Privacy Policy

• Account information. When you sign in with Google, we receive your name, email address, and profile image to create and secure your account.
• Google Calendar data. With your explicit consent, we request read-only access to your calendar (the calendar.readonly scope). We read upcoming events only to understand how busy your week is, so Sous can plan quick meals on hectic days and more involved ones when you have time. We do not create, modify, or delete calendar events.
• Phone number and messages. If you opt into SMS, we store your phone number and the content of messages exchanged with Sous, so we can run onboarding, deliver meal plans and grocery lists, and learn your preferences over time.
• Household preferences. Dietary restrictions, cuisines, skill level, budget, pantry staples, and similar details you share so Sous can plan for you.
• Billing information. Subscription and payment processing is handled by Stripe. We store your subscription status and Stripe customer/subscription identifiers — never your full card number, which is held by Stripe.
• Usage and device data. Basic, aggregate analytics (pages visited, general usage) to improve the product. See Cookies & analytics below.
• AI assistants you connect. If you connect one, a record of that connection and what you and the assistant say through Sous. See AI assistants you connect below.

Sous's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements. Specifically: we request only read-only calendar access; we use Google Calendar data solely to provide and improve the meal-planning features you asked for; we do not use this data for advertising; we do not sell it; and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, where the data has been aggregated and anonymized, or in the limited course of operating and troubleshooting the service (for example, reviewing an individual failed request to diagnose it), always under confidentiality.

Google user data is never used to create, train, or improve any machine-learning or artificial-intelligence models — neither ours (we train none) nor any third party's. Where calendar-derived context is processed by our AI provider to generate your plans (see AI processing below), that processing is governed by commercial terms that prohibit the provider from training models on the data. The one exception is a choice you make yourself. If you connect an AI assistant to Sous (see AI assistants you connect below), it can read the calendar details Sous shows you — the events Sous plans your week around, its questions about your calendars, and its messages that mention them — and what the assistant's provider does with them, including whether it trains models on them, is governed by that provider's terms and your settings there, not by ours. In a kitchen of two, it gets the other adult's events only as far as they let you see them, and an assistant they connect gets yours the same way, under its provider's terms and their settings: your event names reach it only from a calendar you have at Shared — your choice too — or from one they can already read in their own account. You can revoke Sous's access at any time from your Google Account permissions page.

• To provide meal plans, grocery lists, and text-based assistance.
• To personalize plans based on your calendar and preferences.
• To process your subscription and send service messages.
• To secure accounts, prevent abuse, and comply with the law.
• To improve Sous in aggregate — never to sell your data.

Sous uses Anthropic's Claude models, accessed through Anthropic's commercial API, to generate meal plans and conversational replies. Relevant context — such as your household preferences, recent messages, and schedule information derived from your calendar — is sent to Anthropic solely to produce your responses. Anthropic's commercial terms prohibit it from training its models on data submitted through the API, so nothing we send — including any Google Calendar data — is used to create, train, or improve AI models. We share only what is needed to generate your plan, and we train no models of our own.

If a Sous member shares a recipe card with you by link, the page lets you ask Sous to adjust it for your table. When our own rules can't read your request, the text of that one request — and nothing else about you — is sent to Anthropic under the same terms to work out how many servings and which restriction you meant. We keep a count of visits to a shared card and a short-lived rate-limit counter keyed on your connection, and nothing else about who visited.

Message and data rates may apply. Message frequency varies with your plan and activity. You can opt out at any time by replying STOP, and get help by replying HELP. We use Twilio to send and receive messages; message content passes through Twilio to deliver it to you.

If you connect Sous to an AI assistant you already use — such as Claude, ChatGPT, or Gemini — the assistant can work with your Sous household on your behalf. Connecting is optional. Each time you connect one, Sous shows you a screen naming the assistant and what it is asking for, and nothing about your household is shared until you approve.

