Mirabelly Privacy Policy

Not legal advice. This document is a product/engineering draft of a Privacy Policy, not legal advice, and it does not replace review by qualified counsel. Clauses that turn on a legal judgment — international data transfers, the data-subject access request (DSAR) process, and the treatment of a child’s data — are tagged [COUNSEL] and collected for a single review pass in §11 (Counsel-review checklist). Do not publish this policy until counsel has signed off on every [COUNSEL] item.

Last updated: draft — set on counsel sign-off. Applies to: the Mirabelly application (app.mirabelly.com), the public knowledge-base / nutrient-explorer site (mirabelly.com), and the weekly grocery-list email.

This Privacy Policy explains what personal data Mirabelly collects, how it is used, the third-party processors that handle it, how long it is kept, and the rights you have over it. It is a companion to the Terms of Service and the advisory disclaimer copy deck; Mirabelly is a planning aid, not medical advice, and that posture is described in those documents.

1. Data we collect

Mirabelly collects only the data needed to run a household grocery/nutrition planner. We group it below by source. Some of this data is sensitive — see the call-out after the table.

1.1 Account & identity

Data	Field / source	Why we have it
Account identifier	Auth0 `sub` (the stable subject id, stored as `User.subject`)	The primary key that links your account to your household data; it is how we recognize you across logins.
Email address	Auth0 profile (login email)	Account login, password reset, receipts, and the weekly list email. We never use it as an analytics identifier (see §4).

Authentication (passwords, social login, multi-factor) is handled by Auth0; Mirabelly does not store your password. We store no other identity profile fields beyond the sub and email.

1.2 Household & member profiles

You create a household and add the people in it. For each household member (Person) we store what the nutrition solver needs:

Name (a label you choose; it can be a nickname).
Age — age_years for adults/children, and for infants under one year an age_months value (0–11). A child’s age is therefore data we collect.
Sex (sex) — biological sex, used to select the correct nutrient reference values (RDAs). A child’s sex is therefore data we collect.
Pregnancy / lactation status (pregnancy_lactation), where applicable.
Body metrics — height (height_cm) and weight (weight_kg).
Energy / macro goals — calorie_goal, carbs_pct, protein_pct, fat_pct, and any explicit protein_g_target.
Infant feeding inputs, where applicable — formula_ml_daily, breastmilk_ml_daily.

1.3 Dietary restrictions, allergens & preferences

For each member you may record dietary restrictions (PersonRestriction). Each entry is a kind + value + strength:

Allergens (kind = allergen) — e.g. peanut, milk, egg.
Diets (kind = diet) — e.g. vegan, vegetarian, halal, kosher.
Preferences (kind = preference) — specific ingredients to avoid.

These are sensitive categories. A dietary restriction can imply information about a person’s health (an allergy) or religious or philosophical beliefs (a faith-based or ethical diet). We treat this data with extra care: it is used only to filter your plans, is never used for advertising, and is never sent to our analytics processor (see §4). [COUNSEL] — confirm the lawful basis and any explicit-consent requirement for this category under GDPR Art. 9 (see §11).

1.4 Meal & grocery history

Generated grocery pools / lists, the items in them, and per-person nutrient-coverage snapshots persisted when you approve a list.
Meal tracking entries you log.
List lifecycle state (draft → approved → shopping) and ad-hoc shopping extras you add.

1.5 Payment data

Billing is handled by Stripe. Mirabelly stores only Stripe metadata — the Stripe customer id, subscription id, subscription status, and billing-period timestamps — needed to know whether your account is entitled.

Mirabelly never sees or stores your full card number, CVC, or bank details. Card data is collected and held by Stripe; it never touches Mirabelly’s servers.

1.6 Analytics & technical data

Product-analytics events (via PostHog) describing how you use the app — e.g. that a list was generated — keyed to your Auth0 sub, never your email and never your restriction values or child data (see §4).
Error reports (via Sentry) captured when the app or our servers hit an unexpected error. A crash report is a pseudonymized record: it carries the stack trace and technical context (what operation failed, where in the code, and browser/server details), but request bodies are dropped and a fixed list of sensitive keys — authorization tokens, cookies, email, names, dietary-restriction/allergen/diet values, and child-related fields such as age or date of birth — is stripped to [scrubbed] before the report leaves your device or our server. Only the web app’s (in-browser) crash reports are keyed to your Auth0 sub; server-side error reports are not keyed to your account and age out automatically under Sentry’s standard 90-day retention. Either way a report carries no email, no restriction values, and no child data (see §3, §4). [COUNSEL]
Standard technical data your browser sends (IP address, user-agent, approximate region) and cookies/local storage needed to keep you logged in.

