Privacy Policy
ROOTED rates products against published standards and maps places to buy real food. It runs on very little of your data, and this page says exactly what that is.
The short version
- You can use almost all of ROOTED without an account. An account needs an email address and a password.
- We do not run advertising, we do not sell or share your data for advertising, and there are no ad or tracking SDKs in the site or the app.
- The website sets no cookies. Preferences live in your own browser and never leave it.
- Payments are handled by Stripe. Your card number never reaches us.
- Your location is used to centre the map and is never stored by us.
- Assistant questions are answered by Anthropic's Claude and are sent only after you allow it. ROOTED does not store your questions. It keeps a count of how much of the monthly allowance a member has used, and it keeps the answer to a first question for up to 24 hours with no account attached.
- You can delete your account, membership and data yourself, in the app, in one step.
1Who we are
ROOTED is published by Jack Basseer, Santa Monica, California, United States. For anything in this policy, write to team@rootedapproved.com. We are an online-only business and email is our primary contact route; requests made from inside your account count as well.
2What we collect and why
Everything below was written from the site's own code, not from a template. If it is not in this table, we do not collect it.
| What | When | Why | Where it goes |
|---|---|---|---|
| Email address, password | When you create an account | To sign you in and to send sign-up confirmation and password-reset emails | Supabase, our sign-in and database provider. Passwords are stored hashed; we never see them. |
| Name (optional) | Only if you give one when you create an account | Shown to you on your profile | Supabase, stored as your account's name. Leave it blank and nothing is stored. |
| Membership status | When you start or change a membership | To know whether the member features are switched on for you | Stripe handles the purchase. To start it, our server sends Stripe your email address and your ROOTED account ID, so the payment can be matched to your account. We store your Stripe customer ID, subscription ID and status, your membership tier, whether the membership will renew, the dates your paid period and any grace period end, and whether a payment is in dispute, in the account database. |
| Payment event log | When Stripe tells our server about a payment, a renewal, a refund or a dispute | So each event is applied once, and so there is a record of why a membership changed | Supabase: Stripe's ID for the event, its type, the time, what we did with it and your account ID. No card data, no amounts and no email. If an event cannot be matched to an account, we keep Stripe's customer and subscription IDs for it and retry the match for 30 days. |
| Payment details | When you pay | To charge your membership | Stripe only. Card number, billing name and address are entered on Stripe's checkout page and never touch ROOTED's systems. |
| Assistant questions | When a member asks the ROOTED Assistant or the map's AI search | To generate the answer | Nothing is sent until you allow it: the first time you ask, the app explains what is sent and to whom, and you choose Allow or Not now. You can withdraw it in Profile. Once allowed, the question is sent through our own server to Anthropic's Claude with up to the last eight messages of your conversation and the ROOTED product or listing records relevant to it; for a map search, what you typed and the area searched. Your name, email and account are not sent. ROOTED does not store your questions or the conversation. The answer to the first question in a conversation is kept for up to 24 hours, as the answer cache row below says. |
| Assistant usage count | Each Assistant message | Daily and per-minute limits so a runaway script cannot run up a bill | Two counters keyed to your account ID, kept on Cloudflare: the daily one for about 26 hours and the per-minute one for about two minutes, then gone. |
| Assistant allowance counter | Each Assistant answer that uses a member's monthly allowance | To enforce the allowance of 400 units per month | Supabase, one row per member per month: your account ID, the start date of your monthly window, the units used and the number of in-depth answers used. No question text and no answer text. Deleted with your account. |
| Assistant answer cache | When the Assistant answers the first question in a conversation, or a map search | So that the same question, asked again by anyone, can be answered without a new request to Anthropic and without using the allowance | Cloudflare, for up to 24 hours: the answer, filed under a one-way fingerprint of the question and of the ROOTED records sent with it. The question itself, your account ID, your name and your email are not stored with it, so it is not tied to you. If a question included personal details, the answer may repeat them, so please leave them out of questions. |
