Last updated: November 8, 2026 (where trials come from)
Spatch is run by D Miles Holdings LLC, Wisconsin, USA ("we"). This page says what the app
keeps, why, who else handles it, how long it's kept, and how to get it out or delete it.
What we keep
Your household's content: the recipes you add or edit, photos you upload, your
meal plan, grocery list and ticks, ratings, notes, cooking history and settings.
Who's in the household: the email addresses on it, the first names given to them,
and the household's name. An invite keeps the invited email and name until it's used,
cancelled, or expires after 7 days.
Your household link: the private address that opens your household. Anyone who
has it can open the household. Settings → Sign out every phone replaces it, so every
other phone has to sign in again with its email.
Your email address, to send sign-in codes and invites, and messages about your
household and subscription (for example, when someone is removed or the household is
deleted). We don't send marketing email.
A fingerprint of your email (a one-way hash) and when its free trial ends, so each
person gets one free trial. The address can't be read back from it, but someone who
already had an address could check whether it matches, so we treat it as personal
information. It stays after a household is deleted, for as long as Spatch offers free
trials, and nothing else about you is kept with it.
Your subscription status (trial, paid, cancelled, and until when), whether it's
monthly or yearly, Paddle's customer and subscription references, and the email address
the subscription is paid with (from Paddle), so we can send that person the yearly renewal
reminder and tell them when the subscription is changed from the app. Others in the
household see it partly hidden (d•••@gmail.com). We never see or store card numbers.
A record that you agreed to a renewing subscription: when, which plan, and which
wording you were shown. California's automatic renewal law requires us to keep this for
at least 3 years, or a year after the subscription ends if that's later. We keep it for
exactly that long, even if the household is deleted, and then delete it; nothing else is
kept with it.
Usage counts, kept on our own server: how many households used the app each week,
how many recipes were imported and how (and what each AI read cost), and how many planned
meals were built-in recipes versus a household's own; and, for a household that signed up,
when it first added five recipes, planned, used the grocery list and cooked, and which
weeks after signing up it used the app. These are tied to a random household
ID, not to a name, link or email, so they're pseudonymous rather than anonymous. A deleted
household's rows are deleted with it; only overall totals remain.
Where a trial came from: when you arrive by a link we posted that carries a short
tag (such as ?src=reddit), we count the visit under that tag, and if you start a
trial the tag is kept with your household's trial record, so we can tell which places bring
people who stay. Nothing else about the visit is recorded, and there's no cookie. It's
deleted with the household.
Recipes you share as a link: a copy of the recipe and the household's or people's
names, kept behind the link until you delete that recipe or the household. If you added the
recipe's photo yourself with Add photo, the link shows it too (with any location or camera
details removed) for as long as it's the recipe's photo; photos that came from a website,
a screenshot or someone else's shared recipe are never shown. Someone who saves the recipe
gets a copy of its photo in their household, which isn't shown on links they share; and counts of how many recipes were shared, opened and saved. Anyone who has
the link, including anyone it's forwarded to, can see that copy. Deleting the recipe or
the household ends the link, but copies other people already saved stay in their
households, as theirs.
Error reports from the app: what went wrong, where, and the app version, with
any household link or email address removed before they're stored. They aren't tied to
a household.
Technical information. Like any website, each request to Spatch carries your IP
address, browser details and the address requested. We use IP addresses to limit abuse
(for example, too many sign-in codes from one place) and keep them for up to an hour for
that. Cloudflare also keeps short-lived technical logs of requests for up to 7 days; we've
set them to leave out the part of an address that holds the household link.
Recipes shared to Spatch from other apps (the iPhone app's share sheet): the
recipe as read from the link, photos or post you shared, kept on our server for your
household to check over and save, for up to 14 days or until someone in the household
saves or discards it. The photos themselves aren't kept, only the recipe read from them.
On your phone: the app keeps a copy of your household for offline use, and your
display settings, in the browser's storage. Signing out on that phone removes the
household copy.
