Tablespread Privacy Policy

Last Updated: October 11, 2026 • Effective Date: October 11, 2026

September 5, 2026 — changes to this Policy. This Policy has been updated in five material respects: (a) account deletion is now immediate and available inside the Service, so §§6 and 7.2 have been rewritten — the previous 30-day active-deletion and 90-day backup-purge commitments no longer describe how the Service works and have been replaced with the shorter, accurate periods; (b) one record, your consent record, is now expressly identified as being retained after deletion, together with what it holds and why; (c) the Service now includes the Tablespread Android application; (d) §7.1 has been rewritten to separate two things the previous version blurred together — a Recipe Book, which is a paid product feature that produces a file you download, and a request for the personal data we hold about you, which is a legal right and is always free; and (e) §2 now discloses three categories that were previously undisclosed: diagnostic crash reports (§2.5), the information collected from people who request access to the Service (§2.7), and how Recipe Book download links work (§2.8).

Plain-Language Summary

Before the legal detail, here is the short version. If anything here conflicts with the full policy below, the full policy controls.

• What Tablespread is: a menu-planning app, on the web and on Android. You capture recipes, plan meals, build shopping lists, keep a pantry, and share it all within your household.
• What we collect: your account info (via Google Sign-In); the recipes, meal plans, shopping lists, and pantry items you create; food allergies and dietary preferences you record for yourself and for named household members; barcodes you scan; who is in your household; and subscription/billing status. Plus basic usage data like device and IP address.
• What our AI sees: to generate recipes, parse recipes from photos/links, build lists, and estimate nutrition, we send the relevant inputs (e.g., your request, the recipe text or image, your dislikes/allergies/dietary settings) to Anthropic, our AI provider, which processes them and returns a result.
• Allergy and dietary data: food-allergy information tied to a named person may be treated as sensitive “consumer health data” in some states. We handle it accordingly, do not sell it, and do not use it for advertising.
• What we don’t do: we don’t sell your personal information, we don’t use it for advertising or marketing profiling, and we don’t use your individual content to train AI models for advertising purposes.
• Payments: Stripe processes payments. Tablespread does not store your full card number — Stripe does.
• Your rights: you can access, correct, and delete your data. There is no per-recipe download or print in the app — the way to take recipes out is a Recipe Book, which is a product feature. Separately from that, and whatever plan you are on, you can always email us and we will send you a copy of the personal data we hold about you, free (§7.1). Depending on your state or country, you may have additional rights (CCPA/CPRA, Washington/Nevada/Connecticut health-data laws, GDPR).
• Deleting your data: you can do it yourself, in the app, and it happens immediately — usually within seconds. Encrypted disaster-recovery backups rotate and are purged within 7 days. Your consent record survives on purpose (see §6), and Stripe’s payment records are not ours to delete. Full detail at tablespread-app.web.app/delete-account/.
• Who we are: SanctumTools LLC, High Point, NC. Questions: support@sanctumtools.com.

1. Who We Are

SanctumTools LLC (“SanctumTools,” “Tablespread,” “we,” “us,” or “our”) provides Tablespread, a menu-planning and household food-management application — available as a web application and as an Android application — and related services (the “Service”). By using the Service, you agree to the collection and use of information as described in this Privacy Policy. Capitalized terms not defined here have the meaning given in the Tablespread Terms of Service.

Contact: SanctumTools LLC, 413 Cable Street, High Point, NC 27260 · support@sanctumtools.com (support and account requests) · melanie@sanctumtools.com (legal notices) · (336) 695-7270

2. What Data We Collect

2.1 Account Information

When you create an account or join a Household, we collect: - Name and email address (typically via Google Sign-In / Firebase Authentication); - Authentication identifiers managed by Firebase; - Account creation date and your Household role (Owner / Member; planner, shopper, view-only, or staff).

2.2 Content You Create (“Service Content”)

Data you enter, capture, or generate in the Service, including: - Recipes you capture by photo/screenshot, link (URL), or typed text, and the parsed/structured versions of them; - Recipes and meal plans generated by the AI “Sous Chef”; - Your recipe library and per-recipe metadata (favorites, family-favorite tags, times cooked, last-made and date-added labels, like/dislike signals); - Weekly menus and meal plans; - Shopping lists and check-off status; - Pantry items (added by barcode scan, by checking items off your shopping list, or by manual entry), including optional light quantity/weight for fresh items; - Food dislikes and dietary preferences/goals (e.g., vegetarian, vegan, low-sodium, heart-healthy); - Notes and other content you enter; - Recipe Books you create (the recipes you selected and the name you gave the Book — we do not keep the finished file).

