Privacy Policy

BasketAI — getbasketai.com

Last updated: October 15, 2026

Effective date: October 15, 2026

1. Who we are

BasketAI ("we," "us," or "our") is a grocery-planning and recipe-discovery web service operated by Belt Fed Labs LLC (Ohio entity no. 5561355), located at 6545 Market Ave N Ste 100, Canton, OH 44721, with statutory agent Registered Agents Inc. BasketAI helps you find recipes and place the ingredients on your shopping list into your grocery retailer cart.

This Privacy Policy explains what personal data we process when you use BasketAI at getbasketai.com (the "Service"), how we handle data accessed through grocery retailer integrations such as Kroger, and what your choices are.

Questions about this policy can be sent to contact@beltfedlabs.io.

2. The short version

• BasketAI does not sell or share your personal data for advertising, marketing, or affiliate-tracking purposes. Ever.
• Your cart contents and session data are ephemeral: they exist only while you are connected, are scoped to your browser session, and are not kept in a persistent BasketAI database after your session ends.
• We use no third-party advertising cookies, no cross-site trackers, and no ad pixels. The only cookies we set are a first-party session cookie required to keep you connected, plus first-party Google Analytics cookies for anonymous aggregate usage measurement (see Section 5).
• If you create a BasketAI account, we store your email address (or the Google/Apple identity you sign in with) so you can sign in and, optionally, stay signed in. You can delete your account at any time (see Sections 3 and 12).
• We never take payment information and we never complete a purchase for you. Checkout always happens directly on the retailer's own website under your control.

3. Data we collect

3.1 Data you give us directly

• Search and preference inputs. The ingredient terms, recipe queries, and dietary or cuisine preferences you type into BasketAI while planning meals. These are processed to return results and are not retained beyond your session except as described in Section 6.

• Account sign-in information. If you create a BasketAI account, we collect your email address so we can send you a one-time sign-in "magic link." If you choose to sign in with Google or Apple instead, we receive the third-party identity and basic profile information those providers share during their OAuth consent flow (typically your name and email address). We also store a display name and, for Google sign-in, a profile avatar URL when provided. We process this only to create, authenticate, and maintain your BasketAI account and signed-in state. To deliver magic-link emails, we use Amazon Web Services Simple Email Service (Amazon SES) as our email delivery processor; SES receives the destination email address and processes it solely to send that email.

• Saved recipes. If you save a recipe, we store that recipe, the collections you put it in, and any share links you create, on your BasketAI account, until you delete the recipe, turn the link off, or delete your account. We do not keep photos you upload to import a recipe. We do not re-host videos. A share link shows that one recipe to anyone who has the link. If you import a recipe from a YouTube, Instagram, or TikTok link, we read a public caption track when one exists and do not keep that caption text. If the video has no caption track, a temporary copy of the audio is sent to OpenRouter to make a transcript, and that audio is deleted as soon as the transcript exists. We do not keep videos.

3.2 Data accessed through your grocery retailer connections (Kroger)

When you choose to connect your Kroger account through Kroger's OAuth 2.0 authorization flow, BasketAI accesses only the categories of data you explicitly approve on Kroger's consent screen. With your authorization, we access, on a session basis:

• Account identity information (via the Kroger Identity API, identity/profile scope): your Kroger account profile details, such as your name, used to address you personally and to confirm which account items are being staged for. We use this only to operate the connection you authorized.
• Item and price data (via the Kroger Products API, product.compact scope): this is public catalog data — products, descriptions, prices, and store availability — and is not personal information about you.
• Shopping list contents (via the Kroger Lists API, list.basic scope), if you authorize it: the items on your Kroger shopping lists, used to match list items to recipes.
• Cart staging (via the Kroger Cart API, cart.basic:write scope): BasketAI can add selected recipe ingredients to your Kroger cart. Your cart contents are treated by us as ephemeral session data only (Section 6); we do not build a persistent history of your purchases, and BasketAI never submits, pays for, or finalizes an order. Reviewing prices and completing checkout is done by you, directly on Kroger's website or app.

BasketAI does not access your Kroger payment methods, saved cards, Order History, or loyalty/purchase history through the API, and the API scopes we use do not permit it.

If we add other grocery retailer integrations, this policy will be updated to describe them before they go live.

3.3 Data collected automatically

• Server logs. Like most websites, our servers automatically record standard technical information in connection logs — for example your IP address, browser type, requested pages, and timestamps. We use this solely for security, abuse prevention, error diagnosis, and basic reliability monitoring, not for profiling you or behavioral advertising.
• Session state. See Section 5 (Cookies).
• Aggregate usage analytics (Google Analytics 4). We use Google Analytics 4 ("GA4"), Google's first-party web analytics service, to understand aggregate, non-personal usage of the Service — for example, which recipes and features are used and how often. GA4 is configured to anonymize IP addresses, disable Google Signals, and disable advertising and remarketing personalization signals. We do not send Google any personal information: no names, no email addresses, no Kroger account identifiers, no order details, and no payment information. GA4 relies on first-party analytics cookies (see Section 5).

We do not run third-party advertising networks, social-media trackers, or fingerprinting code on the Service.

4. How we use your data

We process the data described above only to:

1. provide the Service — matching recipes to ingredients, staging ingredients into the retailer cart you authorized, and showing you current item and price information;
2. maintain the connection between your BasketAI browser session and your Kroger account, for the duration of that session;
3. keep the Service secure, diagnose errors, and prevent abuse or fraudulent use of the retailer APIs;
4. comply with legal obligations and enforce our Terms of Service;
5. measure and improve the Service using aggregate, non-personal analytics — for example, how often specific recipes and features (ingredient search, meal planning, recipe swaps, retailer cart handoff, and retailer connection) are used. This analytics data is aggregate only and cannot identify you.