In the iPhone app:
So that the share sheet can save straight to your household, the app keeps your
household's private link on the phone, in storage only Spatch and its share sheet can
read. Signing out on that phone removes it.
When you share an Instagram, TikTok or Facebook post, the share sheet opens that post's
public page from your phone to read its caption, the same as opening the link would.
Nothing about you is sent to them beyond what any visit sends (your IP address and
phone details).
The weekly planning reminder, if you turn it on, is scheduled on the phone itself.
Whether to skip a week is worked out on the phone from your plan; nothing about it is
sent to us or anyone else.
The app uses no advertising identifier and no tracking.
There are no ads, no third-party trackers or analytics, and we don't sell or share your
personal information for advertising.
Who else handles it
Cloudflare hosts the app, runs its server and stores your household's data,
including photos. It keeps the technical logs described above.
Anthropic reads recipes for us. When you import from a photo, from a web page
that doesn't publish its recipe in a standard form, or from a social post's caption, that
photo (with anything typed alongside it), the page's text or the caption is sent to Anthropic's API so its AI model can read the recipe out of it. Nothing
else is sent: not your email, your link, or anything else in your household. Recipes you
type, and links to most recipe sites, are read on our own server and never sent to
Anthropic. Under Anthropic's commercial terms, it doesn't use what we send to train its
models, and it deletes it within 30 days, except that anything its safety systems flag
can be kept for up to 2 years.
Paddle handles payments as our reseller and merchant of record. It collects your
payment details, name, email and billing address under its own privacy policy, and tells
us the subscription's status.
Resend sends our emails (sign-in codes, invites and notices). It receives the
address and the message, and keeps delivery records under its own policy.
Zoho hosts our support inbox. If you email us, your message is kept there.
Copyright complaints. If a shared recipe is the subject of a copyright notice, we
keep the notice and any counter-notice, and we would identify the household to the person
who complained only if a court or a subpoena under copyright law required it. A counter-notice, including the name and
address in it, is sent to the person who complained (see the
terms). A shared recipe taken down after a notice is
held, not deleted, in case a counter-notice puts it back, until the recipe or the
household is deleted.
How long we keep it, and deleting it
A household's content is kept while the household exists, including after a trial or
subscription ends (it becomes read-only, not deleted).
Deleting a household (Settings → Delete this household) removes from our live
systems, at once: its recipes, photos, plan, ratings, notes, history, emails, names,
invites and its usage rows.
What can remain after that: the email fingerprint above; Paddle's payment records, as
the law requires; emails already sent (in Resend's records and in your inbox); anything
already sent to Anthropic, until Anthropic deletes it as above; and our hosting's
point-in-time recovery, which keeps a restorable history for 30 days. After those 30
days the deleted household is gone from it too.
Removing an email from a household removes it, and its name, from that household at
once. It doesn't sign out a phone that already has the household's link; replacing the
link does (see the terms).
Keeping it safe
We use reasonable safeguards: connections to Spatch are encrypted, each household can
only be opened with its own link or an email sign-in, sign-in codes and imports are rate
limited, and the keys to our providers are kept in our hosting's secret storage. No system
is perfectly secure; if a breach affects your information, we'll tell you as the law
requires.
Your choices and rights
Get a copy: Settings has a full download of everything your household has saved,
as a readable file, and your cooking history as a spreadsheet, at any time, including
after a trial or subscription ends.
Correct it: edit anything in the app; names and emails are in Settings.
Delete it: as above, or ask us.
To ask what we hold about you, or to have it corrected or deleted, email
support@spatch.kitchen. We'll reply within 30 days and may
need to confirm the request comes from an email on the household. Depending on where you
live, the law may give you further rights; we'll honor them.
Children
The app isn't directed at children under 13, and we don't knowingly collect their
information. If you think we have, tell us and we'll delete it.
Where it's run
Spatch is run from the United States. If you use it from elsewhere, your information is
processed in the US and wherever our providers operate.
Changes and contact
If this policy changes in a way that matters, we'll say so in the app before it takes
effect. Questions or requests: support@spatch.kitchen.