Privacy Policy

Introduction

See Five LLC ("Company" or "We") respect your privacy and are committed to protecting it through our compliance with this policy.

This policy describes the types of information we may collect from you or that you may provide when you visit the website https://tuna-app.com (our "Website") or use the TUNA mobile application (the "App") and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to information we may collect:

On the Website.
On the App.
In email, text, and other electronic messages between you and the Website or App.
Through other mobile and desktop applications you download from the Website, which provide dedicated non-browser-based interaction between you and the Website.

It does not apply to information collected by:

Use offline or through any other means, including on any other website or app operated by Company or any third party; or
Any third party, including through any application or content (including hosting and advertising) that may link to or be accessible from or through the Website or App.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Website or App. By accessing or using the Website or App, you agree to this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Website or App after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Children Under the Age of 13

The Website and App are not intended for children under 13 years of age. No one under age 13 may provide any information to the Website or App. We do not knowingly collect personal information from children under 13. The App allows adult users to enter names and birthdates of children within a household solely for informational and tracking purposes. All information relating to children is entered and managed by an adult user. If you are under 13, do not use or provide any information on the Website or App, subscribe to the Website or App, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us.

Residents of certain states under 13, 16, or 18 years of age may have additional rights regarding the collection and sale of their personal information. Please see Your State Privacy Rights for more information.

Information We Collect About You and How We Collect It

We may collect several types of information from and about users of the Website and App, including information:

By which you may be personally identified, such as name, postal address, email address, telephone number, and any other identifier by which you may be contacted online or offline ("personal information");
That is about you but individually does not identify you; and/or
About your internet connection, the equipment you use to access the Website or App, and usage details.

We may collect this information:

Directly from you when you provide it to us.
Automatically as you navigate through the Website or App. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.

Information You Provide to Us

The information we collect on or through the Website or App may include:

Information that you provide by filling in forms on the Website or App. This includes information provided at the time of subscribing to use the Website or App. We may also ask you for information while you use the Website or App or when you report a problem to us.
Records and copies of your correspondence (including email addresses), if you contact us.
Details of transactions you carry out through the Website or App.
Your inputs to the Website and App, including but not limited to:

Account Information

Email address (required for account creation)
Display name
Profile picture (optional)
Authentication credentials (managed by Supabase Auth; passwords are hashed and never stored in plain text)

Profile and Health Information

Birthday (optional)
Height and weight (optional)
Target weight (optional)
Gender (optional)
Daily nutritional goals (calorie, protein, carbohydrate, and fat targets)
Macro ratio preferences
Measurement system preference (US/metric)

Food and Nutrition Data

Meal logs (foods consumed, portions, dates, and times)
Meal plans (planned meals for future dates)
Pantry inventory (food items, quantities, expiration dates)
Recipes (ingredients, instructions, photos)
Grocery lists
Custom food entries you create

Financial and Spending Data

Grocery receipt data (store name, store address, itemized purchases, prices, dates)
Monthly grocery budget amounts
Subscription and billing status (not payment method details, see Section on Third Party Service Providers)

Photos and Images

Meal photos (submitted for AI-based nutrition estimation)
Recipe photos
Grocery receipt images (processed for OCR)
Nutrition label images (processed for OCR)

Voice and Typed Requests (Talk to Tuna)

Voice recordings you make with Talk to Tuna (transcribed, then discarded)
The text of what you said or typed, and Tuna's reply

Household Information

Household name and membership
Names and birthdays of household children (for nutrition context)
Invitation emails sent to household members

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with the Website and App, we may use automatic data collection technologies to collect certain information about your usage, equipment, browsing actions, and patterns, including:

Details of your visits to the Website or App, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website or App, including but not limited to:
- Screens viewed and features used
- Frequency and patterns of Service use
- Feature adoption and engagement metrics
- Onboarding progress
- Authentication metadata including login timestamps and authentication method (email, Google, Apple)
Information about your computer, mobile device and internet connection, including your IP address, operating system and version, and browser type.

The information we collect may not include personal information, but we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us to improve the Website and App and to deliver a better and more personalized service, including by enabling us to:

Estimate our audience size and usage patterns.
Store information about your preferences, allowing us to customize the Website or App according to your individual interests.
Speed up your searches.
Recognize you when you return to the Website or App.

