Privacy Policy
This Privacy Policy explains how Plenish LLC (“Plenish,” “we,” “us,” or “our”) collects, uses, and shares personal information when you use the Plenish mobile and web application (the “Service”). Plenish LLC is a limited liability company formed in Oregon, United States, and is the controller of the personal information described here.
If you have any questions about this policy or your personal information, contact us at support@plenish.pro.
Information we collect
We collect only the information needed to provide the Service:
- Account and identity. When you sign in with Google or Apple, we receive your email address and, where available, your name, along with a unique account identifier from Firebase Authentication. If you use Sign in with Apple and choose to hide your email, we receive a private relay address rather than your real email, and Apple forwards messages sent to it. Google and Apple handle the sign-in itself under their own privacy policies. You may add or edit your first and last name in your profile.
- Content you create. Recipes you save or import, meal plans, grocery lists, nutrition targets, and related settings. When you open a recipe, we also record when you last opened it so we can sort your library by recently viewed.
- Household and sharing data. If you create or join a household, we store your household membership and any invitations you send so household members can share recipes, meal plans, and grocery lists.
- Recipe images. When you import a recipe from a web address, we may store a copy of its image. These images originate from the third-party websites you import from. Stored images are kept in private storage and are served through short-lived, authenticated links that require you to be signed in to the app.
- Feedback. If you send feedback, we collect a satisfaction rating, its type (bug, suggestion, or compliment), an optional message, and your app version, build number, and platform.
- Agreement records. When you create your account and accept our Terms of Service and Privacy Policy, we record which versions of those documents you accepted, when you accepted them, and the IP address and browser or device identifier (user agent) of the request, as proof of your agreement.
- Security and diagnostic data. To protect the Service from abuse, we use Firebase App Check, which relies on device-integrity attestation (reCAPTCHA Enterprise on the web, Play Integrity on Android, and App Attest on iOS). These checks process device-integrity signals — not advertising or tracking identifiers — and are strictly necessary to secure the Service and prevent abuse. On the web, reCAPTCHA stores and reads information on your device solely to verify that a request is not automated; Google processes this on our behalf and does not use it for its own purposes. We also keep short-lived diagnostic logs of requests to the Service; these logs are configured to redact authentication tokens and IP addresses.
What we do not collect. Plenish does not include third-party advertising or analytics tracking software, does not collect your precise location, and does not send push notifications or collect device push tokens. We do not build advertising profiles about you.
Providing information is your choice. No law requires you to provide us personal information. An email address (or Apple private relay address) and a Google or Apple sign-in are needed to create an account and are required by our contract with you: without them we cannot provide the Service. Everything else, including your name, recipes, meal plans, household membership, nutrition targets, and feedback, is optional.
Tracking and “Do Not Track.” We do not track you over time and across third-party websites or apps, and we do not allow third parties to collect information about your online activities over time and across different websites or apps when you use the Service. Because we do not engage in such tracking, we do not respond differently to browser “Do Not Track” signals: every user gets the same non-tracking treatment. We do not sell or share personal information, so opt-out preference signals such as Global Privacy Control do not change how we process your information.
How we use your information and our legal bases
For users in the European Economic Area and the United Kingdom, we rely on the following legal bases under the GDPR:
- To provide the Service — creating your account, saving your recipes and meal plans, generating grocery lists, and enabling household sharing (performance of our contract with you).
- To parse and organize recipes — we process recipe ingredient text to structure ingredients and organize grocery lists (our legitimate interest in providing core functionality). See “Automated recipe processing” below.
- To keep the Service secure — device-integrity attestation and abuse prevention (our legitimate interest in protecting the Service and our users).
- To provide support and improve the Service — responding to feedback and fixing problems (our legitimate interest, and performance of our contract).
- To keep a record of your agreement — maintaining proof that you accepted our Terms of Service and Privacy Policy (our legitimate interest in establishing, exercising, and defending legal claims).
- To comply with the law — meeting legal obligations that apply to us.
Automated recipe processing
To structure recipe ingredients (for example, separating quantities, units, and items), to classify recipes by meal course, and to organize grocery lists by aisle, we send recipe text — such as recipe titles, descriptions, and ingredient lists — to Google’s Vertex AI (Gemini) service for processing in the United States. Under Google’s Vertex AI terms, this content is processed to return a result and is not used to train Google’s foundation models. The structured results are stored in your Plenish account. This processing only organizes recipe text; it does not make decisions about you.
