Your data and privacy
What Easy Eats stores, how it is protected, and the things it deliberately does not claim.
Your body data is encrypted before it is stored
Weight, height, age, sex, goals and your weight history are encrypted with AES-256-GCM before they are written to the database, each under a separate key. The encryption key is stored in the server configuration file, outside the database. Someone who obtained a copy of the database alone would not be able to read them.
Only you can read your data
Every request for a profile, meal plan, shopping list or weight entry is scoped to the signed-in account on the server. The account is taken from your session, never from anything the page sends, so a changed identifier in a request cannot reach another person's data.
Health values never appear in a web address
Body metrics and weight entries are only ever sent in the body of an encrypted HTTPS request. They are not placed in URLs, which means they do not end up in browser history, server access logs or referrer headers.
Card details never reach this site
Payments run through Stripe Checkout on Stripe's own domain. This site stores a Stripe customer reference and your subscription status. It never receives, processes or stores a card number, and the site is not claimed to be PCI compliant because it never handles card data.
You can export or delete everything
Account settings has a data export that decrypts your own records for you, and a delete option that removes your profile, plans, lists, favourites and weight history permanently. Deletion cannot be undone.
What we do not claim
This is a small application on shared hosting. It is not a medical device, it has not been independently audited or penetration tested, and it is not described as bank grade. Estimates it produces are population averages, not clinical advice.
What is collected
- Account: your email address, a display name, and a password that is stored only as a hash.
- Body and health data: weight, height, age, sex, activity level, goal, goal weight, dietary exclusions, preparation preference, and your weight history. All encrypted before storage.
- Application data: your meal plans, shopping lists and favourites.
- Billing: a Stripe customer reference, your subscription status and renewal date. No card details.
- Security log: sign-in attempts, plan generations and similar events, with IP addresses stored as keyed hashes rather than raw addresses, kept for 90 days.
What it is used for
Producing your meal plans and shopping lists, showing your progress, running your subscription, and detecting abuse of the sign-in and sign-up endpoints. It is not sold, and it is not used for advertising.
Who else sees it
Stripe processes payments and therefore holds your billing details under its own policy. If a language model provider is configured for meal-plan notes, it receives recipe titles only: no body metrics, no weight history, no email address. Nothing else is shared.
How long it is kept
Until you delete it. Deleting your account removes your profile, plans, lists, favourites and weight history immediately and permanently. Payment records held by Stripe follow Stripe's retention policy, which we do not control.
Your choices
Account settings has a full export of your own data, decrypted, as a file you can keep. It also has account deletion. You can change or clear your body measurements at any time, though the planner needs weight, height and age to produce a calorie estimate at all.
Cookies
A WordPress session cookie to keep you signed in, and a security token to protect form submissions. No analytics or advertising cookies are set by this application.
Getting in touch
Write to onlinemegaretailgroup@gmail.com for anything to do with your data.