The technologies we use for this automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of the Website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to the Website. For information about managing your privacy and security settings for cookies, see Choices About How We Use and Disclose Your Information.
Web Beacons. Pages of the Website and App may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages and for other related website and app statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Third-Party Use of Cookies and Other Tracking Technologies

Some content or applications, including advertisements, on the Website and App are served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use the Website or App. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. For information about how you can opt out of receiving targeted advertising from many providers, see Choices About How We Use and Disclose Your Information.

How We Use Your Information

We may use information that we collect about you or that you provide to us, including any personal information:

To present the Website, App and their contents and provide their core features to you.
To provide you with information, products, or services that you request from us.
To calculate nutritional information and track spending and budgets.
To power AI features.
To operate the Tuna connector when you choose to connect an AI chat app.
To fulfill any other purpose for which you provide it.
To provide you with notices about your account.
To manage your subscription and provide notices, including expiration and renewal notices.
To enable household sharing.
To send transactional communications.
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
To notify you about changes to the Website or App or any products or services we offer or provide though it.
To allow you to participate in interactive features on the Website and App.
To diagnose and fix errors and improve the Website and App.
To maintain food database quality.
To enforce the Terms of Service.
In any other way we may describe when you provide the information.
For any other purpose with your consent.

We may also use your information to contact you about goods and services that may be of interest to you. If you do not want us to use your information in this way, please adjust your user preferences in your account profile.

We may use the information we have collected from you to enable us to display advertisements to our advertisers' target audiences. Even though we do not disclose your personal information for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.

When you join or create a household in the Service, certain data is shared with other household members:

Pantry inventory (items, quantities, expiration dates)
Recipes created within the household
Meal plans and logs
Grocery lists
Spending data associated with household purchases

Household sharing is a core feature of the App. By joining a household, you consent to this data sharing with other household members. The household owner (the Big Tuna subscriber) manages membership. You may leave a household at any time.

Talk to Tuna

Talk to Tuna lets you say or type what you bought, ate, cooked or tossed, and Tuna sets up the changes for you to confirm. When you use your voice, the App records a short clip and sends it to our server, which has it transcribed and then discards the recording. We keep the text of what you said or typed and Tuna's reply, so we can show you what Tuna heard, fix recognition mistakes, and improve how well Tuna understands food names. To work out the changes, we send that text, along with the relevant parts of your household's pantry, to our AI providers (see Third Party Service Providers). We keep these records until you delete your account, which deletes them, or until you ask us to delete them by contacting support@tuna-app.com.

AI Chat Apps (the Tuna Connector)

Big Tuna subscribers can connect Tuna to an AI chat app that supports connectors, such as Claude or ChatGPT. Connecting is optional. Nothing is shared with an AI chat app unless you connect it.

What the AI chat app can see. To connect, you sign in to Tuna on our own page and approve the connection. The connector then acts as you, with exactly the access your account has in the App and no more: your household's pantry, recipes, meal plans and logs, grocery list, household member profiles (including the names of any children you have added), nutrition goals and intake, and spending. It cannot see any other household's data. Our database enforces this with the same Row-Level Security rules that protect the App.

What the AI chat app can change. It can add food to your pantry, move food to the freezer, correct amounts, record food that went to waste, set prices, save a recipe you ask it to save, create custom foods, and add items to your grocery list. These changes apply right away, as they would in the App. Meals and cooks it records are saved as plans and do not count until a person confirms them, in the App or on the review card shown in the chat. The AI chat app cannot confirm meals itself, change your nutrition goals, invite or remove household members, or change your subscription. It can undo only the changes it made.

What we receive and keep. We receive the requests the AI chat app sends to Tuna (for example, "add 2 lb of chicken breast to the fridge") and send back the information needed to answer them. We do not receive or store your conversation with the AI chat app. We keep a record of each request (which action was used, what the request contained, whether it succeeded, and what it created) so the AI chat app can undo its own changes, and so we can secure the service and fix problems. Our analytics provider, PostHog, receives only which action was used, whether it succeeded, and how long it took, never the contents of the request. When you delete your account, we delete these records.

