Privacy Policy
Effective November 1, 2026
Who we are
Whole Haul is run by Ronald Padilla, an individual. In this policy, "we" means Ronald Padilla. Contact us at support@wholehaul.org.
The most important thing
Your household answers are sent to Anthropic's API to write your plans. That includes your allergies, the foods you avoid, your notes and any change you ask for. We do this only after you agree on the AI data sharing screen in the app. We don't send your name, your email or your account ID, unless you type them into your notes.
Anthropic is the company that makes Claude, the AI model that writes the plans. Anthropic says it deletes inputs and outputs within 30 days. It can keep them for up to 2 years if its safety systems flag them. Its commercial terms don't let it train its models on this data. Read more at Anthropic's privacy policy and Anthropic's privacy center.
If you turn on weekly plans, the same thing happens every week, using your saved answers.
What we collect, where it goes and how long we keep it
| Data | Where | Kept |
|---|---|---|
| Your answers: household size, meals, cooking time, budget, stores, cuisines, spice, foods loved and avoided, eating style, allergies, tools, pantry, skill, notes, start date | Your phone; our database | Until you change them or delete your account |
| A copy of your answers made for one build | Our database | 30 days after the build |
| Plans, grocery ticks, change requests | Up to 8 plans on your phone; our database | Until you delete your account. The phone copy is wiped when you sign out |
| Email; for Google sign-ins also your name and picture link; your Apple or Google ID | Our sign-in system | Until you delete your account |
| Time zone and notification settings | Our database | Until you delete your account |
| Push tokens (they let us send notifications to your phone) | Our database, Expo, Apple | Removed when you sign out and when you delete your account. Phones not seen for 60 days are dropped |
| Notification text: dates, meal names, trip and store names, item counts | Passes through Expo and Apple; our outbox | 30 days |
| Weekly delivery records | Our database | 180 days; removed when you delete your account |
| Subscription status, product and dates | Our database; RevenueCat; Apple | Removed when you delete your account (Apple's own records aside) |
| Device and connection details that the RevenueCat purchase tool collects, such as your IP address, device type and system version | RevenueCat | Under RevenueCat's own schedule. We ask it to delete your customer record when you delete your account |
| Payment-service event records | Our database | 180 days; your account ID is removed when you delete your account |
| Claude usage counts and cost (no content) | Our database | Kept; the link to your account is removed when you delete your account |
| A scrambled sign-in fingerprint and counts of plans and change requests used | Our database | 24 months after you delete your account |
| Your IP address and device or browser details, from sign-in sessions and server logs (no answers) | Supabase | Sign-in session details until you delete your account. Logs are kept for a short time, no more than 7 days |
Who else handles your data
We use these companies to run Whole Haul. Each one gives your data the same or equal protection as this policy, under its own terms.
- Supabase: hosting, our database and sign-in.
- Anthropic: writes your plans, as described above.
- Apple: Sign in with Apple, payments and push notifications.
- Google: Sign in with Google.
- Expo: delivers push notifications.
- RevenueCat: keeps purchase records. Your account ID is the customer ID there.
- Cloudflare: hosts these web pages only.
We don't sell your data. We don't show ads. We don't track you across other companies' apps or websites.
Taking back your OK for AI sharing
Go to Settings > AI data sharing and tap Stop sharing. New plans and changes stop until you agree again. Any plan still being built is stopped too, and weekly plans are turned off. If you agree again, weekly plans do not come back on their own. You turn them on again in Settings > Notifications. Your saved plans stay. Anthropic deletes what it already has on its own schedule, and we can't speed that up.
Deleting your account
Go to Settings > Account > Delete account. It works right away, inside the app. It removes your answers, plans, grocery ticks, notification settings, phones, weekly delivery records, notifications and subscription records from our systems. We also ask RevenueCat to delete your customer record. If you signed in with Apple, the app asks you to confirm with Face ID so we can end Whole Haul's link to your Apple Account.
Deleting your account does not cancel an Apple subscription. Apple keeps charging you until you cancel in your iPhone's subscription settings. Cancel first. Refunds go through Apple.
What stays after you delete
- A scrambled code made from your Apple or Google sign-in. It comes with a count of how many plans and change requests that sign-in has used, paid ones included, and any builds still in progress when you deleted. We keep it for 24 months so the free plan can't be claimed again by deleting and signing up again. If that sign-in used nothing, we keep nothing. The code can't be turned back into who you are.
- Claude usage counts and cost, with no link to you and no content.
- Payment-service event records, with your account ID removed. They are deleted after 180 days.
- Anthropic's, Apple's, RevenueCat's and Expo's own copies, under their own schedules.
- Copies of plans on other phones where you were signed in. They stay until someone signs in again or deletes the app.
Allergies
Allergy answers are health information. We use them only to write your plans. Whole Haul works to avoid the allergies you list, but it can miss things and can't promise any plan or recipe is safe for you. Always read labels. See also our Consumer Health Data Policy.
Children
Whole Haul is not directed at children under 13, and we don't knowingly collect their data. If you think a child has given us data, write to support@wholehaul.org and we'll remove it.
Where this applies
Whole Haul is offered in the United States only. Your data is handled by the companies above, which may run servers in the United States and elsewhere.
Changes to this policy
If we change this policy, we'll post the new version here with a new effective date. If a change affects what is sent to Anthropic, or to whom, the app will ask you to agree again before it sends anything.
Contact
Ronald Padilla, support@wholehaul.org.