| Assistant and map-search counts (aggregate) | Each Assistant question and each map search | To see how often each feature is used and what it costs to run | Cloudflare: the date, which route answered, the model, token counts and speed. No account ID and no question text, so a count is not tied to you. |
| Your location (precise) | Only if you tap "use my location" and allow it | To centre the map on you | Read by your device and used on the spot. Never stored or sent to ROOTED. See the note below about map services. |
| Your approximate location (from IP address) | The first time you open the map in a session | To start the map somewhere useful without asking permission | Your IP address is sent to GeoJS, which returns a city-level location. The result is kept in your browser for the session and never sent to ROOTED. |
| Map searches | When you type a city, zip code or address into the map's search box and search | To find the place you typed so the map can move there | The text you typed is sent to OpenStreetMap's Nominatim service, which returns that place's coordinates. It goes straight from your browser to Nominatim, never to ROOTED, with no account, name or email attached. Nominatim receives your IP address in the act of answering, like any website. |
| Metro requests | If a member asks us to add their area to the map | To count which areas to build next | Your account ID and the area's name, stored in Supabase against your account. Deleted with your account. |
| Newsletter email | Only when you type it into the newsletter box and press Join | To send the newsletter | Mailchimp. This is separate from your account. |
| Site usage (aggregate) | Every page view | To see which pages are read | Cloudflare Web Analytics: page URL, referrer, browser and operating system type, country and load time. It sets no cookies and does not identify or follow individual visitors. |
| Error reports | Only when something in our own code throws an error in your browser | To find and fix faults we would otherwise never hear about | Sentry, our error monitoring provider: the error and where in our code it happened, your browser and operating system type, and the page path with any query string removed. We switch off Sentry’s session recording and performance tracing, and we strip your account from the report before it is sent, so an error is not tied to you. Sentry receives your IP address in the act of receiving the report and we do not store it. Reports come only from the website: the app does not send them. |
| Request logs | Every request | Serving the site and its services, and stopping abuse | Netlify (the website host), Cloudflare (our small server functions) and Supabase (sign-in and the account database) receive the usual request metadata, including IP address, for a limited time. |
A note on the map
The map's tiles come from CARTO, so as you pan and zoom, CARTO's servers receive requests for the area you are looking at, like any online map. To label the map with the city it is showing, the centre of the view, rounded to about a kilometre, is sent to OpenStreetMap's Nominatim service. When you search the map for a place, what you typed in the search box is sent to the same Nominatim service to find it. None of these requests carries your name, your account or your precise position, and ROOTED keeps none of it.
3What stays on your device
The website keeps a small number of settings in your browser's local storage: card style, colour theme, home-screen layout, navigation style, which Rooted U lessons you have finished, a cache of which product images loaded, and two lists that make Recommendations work: the products you saved and the products you recently viewed. It also keeps your choice about sending Assistant questions to Anthropic, if you have made one. If you are signed in, your sign-in session token is stored there too; it is sent only to Supabase and to ROOTED's own server functions, to show that a request comes from you. None of the rest is transmitted to ROOTED or anyone else, and clearing your browser data removes all of it. The app stores the same things inside the app.
4What we do not do
- We do not sell your personal information, and we have not sold it in the past twelve months.
- We do not share your personal information for cross-context behavioural advertising, and we do not run advertising at all.
- We do not use Google Analytics, Meta Pixel, or any advertising or attribution SDK, and nothing on the site records your session. Twelve scripts load on the site. Ten are served from our own domain: four are our own copies of open-source map, icon and sign-in libraries, two of which are fetched only when you open the Local Food Map, and six are the site’s own code. The other two are Sentry, which reports errors thrown by our own code, and Cloudflare Web Analytics, which counts page views without cookies and without identifying anyone. Sentry’s session replay and performance tracing are both turned off.
- We do not set cookies.
- We do not build profiles or make inferences about you.
- We do not collect sensitive personal information beyond the password that signs you in, and we use that only to sign you in.
5Who receives your data
These are the service providers ROOTED runs on. Each receives only what its row says, only to provide that service to us, and each publishes its own privacy policy.
