile information according to your settings and their policies.
  • Resend: delivers account verification, password-reset and other service emails. Email delivery requires the recipient address and message content.
  • Cloudflare and hosting infrastructure: deliver and protect our website and API, processing connection and request data.
  • Google ML Kit on Android: supports scanning and text recognition. Google collects device and app information, installation identifiers, feature-use events, error codes and performance metrics for diagnostics and usage analytics. Scanning and text recognition run on the device; recognized receipt text is sent to Supa when you choose to import it.
  • AI processing: when you use an available AI feature, relevant input, such as receipt text or a cooking question and its necessary context, may be processed by our configured AI service providers, including OpenAI and, for supported image features, Google AI. Optional sharing of Supa inputs, outputs, feedback and evaluation data with OpenAI for model training was disabled on October 11, 2026. Earlier inputs and outputs may have been shared under the previous setting; disabling it does not erase historical contributions. AI providers may still retain records for service delivery, abuse prevention or legal obligations. Avoid entering information unrelated to the requested food or cooking feature.
  • Internal support tools: account lifecycle or support notifications may be processed through Slack. New account lifecycle notices omit email addresses and account links. Historical notices or support records may contain account identifiers and contact information. These tools support service operations, not public posting.
  • Your household and sharing choices: household members can see the shared kitchen content available to their household. Information you deliberately share may also be visible to its recipients.

7. Data Retention and Deletion

Personal app content is kept while your account is active or until you remove it. To request account and associated data deletion, use Delete account in the app’s profile settings or follow the instructions on our account deletion page. You can make a request without installing or signing in to the app.

Completed deletion removes your account and profile, avatar, personal kitchen inventory and groceries, receipts and purchase history, food preferences, recipe interactions, personal meal plans, and user-owned recipes with their final and temporary uploaded images. It also removes account-linked usage and diagnostic records from active app storage. If cleanup fails, deletion remains pending rather than being reported as complete; contact us if you cannot resume it.

Deleting the owner of a household can also remove that household’s shared kitchen data. Content or copies independently held by other users or recipients, public catalog data, and records a store keeps under its own policy are separate from your personal app account. Account deletion does not cancel store subscriptions.

We retain a minimal security record containing the old account identifier, deletion time and deletion status to prevent deleted sessions from restoring account access. This security record has no automatic expiry in the current system and contains no email address, recipes or uploaded images. Production API process logs rotate daily, with archived logs kept for up to fourteen days. Recovery backups retain separate copies. Other operational infrastructure logs and necessary support, billing or legal records may remain for their security, dispute-resolution or compliance purpose.

Recovery backups rotate separately from active app storage. Our daily backup job keeps five daily snapshots and ten local database dumps; the off-site repository also retains two weekly full snapshots. Snapshots may contain earlier database dumps and uploaded images. These are copy-count limits, not a guaranteed number of days: failed jobs, recovery archives or legal holds can extend retention. Service-provider records follow the applicable provider settings and legal obligations. Contact us at [email protected] for information about retained records or to make a privacy request.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, and disclosure. No method of transmission or storage is 100% secure, but we work to protect your data.

9. Your Rights (Canada)

Under applicable Canadian privacy laws (including PIPEDA), you may have rights to access, correct, or request deletion of your personal information, and to withdraw consent in certain circumstances.

To make a request, contact [email protected].

10. Children’s Privacy

Supa is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

11. Analytics

The Supa website may use Google Analytics and Meta Pixel / advertising analytics to measure page visits, conversion actions, and campaign performance, including App Store clicks, TestFlight clicks, and waitlist submissions. Android scanning components collect the diagnostic and usage data described above. Website advertising analytics are separate from the Android app; the Android app does not use an advertising ID.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date above.