Privacy policy

Updated 20 October 2026

PDF data exports

When you request a PDF pack, we prepare a private copy of your account data and email a download link to your verified address through Loops. You must sign in to your own account to download it. The link expires after 24 hours; stored packs are encrypted and removed after expiry or account deletion. Changing your email address makes the old link unusable. Loops receives your address and download link, not the contents of the PDF. Keep any downloaded copies safe.

Optional email tips

Tips are off by default. If you enable them in Profile, we share your email address and relevant first-use milestones with Loops to send occasional guidance. These milestones are your first completed shopping list, first household member joining and first dinner marked cooked. We record each milestone once from new activity, not by guessing past use. We do not send your shopping contents, recipes, dietary preferences or feedback text to Loops. You can turn tips off in Profile or unsubscribe in a tip email. We retain your consent and milestone delivery status with your account; these are included in your data export and removed from Stirwise when you delete your account. Essential account and household emails are separate.

Who runs Stirwise

Robert Fish operates Stirwise as an Australian sole trader. Stirwise is free to use. Stirwise Pro is an optional paid subscription available in the iOS app. This policy explains how we handle information when you use Stirwise, choose Stirwise Pro, or contact us. Contact robert@stirwise.app about privacy, access, corrections, deletion or a complaint. Your rights under the Australian Consumer Law are unchanged.

What we collect and why

Earlier access requests contain your name, email, referral source and permission date so Robert can review and respond to your request. Registration no longer requires an access request. Accounts contain your name, email, protected sign-in details and verification status. We store freezer entries, household planning preferences, ingredient exclusions, meal plans, shopping choices, remembered products, recipe favourites and feedback to provide and improve Stirwise. Recipe favourites and feedback belong to your account and are not shared with household members. Robert can review recipe feedback to improve the catalogue. They are included in your data export and removed when you delete your account. Avoid entering medical histories or other sensitive personal details in free-text fields. Ingredient exclusions are not a clinical allergy profile.

Campaign measurement

If you arrive through a recognised Stirwise campaign link, we keep its campaign label in your existing server session for up to 24 hours. We create a first-party measurement record for that observed visit and record a form start after focused input, including typing, paste, mobile composition or autofill, a changed form choice or submission. We store the campaign label, the search keyword and ad label from that link when they are present, timestamps and a broad request outcome. We also store a broad device type and up to 512 characters of the browser’s user agent to help identify automated traffic. We do not store an advertising click ID, IP address or form contents in these measurement records. A click ID from the landing link can stay in that same server session for up to 24 hours, and is sent to Google only if you allow ad cookies. We flag known crawlers and scripted clients and exclude them from eligible visit counts. If you allow ad measurement through Cookie choices, our public landing pages also record the first clicked call to action and its local destination without query strings, the number of CTA clicks, a maximum scroll-depth bucket, and whether the page was engaged with or left. Engagement means a CTA click, scrolling at least 25 percent or ten visible seconds. These extra events stay in our first-party database and add no cookies; declined or unavailable measurement is not treated as a bounce. A successful new registration links this record to your account so we can count registrations, verification and early plan-and-list use. Older access-request records may also link to an account; request and direct-registration totals are reported separately. We do not send that first-party measurement record to Google. Campaign links can be shared, so an observed session is not proof of an ad click. Measurement and request records expire after 90 days; linked records are also removed when the request or account is deleted. Contact us to access or remove your request record.

Optional Google Ads measurement

Ad measurement is off until you make the current choice to Allow ad cookies in Cookie choices. Earlier permission for access-request measurement does not grant permission for registration measurement. If you agree, Google may store advertising cookies and receive your IP address, browser information, advertising click identifiers and a random identifier for a newly created account. When your landing link included a click ID, that identifier can be included on the registration event after you allow ad cookies. It is held only in the server session for up to 24 hours and is not written to our database. A brief isolated confirmation page can send this event after registration, before continuing to email verification. It contains no name, email, form answers, meals or account details. The tag does not run in your saved planner or other private account screens. The anonymous guest planner is described below. We do not upload customer data; ad personalisation and enhanced conversions remain disabled. You can continue immediately, and declining or blocked measurement never prevents account access. This is separate from our first-party records and is incomplete when consent is declined or tracking is blocked. Your choice expires after 180 days. Withdraw through Cookie choices to stop future measurement and remove advertising cookies accessible to Stirwise; this does not erase data Google already received. Google may process data outside Australia under its own privacy policy.

Guest plans and optional ad measurement

You can try a plan without an account. The plan stops being used after 24 hours. We clear its dinners and shopping list at the next daily cleanup, within about a day after that expiry. We keep freezer choices. The campaign link is removed when acquisition records are pruned after 90 days. We record a coarse user-agent type (browser, http client, preview, headless, crawler, or missing), a broad device type, and a likely-bot flag. Planner usage events and a keyed hash of the session id, never the raw session id, are kept for 13 months to measure the planner and are deleted at the next daily cleanup after that. The same keyed hash on the guest plan row is kept with that row, with no automatic deletion. Device type, the likely-bot flag, and plan settings (servings, dinner count, max minutes, source, and freezer choices) stay on an expired guest plan row along with the keyed session hash. Choosing to save it carries the plan into your account. We log demo creation and deliberate builds separately to understand use. We also record registration page views, registration submits, whether a saved plan was carried, and email confirmation, keyed by the session hash and the guest plan id, with no email address and no link. When guest-plan ad measurement is enabled and you allow ad cookies, the first plan you deliberately build in that guest session can send Google a random conversion identifier. Opening the ready-made week and later rebuilds do not send additional conversions. If you build before choosing, allowing ad cookies while you stay on that planner page can send that pending event; leaving the page discards it. We do not send Google your dinners, shopping list or freezer choices. This guest event does not restore advertising click identifiers from our server session; Google may receive a valid click identifier still present in the page URL when its tag starts. Guest measurement follows the same optional cookie choice and withdrawal controls described above.