2. How we use your data

We use the data above only to:

Provide the service — authenticate you, build your household model, run the nutrition solver, generate and store grocery/meal plans, and apply your dietary restrictions and allergens as best-effort filters.
Send transactional email — account email (sign-up, password reset) and the weekly grocery-list email you have opted into, each with the advisory disclaimer footer.
Bill you — manage your free trial, subscription, and payments through Stripe.
Improve the product — understand aggregate funnel and usage patterns through analytics, under the PII rules in §4.
Keep the service secure — detect abuse, debug, and protect accounts.

We do not use your data to make medical decisions, and Mirabelly does not provide medical advice. We do not sell your personal data (see §6). We do not use dietary restrictions, allergens, or any child’s data for advertising or analytics targeting.

3. Third-party processors

Mirabelly relies on the following sub-processors. Each receives only the data it needs for its role, under its own privacy policy. [COUNSEL] — confirm a Data Processing Agreement (DPA) is in place with each before launch and that this list stays current (see §11).

Processor	Role	Data it receives	Privacy policy
Auth0 (Okta)	Identity & authentication	Your email/login credentials; returns the `sub` identifier.	https://www.okta.com/privacy-policy/
Stripe	Payments & subscriptions	Your name, email, and card/payment details (entered directly with Stripe); returns customer/subscription ids and status.	https://stripe.com/privacy
Resend	Transactional email delivery	Your email address and the content of the email (e.g. your weekly grocery list).	https://resend.com/legal/privacy-policy
PostHog	Product analytics	Pseudonymized event data keyed to your Auth0 `sub`; no email, no dietary-restriction values, no child data (see §4).	https://posthog.com/privacy
Sentry	Error and crash reporting	Pseudonymized error reports; stack traces with request bodies and sensitive keys stripped; no email, no dietary-restriction values, no child data. Only the web app’s in-browser reports are keyed to your Auth0 `sub`; server-side reports are not keyed to your account and expire under Sentry’s standard 90-day retention (see §1.6). `[COUNSEL]`	https://sentry.io/privacy/

We also use our hosting/database provider to run the application and store your data. We will update this section if we add or change a processor.

Strictly necessary cookies / storage keep you logged in and the app working; these cannot be disabled while you use the app.
Product analytics (PostHog) record how the app is used. Where required by law (e.g. the EU/EEA/UK), analytics run only after you consent via a cookie banner, and you can withdraw consent at any time.
Error reporting (Sentry) is treated differently from analytics: it is not consent-gated and runs under our legitimate interest in keeping the service working and diagnosing crashes. It captures no behavioral analytics, and it scrubs personal and sensitive fields (see §1.6) before an error report leaves your device or our server. [COUNSEL]

Analytics PII rules (binding on the codebase):

We identify analytics events by your Auth0 sub, never by your email.
We never send the values of your dietary restrictions, allergens, or any child’s data into analytics — only non-identifying counts or booleans.
Analytics events carry no medical or health-outcome claims.

These rules mirror the analytics event taxonomy and the advisory posture in the disclaimer copy deck.

5. Data retention

Account, household, member, restriction, and history data is retained for as long as your account is active, so your plans persist between sessions.
When you delete your account (or ask us to), we delete or anonymize your personal data within a reasonable period, except where we must keep limited records for legal, tax, or fraud-prevention reasons (e.g. Stripe billing records).
Payment records are retained by Stripe per its own retention and legal obligations.
Analytics events are retained per our PostHog configuration in pseudonymized form.
Error reports are retained by Sentry per its default event retention (90 days), after which they age out automatically. [COUNSEL]
Reference/catalog data (USDA-derived nutrient data) is not personal data and is retained independently of any account.

[COUNSEL] — confirm the concrete retention periods and the legal-hold exceptions (see §11).

Depending on where you live, you have rights over your personal data. Mirabelly honors these rights for all users regardless of region:

Access — get a copy of the personal data we hold about you and your household.
Rectification — correct inaccurate data (you can edit most household and member data directly in the app).
Erasure / deletion — delete your account and associated personal data, subject to the legal-hold exceptions in §5. A deletion request also covers your telemetry: we issue a PostHog person deletion (covering both distinct-id shapes we may have used for you) and delete the web app’s Sentry events keyed to your Auth0 sub; server-side error reports are not keyed to your account and expire automatically within Sentry’s standard 90-day retention. [COUNSEL]
Portability / export — receive your data in a portable, machine-readable format.
Restriction & objection — restrict or object to certain processing, including withdrawing analytics consent (§4).
Opt-out of “sale” / “sharing” — under the CCPA/CPRA you may opt out of the sale or sharing of personal information. Mirabelly does not sell or share your personal data, so there is nothing to opt out of, but we honor the request as a no-op confirmation.
Non-discrimination — we will not deny you service or charge you differently for exercising these rights.

To exercise any right, contact us as described in §10. [COUNSEL] — confirm the verification standard, response deadlines (GDPR: 30 days; CCPA: 45 days), and authorized-agent handling for the DSAR process (see §11).

7. Children’s privacy (13+)

Mirabelly is intended for adults aged 13 or older who manage a household. Account holders must be at least 13. We do not knowingly let anyone under 13 create an account.

