Privacy Policy
Last updated: [REVIEW: launch date, e.g. “July 15, 2026”]
This policy explains what La Mesa (lamesa.family) collects, how we use it, and the choices you have. La Mesa is a family recipe platform operated by [REVIEW: legal name / entity]. We try to collect as little as possible and we don’t sell your data.
1. Information we collect
- Account information: your email address, a securely hashed password (we never store your password in plain text), and an optional display name.
- Your content: the recipes, photos, captions, stories, notes, tags, comments, menus, “made this” check-ins, and cookbook name you add.
- Sharing information: the email addresses you choose to share a cookbook or menu with, and any successor (“heirloom”) email you designate.
- Technical information: your IP address, browser information, and server logs, used to operate and secure the service (including rate-limiting and abuse prevention).
- Payment information (if you subscribe): handled by our payment provider, Lemon Squeezy. We do not receive or store your full card details. We receive your subscription status and limited billing metadata.
2. How we use your information
- To provide La Mesa — store and display your cookbook, share it with people you choose, generate PDFs and menu cards, and run the features you use.
- To send you essential emails — verification, password resets, and recipe emails you request.
- To secure the service — authentication, abuse prevention, and rate limiting.
- To provide AI features when you choose to use them (see Section 4).
- To manage subscriptions and billing (if you subscribe).
3. Cookies
La Mesa uses only essential cookies: a login/session cookie (including an optional 30-day “remember me”) and a security token to protect forms. We don’t use advertising or cross-site tracking cookies. If the signup page shows a CAPTCHA, that provider (hCaptcha) may set its own cookies to detect bots.
4. AI features and third-party AI processing
Some optional features use artificial intelligence to help you. Today that provider is Anthropic (the “Claude” models).
- What’s sent, and when. AI processing only happens
when you choose to use an AI feature. At that point, the
relevant content is sent to Anthropic to produce a result:
- Recipe import from a photo → the photo you upload;
- “What can I make tonight?” and “Build a menu” → your request plus titles and ingredients from cookbooks you can access;
- Recipe scaling → the recipe’s ingredient list.
- How it’s handled. Anthropic processes this content to return a result and under its own terms and privacy commitments. [REVIEW: link Anthropic’s current commercial terms / privacy and, if you’re on a plan where Anthropic doesn’t train on your data, say so explicitly here — it’s reassuring and worth stating.]
- It’s a draft, and it’s optional. AI output is a suggestion you review before saving; it never overwrites your original recipe automatically. If you’d rather not use AI, simply don’t use these features — the rest of La Mesa works without them.
- Cost metering. We keep an internal count of AI usage (which feature, token counts, estimated cost) to manage the service’s costs. This is tied to your account but isn’t shared.
5. How we share information
We share information only in these limited ways:
- With people you choose — when you share your cookbook or a menu, or designate a successor, the people you name can see what you’ve shared.
- With service providers that help us run La Mesa:
- Anthropic — AI features (Section 4);
- Resend — sending transactional email;
- Fly.io — hosting (servers located in the United States);
- Cloudflare R2 — encrypted off-site backups;
- Lemon Squeezy — payments and subscriptions, if you subscribe;
- hCaptcha — bot prevention on signup (if enabled).
- For legal or safety reasons — if required by law or to protect the rights and safety of La Mesa and its users.
We do not sell your personal information.
6. Data retention and backups
We keep your information for as long as your account is active. We take daily encrypted backups (retained about 30 days) so we can recover from problems. When you delete your account, we delete your account and content from the live service; residual copies may persist in backups for up to the backup retention period before rotating out.
7. Your rights and choices
You can access most of your information directly in the app, and edit or delete your recipes and content at any time. You also have the right to request a copy (export) of your data or deletion of your account.
- Export: download all your data anytime from Your account → Export my data (a ZIP with a data file and your photos).
- Deletion: permanently delete your account and its content anytime from Your account → Delete my account. You can also email privacy@lamesa.family and we’ll take care of it.
Depending on where you live (for example, the EU/UK under GDPR or California under CCPA/CPRA), you may have additional rights such as correction, restriction, or objection. Contact us and we’ll honor applicable rights. [REVIEW: confirm the specific rights language with a lawyer if you expect meaningful EU/CA usage.]
8. Children’s privacy
La Mesa isn’t directed to children under [REVIEW: 13], and we don’t knowingly collect their personal information. If you believe a child has created an account, contact us and we’ll remove it.
9. Where your data is processed
La Mesa is hosted in the United States, and our providers may process data in the United States or elsewhere. If you use La Mesa from outside the U.S., you understand your information will be processed in the U.S.
10. Security
We protect your information with measures including encrypted connections (HTTPS), securely hashed passwords, and encrypted off-site backups. No system is perfectly secure, but we work to keep your family recipes safe.
11. Changes to this policy
We may update this policy from time to time. We’ll update the “last updated” date above and, for material changes, notify you where appropriate.
12. Contact
Questions about your privacy? Email privacy@lamesa.family.