Privacy

• Without an account, your box, racks and settings stay in your browser.
• With a free account, we keep your email address with your box, favorites, saved boxes, and the recipes and reviews you add.
• We count visits and clicks against a random ID, never your name or email. There are no ad trackers or third-party analytics on the site.
• When you follow a link to Walmart, Amazon or Instacart, that store sees the visit under its own privacy policy.
• We don't sell your personal information. To get a copy of it or have it deleted, email hello@mealkitcart.com.

Without an account, these live only on your device, in your browser's storage:

• Your box: the week's recipes and servings, the shopping list and what you ticked off, prep-day progress, and the Walmart products matched to it.
• Your racks: the spices, pantry staples and produce you told us you have.
• Settings: light or dark theme, the store you check out with, swaps you made on a plan, recipe imports still in progress, and whether you closed the sign-up card.
• A random visitor ID, and the campaign tags (utm) of the link that first brought you here, used for 90 days.

Clearing this site's data in your browser removes all of it.

• Pricing your box. Ingredient names go to our server, which looks up matching products and prices on walmart.com.
• Importing a recipe. Our server fetches the page you link, or reads the text you paste, and works out the ingredients, sometimes with a language model that runs on servers we operate. The recipe is kept in our library, on your account if you're signed in.
• Sharing a box. Share saves a copy of the box on our server. Anyone with the link can see it.
• Sending a cart to Walmart. We make the add-to-cart links on our server and store them with your box's random ID, your visitor ID and the campaign tags that brought you. When you open one, we log the click with your browser's user agent and a salted hash of your IP address, never the address itself.
• Limiting abuse. Our server briefly uses your IP address to stop too many requests from one connection. It isn't saved to our database.

• Signing in. With an email link, we store your email address; each link works once and expires after 15 minutes. With Google, Google gives us your name, email address, profile photo and Google account ID, and we store them.
• What we keep with your account. Your box (so it syncs between devices), favorites, saved boxes and their weekly price history, recipes you import or write, and the ratings, reviews and reports you send.
• What other people see. A recipe you share or a review you post shows your first name and last initial, or “A MealKitCart cook” when we don't have a name. A saved box you share is visible to anyone with its link.
• The weekly deals plan email. Creating an account subscribes you, as the sign-in form says. We record when you agreed and to which wording. Unsubscribe from the link in the email or in your account at any time; signing in again never re-subscribes you.

We use cookies only to sign you in:

• __Host-mkc_session keeps you signed in. It is set when you sign in, lasts 30 days and renews while you use the site. Signing out clears it.
• __Secure-mkc_oauth lasts 10 minutes during Google sign-in, to check that the reply came from Google.
• mkc_welcome lasts 2 minutes after you sign in, so we can say hello once.

No advertising or analytics cookies. Stores you visit through our links, and their affiliate networks, set their own cookies on their own sites.

We record a few events in our own database: visits from campaign links, shares, sending a cart, opening a store from the cart, copying or swapping a plan, the sign-up card being shown or closed, and installing the app. Each record holds the page, the referring site's domain, campaign tags, the random visitor ID and the time. No name, email or IP address, and no third-party analytics service.

• Cloudflare hosts the site, our database and our media, so every request passes through it, IP address included.
• Resend delivers our sign-in emails: your email address and the message.
• Google, if you choose to sign in with Google.
• Walmart, Amazon and Instacart, when you follow a link to them. They see the visit, the items or searches in the link and our affiliate tag. Walmart links can pass through its affiliate network, Impact. See the affiliate disclosure.
• Photo hosts. Product and recipe photos load straight from Walmart, TheMealDB and recipe sites, which see an ordinary image request from your browser.

We don't sell your personal information or share it for advertising.

• Sign-in sessions end after about 30 days without a visit. Sign-in links expire after 15 minutes; expired ones are deleted after a day.
• From your account you can remove favorites, saved boxes and recipes you wrote, and turn off the weekly email.
• To get a copy of your data, or to delete your account and everything stored with it, email hello@mealkitcart.com from the address on your account.

MealKitCart is for adults planning household groceries. It isn't meant for children under 13, and we don't knowingly collect their information.

When this page changes, the date at the top changes with it. MealKitCart is based in Florida, USA. Questions about privacy go to hello@mealkitcart.com.