What the AI chat app's provider receives. Information Tuna sends to the AI chat app becomes part of your conversation there. The provider of that app handles it under its own privacy policy and the settings you have chosen with it, for example whether conversations are used to train its models. We do not control how that provider stores or uses your information, so please review its policy before connecting.

Sign-in and security. The connection uses OAuth. The AI chat app never sees your Tuna sign-in code or password. The tokens that keep the connection signed in are encrypted, stored with our hosting provider (Cloudflare), and expire and renew automatically.

Disconnecting. You can disconnect at any time in your AI chat app's connector settings. To have us revoke a connection on our side, contact support@tuna-app.com. If your Big Tuna subscription ends, the connection stops working.

Household members. Each household member who connects does so with their own account. Because your household's pantry, plans and grocery list are shared, another member's AI chat app can read and change that shared information, just as that member can in the App.

Admin Review of User-Created Foods

When you create a custom food entry that does not match our existing food database, it is flagged for review by our team. During review, we may:

View the food name and nutritional information you provided
Merge it with an existing entry in our shared food database
Add it as a new entry available to all users

Only the food name and nutritional data are considered for inclusion. We do not share your identity, personal information, or other account data as part of this review process.

Disclosure of Your Information

We may disclose aggregated information about our users without restriction.

We may disclose personal information that we collect or you provide as described in this privacy policy:

To our subsidiaries and affiliates.
To contractors, service providers, and other third parties we use to support our business.
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Company's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Company about the Website or App users is among the assets transferred.
To fulfill the purpose for which you provide it.
For any other purpose disclosed by us when you provide the information.
With your consent.

We may also disclose your personal information:

To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
To enforce or apply the Terms of Use, incorporated herein by reference, and other agreements, including for billing and collection purposes.
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Company, our customers, or others.

Third Party Service Providers

We do not sell your information but may share information with third-party service providers, including as follows.

Supabase (Database and Authentication)

Provider: Supabase, Inc.
Data shared: All account data, food data, meal logs, pantry items, recipes, household data
Purpose: Database hosting, user authentication, file storage
Location: United States
Their privacy policy: https://supabase.com/privacy

Cloudflare (Website and Tuna Connector Hosting)

Provider: Cloudflare, Inc.
Data shared: Requests to the Website and to the Tuna connector, including the information passing through them; encrypted sign-in tokens for AI chat app connections
Purpose: Hosting, delivering, and securing the Website and the Tuna connector
Location: United States and Cloudflare's global network
Their privacy policy: https://www.cloudflare.com/privacypolicy/

Stripe (Payment Processing)

Provider: Stripe, Inc.
Data shared: Email address, user identifier (for linking accounts), subscription plan selection
Purpose: Processing subscription payments, managing billing, providing customer portal
What Stripe receives directly from you: Payment method details (credit card, etc.), these are entered directly into Stripe's interface and are never transmitted to or stored on our servers
Location: United States (PCI-DSS compliant)
Their privacy policy: https://stripe.com/privacy

PostHog (Product Analytics)

Provider: PostHog, Inc.
Data shared: User identifier, screen views, feature usage events, subscription status, event properties (e.g., number of items scanned, onboarding task completed)
Purpose: Understanding feature adoption, improving the Service, identifying issues
Location: United States (us.i.posthog.com)
Collection context: Analytics data is collected only when the App is in release mode (not during development/testing)
Their privacy policy: https://posthog.com/privacy

Firebase Crashlytics (Error Reporting)

Provider: Google LLC
Data shared: Crash and error logs, device information (OS version, device model), user identifier, household identifier, subscription status, breadcrumb logs of user actions preceding a crash
Purpose: Identifying and fixing crashes and errors
Location: United States
Their privacy policy: https://firebase.google.com/support/privacy

Anthropic (AI Processing)

Provider: Anthropic, PBC
Data shared: Photos of meals, text descriptions of food, recipe URLs and text, nutrition label images, receipt images and receipt line items, and Talk to Tuna requests (the text of what you said or typed, with the relevant parts of your household's pantry), all sent from our servers (not directly from your device to Anthropic)
Purpose: Nutrition estimation, recipe reading and writing, receipt reading, matching receipt lines to foods, nutrition label reading, and understanding Talk to Tuna requests
Data retention by Anthropic: Subject to Anthropic's data processing terms
Their privacy policy: https://www.anthropic.com/privacy

