Privacy policy

Last updated 2026-10-20

This policy covers sustainbite.com, run by SustainBite ("we"). It says what we keep about you, why, who helps us run the site, and what you can do about it. Questions: info@sustainbite.com.

What we keep

When you use SustainBite with an account, we keep:

Your account: your email address, the name you give, and your password, stored only as a scrambled hash we can't read back. If you sign in with Google, Google tells us your email address and name instead of a password.
Your profile: sex, birth date, height, weight, activity level, your goal, and the foods you tell us you don't eat (for example pork, alcohol or eggs), so we can work out your nutrient targets and suggest meals without them. You can also set targets of your own. When you ask for a week made for you, we use these with your favourites, and your country and the month to choose your country's food and what's in season; the week is kept in your browser. If you tell us where you live and the cuisines you cook (Settings → Preferences), we keep them with your account.
Where you seem to be: before you choose a country, the site asks our host, Vercel, which country your network address is in, to show you a week of that country's food. Your browser keeps the answer until you close the tab; we don't keep it or your address.
What you plan and eat: the foods, meals and recipes on your days, your weekly menus, favourites, notes, water and grocery lists, and the recipes you asked us never to suggest.
Your calendar link, if you make one (Settings → Preferences): the meals of the weeks you keep, the times you want them at, your time zone and language. We keep the link only as a scrambled hash; anyone you give the link to, or whose calendar has it, can see those meals, until you stop it or make a new one.
Your Fridge & pantry: the food you have at home, mostly what your shopping left over (worked out from usual pack sizes when you press "I've done the shopping") or what you added yourself, with a rough date to use each by and whether you froze it, and the staples you always have. If you're in a family, everyone who plans for it shares one. Food past its date leaves it.
Grocery lists you share: when you press Share in your cart, the list is kept at its own link, so whoever you send it to can open it and tick things off. Anyone with the link can see the list; it doesn't show your name.
Recipes you write, with their photos. A recipe stays private unless you make it public, and our team checks a public recipe before anyone else sees it.
Your family, if you make one: the people you invite by email and who has accepted, and the details you enter for someone without an account, like a child (such as their age, height and weight).
Nutritionists you let in: who may see your food, or see and plan it, until you take that back; the goals they set for you, which you see on My Plan; and private notes they write about your work together, which only they can read.
Who saw your data: when someone other than you (your nutritionist, your family's founder or our support team) looks at or changes your data, we note who, what and when. You see the last 90 days of it on the Sharing page.
If you're a nutritionist: your practice's name, colour, contact details and logo, which go on the reports you print for clients, and the notes and goals you keep for them.
Two-step sign-in, if you turn it on: the key your authenticator app uses, and your recovery codes, kept only as scrambled hashes.
Activity you send us: steps and active energy, and from some Android apps the day's total calories burned, if you connect a watch or phone on the Watches page (with the Apple Shortcut on an iPhone, or an app such as HC Webhook on Android).
Messages from us: notifications in the app, and your email address if you sign up for the newsletter (from the form at the bottom of the site; you don't need an account for that).

We don't ask for or keep payment details: SustainBite takes no payments at the moment, and every feature is free.

Why we keep it

To run the service you signed up for: your plan, your targets, your lists and your reports.
To let the people you choose see your plan: your family, or a nutritionist you've given access.
To keep accounts safe: sign-in codes, limits on repeated attempts, and logs that help us find and fix problems.
To send you the emails you ask for: sign-in codes, password resets, family invitations, a grocery list you email to yourself, and the newsletter if you signed up.

We don't sell your data, and we don't use what you eat for advertising.

Advertising and visitor counts

On the public pages (the home page, recipes and articles), visitors who aren't signed in may see Google ads (AdSense), and we count visits with Google Analytics. Both use cookies. Once you're signed in, neither runs on any page. You can block or delete these cookies in your browser.

The app itself keeps a few things in your browser's storage, not in cookies: your sign-in, your language, light or dark mode, and your grocery list while you build it.

Who helps us run SustainBite

These services handle data for us, only to provide their part of the service:

Vercel serves the website.
Render runs our server, in Frankfurt, Germany.
MongoDB Atlas holds our database, on Amazon Web Services in Singapore.
Google handles "Sign in with Google" (Firebase), and the ads and visitor counts described above. The site also loads a font from Google Fonts.
Zoho sends our emails.
Wikimedia Commons serves the paintings in our articles, straight to your browser.

When you choose to, your grocery list goes to Instacart (to order the food) or Bring! (to add it to your shopping list app), whose own privacy policies then apply. When you add your calendar link to Google Calendar, Apple's or another calendar, that calendar fetches your meals from it, and its own privacy policy applies to them. On Android, the app you install to send your activity (such as HC Webhook) reads it from Health Connect on your phone and sends it straight to us; its own privacy policy applies to it. Food searches use the USDA's FoodData Central and Open Food Facts; we send them the words you search for, not who you are. When you scan a barcode, the camera's picture stays on your phone: only the barcode's number is sent, to us and from us to Open Food Facts. Norway's numbers come from our own copy of Matvaretabellen: nothing is sent to it.

Some of these companies are in the United States or other countries, so your data may be stored or handled outside your own country.

How long we keep it

As long as you have an account. When you delete your account (Settings → Data & account), we delete your data from our database straight away: your profile, plans, recipes, grocery lists, calendar link, Fridge & pantry (and your family's, if you founded it), family links and the access you gave. One exception: a public recipe of yours that's part of the site's weekly menus stays, without your name. A grocery list you shared stays at its link for 90 days, then is deleted. The record of who saw your data is kept for 13 months. A nutritionist's notes and goals about a client are deleted when either of them deletes their account. Our server's logs, which can include an email or IP address, are kept for a limited time and then deleted. Newsletter addresses are kept until you unsubscribe.

What you can do

See and take away your data: Settings → Data & account → Download your data gives you everything in one file.
Correct it: change your profile, targets and preferences in Settings at any time.
Delete it: delete your account in Settings → Data & account.
Take back access: remove a nutritionist or a family member at any time.
Stop emails: unsubscribe from the newsletter with the link in any newsletter.
Ask us: write to info@sustainbite.com about anything here. Depending on where you live, you may also complain to your data protection authority.

Children

Accounts are for people aged 16 and over. A parent or guardian can add a profile for a child to their family: the child gets no account, and the parent decides what's entered. If you think a child under 16 has made an account, write to us and we'll delete it.

Changes

If we change this policy, we'll update it here and change the date at the top. If a change matters for how we use your data, we'll tell you in the app or by email first.