2.3 Household-Member Allergy and Dietary Data — Sensitive

The Service lets you record food allergies and dietary needs for yourself and for named members of your Household (for example, that a specific member is allergic to milk). We treat food-allergy information tied to an identifiable person as sensitive data and handle it as described in Sections 4 and 5. You should only enter another person’s allergy or dietary information if you have the authority or consent to do so (see Section 9).

2.4 Barcode Data

When you scan a product barcode to populate your pantry, the barcode is decoded on your own device and the resulting UPC is looked up against the Open Food Facts product database to identify the item. The camera image itself is not transmitted to us or to any third party — only the decoded UPC leaves your device. The Service does not currently build a spend-history or purchase-history profile of your household; if that changes, we will update this Policy.

2.5 Usage and Diagnostic Data

Automatically collected when you use the Service: - Device type and operating system; - Browser type and version; - IP address (for security, abuse detection, and session management — not for advertising or cross-site tracking); - Features accessed, and time/date of access; - Per-account usage counters, which record how many AI generations your account and Household have used in a given day or week, so that plan allowances and the limits in §8.2 of the Terms of Service can be enforced.

Crash and error reports. When something in the app fails, the app may send us a diagnostic report. It contains the error message, a stack trace, an internal label for where in the app the failure happened, the page address you were on, your browser’s user-agent string, the version of the app you were running and the version of our server, your household identifier, and — so we can tell whose session broke — your account identifier and email address. These reports are not designed to include, and we do not intentionally collect in them, your recipes, menus, pantry contents, or allergy information. The message and stack fields are free-form technical text produced by the software, and we truncate them, so we cannot promise absolutely that no fragment of content ever appears in one. Reports are rate-limited per account per day, are used only to find and fix faults, and are deleted with your account.

Analytics on our public pages. Our public marketing pages at tablespread.melaniekertley.com — including the copies of this Policy and of the Terms of Service served there — load Cloudflare Web Analytics, a cookieless measurement tool. It reports aggregate page views, referring site, approximate country, and browser/device type. It sets no cookies, stores nothing on your device, does not fingerprint your browser, and does not track you across other sites or build an advertising profile. Requesting the measurement script does disclose your IP address to Cloudflare, which uses it to derive approximate country and handles it under its own privacy terms; what is reported to us is aggregate and does not identify you. The Tablespread application itself — everything behind sign-in — loads no third-party analytics or advertising trackers.

2.6 Payment Information

If you buy anything from us on the web — a Subscription, or a one-time purchase such as a Recipe Book: - Payment processing is handled by Stripe. - We do not store your full credit/debit card number, CVV, or other full payment-card data — Stripe does, under its own terms and PCI-DSS obligations. - We retain billing status, subscription tier, renewal dates, whether a cancellation is scheduled, which one-time purchases a Household has made, and a Stripe customer/subscription identifier. - The Tablespread Android application does not offer purchases and collects no payment information. If purchases are offered there in future, Google Play’s billing system will process them and Google will handle that payment data under its own policies.

2.7 Access Requests (people who are not yet users)

Access to the Service is sometimes limited to invited users. If the Service is invite-only when you sign in, and you are not on the access list, we show you a waitlist screen and you may ask for access. If you do, we record your email address (which we also use as the identifier for the request), your account identifier, an optional note of up to 500 characters that you write, and the date. We use it only to decide whether to admit you and to contact you about it. We do not use it for marketing and we do not share it.

An access request is made before you have accepted these documents at the in-app consent screen, so we are telling you here: if you would rather we did not keep it, email support@sanctumtools.com and we will delete it. It is also deleted automatically if you later create an account and then delete that account.

2.8 Recipe Book links

When you make a Recipe Book, we give you a web link to download the file. That link carries its own access code, which means it works for anyone who has it, without signing in, and it stops working fifteen minutes after it is issued. We do this so a download works the same way on a phone, a laptop, and in the Android app. Two things follow, and we would rather say them than not: treat the link like the book itself — anyone you forward it to while it is live can open it — and be aware that a link you open in a browser is recorded in that browser's history. The finished file is not kept on our servers, and the link is not indexed by search engines. Making the Book again gives you a fresh link.

