Privacy Policy

Effective October 22, 2026

This Privacy Policy explains what information Shop with MiMi collects, why, who we share it with, and the choices and rights you have. It applies to the website at shopwithmimi.com, the app and MiMi, the in-app coach (together, the "Service").

The short version:

• We collect what you enter to plan meals and shop: your account, your profile (including health-related details like weight and goals), your household, allergies, and your plans and lists.
• We don't sell your personal information. We don't use it for targeted advertising. We don't have ads, and we don't use advertising or analytics trackers.
• We share information only with the companies that help us run the Service (such as our hosts, our email sender, Stripe for payments and Kroger when you ask us to fill your cart), and only for that purpose.
• You can delete your account and its data any time in the app, and you can ask us for a copy of your data.

1. Who we are

Shop with MiMi ("we", "us", "our") is a sole proprietorship based in the Dallas–Fort Worth area of Texas. We are responsible for your information.

Email: hello@shopwithmimi.com

2. Information we collect

What you give us

• Account: your email address and password. We store only a scrambled one-way hash of your password (bcrypt), never the password itself.
• Profile: name or nickname, age, sex, height, weight and goal weight, activity level, your goal (lose weight or maintain my weight; if you choose maintain, we don't ask for a goal weight), food preferences and dislikes, foods you already have, ZIP code, weekly grocery budget, and whether you prefer pickup or delivery.
• Health-related information (see section 4): weight, height, age, activity level, weigh-ins (optional if you're maintaining), goal weight (only if you're losing weight), your lose or maintain goal, whether you're pregnant or breastfeeding (a yes/no box), food allergies, areas of pain or soreness you tell MiMi about (for example, sore knees), and workouts and movement you log.
• Household: for each person you plan for, a nickname, age, diet, allergies, foods they won't eat, and portion settings. This may include children, whose information you enter as their parent or guardian (see section 9).
• Your day: routines you choose to share, such as a dog walk, gym time, workday pattern or meal-prep day, with optional times and lengths.
• Plans and shopping: your chosen Kroger store, meal plans, recipe ratings, grocery lists, products you swap or search for, your quality-tier choice, and what you sent to your Kroger cart.
• Messages with MiMi: what you write to MiMi and her replies, and your answers to check-ins.
• Your recipes: recipes you add yourself (typed, pasted into the chat with MiMi, or read from a photo), including the title, ingredients, amounts, steps, servings and any notes. They're private to your account and used to put your recipes in your plans and grocery lists.
• Recipe photos: if photo reading is turned on and you choose to snap or upload a photo of a recipe, we use the photo only to read the recipe text so you can review it. We don't save the photo: it's held in memory for that one request and then discarded. Only the recipe you review and save is kept. Photo reading is off until we enable an AI provider (see section 5).
• Notifications (optional): if you turn on reminders from MiMi, your device's push subscription (described below), your notification settings (on or off, quiet hours) and your phone's or browser's time zone (for example, America/Chicago), so reminders arrive at the right local time and never during quiet hours. We also keep a short log of what we sent you today, to limit how many reminders you get.
• Messages to us: emails you send us.

What we get from others

• Kroger: if you connect your Kroger account, Kroger gives us access tokens that let us add items to your cart (permissions called cart.basic:write and product.compact). We also get store, product, price and availability information from Kroger. We never see your Kroger password, your Kroger order history or your payment details, and we can't check out for you.
• Your browser's push service: when you allow notifications on a device, your browser gives us a push subscription (a web address at your browser maker's push service, such as Google, Apple or Mozilla, plus encryption keys) and your browser type. We store it so we can send that device reminders, and we delete it when you turn notifications off on that device, when the push service tells us it's no longer valid, or when you delete your account.
• Stripe: if you choose a paid plan, Stripe collects your card details, name and billing address on its own secure pages. We receive only your Stripe customer and subscription IDs, your plan, its status, renewal and cancellation dates, and whether a payment went through. We never receive or store your full card number.

What's collected automatically

• Cookies that make the Service work (see section 10).
• Technical information in our hosting and network providers' logs: your IP address, browser type, the pages and features requested, and the time. We use it for security, fraud and abuse prevention, rate limiting and fixing problems.
• On your device: the app saves a copy of your profile, chosen store and workout log in your browser's local storage so it loads quickly. It's cleared when you sign out or delete your account.

We don't use advertising cookies, third-party analytics, tracking pixels, social-media plugins or session-recording tools. We don't buy information about you from data brokers.

3. How we use information

We use your information only to:

• run the Service for you: estimate calorie and protein targets, plan meals for your household, leave out allergens and foods you avoid, build and price grocery lists at your store, add items to your Kroger cart when you ask, add your own recipes to your plans, suggest movement that fits your routines, and power MiMi's coaching and the reminders you turn on;
• run your account and subscription: sign-in, password-reset emails, your free trial, billing, and service messages such as receipts or important changes;
• keep the Service safe and working: prevent fraud and abuse, secure accounts, fix bugs, and make sure features work as intended;
• improve the Service: for example, by finding out which features fail or are hard to use. When we study usage, we use the smallest amount of information we can, and never your health information for anything other than providing the Service to you; and
• follow the law: meet legal obligations and protect rights and safety.

