Dinner Plan by Escape Plan Software

Privacy notice

Last updated 25 October 2026 · applies to getdinnerplan.com

This notice covers Dinner Plan. It adds to our company privacy policy; where they differ, this notice applies to Dinner Plan. The data controller is Escape Plan Software Ltd, company number 17262078, Suite 10906, 5 Brayford Square, London E1 0SG, United Kingdom. Contact: hello@escapeplan.software.

Your answers

To build your plan we ask for your country, how many adults and kids eat dinner, your weekly dinner budget, how many dinners you want, diet choices (vegetarian, gluten-free, dairy-free, nut-free), foods to leave out and how long you can cook. We also ask three optional questions that only change the wording of your results page: what you want from the week, the hardest part of dinner for you, and the day you usually shop. Those three answers travel in your results link as plain words (for example "h=para"), not encrypted; they say nothing about your health or beliefs.

Some of these can say something about your health: gluten-free, dairy-free and nut-free, and anything about allergies or health needs in a note you write (see "Changes in your own words"). We only use these if you tick the box that appears when you choose them, and only to choose your dinners. Vegetarian and the foods you leave out are used the same way but don't need that box. Your answers are encrypted into your plan link. Our server decrypts them only while it builds your plan, keeps the result briefly in memory to answer your next request faster, and doesn't store them. When you pay, the encrypted reference from your plan link goes to Stripe and Link with your payment so that you get the right plan. They don't decrypt it, but like the link itself it would open your plan preview on our site. We never send your answers or your plan to Meta or any advertiser.

Health-related answers

What: gluten-free, dairy-free and nut-free choices, and any allergy, intolerance or health need you mention in a note. They may be about you or someone you cook for.

Why: only to leave out dinners you can't eat and to follow your note. We don't use them for ads or anything else, and we don't try to work out anything about your health from them. Our anonymous daily totals count only how often the consent box is shown, ticked and withdrawn, never which choice.

Legal basis (UK): your explicit consent, given with the tick box (UK GDPR Article 9(2)(a)), together with the steps you ask us to take before buying and, after you pay, our contract with you (Article 6(1)(b)). We record that you ticked the box, which version of its wording you saw and the day, with your encrypted answers.

How long: before you pay, they exist only in your plan link. After you pay, they stay in the encrypted reference held with your Stripe and Link order, and our server reads them each time it builds your plan.

Who handles them for us: Cloudflare, which runs our server, and Anthropic, which reads your note (see "Changes in your own words"). Both act only on our instructions. Common health phrases in a note, such as "nut allergy" or "coeliac", are turned into plan settings on your device and on our server and aren't sent to Anthropic.

Withdrawing consent: use "Stop using my health-related answers" on your plan page, or email hello@escapeplan.software. From then on we ignore those answers and your note, and your plan will no longer avoid those foods. Withdrawing doesn't affect plans we built before. To remember that you withdrew, we keep a one-way hash of your checkout reference and the time, for six years.

US residents: see our Consumer Health Data Privacy Policy.

Anonymous counts

We count, as daily totals, how many times pages and quiz steps are viewed, plans are built, checkout is started and payments are completed, how often people accept or reject the cookie choice or opt out of sharing, and how often the pay button is pressed before the UK consent box is ticked, how often the UK consent step appears on the plan page and is completed, how often plans are opened, how often a list is shared or copied, cooking mode is opened and the plan is added to a home screen, how often the health-data consent box is shown, ticked and withdrawn (never which choice), how often checkout or delivery fails or is refused because of the buyer's country, how often our server fails to answer, how often a plan is emailed from the preview page and how often tips and offers are asked for and confirmed, how many emails we send and why we didn't send one (for example, because someone turned them off), how often links in our emails are clicked, how often people turn emails off, and how many plan-link requests we receive and whether a purchase was found. Each count holds only the event, the day, the ad code from the link you arrived by (for example "m3"; for emails, the type of email or link instead), which offer was shown, US or UK, and your approximate region (US, UK or other), worked out from the country Cloudflare tells us (we don't store the country itself). It holds no cookie, IP address, device identifier or anything else that could identify you. We use these totals to see which ads and pages work (our legitimate interest in running and improving the service) and keep them for 25 months.

