Privacy Policy

Last updated October 8, 2026

Pinched helps you plan meals, shop and prep. This page says what information it uses, where it lives and how you control it. Pinched (“we”) runs Pinched.

Using Pinched without an account

You don't need an account. Without one, your recipes, plan, lists, kitchen, settings, food preferences, delivery address and photos are saved only in your browser on your device. We can't see them.

A few features do contact our servers, even without an account:

• Importing a recipe from a web address sends that address to our server, which fetches the page and returns the recipe. We don't keep it.
• Timer notifications, if you turn them on, store a random device id, your browser's push subscription and, for each running timer, its end time and name (for example “Irish Stew: Bake”) until the notification is sent.

If you create an account

• Sign-in details (email address, name, profile picture, password) are handled by our sign-in provider, Clerk. We don't store your password.
• Your plan and recipes are stored in our database (hosted by Supabase) so they are backed up and sync between your devices: planned meals, batches, your Kitchen items, each week's grocery list and prep plan, your prep day, the recipes you add, your edits to built-in recipes, your saved recipes with their ratings, notes, collections and cooking history, your settings (first day of the week, household size, weekly meal plan, prep method), your food preferences and the photos you add to your recipes (up to 50 MB per person, in private storage that only your account can read back). It is tied to your account and no one else can read it through the app.
• Kept on your device only, even when signed in: your delivery address, timers and cook-view progress. These are not uploaded to our database.

If you subscribe to a paid plan in future, payments will be handled by our payment provider; we won't see your card number.

Who else handles your information

• Clerk (sign-in and, if used, billing)
• Supabase (the database for signed-in users)
• Netlify (hosting, serverless functions and timer-notification storage); like any host, it keeps standard server logs including IP addresses
• Sentry (error reports): when something breaks in the app, a report is sent with the error message, the type of error, the page address without anything after the question mark, and the app version. It leaves out your name, email, IP address, cookies, your plan and your food preferences. Sentry may infer an approximate location from the connection.
• Your browser's push service (Apple, Google or Mozilla) when you turn on timer notifications

We don't sell your information, and we don't show ads or use advertising trackers. Pinched has no analytics. If we add analytics, we'll update this page, and we won't send your food preferences or address.

Food preferences and allergies

You can tell Pinched about allergies and diets so it can flag recipes. This is sensitive health-related information. Without an account it stays on your device. If you sign in, it is saved with your account, in the same database as the rest of your plan, so every device shows the same flags; we use it only for that, and never share it. The flags are a convenience based on ingredient names. They can't see hidden ingredients or cross-contact, so always check labels yourself.

Your choices

• Download your data. Settings → Your data → Download my data gives you one file with everything Pinched holds for you, including the copy in your account.
• Delete your account. Settings → Your data → Delete my account permanently removes your account, the plan stored in it and your notification devices. You can also remove the data on your device at the same time, or when you sign out.
• Clear what's on your device at any time by clearing this site's data in your browser.

Depending on where you live, you may have further rights, such as asking us to correct or delete information, or to object to how it's used. Write to us and we'll help.

Abuse protection

To keep Pinched working for everyone, we count requests per account, or for people without an account per connection address (stored only as a short one-way hash). These counters are deleted within a day and are used for nothing else.

Cookies and storage

Pinched saves your plan in your browser's storage. Our sign-in provider sets the cookies it needs to keep you signed in. We don't use advertising cookies.

Children

Pinched isn't directed at children. A grown-up should create any account.

Changes and contact

If we change this policy in a way that matters, we'll say so in the app. Questions or requests: support@pinched.app.