We don't sell your personal information, "share" it for cross-context behavioral advertising, use it for targeted advertising, or use it to make decisions with legal or similarly significant effects about you (such as credit, insurance, housing or employment). We don't use your information to train AI models.

4. Health information and your consent

Some information you give us is health-related, such as your weight, height, age, activity level, your lose or maintain goal, goal weight, pregnancy or breastfeeding status, food allergies, pain or soreness, and workouts. Some laws treat this as sensitive data or consumer health data.

• We collect and use it only with your consent, which you give when you create your account and choose to enter it, and only to provide the features you ask for.
• Most of it is optional. You can leave out details (for example, you don't need to tell MiMi about pain), but some features, like calorie targets, need basic details such as age, height, weight and activity level. We use them to estimate your daily energy needs: for a lose goal, a safe calorie target below that; for a maintain goal, a target at about that level.
• We never sell it, never use it for advertising, and never share it with anyone except the service providers who help us run the Service (section 5).
• You can withdraw consent by deleting the information or your account at any time.

Shop with MiMi gives general guidance, not medical advice. It isn't a healthcare provider, and the information you enter isn't covered by HIPAA. We protect it anyway as described in section 7.

Consumer health data (Washington, Nevada and similar laws)

This section is our consumer health data privacy policy:

• What we collect: the health-related information listed above.
• Where it comes from: directly from you (and, for household members, from you as the account holder).
• Why: to plan meals and portions, leave out allergens, set safe calorie targets for your lose or maintain goal, and coach you. Examples: pregnancy turns off weight-loss targets, and pain keeps those moves out of your suggestions.
• Who receives it: only the service providers in section 5, under contract, to run the Service. If we turn on AI features, also the AI provider named in section 5.
• Your rights: to confirm whether we have it, access it, see who we shared it with, withdraw consent, and delete it (section 8).
• We don't sell it, and we won't collect or share it for any other purpose without asking you first.

5. Who we share information with

We share information only as described here:

• Service providers that run the Service on our behalf, under contracts that limit how they can use your information:
  • Sevalla (application hosting and database). Our servers and database, which hold the information above, run on Sevalla.
  • Cloudflare (network, security and content delivery). All traffic to shopwithmimi.com passes through Cloudflare, which protects the site from attacks and speeds it up. Cloudflare processes technical information such as your IP address and the requests your browser makes.
  • Stripe (payments, subscriptions and sales-tax calculation). Stripe receives what you give it at checkout and the plan you chose. Stripe also acts as an independent company for payments under its own privacy policy.
  • Resend (email delivery). Account emails, such as password-reset links, are sent from hello@shopwithmimi.com through Resend, which receives your email address and the content of that email.
  • Your browser's push service (only if you turn on notifications). To deliver a reminder, we send an encrypted message to the push service your browser uses (for example, Google, Apple or Mozilla), which delivers it to your device. The message is the reminder text, such as a nudge to log a workout.
  • AI provider (only if enabled). AI features are off unless we enable an AI provider. While they're off, MiMi's replies come from software we built and run on our own servers, recipe photo reading is unavailable, and your messages and photos are not sent to an AI company. If we enable an AI provider, a third-party AI service acting as our processor may receive: your chat message and the context MiMi needs to answer (such as your plan, goals, routines and the health and household details described above), and, when you choose to read a recipe photo, that photo, to turn it into recipe text. We don't use OpenAI. Before we turn AI features on, we'll update this policy to name the provider, and tell you. We'll only use a provider that is contractually barred from training its models on your information.
• Kroger, at your direction. Connecting Kroger is optional; you can also copy your list to shop anywhere. When you search for stores, we send Kroger your ZIP code. When we price your list, we send product search words and the store ID, but not your name or health information. When you send items to your cart, we send product codes, quantities and your pickup or delivery choice, using the access you gave us. Kroger's privacy policy applies to your Kroger account.
• Legal and safety reasons, when we believe in good faith that it's required by law, subpoena or court order, or necessary to protect someone's safety, investigate fraud, or protect our rights.
• If the business changes hands (for example, if we form an LLC to run Shop with MiMi, or the Service is sold), your information may transfer to the new owner. It will remain subject to this policy, and we'll tell you before it's used in a materially different way.
• With your permission, in any other case.

We don't share your information with advertisers, data brokers, insurers or employers. Instacart isn't connected yet; if it is, we'll update this policy first.

6. How long we keep information

• Account, profile, household, plans, your recipes, chats, notification settings and progress: while your account is open. When you delete your account, we delete them from our live database right away.
• Kroger access tokens: until you delete your account (or until Kroger expires them). You can also remove our access in your Kroger account settings.
• Billing records: we delete our copy of your subscription details when you delete your account. Stripe keeps payment and tax records as required by law and its policies.
• Recipe photos aren't stored at all (see section 2).
• Push subscriptions are deleted when you turn notifications off on that device, when your browser's push service says they're no longer valid, or when you delete your account.
• Sign-in sessions expire after 30 days. Password-reset links expire after 1 hour and can be used only once.
• Server logs and database backups are kept by our hosting and network providers for a limited time and then deleted or overwritten automatically. Deleted data can remain in backups until they roll over, and we don't restore deleted accounts from them.
• Emails you send us are kept as long as needed to help you and for our records, and no longer than 3 years.

