CestaChef.
Start free

Privacy Policy for US residents

Last updated: October 2026

1. Who we are

CestaChef is a meal planning app for iPhone and Android, and a website (cestachef.es), that builds a personalized weekly meal plan with a grocery list. This policy explains what personal information we collect, why, and the rights you have, including under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Washington My Health My Data Act and the Nevada consumer health data law (SB 370).

Business responsible: Alex Morata. Contact: info@cestachef.es. More details in our legal notice.

2. Information we collect

  • Account information: your name and email address when you sign in with Google, with Apple (in the iPhone app), with an email address and password, or with an emailed magic link. If you use a password we store it only in hashed form, through our authentication provider.
  • Profile photo: only if you choose to upload one.
  • Plan preferences: the store you choose, your budget, your diet and the kitchen appliances you have.
  • Allergies and intolerances: the ones you select are kept only on your device and used there to remove dishes from your plan. We do not store them in your account or on our servers.
  • Saved plans: the recipes and grocery lists you choose to save, and a local history on your device.
  • Subscription and purchase records (only if you subscribe): the purchase identifier, plan, status and renewal or expiry date that Apple or Google share with us, tied to your account so we know whether you have access. We never receive your payment card.
  • Creator code (only if you enter one): the code, which creator it belongs to and when you registered it. It does not change your price. We give the creator no information that identifies you.
  • Push notification token (only if you turn on weekly reminders): the identifier needed to send you those reminders. You can turn them off at any time.
  • Consumer health data (only if you turn on “My goal”, our Diet Mode): sex, age, height, current weight, target weight, activity level and chosen pace, plus the history of the weights you log, and the calorie target we calculate from them. See section 3.
  • Contact and waitlist: what you send us through the contact form or by email, and your email address if you join the waitlist.
  • Technical data of the website: our hosting provider processes technical data of your visit, such as your IP address, to serve the pages.

3. Consumer health data (Diet Mode)

CestaChef works fully without this. Only if you turn on “My goal” do we ask for the data in section 2 to calculate a daily calorie target and adjust your meal plan to it. This is consumer health data under the Washington My Health My Data Act and Nevada SB 370, and sensitive personal information under the CCPA/CPRA. We handle it under these rules:

  • Separate consent to collect and use it. It is a checkbox of its own, not pre-checked and not part of accepting these policies or any terms. Until you check it, the weight and height fields do not even appear. We collect and use this data only to calculate your target and choose recipes for you.
  • We do not sell it and we do not share it. It is not disclosed to advertisers, data brokers or anyone else for their own purposes, and we would ask for a separate, specific authorization before ever doing so. The only parties that process it are the service providers that store it for us (section 6).
  • Adults only. The feature is for people aged 18 or over; if the age you enter is under 18, the feature is not turned on.
  • It never goes into our usage analytics. No weight, age, height or exact calorie target is sent to our event log, only the range it falls into (for example, “1700-1999”). We do count, in aggregate and without identifying anyone, how many accounts have set up Diet Mode (we do not show the figure below 5 accounts).
  • Apple Health and Health Connect (only if you connect them). In the iPhone and Android apps, and only if you grant permission in the system prompt, we read your weight, steps and active calories. Weight is added to your weight history in “My goal” under the rules of this section; steps and calories are shown on your device only and are not stored on our servers. We do not write anything to Health. You can remove the permission at any time in your Health or Health Connect settings.
  • Withdraw consent and delete. In Profile → My goal you can withdraw your consent at any time. Doing so permanently deletes your health profile and your entire weight history and turns Diet Mode off. Your shopping preferences stay as they are. You can also delete your whole account (section 8) or email us.
  • Access. You can see the data you entered in the app, and you can download a copy from Settings → Export my data.

The free calorie calculator on cestachef.es is different: the numbers you type are calculated entirely in your browser, are not sent to any server and are not saved.

This is not medical or nutritional advice. The calorie target comes from a standard estimation formula and does not take your medical history into account. CestaChef does not diagnose, treat or prevent any condition. If you have a medical condition, are pregnant or breastfeeding, talk to a health professional before following any plan.

4. Usage analytics (only with your consent)

If you accept the analytics notice, in the app or on this website, we record in our own database which screens and features you use (for example, generating, viewing or saving a plan, or ticking off the grocery list), what you choose when you build each plan (store, days, meals, budget, people, appliances and diet type) and technical errors by category. Each record carries a random session identifier and, if you have an account, is linked to it.

We do not record your allergies, your Diet Mode data or calorie target, what you type, or which specific products or recipes you pick. We do not use advertising identifiers or device fingerprinting, and we do not send analytics to any third-party analytics provider. If you do not accept, or you withdraw, the analytics record nothing about your use and everything works the same. If you arrive from a campaign link, we store which campaign only with analytics accepted.

Separately from analytics, we count in aggregate how many times a day some features are used (for example, generating a plan or sharing a list) per store and per platform (iPhone, Android or web). Those counters do not say who did it and store nothing on your device.

