What we collect,
what we don't.
Last updated 2026-08-26. This policy was AI-drafted and has not yet been through legal review. If you rely on any specific point, please email hello@trydonebylunch.com.
The short version
We collect the minimum needed to give you an account, keep the site working, and eventually deliver Pro when the payment provider is chosen. We don't sell your data, we don't build advertising profiles about you, and we don't rent your email to third parties.
What we collect
- When you join the notify list — just your email address and a source tag so we can email you when Pro opens. Stored in a Cloudflare KV bucket keyed by a SHA-256 hash of the email.
- When you create a free account — email address (for magic-link login or Google sign-in) and, optionally, a display name and role category you tell us about yourself. Stored in Supabase Auth + a profiles table.
- When Pro opens — a future payment provider will handle payment and receive whatever it needs to charge you. We ourselves will only receive your email and the fact that Pro is active on your account.
- When you browse the site — Cloudflare's edge logs (IP, user-agent, request path) for security and diagnostics, plus lightweight event counters (page views, which prompts were opened) so we can improve the library. Aggregated, not tied to your account.
- Marketing pixels — Meta and TikTok pixels fire on public marketing pages when we're running ads. Block them with a standard ad blocker or opt out through Meta's / TikTok's own settings; they never fire inside the paid vault.
What we don't collect
- The prompts you write, the answers you get from AI tools, or anything you paste into them — those live between you and the AI vendor you use.
- Credit-card numbers — we don't touch card data at all today.
- Contacts, location, camera, or microphone.
How to reach us
Email hello@trydonebylunch.com — we'll answer within two business days. To delete your account and any associated data, ask us there.
Legal basis (for EU/UK visitors)
Contract (delivering the account), legitimate interests (running the site securely), and consent (marketing pixels — refusable via cookie/ad-blocker controls or platform settings).
DoneByLunch is operated by an independent seller. Questions about the underlying data flow? Start with us — we'll walk you through it.