A household, however, may include children — and a parent or guardian using the service may enter a child’s age and sex (and, for infants, age in months and feeding inputs) so the solver can compute the right nutrient targets. In that case:

The child does not have an account and does not interact with the service; their data is provided by the responsible adult.
A child’s data is used only to compute that household member’s nutrition plan. It is never sent to analytics and never used for advertising (see §4).
The responsible adult can edit or delete a child’s profile in the app at any time, and deleting the household removes it.

If you believe a person under 13 has created an account, contact us (§10) and we will delete it. [COUNSEL] — confirm whether COPPA, GDPR-K (Art. 8), or other children’s-data rules impose additional obligations given that a parent supplies a child’s age/sex, and confirm this section is consistent with the signup acknowledgement in the disclaimer copy deck §7 and the Terms of Service (see §11).

8. Security

We take reasonable technical and organizational measures to protect your data, including:

No card data on our servers — payment details go directly to Stripe.
No stored passwords — authentication is delegated to Auth0; we hold only the sub identifier and email.
Encryption in transit (HTTPS/TLS) for all traffic, and encryption at rest for the user database.
Tenant isolation — household data is scoped per household; access is gated so one household cannot read another’s data.
Secrets management — third-party keys are held in managed secrets, not in source.
Least-privilege access for the small team and processors.

No method of transmission or storage can be perfectly secure, and we do not promise that it is; we work to protect your data and will notify you and the relevant authorities of a breach as required by law.

9. International data transfers `[COUNSEL]`

Mirabelly and its processors (Auth0, Stripe, Resend, PostHog, Sentry, and our hosting provider) may store and process data in countries other than your own, including the United States. Where we transfer personal data out of the EU/EEA, UK, or other regulated regions, we rely on appropriate legal protections (e.g. Standard Contractual Clauses and processor certifications).

[COUNSEL] — confirm the lawful transfer mechanism for each processor and region, name the data-storage locations, and approve the wording of this section before launch (see §11).

10. Contact / Data Subject Access Requests (DSAR) `[COUNSEL]`

To exercise any right in §6, ask a question about this policy, or report a concern, contact:

Email: privacy@mirabelly.com (placeholder — confirm the live mailbox) [COUNSEL]
Account deletion (closed beta): there is no in-app self-serve “delete account” control yet. During the closed beta you request deletion of your account and household data by emailing the address above, and we action it manually. [COUNSEL] — build the self-serve in-app deletion path, then update this line, before the paid launch.

We will verify your identity before acting on a request that concerns personal data, and respond within the time limits required by law. Telemetry deletion is part of this workflow: a verified erasure request triggers a PostHog person deletion (covering both distinct-id shapes we may have used for you) and deletes the web app’s Sentry events keyed to your Auth0 sub; server-side error reports are not keyed to your account and expire automatically within Sentry’s standard 90-day retention (see §1.6, §3). During the closed beta, each verified deletion request is logged as a dated entry — received, verified, and completed — in our operations log; a durable deletion ledger ships with the self-serve deletion path. [COUNSEL] — define and approve the full DSAR intake, identity-verification, and response workflow, including how requests are logged, the telemetry-deletion steps, and the statutory response deadlines (see §11).

11. Counsel-review checklist

Tag: [COUNSEL] — clauses that turn on a legal judgment and must be reviewed and approved by counsel before this policy is published. Collected here for a single review pass:

[COUNSEL] Sensitive-category lawful basis (§1.3). Confirm the lawful basis and any explicit-consent requirement for dietary restrictions/allergens as a special category (GDPR Art. 9), given they can imply health or religious belief.
[COUNSEL] Processor list & DPAs (§3). Confirm a Data Processing Agreement is in place with Auth0, Stripe, Resend, PostHog, Sentry, and the hosting provider, and that the role/data descriptions and policy links are accurate and current.
[COUNSEL] Retention periods (§5). Set the concrete retention windows and legal-hold exceptions (billing/tax/fraud).
[COUNSEL] DSAR process (§6, §10). Approve the verification standard, statutory response deadlines (GDPR ~30 days; CCPA ~45 days), authorized-agent handling, and the request-logging workflow.
[COUNSEL] Children’s data (§7). Confirm COPPA / GDPR-K (Art. 8) and any other children’s-data obligations given a parent supplies a child’s age/sex, and confirm consistency with the signup acknowledgement (disclaimer deck §7) and the Terms of Service.
[COUNSEL] International transfers (§9). Confirm the lawful transfer mechanism (e.g. SCCs) and data-storage locations per processor and region.
[COUNSEL] Contact mailbox & deletion path (§10). Confirm the live privacy@ mailbox, confirm the closed-beta account-deletion path (manual, by email — there is no self-serve in-app deletion yet), and confirm the plan to build self-serve deletion before the paid launch.

This is a draft for counsel review and is not legal advice. Do not publish until every [COUNSEL] item above has been resolved and signed off.