Privacy Policy

Effective July 25, 2026

NoshUp is a Canadian meal planning service. This policy explains what we collect, why, who processes it on our behalf, and how to exercise your rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

• Account information — your email address, display name, and a hashed password.
• Household composition— the number of adults and children, and a general age range for children, used to tailor meal suggestions. We never collect children's names, birthdates, or individual ages.
• Dietary preferences and restrictions — including allergy and health-related restrictions you choose to enter, so plans avoid foods you can't eat.
• Meal plans, grocery lists, and pantry items you create in the app.
• Receipt images and the line items parsed from them when you upload a receipt.
• Store and postal-code preferences used to match local flyer deals.
• Support and contact messages you send us, including the email address you supply.

Why we collect it

We use this information to generate meal plans, build grocery lists, track grocery spending, match flyer deals near you, and answer your support requests. We do not sell your personal information, and we do not use it for advertising or to train third-party models.

Usage measurement

To understand which features actually help households, we record first-party product events such as “a meal plan was generated” or “a receipt was scanned”. These records never contain your name, email address, receipt contents, or any other personal detail: your account and household are replaced with a one-way, keyed code that we cannot reverse into your identity. They are stored with our application logs in Canada and deleted after 90 days, are used only to improve NoshUp, and are never sold or used for advertising. This first-party product analytics is separate from the Google Analytics service described below.

Service providers

We share the minimum data needed with providers who process it on our behalf:

• Microsoft Azure — hosting, database, and storage of receipt images, plus the document processing service that reads uploaded receipts.
• Resend — transactional email such as password resets and support notifications.
• Stripe — payment processing, only if and when you start a paid plan. We never receive or store your full card number.
• Google Analytics (Google LLC) — usage measurement and campaign attribution. Google Analytics records pageviews, general usage patterns, and which source, medium, or campaign brought you to the site. This is separate from the first-party product analytics described above: Google Analytics does not receive your name, email address, receipt contents, or other account details.

These providers, including Google, may process or store data outside Canada, which means it can be subject to the laws of the country where it is held.

Safeguards

Data is transmitted over TLS. Passwords are stored hashed, never in plain text. Access to meal plans, grocery lists, and receipts is scoped to your household, and receipt images are kept in access-controlled cloud storage that is served through short-lived, expiring links rather than public URLs.

Retention

Your account data, meal plans, grocery lists, and parsed receipt line items are kept while your account is active, and are deleted when you ask us to delete your account. Receipt images themselves are deleted automatically on a rolling schedule after they have been processed — the parsed totals remain so your spending history stays intact. Support and contact messages are deleted within 90 days. Security audit logs are kept for one year.

Your rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, withdraw your consent, or ask us to delete your account and its data. Email [email protected] and we will respond within 30 days. During early access these requests are handled manually by a person rather than through a button in the app.

Contact

Questions or complaints about privacy go to [email protected], which reaches the person accountable for privacy at NoshUp. If we change this policy, we will post the change here and update the effective date above.