7. How we protect information

• All connections use HTTPS (encryption in transit).
• Passwords are stored only as bcrypt hashes.
• Kroger access tokens are encrypted with AES-256-GCM before we store them.
• Sign-in cookies are HTTP-only and secure, with protection against cross-site request forgery. Sign-in, sign-up and password-reset attempts are rate-limited.
• Access to our production systems is limited to the operator and protected with strong passwords and two-factor authentication.

No system is perfectly secure, so we can't promise that information will never be accessed without permission. Please use a strong, unique password.

If there's a breach. If we learn of a breach that affects your personal or health information, we'll investigate, contain it, and notify you without unreasonable delay (and no later than the law requires, generally within 60 days of discovery). We'll also notify regulators when required, such as the Texas Attorney General and, where the FTC's Health Breach Notification Rule applies, the Federal Trade Commission.

8. Your choices and rights

We give every US user the same rights, wherever you live:

• Access: see your information in the app, or ask us for a copy.
• Correct: edit your profile, household and settings in the app, or ask us to fix something.
• Delete: sign in, choose Delete account at the top of the app, and confirm with your password. This permanently deletes your account, profile, household, plans, your recipes, MiMi chats and progress, notification settings and push subscriptions, and the Kroger access we stored, and cancels your subscription. You can also ask us to delete specific information.
• Get a copy (portability): ask us, and we'll send your data in a common, machine-readable format (JSON).
• Opt out: we don't sell your data, use it for targeted advertising, or use it for profiling with significant effects, so there's nothing to opt out of. If that ever changes, we'll ask first. We don't send marketing email.
• Notifications: MiMi's push reminders are off until you allow them on a device. You can turn them off anytime in Me > Notifications or in your phone's or browser's settings, and set quiet hours. Reminders also appear inside the app.
• Withdraw consent to health-information processing by deleting it or your account.

How to make a request. Email hello@shopwithmimi.com from your account email address, with the subject "Privacy request." We may need to confirm it's you, and we won't ask for more information than we need to do that. We'll respond within 45 days. If we need more time (up to another 45 days), we'll tell you why. Requests are free, up to twice a year.

Authorized agents. Where the law allows, someone you authorize can make a request for you. We may ask for proof of authorization and to confirm your identity.

Appeals. If we decline your request, you can appeal by replying to our answer with the subject "Privacy appeal." We'll respond within 60 days and explain our decision. If you're not satisfied, you can contact your state attorney general. Texas residents can file a complaint with the Texas Attorney General at texasattorneygeneral.gov.

No discrimination. We won't treat you differently or charge you more for using your privacy rights.

Texas residents. These rights include those under the Texas Data Privacy and Security Act. We don't sell personal data, including sensitive personal data, and we process sensitive data only with your consent.

9. Children

• Shop with MiMi is for adults 18 and older. It's not directed to children, and children can't create accounts. If we learn that a child under 18 has created an account, we'll delete it.
• Household profiles for kids. Parents and guardians can add children and teens to their household so meals and portions fit the family. You enter that information as the parent or guardian, and by doing so you consent to our processing it to plan your family's meals. We collect only what's needed (a nickname, age, diet, allergies and foods they won't eat), and you don't need to enter their real names.
• We handle kids' information with extra care: it's used only to plan your household's meals and portions; it's never used for advertising, sold or shared except with the service providers in section 5; children are never put on a weight-loss goal; and MiMi doesn't discuss calorie numbers for minors.
• You can edit or remove a child's information any time in your household settings, or by deleting your account.

If you believe a child has given us information directly, contact hello@shopwithmimi.com and we'll delete it.

10. Cookies and similar technology

We use only cookies needed for the Service to work:

Local storage in your browser saves your profile, chosen store and workout log for speed. It's cleared when you sign out or delete your account.

When you pay, Stripe's checkout and billing pages (on Stripe's own website) use Stripe's cookies for payments and fraud prevention, under Stripe's policies.

We don't use advertising or analytics cookies, so there's no cookie banner. Your browser's "Do Not Track" and Global Privacy Control signals don't change anything, because we already don't sell your data or use it for targeted advertising.

11. Where your information is processed

Shop with MiMi is for people in the United States, and we intend to store and process your information in the United States. Some of our providers, such as Cloudflare and your browser's push service, run worldwide networks, so your information may pass through or be processed in other countries when you use the Service.

12. Changes to this policy

We'll post any update here with a new effective date. For important changes, we'll tell you by email or in the app at least 30 days before they take effect, and we'll ask for your consent before using health information or other sensitive data in a new way.

13. Contact

Shop with MiMi
Dallas–Fort Worth area, Texas
Email: hello@shopwithmimi.com (subject "Privacy request" for privacy requests)

Terms of Service · ← Back to Shop with MiMi