Google (Gemini API, AI Processing)

Provider: Google LLC
Data shared: Talk to Tuna voice recordings (for transcription), photos and text descriptions of meals, photos of groceries, recipe images, and receipt images, all sent from our servers (not directly from your device to Google)
Purpose: Transcribing Talk to Tuna recordings, nutrition estimation, identifying groceries in a photo, improving recipe images, and receipt reading
Data retention by Google: Subject to Google's terms for the paid Gemini API
Their privacy policy: https://policies.google.com/privacy

OpenAI (Food Matching)

Provider: OpenAI, L.L.C.
Data shared: The text of receipt line items as printed by the store (for example, "GV ORG BLK BEANS 15OZ"), sent from our servers without your name or account details
Purpose: Matching receipt lines to foods in our database
Data retention by OpenAI: Subject to OpenAI's API data usage policies
Their privacy policy: https://openai.com/policies/privacy-policy

OpenFoodFacts (Food Database)

Provider: Open Food Facts (non-profit)
Data shared: Barcode numbers, app user-agent identifier
Purpose: Looking up product information (name, brand, nutrition) from barcode scans
Note: OpenFoodFacts is a public, open-source database. No personal information is shared.
Their privacy policy: https://world.openfoodfacts.org/privacy

Mailgun (Email Delivery)

Provider: Mailgun Technologies, Inc. (a Sinch company)
Data shared: Recipient email address, sender name, and email personalization details (such as household name and invitation details)
Purpose: Delivering transactional, authentication, and product and marketing emails
Their privacy policy: https://www.mailgun.com/legal/privacy-policy/

Authentication Providers

Google Sign-In (Google LLC), receives authentication requests; provides email, name, profile photo
Sign in with Apple (Apple Inc.), receives authentication requests; provides email, name

These providers' data practices are governed by their own privacy policies. We do not control third parties' collection or use of your information to serve interest-based advertising. However these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website.

Residents of certain states may have additional personal information rights and choices. Please see Your State Privacy Rights for more information.

Accessing and Correcting Your Information

You can review and change your personal information by logging into the App and visiting your account profile page.

Your data is visible and accessible through the App at all times.
You can edit or delete individual entries (meals, pantry items, recipes) within the App.
You can permanently delete your account and all associated data through the App.
You can cancel or modify your subscription via the Stripe Customer Portal.

You may also contact us to request access to, correct, or delete any personal information that you have provided to us. We cannot delete your personal information except by also deleting your user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

User Contributions may remain viewable in cached and archived pages, or might have been copied or stored by other Website users even if your account is modified or deleted.

Residents of certain states may have additional personal information rights and choices. Please see Your State Privacy Rights for more information.

Your State Privacy Rights

State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information.

Many states, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia provide (now or in the future) their state residents with rights to:

Confirm whether we process their personal information.
Access and delete certain personal information.
Correct inaccuracies in their personal information, taking into account the information's nature processing purpose (excluding Iowa and Utah).
Data portability.
Opt-out of personal data processing for:
- targeted advertising (excluding Iowa);
- sales; or
- profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
Either limit (opt-out of) or require consent to process sensitive personal data.

The exact scope of these rights may vary by state.

Data Security

We implement the following security measures to protect your data:

Encryption in transit: All data transmitted between the App and our servers uses TLS/HTTPS encryption.
Database security: Row-Level Security (RLS) policies restrict data access to authorized users and their household members.
Authentication: JWT-based authentication with secure token management via Supabase Auth.
Payment security: Credit card and payment data is handled exclusively by a third-party payment processor, Stripe (PCI-DSS Level 1 compliant), and is not stored on our servers.
Access controls: Administrative access to user data is restricted and logged.
On-device processing: Sensitive image processing (OCR, barcode detection) is performed on-device where possible.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

In conjunction with our application providers, we have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of the Website or App, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to the Website or App. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website or App.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page. If we make material changes to how we treat our users' personal information, we will notify you by email to the email address specified in your account and/or through a notice on the Website or App. The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting the Website and App and this privacy policy to check for any changes. Your continued use of the Application after changes become effective constitutes acceptance of the revised policy.

Contact Information

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to support@tuna-app.com.