3. How We Use Your Data

We use the data we collect to: - Provide the Service — store and display your recipes, menus, lists, pantry, and household data back to you and your Household; - Power the AI Features — process your inputs to generate recipes/meal plans, parse captured recipes, consolidate shopping lists, estimate nutrition, and assist with allergen/dietary filtering; - Learn your household’s tastes — use your in-app signals (such as made/liked/disliked), together with your pantry contents, spice rack, and dietary settings, to make suggestions more relevant to your Household; - Process payments and manage subscriptions — via Stripe; - Communicate with you — service updates, security and billing notices, and support responses (and, with your consent where required, product news you can opt out of); - Maintain and improve the Service — using aggregated and de-identified usage data; - Protect the Service — detect and prevent abuse, fraud, and violations of our Terms; - Comply with law.

We do not sell your personal information, use your content for third-party advertising or marketing profiling, or use your individual Service Content to train AI models for advertising purposes. (On AI-model training generally, see Section 4.3.)

4. How We Share Your Data

4.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under applicable law.

4.2 Service Providers (Processors)

We share data with trusted third-party providers who help operate the Service, only as needed to provide it and under obligations to protect it:

Tablespread does not use a third-party email marketing or transactional email provider. Any account or notice emails are sent through Google (Firebase Authentication / Google Workspace).

4.3 AI Processing — Anthropic

Important disclosure: when you use the AI Features, the relevant inputs are transmitted to Anthropic, Inc. for processing under Anthropic’s commercial API terms, and Anthropic returns the result. We encourage you to review Anthropic’s privacy policy.

Under Anthropic’s standard commercial API terms, the inputs and outputs we transmit are not used to train Anthropic’s models. Anthropic may retain data for a limited period to operate and secure its service, and may retain data flagged by its trust-and-safety systems for longer, as permitted by its commercial terms.

What is transmitted: only the inputs needed for the specific AI task — for example, the recipe text or image you are parsing, your generation request, and the dislikes/dietary/allergen settings that the AI must honor to avoid suggesting an excluded ingredient. We do not transmit your payment or billing information — such as card data or Stripe customer identifiers — to Anthropic.

Note on third-party retention: a deletion request to us removes your data from our systems but does not automatically delete data already processed by Anthropic, which is subject to Anthropic’s own retention schedules.

4.4 Legal Requirements

We may disclose information if required by law, court order, or government authority, or if we believe in good faith it is necessary to comply with a legal obligation, protect the rights or safety of SanctumTools, our users, or the public, or investigate fraud or security issues.

4.5 Business Transfers

If SanctumTools is involved in a merger, acquisition, or sale of assets, your data may transfer as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.

5. How We Protect Your Data

5.1 Security Measures

We implement industry-standard safeguards, including: - Encryption in transit (HTTPS/TLS); - Encryption at rest via Firebase/Firestore; - Access controls limiting internal access to user data; - Firebase Authentication for secure login; - Household-scoped access controls so a Household’s data is visible only to its Members per their roles.

5.2 Sensitive Data Handling

We recognize that food-allergy data tied to a named person can be sensitive. We do not display your Household’s allergy/dietary data to anyone outside your Household, do not use it for advertising or profiling, and do not sell it.

5.3 Limitations

No internet transmission or storage is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security, and you use the Service at your own risk regarding data security.

5.4 Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users in accordance with applicable state and federal law, without unreasonable delay and within any timeframe required by the relevant statute. Notice may be provided by email to your registered address or by prominent in-Service notice.

5.5 Not HIPAA Covered

SanctumTools is not a healthcare provider, health plan, or healthcare clearinghouse, is not a HIPAA “covered entity,” and is not subject to HIPAA. We nonetheless apply strong security practices to the data we hold.

6. Data Retention and Deletion

Deletion in Tablespread is immediate, not scheduled. When you delete your account, the deletion runs while you wait — usually in seconds, and up to a few minutes for a very large recipe library — and your account data and Household content are removed from our live database the moment it finishes. We do not hold it for a waiting period, and there is no undo. The exceptions, which are few and named, are listed below.

