Privacy Policy

DRAFT - needs legal review. This is a working draft, not final legal text. It must be reviewed by a qualified attorney before Shop with MiMi opens to the public. Highlighted items in [brackets] are placeholders.

Last updated: [date]

Who we are

Shop with MiMi ("we", "us") is a meal-planning website at shopwithmimi.com, operated by [owner's legal name, or company name once formed], [mailing address], Texas, USA. Contact: [privacy@shopwithmimi.com].

What we collect

• Account: your email address and a password. We store only a one-way hash of your password (bcrypt), never the password itself.
• Profile and health-related information you enter: age, sex, height, weight and goal weight, weigh-ins, activity level, goals, pregnancy/breastfeeding status (yes/no), pain or soreness you tell MiMi about, dietary preferences, food allergies and dislikes.
• Household information you enter: nicknames, ages, diets and allergies of the other adults and children you shop for. Please only add people you're allowed to share this about (for example, your own children).
• Shopping information: ZIP code, chosen store, weekly budget, pickup or delivery preference, meal plans, grocery lists and your quality-tier choice.
• Chats with MiMi: messages you send to the MiMi coach and her replies. [If AI replies are turned on: messages are sent to our AI provider, [provider name], to generate replies. Counsel: confirm provider terms on data retention and training.]
• Kroger connection (optional): if you choose "Send to my Kroger cart", Kroger gives us access tokens limited to adding items to your cart and reading product data (scopes cart.basic:write and product.compact). We never see your Kroger password or payment details and cannot place orders or check out for you.
• Technical data: a sign-in cookie, a security (CSRF) cookie, and standard server logs (IP address, browser type, timestamps).

How we use it

• To estimate calorie and nutrition targets, create meal plans and grocery lists, and suggest movement routines.
• To find nearby stores, look up products and prices, and add the items you choose to your Kroger cart when you ask.
• To send account emails you ask for, such as password-reset links.
• To keep the service secure and working. We do not sell your personal information, and we do not use your health information for advertising.

Where it is stored and how it is protected

Your account and app data are stored in a PostgreSQL database run by our hosting provider, [Sevalla (Kinsta Inc.)], in [data-center region]. Connections use HTTPS. Sign-in cookies are HTTP-only and HTTPS-only. Kroger access and refresh tokens are encrypted (AES-256-GCM) before they are saved. Passwords are hashed with bcrypt. Login attempts are rate-limited.

Sharing

• Kroger: when you search stores we send your ZIP code; when pricing your list we send product search terms and the store ID; when you send items to your cart we send product UPCs, quantities and your pickup/delivery choice, using your authorization. Kroger's own privacy policy applies to your Kroger account.
• Service providers that run the service for us under contract: hosting and database ([Sevalla / Kinsta]), email delivery ([Resend]), and [AI provider, if enabled].
• When required by law, or to protect the safety of our users.

Instacart integration is not live. If it is added, this policy will be updated before any data is shared with Instacart.

Health information

Shop with MiMi provides general nutrition guidance, not medical advice. The health-related information you enter may be considered sensitive under laws such as the Texas Data Privacy and Security Act, the Washington My Health My Data Act and other state privacy laws. We collect it only to provide the features you ask for, and you can delete it at any time. [Counsel: confirm consent flow, state-law obligations, and whether the FTC Health Breach Notification Rule applies.]

Food allergies

We use the allergies you enter to leave matching recipes and products out of your plan, but product data can be incomplete or change. Always read the label before buying or eating. See the allergy disclaimer in our Terms.

Kroger data

Store, product, price and availability information is provided by The Kroger Co. through its public developer APIs and may change at the store. Shop with MiMi is not affiliated with, sponsored by or endorsed by Kroger. [Counsel: confirm attribution wording required by the Kroger Developer Terms.]

Your choices and rights

• Delete your account any time: sign in, choose Delete account at the top of the app, and confirm with your password. This permanently deletes your account, profile, household, plans, MiMi chats and progress, and our stored Kroger tokens. To also remove Shop with MiMi's access on Kroger's side, disconnect it in your Kroger account settings.
• Depending on where you live (including Texas), you may have rights to access, correct, delete or get a copy of your data, and to appeal our decision. Contact [privacy@shopwithmimi.com]. We will respond within [45] days.

Children

Accounts are for adults 18 and older. We do not knowingly let children create accounts. Information about children in your household is provided by you, the adult, to plan family meals. [Counsel: review COPPA and state-law considerations for household data about minors.]

Retention

We keep your data while your account is open and delete it when you delete your account. Server logs are kept for [30 days]. Database backups made by our host are kept for [up to N days] and then overwritten.

Changes

We will post updates here and, for material changes, tell you in the app or by email before they take effect.

Terms of Use (draft) · ← Back to Shop with MiMi