| Provider | Receives | For |
|---|---|---|
| Supabase | Email, optional name, hashed password, membership fields, the payment event log, the Assistant allowance counter, metro requests; request metadata including IP address | Sign-in and the account database |
| Stripe | Name, email, payment card, billing address; your ROOTED account ID | Membership payments and the billing portal |
| Anthropic | Assistant question text, the last few turns of that conversation, and the ROOTED records relevant to it | Generating Assistant answers. Under the commercial terms we use, Anthropic does not train its models on this data. |
| Mailchimp | Newsletter email address, on sign-up only | The newsletter |
| Cloudflare | Request metadata for our server functions; aggregate page-view analytics and aggregate Assistant and map-search counts; the Assistant usage counters; Assistant answers held for up to 24 hours with no account attached | Running the image, payment, Assistant and food-data functions, and site analytics |
| Sentry | Errors thrown by our own code: the fault and where it happened, your browser and operating system type, and the page path without its query string. Not your account, not your name, not a recording of your session | Finding and fixing faults |
| Netlify | Request metadata | Hosting the website |
| CARTO | Map tile requests for the area on screen | The map's base layer |
| OpenStreetMap Foundation | The map view's centre, rounded to about a kilometre; the text you type into the map's search box | Naming the city the map is showing, and finding the place you search for |
| GeoJS | Your IP address, once per session | A city-level starting point for the map |
Product images are fetched through ROOTED's own image function, so the brands and retailers whose products we rate do not see your visit. The USDA food directory that feeds part of the map is read in bulk by our server; no query of yours reaches the USDA. We may also disclose information if the law requires it, and we would say so here if that ever happened.
6How long we keep it
| Data | Kept |
|---|---|
| Account and profile | While your account exists. Deleted when you delete your account. |
| Membership records | Your membership fields and records are deleted with your account. Deleting your account cancels your membership but does not delete Stripe's record of you as a customer (name, email, billing address and saved card), and Stripe keeps its record of past transactions for as long as financial regulations require it to. |
| Assistant conversations | Your questions and the conversation are not stored by ROOTED: the conversation lives in the page while it is open and is gone when you close it. The one exception is the answer cache below. Messages you send to the ROOTED Assistant are processed by Anthropic. Under Anthropic's commercial terms, your messages are not used to train their models. Anthropic's retention of API data is governed by their published commercial data retention policy at platform.claude.com. Content flagged for a usage policy violation may be retained longer. |
| Assistant usage counters | About 26 hours for the daily counter and about two minutes for the per-minute one. |
| Assistant allowance counter | While your account exists. There is one row per month, and past months are not deleted on a schedule today. All of them are deleted when you delete your account. |
| Assistant answer cache | Up to 24 hours, then gone. It is not tied to an account, so deleting your account does not remove an answer sooner. |
| Payment event log | Kept as a record of what happened to a membership, and not deleted on a schedule today. When you delete your account, your account ID is removed from it and the rest of each entry stays: Stripe's ID for the event, its type, the time and what we did. An event that never matched an account keeps Stripe's customer and subscription IDs. |
| Location | Never stored by ROOTED. The IP-based city estimate is kept in your browser for the session only. |
| Map searches | Never stored by ROOTED. OpenStreetMap Foundation's handling of the requests it receives is set out in its own privacy policy. |
| Metro requests | Deleted automatically with your account. |
| Newsletter address | Until you unsubscribe using the link in any newsletter. Deleting your account does not unsubscribe you, because the newsletter is a separate list. |
| Error reports | Held by Sentry under the retention period set on our project, then deleted. They are not tied to your account. |
| Request logs and analytics | A limited period set by the hosting providers, for security and operations, under Netlify's, Cloudflare's and Supabase's privacy policies. Analytics are aggregate and not tied to you. |
| Settings on your device | Until you clear your browser data or uninstall the app. |
7Deleting your account and data
You can do this yourself, without contacting anyone, on the website and in the app.
- Open Profile and choose Delete Account.
- Type DELETE to confirm, then press Delete my account.
- That is all. What happens next runs on our server, in this order, and takes a few seconds.
- Your membership is cancelled, every subscription on your customer record, so nothing can bill you again.
- The unused part of your current billing period is refunded to your card, pro rata. If the refund cannot be processed automatically, the deletion still goes ahead and we settle the refund by hand.
- Your profile is deleted, including your name, membership fields and any metro requests.
- Your sign-in is deleted, so the email address and password no longer exist on ROOTED. Your membership records and your Assistant allowance counts are deleted with it.
If a step fails, nothing is left half-done silently: the page tells you exactly what was completed and what to do next. After deletion, what remains is only what section 6 says: Stripe's customer record and transaction record, the payment event log with your account ID removed, your newsletter subscription if you had one, settings on your own device, and whatever short-term logs the hosting providers hold. If you would rather we do it for you, email team@rootedapproved.com from the address on the account.