• Account data and Service Content (recipes, menus, shopping lists, pantry, spice rack, appliances, household-member allergy and dietary data, invitations you had sent, and your sign-in): retained while your account and Household are active. What is deleted depends on who you are in the Household — see §7.2, which explains the difference between leaving a Household and deleting one.
• Backup systems: we keep encrypted daily backups of our database for disaster recovery, with a retention period of seven (7) days, and point-in-time recovery covering the same seven days. A deleted account may therefore persist in those backups for up to seven days, after which it is purged. Backups are not readable by the application and are never used to restore a deleted account.
• Usage counters: the per-day and per-week counters that enforce plan allowances and anti-abuse limits are retained while your account is active and are deleted with it.
• Crash and error reports (§2.5) and access requests (§2.7): retained while your account is active and deleted with it.
• Recipe Books: we keep the Book’s definition — the recipes you chose and the name you gave it — while your account is active, so you can make the Book again. It is deleted with your Household. We never keep the finished file, and the download link stops working shortly after it is issued (§2.8).
• Server logs: operational logs generated by our hosting provider, Google Cloud, which may include IP addresses and request metadata, are retained for 30 days. A separate administrative audit log, which records operations performed on our infrastructure rather than your household content, is retained by Google for 400 days under a setting Google does not permit us to shorten.
• Your consent record — deliberately retained. We keep a short record of which version of these Terms and this Privacy Policy you accepted, which allergy-safety acknowledgment you confirmed, when (by our server’s clock), the identifier of the Household the acceptance was given in, and the email address your account was verified under. It contains no recipes, no menus, no pantry contents, and no household health information. We keep it after deletion because it is the record whose entire purpose is to outlive the relationship: it is how either of us can later show what was agreed and by whom, and the email address is what makes it evidence of a person rather than of an account number that no longer resolves to anyone. We keep it for as long as a claim about that agreement could be brought, and no longer. See §7.2.
• Payment records: held by Stripe under its own retention rules and the record-keeping the law requires of it — typically up to 7 years. We never see or store your card number, and deleting your Tablespread account does not delete Stripe’s records.
• Third-party data: a deletion request to us applies to data in our systems. Data already processed by Anthropic, Google Firebase, Stripe, or another provider is subject to that provider’s own retention schedule and is not deleted by your request to us. Neither Anthropic nor Google is permitted to use your data to train their models.

7. Your Rights and Choices

7.1 Access, Correction, and Portability

You may view and correct the personal data we hold about you directly in the Service — your household members, their allergies and dietary preferences, your recipes, pantry, and settings are all editable in the app.

Two different things are described here, and they are not the same.

A Recipe Book is a product feature. The Service can assemble recipes you select into a formatted book file you download and keep (see §10.5 of the Terms). It is priced — included with a Subscription, and a one-time charge on the Free plan. There is no other download, PDF, or print in the app, and no per-recipe export.

A request for your personal data is a legal right, and it is always free. Whatever plan you are on, you may email support@sanctumtools.com with the subject “Data Access Request” from the address on your account, and we will compile the personal data we hold about you and send it to you in a portable, machine-readable format within the period applicable law allows. We will not charge you for this, refuse it, or give you a worse service for asking. Please keep it in mind before you delete your account: deletion is immediate and cannot be undone.

7.2 Deletion

You can delete your account yourself, from inside the Service, and it takes effect immediately. Open the Service, tap the monogram in the top-right corner to open Your household, scroll to Your account, and follow the instructions there. The app tells you, before you confirm, which of three cases applies to you, because deletion means something different in each:

• You are a Member of someone else’s Household. Your membership and your sign-in are deleted, along with the personal records described below. The Household’s contents are not deleted — its recipes, menus, shopping lists, pantry, and the allergy and dietary entries it holds (including any that describe you by name) belong to that Household and remain with it. If you want an entry about you removed, ask the Household’s Owner to delete it, or email us.
• You are the Owner and the only person in your Household. The Household is deleted with you: every recipe, menu, shopping list, your pantry, spice rack, appliances, household-member allergy and dietary entries, and any invitations you had sent. Your sign-in goes last.
• You are the Owner and others are still in the Household. We refuse, because deleting would take other people’s data with it. Each of the others can leave from Your account on their own device; once you are the only one left, deletion goes through.

In every case we also delete your personal records held outside the Household: your usage counters, your crash reports, any access request you made, and any invitations addressed to your email address. A step-by-step description is published at tablespread-app.web.app/delete-account/.

If you cannot get into the app — a lost device, a sign-in that will not work — email support@sanctumtools.com with the subject “Data Deletion Request”, from the email address on the account. We verify that the request comes from the account holder before deleting anything, which may mean one reply from us asking a question only you can answer, and then we run the same deletion the button runs. Emailed requests are processed within 30 days and usually far sooner.

What survives either route. Your consent record — which includes the email address your account was verified under, and which we keep as proof of what was agreed and by whom (see §6) — and Stripe’s payment records, which Stripe holds under its own legal retention obligations and which are not ours to delete. There is no undo, and we cannot restore a deleted account.