Changes to your plan

You can swap, remove or add dinners and ask us not to suggest a dinner again. Before you pay, these changes are encrypted into your plan link with your answers, and our server doesn't store them. After you pay, we keep your changes so your plan link keeps showing them: which dinners are in your plan for the week (recipe codes such as "r014") and which ones you asked us not to suggest, linked to a one-way hash of your Stripe checkout reference, and nothing else about you. We delete them 13 months after you last open your plan. The anonymous daily totals above also count how often plans are changed and how many changed plans are bought.

Changes in your own words

You can tell us what you want this week in a short note, for example "no fish, use up the spinach". To read it, we send the note, and nothing else about you, to Anthropic, whose Claude model turns it into plan settings such as "leave out fish". Our code then picks the dinners from our own recipes and works out every amount and price. Anthropic acts as our processor under its Commercial Terms and Data Processing Addendum. It doesn't use what you type to train its models, and it deletes it within 30 days, unless its safety systems flag misuse or the law requires it to keep it longer. We don't store your note, count it, put it in any link or send it to Meta or any advertiser.

What we keep is the result: before you pay, the settings travel encrypted in your plan link with your other answers; after you pay, the dinners we picked are kept like any other change to your plan (above), with a note that the week was changed in your own words (not what you asked for), and the settings themselves travel encrypted in your plan page's link and stay on your device (below), so swaps and added dinners keep following them; we don't store them. On another device, those settings aren't there and the page says so. The anonymous daily totals above also count how often the note is used, which kinds of setting it led to (such as "leave out an ingredient") and how often we couldn't do what was asked, never what you wrote. To stop abuse, we count notes per plan link or checkout reference for up to three days, using a one-way hash; we count notes per IP address for up to three days, using a keyed hash that changes every day; and Cloudflare limits how many notes one IP address can send. We don't store IP addresses. Because a note can mention an allergy or a health need, we only send it after you tick the box described under "Health-related answers", and we use it only to choose your dinners. Our legal basis is that consent, together with the steps you've asked us to take before buying and, after you pay, our contract with you.

Payments

Your order is sold through Link: Sold through Link, LLC, a Stripe company, is the merchant of record. Link and Stripe collect your card details, name, email address and billing address, work out any sales tax or VAT, and email you receipts; we never see your full card number. Link shares your order details with us, including your name, email address, billing address, what you bought and whether the payment succeeded. We use this to give you your plan, manage your subscription, handle refunds and support, prevent fraud and keep the records the law requires (UK tax and accounting records are kept for six years). Link and Stripe use your data as controllers for their own purposes, such as payments, tax, fraud prevention and your Link account, as described in Stripe's privacy policy for Link. If you ask Link to delete your data, Link also cancels any subscription you bought through it.

To make sure a completed payment is counted once, we keep a one-way hash of the Stripe checkout reference for 35 days. It can't be turned back into the reference.

The ad code from the link you arrived by is kept with your order. If that link came from one of our partners, the code is the partner's (for example "p001"): it travels in the links on our site and in your plan link, with no cookie, and we use it to pay the partner a share of your payments (our legitimate interest in paying partners correctly). We tell the partner only the amounts and dates, never who you are.

If you're a UK customer and confirm on your plan page that you want your plan straight away, we keep a record of that confirmation: a different one-way hash of the checkout reference and the time you confirmed. We keep it for six years, as evidence for any dispute about your right to cancel.

Emails

We only email you about Dinner Plan:

If you subscribe, we may also write to you about a price change, a change to our terms, or if we stop the service, as our terms of sale say.