8Your rights, including under the CCPA
Everyone who uses ROOTED, wherever they live, can ask us to tell them what we hold about them, correct it, or delete it. California residents have these rights under the California Consumer Privacy Act, and this section is our notice under it.
Categories of personal information
| CCPA category | Examples we collect | Source | Disclosed to | Sold or shared |
|---|---|---|---|---|
| Identifiers | Email address, name, account ID; IP address in request logs | You; your device | Supabase, Stripe, Mailchimp, Netlify, Cloudflare (service providers); account ID also to Stripe | No |
| Commercial information | Membership status and payment history; how much of the Assistant allowance you have used | You; Stripe | Stripe, Supabase | No |
| Internet activity | Aggregate page views and feature counts; request logs; error reports from our own code | Your device | Cloudflare, Netlify, Sentry | No |
| Geolocation | City-level estimate from IP; the map area on screen; places you type into the map's search. Precise location only on your device, with your permission, never collected by us | Your device | GeoJS, CARTO, OpenStreetMap Foundation | No |
| Sensitive: account credentials | Your password, hashed | You | Supabase | No |
| User content | Assistant questions | You | Anthropic | No |
| Inferences | None | No |
We use each category only for the purpose in section 2 and keep it only as long as section 6 says. We do not use or disclose sensitive personal information for any purpose other than signing you in.
Your rights
- To know what personal information we have collected about you, from where, why, and to whom it was disclosed.
- To delete it. Section 7 is the fastest way; email works too.
- To correct inaccurate information. Your name can be edited in your profile; for anything else, email us.
- To opt out of sale or sharing. We do neither, so there is nothing to opt out of. We treat a Global Privacy Control signal from your browser as an opt-out request anyway.
- To limit the use of sensitive personal information. We already use it only to sign you in.
- Not to be discriminated against for exercising any of these rights. Nothing about your membership or access changes if you do.
How to exercise them
Delete or correct from inside your account, or email team@rootedapproved.com. To verify a request made by email, we ask that it come from the address on the account, and we may reply to that address to confirm before acting. An authorised agent may make a request for you if they provide your signed permission and we can confirm the request with you. We answer within 45 days, and if we need longer we will tell you why. We do not offer financial incentives in exchange for personal information.
9Security
The site is served only over HTTPS with strict transport security and an enforced content security policy that limits which services the page can talk to. Passwords are hashed by Supabase and are never visible to us. From the site and the app, your profile row can be read only with your own sign-in token. One of ROOTED's server functions, the one that handles payments and account deletion, holds an administrative key to the account database; it is kept as a secret on Cloudflare and is never sent to a browser. Card details are handled entirely by Stripe. No system is perfectly secure, and if we ever learn of a breach affecting your data we will tell you.
10Children
ROOTED is not directed at children and we do not knowingly collect personal information from anyone under 13. We do not sell anyone's information, including that of anyone under 16. If you believe a child has created an account, email us and we will delete it.
11The iOS and Android app
The app is the same site inside a native shell, and everything on this page applies to it. The app asks the operating system for location permission only when you tap "use my location", and you can withdraw that permission in your device settings at any time. The app does not track you across other companies' apps or websites and contains no advertising or tracking SDK. Account deletion is available inside the app exactly as described in section 7. The app does not send error reports to Sentry.
12Changes and contact
When this policy changes, the effective date at the top changes with it and, for anything material, we will say what changed. On September 28, 2026 map searches were added to sections 2, 5, 6 and 8: what you type into the map's search box was already being sent to OpenStreetMap's Nominatim service, and this policy did not say so. On September 29, 2026 the policy was corrected to what the site's code does, and the name was made optional at sign-up: Stripe receives your ROOTED account ID; Stripe's customer record survives account deletion; Supabase receives request metadata; the sign-in token is sent to our own servers and Supabase; the app sends no error reports; and Assistant questions are sent only after you allow it. On October 6, 2026 the Assistant allowance counter, the Assistant answer cache, the aggregate Assistant and map-search counts and the payment event log were added to sections 2, 5, 6, 7 and 8, and the short version was changed to match: ROOTED now keeps the answer to a first question for up to 24 hours. Section 9 was corrected: one server function holds an administrative key to the account database, and the policy had said none did. Questions, requests and complaints: team@rootedapproved.com.