• What it can read. A connected assistant can see your household's profile (household size, ZIP code, time zone, the people you cook for, dietary needs, food preferences, and notes); the current week's meals and grocery list, with the calendar events Sous plans the week around (see the next point); recipe cards; past weeks, with your own ratings; Sous's open questions about your calendars; who is in your kitchen (phone numbers only as their last four digits); what Sous is waiting on you to answer; and your recent conversation with Sous. It cannot see your partner's conversation with Sous, a calendar nobody shares with Sous, or your billing details.
• What it reads of calendars. The events Sous plans your week around, by these rules:
  • From the calendars you share with Sous, it can read your events in full from today on (days already past show the week as Sous saved it).
  • From a calendar only your partner (the other adult in your kitchen) has, it reads only as much as they let you see, by that calendar's level, which is theirs to choose: Not shared gives it nothing (Sous still plans around it, so the plan itself may show an away day, a dinner for one or a suggested night out, but never why); Busy only gives a busy block at that time, such as “Busy (Sam)”, with no event name; and Shared gives the event names.
  • On a calendar only your partner has, an event marked Private or Confidential in Google reaches it as no more than busy, whatever the calendar's level.
  • A Google calendar or calendar link you both have in full in your own accounts has no level: Sous reads it only if you both share it with Sous, and then your assistant gets no more of it than you can already see yourself. If either of you doesn't share it, Sous reads none of it, for either of you.
  • It works the same way in reverse. An assistant your partner connects reads your calendars by these rules, so your event names reach it only from a calendar you have at Shared, or from one they can already read in their own account. Choosing Shared is your decision, made under Preferences → Calendars Sous reads on your Sous dashboard, where you can change a calendar's level at any time.
• What it can change. Only if the assistant asked for permission to make changes and you approved it: it can edit the week (replace, move, or remove a meal, undo the last change, or ask Sous to redo the rest of the week), rate meals, say who is cooking, add to and check off the grocery list, update your household's details, preferences, and notes and the people you cook for, answer Sous's questions for you, save planning notes, and choose how Sous reaches you and which of its texts you get. Sous applies the same rules it applies on the dashboard — for example, it refuses a dish that conflicts with an allergy or diet your household has told Sous about. Some things stay on the web and can't be done through an assistant at all: connecting calendars, choosing which calendars Sous reads and how much of each one your partner sees, billing, inviting a partner, and your phone number.
• What Sous keeps. What you and the assistant say through Sous is saved in your Sous conversation, labelled with the assistant's name: each change it makes, any reason it gives, the messages it sends Sous for you and Sous's replies, and any planning notes you ask it to save. You can read it in Chat with Sous, and it is handled like the rest of your conversation, including the AI processing described above. Sous never sees the rest of your conversation with the assistant — only what the assistant sends to Sous. We also keep a record of each connection (which assistant, what you approved, and when it was connected, last used, and disconnected) with your account. Deleting your account deletes these too. One exception: for an assistant that registers itself with Sous when you connect it (Gemini CLI does, for example), that record is deleted once the connection has ended and the assistant has gone 30 days unused — or sooner, if a great many such assistants are registered.
• The assistant's provider. The assistant is run by its own company (for example Anthropic for Claude, OpenAI for ChatGPT, or Google for Gemini). It is not one of our service providers: you choose it, and it receives your Sous information at your direction. What it does with what it reads — how long it keeps it, who can see it, and whether it is used to train models — is governed by that company's terms and privacy policy and your settings there, which Sous does not control. The same goes for an assistant your partner connects: it is their choice, and what it reads, including what they may see of your calendars, is governed by its company's terms and their settings there. This is separate from Sous's own use of Anthropic described under AI processing: if you connect Claude, what Claude reads from Sous is handled under your own account with Anthropic, not under our commercial terms. Sous never sends your information to an assistant on its own; it only answers an assistant's requests while the person who connected it keeps it connected.
• Access keys, and how long they last. When you approve, Sous gives the assistant an access key (a token) that lets it act for you. We store only a one-way fingerprint of each key (a SHA-256 hash), never the key itself, so our records can't be used to act as you. An access key works for one hour. If the assistant asked to stay connected, it also receives a refresh key, which it can trade for a new access key for up to 60 days from when you approved; after that, Sous asks you to approve again. Each refresh key works once: if a used one is ever presented again, Sous disconnects the assistant to be safe. The one-time code your browser passes to the assistant when you approve works once and expires after 60 seconds.
• Disconnecting. You can disconnect an assistant at any time under Preferences → Connected apps on your Sous dashboard. It takes effect on the assistant's next request: every key it holds is refused from then on, and using it with Sous again means connecting and approving again. Removing Sous in the assistant's own settings may not tell Sous, so disconnect in Sous too.
• No sale. We don't sell what an assistant reads or writes through Sous.