Our legal basis for these emails is our contract with you (sending what you bought), for the email you ask for on your plan preview, taking the step you asked for before buying, and, for the UK confirmation, a legal obligation. For the plan-link form, the limits on repeated requests and the record of people who turned emails off, it's our legitimate interest in answering your request, preventing abuse and respecting your choice. For the one invitation to come back it's, in the US, our legitimate interest in telling customers about the same service, with the right to say no in every email, and in the UK your consent. You can stop promotional emails at any time; we never send them to people who haven't bought from us, unless they signed up for tips and offers (below).

Unless you sign up for tips and offers (below), we don't keep your email address. We read it from Stripe and Link each time we send an email. To make sure each email goes only once, we keep one-way hashes, never the address or reference itself:

A keyed hash can't be turned back into your address. When you ask for a plan link, the address you type is sent to Stripe to look up your purchase; we don't store it, and we keep a keyed hash of it for up to 3 days to limit repeated requests. When you ask us to email your plan from the preview, we use the address only to send that email; we don't store it, and we keep a keyed hash of it for up to 3 days to limit repeated requests (and, if you tick the box for tips and offers, for 8 days, as described below). To stop abuse of these forms, Cloudflare also limits how many requests one IP address can make, and for "Email me this plan" we count requests per IP address for up to 3 days, using a keyed hash of it; we don't store IP addresses.

Tips and offers. If you tick "Send me dinner tips and offers" and then confirm with the button in the email we send you, we keep your email address, your country (US or UK) and when you confirmed, so we can email you dinner tips and Dinner Plan offers now and then. If you don't confirm within 7 days, we keep nothing about you except the 8-day record below. Our legal basis is your consent. If you leave our checkout without paying, one of these emails may be a single reminder, a few hours later (at most about a day), with the first dinners of your plan, its estimated total compared with your budget and a link back to it. Before we send it, we look up your address in Stripe to check that you haven't already bought from us. To send it, when you tick the box (even before you confirm) or if you've already confirmed, we keep a one-way hash of your plan link next to the keyed hash of your address for 8 days, and a keyed hash of your address for 40 days, so we send you at most one such reminder in 40 days. Every such email has a link to unsubscribe; when you unsubscribe, we delete your address and keep only the keyed hash so we can respect your choice. Otherwise we delete it 2 years after you confirmed.

Cloudflare sends our emails as our processor. It keeps delivery records (recipient, subject and whether the email was delivered) for up to 31 days, and a list of addresses that bounced or reported our emails as spam so they aren't emailed again. Our promotional emails (today, the one reminder after you leave checkout and the one invitation to come back) are sent instead by Postmark (AC PM LLC, part of ActiveCampaign) as our processor. Postmark keeps each email and its delivery records for up to 45 days, and a list of addresses that bounced, reported its emails as spam or unsubscribed, so they aren't emailed again. Our emails contain no tracking pixels. Links in them carry the type of email and your country (US or UK). Links to your plan carry the same private checkout reference as your plan link; the link in a plan-link email carries it encrypted and stops working after 24 hours; the link to turn off weekly emails and the unsubscribe link in promotional emails carry the keyed hash of your address; the links in the reminder after checkout and in the invitation to come back carry your encrypted plan link or answers, like the link to your plan preview. The link in an "Email me this plan" email carries your encrypted plan link, like the preview page, and the button to confirm tips and offers carries your address encrypted and stops working after 7 days.

Cookies, the Meta pixel and the Google Ads tag

In the UK, and when we can't tell which country you're in, this site sets no cookies and loads no third-party scripts until you choose Accept. In the US, if we're running Google search ads, the Google Ads tag described below is on unless you opt out. Your browser remembers your cookie choice so we don't ask again.

On your plan page, your browser also keeps a few things on your device so the page works the way you use it: which list items you've marked as bought or as already at home, the encrypted settings from changes in your own words, a copy of your plan and of the site's files so your plan and recipes open without a connection, whether you closed the home screen tip and, if you add the plan to your home screen, the link to your plan so the home screen app can open it, and that the home screen app has been opened once (so it's counted once). These stay on your device and aren't shared with anyone; the saved plan link is used only to load your plan from our server, as your link always is. Clearing this site's data in your browser removes them.

