What we keep, and why

Last updated October 18, 2026

The Salt and Pepper is a small, invite-only tool for planning and cooking multi-course meals. We collect only what the app needs to work. We don’t sell your data, show ads, or use analytics or tracking scripts.

What we collect

Your account: your name and email address. If you sign in with Google, we also store the account ID Google gives us so we can recognize you next time. We never see your Google password.
What you create: meals, dishes, recipes, tasks, shopping lists, pantry items, notes, and any photos you upload.
People you add: names, email addresses, and dietary needs (such as allergies) for guests and helpers you add to your contacts or meals. Please only add details the people involved would be comfortable sharing with you.
RSVPs: if you answer an invitation through a guest link, we pass your name, party size, and dietary notes to the host.
Basic server logs: IP address, browser, and pages requested. We use these to keep the service secure and to limit repeated sign-in attempts.

How we use it

Only to run the app: to sign you in, show you your meals, build shopping lists and schedules, flag dietary conflicts, and send the emails you ask for (sign-in links, co-host invitations, and RSVP notifications).

Who can see it

Your meals are private to you and anyone you invite as a co-host.
Sharing links work without an account. A helper link shows that meal’s tasks, and a guest link shows the menu. Anyone who has the link can open it, so share links only with the people they’re meant for. If a link reaches the wrong person, contact us and we’ll turn it off.

Services we use

A few providers handle data on our behalf, only as needed for these features:

Amazon Web Services: hosting and database storage, in the United States.
Mailgun: delivers the emails the app sends.
OpenAI: when you import a recipe or ask for drink pairings, we send the recipe text or page, or the meal’s dish names, courses, ingredients, and dietary tags. We don’t send guest names or contact details.
Google: only if you choose to sign in with Google. We request your name, email address, and account ID, and use them only to sign you in.

Cookies and storage

We use only the cookies needed to keep you signed in. Your browser also stores a few things on your device, such as unsaved dish drafts and running kitchen timers, so they survive a page reload. None of it is used for tracking.

Keeping and deleting your data

We keep your data for as long as you have an account. Sign-in links expire after 15 minutes. You can delete meals, dishes, contacts, and pantry items in the app. To get a copy of your data or to have your account and everything in it deleted, contact us and we’ll take care of it.

Security

All traffic is encrypted with HTTPS. Accounts sign in with an email link or Google, so there’s no password of yours for us to store or lose. No system is perfectly secure, but we keep the service updated and collect as little as we can.

Changes and contact

If this policy changes, we’ll update the date at the top. For questions or requests, contact the person who invited you.