Privacy Policy

Cookies and trackers

There are no advertising cookies, no third-party trackers, and no social media pixels on this site — which is why you have never seen a cookie banner here. Analytics are provided by Cloudflare Web Analytics, which is cookieless and measures pages in aggregate; it does not identify you and does not follow you across other sites.

The only cookie is a strictly necessary session cookie, set after you sign in, so the site can keep you logged in. It is not used for tracking, and signing out clears it.

The email list

If you subscribe to the weekly email, your email address is stored in our database and used for one thing: sending you that email. Subscription is confirmed by a double opt-in link — you are not added until you click it. Every email contains a one-click unsubscribe link, and unsubscribing removes you from future sends. Delivery is handled by Resend, which processes your address on our behalf.

Accounts and health-related information

Creating an account requires an email address and a password; passwords are stored only as a cryptographic hash, never in readable form. When you set up meal preferences, you may choose to enter information related to your health — for example dietary exclusions, a flare-up status, or conditions you want the meal planner to account for. That information is treated as sensitive: it is used only to build and save your own meal plans, it is never shared with anyone, and it is never used for advertising. Saving these preferences is your choice, and you can change or delete them at any time from your account.

Payments

Payments are processed by Creem, which acts as the Merchant of Record. This means your card details go directly to Creem and never touch GoutPlate’s servers. We receive only what is needed to run your subscription: the plan you chose, its status, an identifier for your customer record at Creem, and the email address on the purchase. Creem’s own privacy policy governs the payment data it holds.

Service providers

GoutPlate runs on a small stack, and each provider processes data only for the purpose listed:

• Cloudflare — hosting, database, file storage, and cookieless analytics.
• Resend — sending subscription emails.
• Creem — payment processing and subscription management, as Merchant of Record.

Like any website, requests to the site pass through infrastructure that keeps short-lived technical logs (for example, IP addresses used to block abuse and attacks). These logs are not used to build profiles and are not linked to your account.

How long data is kept

• Email list — until you unsubscribe or ask us to delete you.
• Account data — until you delete your account; then it is removed from the live database.
• Subscription records — kept while your subscription is active and afterwards where tax and accounting rules require it.

Your rights

If you are in the EU or UK, you have the right to access your personal data, to correct it, to delete it, to restrict or object to its processing, and to receive a portable copy. If you are in California, you have the right to know what is collected, to request deletion and correction, and to not be discriminated against for exercising those rights. GoutPlate does not sell personal information and does not share it for cross-context behavioural advertising — so there is nothing to “opt out” of.

To exercise any of these rights, contact us using the details below. We may ask you to verify your identity, and we will respond within 30 days. If you believe your data has been handled unlawfully, you also have the right to complain to your local data protection authority.

Children

GoutPlate is a site about managing a condition that mostly affects adults, and it is not directed at children. Accounts are not offered to anyone under 16, and we do not knowingly collect data from children.

Where data is processed

The service runs on Cloudflare’s global network, and our email and payment providers are based in the United States. Where personal data moves across borders, it is protected by the providers’ standard contractual clauses and equivalent safeguards.

Changes to this policy

If this policy changes in a way that matters — a new provider, a new category of data — the date at the top will change, and material changes will be announced on the site. The policy always describes the site as it currently operates.

Contact

A public contact address for privacy requests is being set up before launch.

See also the Terms of Service and the Disclaimer.