If we're running ads, we may use the Meta pixel. In the UK, and when we can't tell which country you're in, we ask first with a short cookie choice at the top of the page. In the US there's no cookie choice: a short notice and a "Do Not Sell or Share My Personal Information" link at the bottom of each page let you opt out. Only if you choose Accept, your browser loads Meta's script, which sets Meta cookies and tells Meta that you visited, viewed your plan preview, started checkout and, if you buy, the amount and currency. When you accept and then buy, our server may also tell Meta about the purchase directly (Meta's Conversions API), including a one-way hash of your email address so Meta can match it to an ad. Meta uses this to measure and improve our ads; we and Meta are joint controllers for collecting and sending it, and Meta's own use is covered by Meta's privacy policy. Our legal basis is your consent. You can change your choice any time with "Cookie settings" (UK) or "Do Not Sell or Share My Personal Information" (US) at the bottom of each page. If your browser sends a Global Privacy Control signal, we treat it as a Reject and an opt-out.

If we're running Google search ads, we use the Google Ads tag to count which ads lead to a plan preview and a purchase. In the UK, and when we can't tell which country you're in, it loads only if you choose Accept. In the US it loads unless you opt out with "Do Not Sell or Share My Personal Information" or your browser sends a Global Privacy Control signal. When it loads, your browser loads Google's script, which sets Google cookies (such as _gcl_au, and _gcl_aw if you arrived from a Google ad) and tells Google that you visited, that you opened your plan preview after the questions and, if you buy, the amount and currency and a one-way hash of your checkout reference so the purchase is counted once. Google sees the page address without its private parts: never your plan link's code or your checkout reference. We don't send your email address, your answers or your plan to Google, and ad personalisation is off. Google uses this to measure our ads, as an independent controller under its Google Ads Controller-Controller Data Protection Terms; see how Google uses information from sites that use its services. Our legal basis is your consent in the UK. If you reject or opt out later, the tag stops measuring and we delete the Google cookies set on our site; cookies Google sets on its own domains are covered by Google's own settings.

Hosting

The site runs on Cloudflare, which processes standard technical data such as IP address and browser type to deliver pages and protect the site from abuse, as our processor. We have switched off request logs. Cloudflare tells our server which country a request comes from; we use it to check that we can sell to you, to choose which cookie and privacy choices to show you and, reduced to US, UK or other, in the anonymous daily totals above; we don't store the country itself.

Who we share data with

We don't sell personal data. Stripe, Cloudflare, Postmark, Meta and Google are based in or transfer data to the United States; we rely on the UK Extension to the EU-U.S. Data Privacy Framework or the UK's International Data Transfer Addendum for these transfers. Our contract with Anthropic is with Anthropic Ireland, Limited; Anthropic may process your note in the United States under the EU Standard Contractual Clauses and the UK Addendum in its Data Processing Addendum.

Your rights

Under UK data protection law you can ask to access, correct or delete your personal data, to restrict or object to how we use it, or to get a copy. You can withdraw consent to the pixel and the Google Ads tag at any time, turn off the weekly emails with the link in any of them, and unsubscribe from tips and offers at any time. You can also object to marketing emails at any time, with the unsubscribe link in the email or by writing to us, and we'll stop. US residents have similar rights under their state's law, including the right to opt out of "sharing" for advertising; the "Do Not Sell or Share My Personal Information" link, Reject in the cookie choice or a Global Privacy Control signal does this. Email hello@escapeplan.software; we reply within one month. You can complain to the UK Information Commission (ico.org.uk).

You can withdraw your consent to health-related answers at any time (see "Health-related answers"). If you live in a US state with a privacy law that applies to us, such as Connecticut, you can also ask to correct your data or get it in a portable format, and if we refuse a request you can appeal by replying to our answer; we'll respond to an appeal within 45 days and tell you how to contact your state Attorney General if you disagree.

Children

Dinner Plan is for adults; you must be 18 or over to buy.

Changes

When we change this notice we update the date at the top. If a change affects how we use your data, we'll say so here before it applies.