To remove a specific household member’s information (for example, one person’s allergy entry) without closing your entire account, the account holder can edit or delete that information directly in the app, or email the same address to request its removal. This applies to information about a named person who does not have their own account.

If you have an active Subscription, we cancel it before deleting anything. If the cancellation cannot be completed, nothing is deleted and we tell you so. Note that deleting forfeits the remainder of a paid period — if you want to stop paying but keep your library until the period ends, cancel instead (see §8.4 of the Terms).

7.3 Communication Preferences

You may opt out of non-essential communications (product news) anytime via the unsubscribe link or by emailing us. You cannot opt out of essential service communications (security, billing, and account notices).

7.4 California Residents — CCPA/CPRA

If you are a California resident, you have the right to: know the categories and specific pieces of personal information we collect, use, and disclose; delete your personal information; correct inaccurate personal information; opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising); limit the use and disclosure of sensitive personal information; and not be discriminated against for exercising these rights. To exercise these rights, contact support@sanctumtools.com.

Categories collected/disclosed: See Section 2 (categories collected) and Section 4.2 (categories disclosed to service providers). We disclose the categories in Section 2 to the service providers in Section 4.2 for the business purposes in Section 3. We do not sell or “share” personal information.

7.5 Washington, Nevada, and Connecticut Residents — Consumer Health Data

If you are a resident of Washington State, Nevada, or Connecticut, state consumer-health-data laws may give you additional rights regarding health-related information, which may include the food-allergy information you or your Household records. These may include the right to confirm whether we collect your consumer health data, access it, delete it, withdraw consent to its collection and sharing, and appeal a denied request. To exercise these rights, contact support@sanctumtools.com with subject “Consumer Health Data Request.”

7.6 Do Not Track / Global Privacy Control

Tablespread does not sell or share your personal information and does not engage in cross-site tracking for advertising. Because there is no sale or sharing of personal data to opt out of, the Service does not process browser Do Not Track (DNT) or Global Privacy Control (GPC) signals. If we ever introduce any practice that would constitute a “sale” or “share” under applicable law, we will update this Policy and honor opt-out preference signals as required.

7.7 International Users

The Service is operated in the United States. If you access it from outside the US, your data will be transferred to and processed in the US, and you consent to that transfer. If you are in the EU/UK or another jurisdiction with comprehensive data-protection law, additional rights may apply (access, rectification, erasure, restriction, portability, objection); contact us to exercise them.

8. Cookies and Tracking

Tablespread uses limited cookies and similar technologies to maintain your login session, remember preferences, and analyze aggregate, de-identified usage. We do not use tracking cookies for advertising or third-party marketing. You can control cookies via your browser, but disabling them may affect functionality. Our public marketing pages also load a cookieless analytics tool that sets no cookies and stores nothing on your device; see Section 2.5.

9. Children’s Privacy and Household Minors

Tablespread accounts may only be created by, and are intended for, adults 18 and older. Minors do not create accounts or log in to the Service. We do not knowingly collect personal information directly from children.

The Household feature does, however, allow an adult Owner or Member to store information about other people in the household — including a minor’s name, food allergies, and dietary needs — within the adult’s own account. That information is entered and managed by the adult, not by the minor.

• Minors may not create an account or hold a login.
• If an adult enters a household member’s information (including a minor’s allergy or dietary data), the adult is responsible for that information and confirms that they have the authority to provide it.
• We do not knowingly allow a child under 13 to create an account. If we learn we have collected account information directly from a child under 13, we will delete it.

To be clear about the two ages mentioned here: our own rule is that account holders must be 18 or older. The references to age 13 reflect the additional minimum set by federal law (the Children’s Online Privacy Protection Act, “COPPA”), which we also honor.

10. Changes to This Privacy Policy

We may update this Policy. We will notify you of material changes by posting the updated Policy with a new “Last Updated” date and, for material changes, by email and/or in-Service notice. For non-material changes, continued use after posting constitutes acceptance. For material changes affecting how we collect, use, or share your sensitive or consumer-health data, we will seek your affirmative consent or provide a clear opportunity to decline before the change applies to you.

11. How to Contact Us

For privacy questions or data requests:

SanctumTools LLC 413 Cable Street High Point, NC 27260 Email: support@sanctumtools.com (support and account requests; subject line “PRIVACY POLICY” or the specific request type) · melanie@sanctumtools.com (legal notices) Phone: (336) 695-7270

We aim to respond to privacy inquiries within 30 days.

— END OF PRIVACY POLICY —