We share data only with the service providers who help us run Sous, each only to the extent needed to provide the service. All of them process data in the United States.

• Google — sign-in, and read-only access to the calendars you select.
• Twilio — sends and receives your texts; sees your phone number and the content of those messages.
• Anthropic — generates your plans, grocery lists, and replies. Prompts include your preferences, your plan, and relevant calendar details. Anthropic's commercial terms prohibit training on this data.
• Inngest — schedules Sous's work and makes message delivery reliable. It holds account identifiers in readable form; message content is encrypted with a key only we hold.
• Vercel — hosting and request logs.
• Supabase — our database: everything in your account is stored there.
• Stripe — payments and subscriptions. Card numbers go to Stripe directly; we never see them.
• Langfuse — monitoring and troubleshooting of our AI requests, including the content of those requests and responses.
• Resend — sends sign-in links to your email address, and these emails from Sous: if you choose Quiet mode, the one telling you your week's plan is ready (the days and dishes, never your calendar events) and the one telling you an invite you tried to send didn't go out because that number had opted out of texts (it names only the number's last four digits); and, if you set Sous up through an AI assistant, one email on the last day of your first plan, whether you're on Quiet or Texts (its date and your assistant's name — nothing from your plan or your calendar); and, if Sous doesn't text you, the emails Sous sends when three weeks go by with nobody in your kitchen using it: two check-ins, the day before your planning day, asking whether you want a meal plan that week, and one last note that Sous built you a plan, with a link to it, or, when no plan could be built, that this is its last check-in (nothing from your plan or your calendar is in any of them); and, if Sous doesn't text you, one email when you and the other adult in your kitchen both have a calendar but only one of you shares it with Sous (the calendar's name and which of you shares it — no events from it). Each of these has an unsubscribe link that stops all of them; so does the email switch under Your kitchen → How I reach you.
• Upstash — rate-limiting counters that protect our public endpoints; sees the network (IP) address of requests, never names or message content.
• Microsoft — only if you connect an Outlook calendar; sees the calendar data you select.

If you connect an AI assistant, Sous also gives it the information it asks for, at your direction; if the other adult in your kitchen connects one, at theirs, including what they may see of your calendars. An assistant's provider isn't one of our service providers, so it isn't listed above; see AI assistants you connect.

We may disclose information if required by law or to protect the rights and safety of our users. We do not sell your personal information.

We keep your information for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain it to comply with legal, tax, or accounting obligations.

• Revoke Google Calendar access from your Google Account at any time.
• Opt out of SMS by replying STOP.
• Disconnect an AI assistant you've connected under Preferences → Connected apps.
• Request access to, correction of, or deletion of your data by contacting us.
• Cancel your subscription from the billing portal.

We use industry-standard measures to protect your data in transit and at rest. No system is perfectly secure, but we work to safeguard your information and limit access to those who need it to operate the service.

Sous is not directed to children under 13, and we do not knowingly collect their personal information.

We may update this policy from time to time. When we do, we'll revise the “Last updated” date above and, for material changes, notify you.

Questions about your privacy? Email us at privacy@textsous.com.