Household sharing

If you create a household invitation, we store the invited email address, invitation status, sharing updates and email sending status. We email the person you invite and notify the other person when an invitation is accepted, declined or sharing ends. These service messages do not subscribe anyone to marketing. An accepted member can view your saved dinners and edit your shopping list. Your freezer settings and account details are not shared. You can remove access, decline an invitation or leave a shared household from Household sharing. Removing access leaves the owner’s dinners and shopping items in place.

Activity and security monitoring

We record account-linked activity such as creating plans, saving or copying shopping lists, cooking dinners and providing feedback. Internal aggregate reports and PostHog help us understand use and improve Stirwise. PostHog receives selected action names, timestamps and internal account and plan IDs; these are not anonymous source records. For recognised campaign visits, PostHog also receives landing, registration-page, form-start, registration and email-verification milestones, timestamps and approved campaign/source/medium labels linked by an opaque pseudonymous session identifier. This session funnel is separate from account-linked product activity; it does not identify a unique person. We do not send names, emails, dietary details or feedback text to PostHog. The server export does not send browser IP addresses. PostHog records anonymised sessions, clicks, heatmaps and surveys on the home page, meal planner, freezer inventory, guest plan and register page (inputs masked, no cookies). Opting out in Cookie choices stops PostHog in your browser, but the server-side campaign milestones described above and our planner usage counts still run. Laravel Nightwatch provides operational monitoring. Our request filtering removes query strings, request bodies, headers and IP addresses from Nightwatch request events and retains an internal account ID. Infrastructure, security, exception and support logs may still contain technical or personal information.

Cookies and browser storage

Session and CSRF cookies support sign-in and security. Cloudflare may set bot-protection cookies. Appearance and sidebar preferences use cookies, and theme preferences, dismissal of the install suggestion, your optional ad-measurement choice, your anonymous-analytics opt-out and whether you've already seen the planner question use browser storage. The anonymous analytics id stays in session storage for the tab and is not a cookie. Our service worker shows a reconnect screen when offline; it does not cache your private meal plans or queue changes. Google advertising cookies are optional and load only after an explicit choice. Dismissing the old informational notice never grants this permission. Optional ad measurement is separate from permission to email you about Stirwise. You can clear storage in your browser; blocking essential cookies may prevent sign-in and saving.

In-app subscriptions

RevenueCat processes an app user id, purchase data, and entitlement data, including store receipt data when you subscribe. The iOS app can send that app user id once you are signed in, even if you do not subscribe. Purchases are processed by Apple. Stirwise Pro is not sold in the Android closed test. We do not receive your card number. Once you are signed in, the iOS app sends your Stirwise account id to RevenueCat. That links the RevenueCat app user id to your account. We keep an entitlement with your account when a RevenueCat update matches the app user id stored on the account. That record stores the product identifier, the store, whether it will renew, the expiry time, and the subscriber snapshot without the attributes RevenueCat sent. We mark that entitlement active when it is from a recognised store, still inside its period, and not refunded. A trial is active for that period. We also keep RevenueCat event identifiers and event types. Those event records are not stored on your account. We remove those event records after 90 days. The account PDF export does not include the app user id or the entitlement record. Deleting your account removes the app user id and the entitlement record, with the other application records described in Retention and deletion. Deleting your account does not remove those event identifiers. Apple and RevenueCat keep their own copies under their policies.

Service providers and overseas handling

The application is hosted on Laravel Cloud in Sydney. Hosting and security services, including Cloudflare, Laravel Nightwatch and PostHog (United States), process information to operate and protect the service. Household sharing updates, welcome and getting-started messages, account verification, password-reset, account-deletion confirmation and account-security emails may be delivered through Loops when enabled; this includes the recipient name or email and the link needed for that message. Grocery searches, when enabled, send search terms and shopping-location inputs to WhichGrocer, not your account credentials. When in-app purchases are on, the iOS app uses RevenueCat, as described under In-app subscriptions. These providers may process information outside Australia. Contact us for current provider and processing-location details. We do not sell your personal information or add access-request details to a marketing mailing list.

Retention and deletion

Access requests and campaign-measurement records are scheduled for removal from the application database after 90 days, or earlier on request. Account and planning information is kept while your account exists. You can export your planning data from the app. You can delete your account in the iOS or Android app, or from the Delete account page on this website without signing in. We email a confirmation link to the address you enter. The link expires after 60 minutes. Opening the link does not delete the account. Deletion happens only after you confirm on that page, and the link works only while that address is still the account email. Deleting an account removes its associated application records; a separate access request may remain until it expires or is removed on request. Backups, provider logs and support correspondence may persist separately and are not erased immediately by account deletion. Deleting the Stirwise account does not cancel an Apple subscription. Contact us about these records and applicable retention periods.

Your choices and complaints

You can correct account details in the app, forget remembered product choices, export your data, or delete your account in the app or from the Delete account page on this website. Email robert@stirwise.app to access or correct other records, leave the Android closed test, or raise a privacy complaint. We may need to verify your identity before acting. We will review your concern and respond using your contact details. If you are not satisfied, you can contact the Office of the Australian Information Commissioner to ask about available complaint options.

Changes to this policy

We will update this page when our practices change. Material changes affecting people who use Stirwise will be communicated before introducing the changed use where required. This policy does not give blanket permission for unrelated marketing or new tracking.

Delete your Stirwise account Help, account controls and contact details