You can change your choice at any time in Settings → Privacy in the app, or with on this website. Usage events are kept for at most 15 months (90 days if you accepted an earlier notice); afterwards only aggregate counts without identifiers remain.

5. Why we use your information

  • To build and save your meal plans and grocery lists.
  • To authenticate your account and keep your session secure.
  • To tell whether you have access to CestaChef Premium, because you bought it or because our team granted it.
  • To send the weekly reminders you turned on, and the service emails you request (sign-in links, welcome, notices).
  • To answer your messages and to keep the service secure and prevent abuse.
  • With your consent, to understand how the app is used and improve it.
  • If you entered a creator code, to calculate the creator’s commission on your first purchase.

6. We do not sell or share your information; service providers

We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA/CPRA. For that reason there is no “Do Not Sell or Share My Personal Information” link. We do not use or disclose sensitive personal information for purposes other than providing the service you asked for. Because we do not sell or share, there is nothing to opt out of; if that changes we will update this policy first and give you the choices the law requires.

Service providers process information on our behalf and may only use it to provide their services to us:

  • Supabase: authentication, database, photo storage and our usage event log. Hosted in the European Union (Ireland).
  • Google and Apple sign-in: if you choose them, we receive your name and email address.
  • Apple (App Store) and Google (Google Play): they charge and manage subscriptions and tell us their status. Their own privacy policies apply to the payment.
  • Firebase Cloud Messaging (Google): only to deliver the notifications you turn on.
  • Resend: sends our emails (your address and the content of the email).
  • Vercel: hosts this website and sees technical data such as IP addresses.
  • Formspree: the contact form (name, email and message).
  • Stores, supermarkets and brands, and content creators: they receive no personal information about you, only aggregate figures that identify no one. If you tap an affiliate link you leave CestaChef for the store’s website, which has its own privacy policy.

Because our database is in the European Union, your information is transferred from the United States to the EU (and some providers above process it in the United States). We may also disclose information when the law requires it or to protect our rights, and to a successor if the business is transferred, in which case this policy would continue to apply to the information.

7. Your rights

Depending on where you live (including California, Washington, Nevada and other states with privacy laws), you may have the right to:

  • know and access the personal information we hold about you, and receive a copy in a portable format;
  • request deletion of your personal information, including your consumer health data;
  • request correction of inaccurate personal information;
  • withdraw consent you gave (for analytics or for Diet Mode) at any time;
  • opt out of the sale or sharing of your information and of targeted advertising or profiling (we do none of these);
  • limit the use of sensitive personal information (we do not use it beyond providing the service);
  • not be treated differently for exercising these rights.

The quickest way is in the app: Profile → My goal (withdraw consent and delete health data), Settings → Export my data, and Settings → Delete account. You can also email info@cestachef.es. We may need to verify your identity before acting, and you may use an authorized agent. We aim to respond within 45 days, and may extend it once when the law allows, telling you why. If we deny your request you may appeal by replying to our answer, and you may contact your state attorney general if you disagree with the outcome. We do not charge for exercising your rights.

Categories (CCPA/CPRA). In the last 12 months we collected identifiers (name, email, random identifiers), commercial information (subscription records), internet or app activity (analytics, only with consent), approximate technical data (IP address processed by our hosting provider) and sensitive personal information (consumer health data, only if you turn on Diet Mode; account login credentials). We collect them from you and from the sign-in and store providers you use, for the purposes in section 5, and we disclosed them only to the service providers in section 6.

8. Retention and deleting your account

We keep your information while your account is active. You can delete your account and your data in Settings, or by emailing us. Deleting the account removes your profile, weight history, saved plans, lists and recipes, push token and the usage analytics tied to your account; any creator code link and any access we granted are also removed. Only aggregate counts without identifiers, and the economic record of purchases without anything that identifies you (date, plan, amount and country), are kept for as long as accounting and tax obligations require.

Deleting your CestaChef account does not cancel your subscription. You must cancel it in the App Store or Google Play.

If you joined the waitlist, your email is deleted 30 days after you unsubscribe, or sooner if you ask.

9. Cookies and local storage

CestaChef does not use tracking or advertising cookies, and does not respond to a “do not track” signal because it does not track you across other sites. Your session and your preferences live in your browser’s or app’s local storage. With analytics accepted, we also store random session and consent identifiers there. You can clear it at any time in your browser or device settings.

10. Children

CestaChef is not directed to children under 13 and we do not knowingly collect personal information from them. If you are under 13, do not use the app or give us any information. If you think a child under 13 has given us information, email us and we will delete it. Diet Mode is for adults aged 18 or over. We do not knowingly sell or share the personal information of anyone under 16.

11. Security and changes

We use reasonable technical and organizational measures to protect your information, but no system is completely secure. If we change this policy in a relevant way we will tell you by email or in the app, and we will update the date above. We will ask for your consent again if a change requires it. Contact: info@cestachef.es.