We keep your household's data for as long as you use the Service, and delete it when you ask.
Household data
Recipes, meal plans, grocery lists, inventory and its history, preferences and alerts are kept until the household is deleted. The inventory history is an append-only ledger by design — corrections and undos are recorded as new entries rather than erasing old ones — so your balances stay explainable.
Export
The household owner can download a JSON export of the household's data from Household settings at any time.
Deleting a household
Only the owner can delete a household, and must confirm by typing the household name. Deletion removes the household's recipes, plans, lists, inventory, uploads and member access from the live database. An audit record that the deletion happened (who and when, without the deleted content) is kept for security purposes.
Uploaded photos
Recipe photos are re-encoded on upload (removing embedded metadata such as location), stored in private storage that is not publicly reachable, and deleted with the household.
Import drafts
When an AI or parser import fails, the job record and its error message are kept so it can be retried, and so you can see what happened and enter the recipe by hand instead. Import jobs, unconfirmed drafts and their source photos are deleted with the household.
Sessions and security logs
Expired sessions are no longer valid and are removed over time. Audit events are kept for as long as needed to investigate security incidents and meet legal obligations.
Backups
Database backups are kept for about 35 days, then overwritten. Data deleted from the live Service may remain in backups until they roll off, and is not restored into the live Service except as part of disaster recovery.
Billing records
Billing and tax records may be kept longer where the law requires.