How we share information
We do not sell your personal information, and we do not share it for advertising. We share information only with service providers that host and operate the Service on our behalf, and only as needed to run Plenish:
- Google Cloud and Firebase — authentication, database storage, file storage, application hosting, diagnostic logging, and the Vertex AI processing described above.
- reCAPTCHA Enterprise, Apple, and Google Play — device-integrity attestation used by Firebase App Check.
- Other household members — if you join a household, the recipes, meal plans, and grocery lists in that household are visible to its members.
These providers process your information on our behalf under contracts that require them to protect it to at least the standard described in this policy and to use it only to provide their services to us.
We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of Plenish and its users. If Plenish is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, and we will notify you of any change in who controls your personal information.
Where your information is stored and international transfers
Your information is stored on Google Cloud infrastructure in the United States. If you use the Service from the European Economic Area or the United Kingdom, your information is transferred to the United States. Our infrastructure provider, Google LLC, is certified under the EU-US Data Privacy Framework, the UK Extension to it, and the Swiss-US Data Privacy Framework, which the European Commission and the UK Government recognize as providing an adequate level of protection. Where the Framework does not apply, these transfers rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated into our service providers’ data processing terms. You can obtain a copy of these safeguards by contacting us at support@plenish.pro; the Standard Contractual Clauses are published by the European Commission, and Google’s data processing terms incorporating them are available at cloud.google.com/terms/data-processing-addendum.
How long we keep your information
- Account and content — kept for as long as your account is active. If you delete your account — from Account settings in the app, or by asking us — your account and the personal content associated with it are removed. Content you shared with a household remains available to its other members, with your identity removed. Recipes imported from the web, and their images, are part of our shared recipe catalog and may be retained after your account is deleted; your personal connection to them is removed.
- Feedback — kept for as long as your account is active; after that we delete it or remove the details that identify you and keep only anonymized feedback to improve the Service.
- Agreement records — kept for as long as your account is active. If you delete your account, we erase the IP address and user agent and keep a minimized proof of your agreement: a one-way coded token derived from your email address (which cannot be reversed to reveal it), the document versions you accepted, and the acceptance time. We keep this proof for six years from the date your account is deleted so that we can establish, exercise, or defend legal claims — an exception to the deletion described above, based on our legitimate interests (GDPR Article 6(1)(f)) and permitted by the GDPR’s erasure exemption for legal claims (Article 17(3)(e)). You may object to this retention under Article 21; we may nevertheless continue to retain the proof where necessary to establish, exercise, or defend legal claims.
- Diagnostic logs — retained for approximately 30 days.
After you delete data or your account, residual copies may remain in routine backups until those backups are overwritten on our provider’s standard backup cycle.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal information, to receive a portable copy of it, and, where we rely on consent, to withdraw that consent. You can delete your account yourself at any time in the app, under Account settings, which permanently removes your account and personal information, except the limited records described in “How long we keep your information.” To exercise any other right — or to have us delete your account for you — contact us at support@plenish.pro. To help us route your request quickly, you can use a subject line such as “Privacy request” or “Delete my account,” but your request is valid however you word it. Exercising your rights is free, and we respond within one month; if your request is complex we may extend this by up to two further months and will tell you why. To protect your account, we may first ask you to verify your identity, for example by confirming you control the email address on the account. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, your national authority. If you are in the UK, you can also complain to us directly about how we handle your personal information by emailing support@plenish.pro; we will acknowledge your complaint within 30 days and respond without undue delay, and you can complain to the ICO at any time.
We do not sell covered information as defined by Nevada law. Nevada residents may submit a verified request concerning the sale of covered information to support@plenish.pro, our designated request address; we respond within 60 days.
Your right to object
Where we process your information based on our legitimate interests (see “How we use your information and our legal bases”), you have the right to object at any time, on grounds relating to your particular situation. If you object, we will stop that processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed to establish, exercise, or defend legal claims. To object, contact us at support@plenish.pro.
Security
We protect your information with encryption in transit, identity-based access controls on our infrastructure, and device-integrity checks on requests to the Service. No method of transmission or storage is completely secure, but we work to protect your information.
Children
Plenish is intended for adults and is not directed to children. You must be at least 16 to use the Service, and we do not knowingly collect personal information from anyone under 16. If you believe someone under 16, or under the age of digital consent in their country, has provided us personal information without appropriate consent, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Effective” date above. If a change is material, we will give you reasonable advance notice by email or in the app before it takes effect.
Contact us
Plenish LLC
395 SW Roosevelt Ave, Bend, OR 97702, United States
Email: support@plenish.pro