Privacy policy

Last updated 24 October 2026. Table Plan is in private beta, so this may change as we grow; we'll tell you about changes that matter.

This explains what Table Plan collects, why, who sees it, and what you can do about it. We've tried to keep it plain. If anything is unclear, ask us at jack@betmate.app.

Who we are

Table Plan is a meal-planning web app for adults in the UK. We decide how and why your personal information is used (we are the “controller” under UK data protection law). You can reach us at jack@betmate.app.

What we collect, and why

Your email address, to create your account and send the code you sign in with. There are no passwords. (Contract.)
Your goal and how active you are, to set your daily calorie and protein target. (Contract.)
Your height, weight, age and sex, all optional, to make that target personal. Without them we use a typical target for your goal. This is health information, so we ask your explicit consent first. (Consent.)
Your allergies, to leave out meals that contain them. This is health information, so we ask your explicit consent first. (Consent.)
Your dislikes, the meals you keep or skip, which meals you want planned, how many you cook for, and your weekly spend setting, to build plans you will actually cook. (Contract.)
Your plans, shopping lists and what you tick off as eaten, so the service works from one visit to the next. (Contract.)
Your subscription: plan, status, trial and renewal dates, and your Stripe customer reference. Your card details go straight to Stripe; we never see or store them. (Contract.)
Feedback you send us, linked to your account so we can follow up. (Legitimate interests: improving the service.)
Waitlist signups: your email and when you agreed to hear from us. (Consent.)
Technical data such as your IP address and browser type, which our hosting provider logs when you use the service, and which we use to keep it secure and stop abuse. To limit abuse we also keep a scrambled (hashed) version of your address for up to a day, so we can slow down anyone sending too many requests. (Legitimate interests.)

What we don't do

We don't sell your information, and we don't use it for advertising.
We don't share it with supermarkets. Tapping a Morrisons link, or using our browser extension to fill your Morrisons trolley, sends them nothing from us: the extension works in your own browser and your own Morrisons session, and doesn't send your list or anything else to us.
The prices we show come from public product pages, fetched without any information about you.
Analytics are off unless you opt in, and we never put your height, weight, age, sex, allergies or free text in analytics.

Health information and your consent

Allergies and body measurements count as health information, which the law treats with extra care. We only use them to build and size your plan, and only if you agree. You can say no to the optional measurements and still use Table Plan with a typical target. You can change or remove any of it in Settings, and you can withdraw your consent at any time there: we then delete your measurements, allergies and the plans built from them.

Who we share it with

We use a few companies to run the service. They act on our instructions and may use your information only to provide their service to us.

Supabase: our database and sign-in. Hosted in Ireland (EU).
Vercel: runs the website and its servers. Our servers run in London.
Stripe: takes payment and manages subscriptions.
An email delivery provider: sends your sign-in code.

We may also share information if the law requires it, or to protect people from harm or fraud.

Sending information abroad

Vercel and Stripe are US companies and may process some information in the United States. When they do, it is protected by approved safeguards (the UK–US data bridge, or the UK's standard contract terms).

How long we keep it

We keep your information while you have an account. When you delete your account (Account), we cancel your subscription and delete your profile, plans, answers, feedback and login straight away. Copies in our providers' routine backups are overwritten as those backups roll over. Stripe keeps payment records for as long as the law requires them to (usually six years for tax and accounting). Waitlist emails are kept until you ask us to remove them.

Your rights

You can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it to another service. You can also withdraw consent at any time.

Get a copy: Account → Download my data (a JSON file of everything we hold).
Correct or change it: Settings.
Delete it: Account → Delete my account.
Anything else: email jack@betmate.app. We'll reply within one month.

If you're unhappy with how we've handled your information you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We'd like the chance to put it right first.

Cookies and storage on your device

We don't use advertising or tracking cookies. We keep a sign-in token and a few preferences (for example, that you dismissed the “add to home screen” prompt) in your browser's storage so the app works; these are essential and don't need consent.

Children

Table Plan is for adults (18 and over). If you think a child has signed up, tell us and we'll delete the account.

How we keep it safe

Information is encrypted in transit; each person can only read their own profile (enforced in the database, not just the app); payments are handled by Stripe; and access to our systems is limited. No service is perfectly secure. If something goes wrong that puts your information at risk we'll tell you and the ICO as the law requires.

Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect, and ask for your consent again if what we ask consent for has changed.