We do not use your personal data for advertising, marketing profiles, behavioral audience measurement, or affiliate attribution, and we do not combine your personal data with data from other companies for those purposes.

5. Cookies and local storage

Name	Type	Purpose	Lifetime
basketai_session	First-party, HttpOnly, Secure	Identifies your signed-in BasketAI session — your account sign-in state and, when connected, your retailer connection status	Cleared when you sign out, delete your account, or the session expires
kroger_session (legacy)	First-party, HttpOnly, Secure	Former name of the session cookie; still honored during a 30-day rename grace period while browsers still hold it	Cleared when you disconnect or when the session ends
_ga	First-party analytics cookie (set by Google Analytics 4)	Distinguishes visitors for aggregate, non-personal usage analytics	Up to 2 years
_ga_*	First-party analytics cookie (set by Google Analytics 4)	Stores and counts page views for aggregate usage analytics	Up to 2 years

• The BasketAI session cookie (basketai_session) is HttpOnly and transmitted only over HTTPS. During the cookie rename, the legacy kroger_session name is also accepted for a 30-day grace period so existing sessions keep working. In addition, Google Analytics sets first-party _ga / _ga_* cookies for aggregate usage analytics.
• We use no third-party cookies, no advertising or retargeting cookies, and no cross-site tracking technologies. GA4 cookies are first-party, work with IP anonymization, and are used only for aggregate usage measurement — never for advertising.
• We do not store your data in browser local storage for tracking purposes.
• Because the only strictly necessary cookie is the session cookie, no consent banner is required for core functionality; blocking cookies simply disables the sign-in and "connect retailer account" features (and analytics) while recipe browsing continues to work.

6. Ephemeral cart and session data — our retention commitment

This section reflects commitments required by the Kroger Developer Program terms under which the API access is provided to us:

• Session scope only. Access tokens and any cart, list, or session data received through retailer APIs are held in memory or session state for the duration of your active browsing session and are used only to deliver the feature you requested.
• No persistent cart tracking. We do not retain, archive, warehouse, or build profiles from your cart contents, shopping lists, or order data after your session ends. When you disconnect your account or your session terminates, the associated tokens and cached retailer data are discarded from active session state.
• No resale or ad-tech sharing. We do not store retailer session data for later commercial exploitation, sell it, license it, or share it with data brokers, advertising networks, or affiliate networks.
• Aggregation limit. Any non-personal aggregate metrics we may compute (for example, counts of API errors or feature usage) contain no item-level, list-level, or cart-level retailer data and cannot identify you or your purchases.

7. Legal bases and your rights (including California and EU/UK users)

If you are covered by the GDPR/UK GDPR, we process personal data on the bases of (a) your consent for the retailer-account connection and identity/profile access, which you may withdraw at any time by disconnecting, and (b) legitimate interests / contract performance for operating and securing the Service.

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent. California residents: we do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA, and we do not honor "do not sell" signals because there is nothing to opt out of. We will not discriminate against you for exercising any privacy right.

To exercise any right, email contact@beltfedlabs.io. We will verify your request using information already associated with you (for example, the email address you write from) and respond within 45 days where required by law. Account deletion is also available directly in the app at any time (see Section 12).

Separately, and at any time, you can revoke BasketAI's access to your Kroger account by (a) clicking Disconnect in BasketAI, and/or (b) revoking the application's authorization from within your Kroger account settings. Kroger's own privacy practices for data it holds are described in Kroger's Privacy Policy, which is independent of this one.

8. How we share data

We do not sell, rent, or trade personal data, and we do not share retailer session data for advertising or affiliate purposes. We disclose data only in these limited circumstances:

1. With your retailer (Kroger): API calls you trigger send the necessary identifiers to the retailer so it can serve catalog, list, and cart-staging responses to your session. The retailer processes that data under its own privacy policy.
2. Email delivery (Amazon SES): if you sign in by email, we use Amazon Web Services Simple Email Service (Amazon SES) to deliver your sign-in magic link; SES processes the destination email address solely to send that message.
3. Infrastructure providers: our hosting/logging providers who process data on our instructions under confidentiality obligations and do not use it for their own purposes.
4. Legal: if required by a valid legal process, or to protect the rights, safety, or property of BasketAI, our users, or the public — limited to what the law permits.
5. Business transfer: in connection with a merger or acquisition, subject to this policy continuing to apply.
6. Recipe import (OpenRouter): turning a caption or transcript into a recipe uses OpenRouter. When a video has no caption track, the temporary audio described in Section 3 is also sent to OpenRouter for transcription and is not kept. Photos and videos are not kept.

9. Children's privacy

The Service is not directed to children under 13 (or under 16 in jurisdictions where that is the threshold), and we do not knowingly collect personal data from children. If we learn we have collected such data, we will delete it.

10. Security

We use transport-layer security (HTTPS/TLS everywhere, HSTS enabled), HttpOnly/Secure session cookies, scoped minimum-privilege API credentials stored outside the application codebase, and code that enforces that checkout can only be completed by you at the retailer. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we maintain safeguards appropriate to the sensitivity of the limited data we handle.

11. International transfers

The Service is operated from the United States. If you access it from outside the United States, your information is processed in the United States as described in this policy.

12. Data retention

The Service remains session-scoped for cart, shopping-list, and catalog data — we do not maintain a persistent database of your cart contents, shopping lists, or purchase history. If you create a BasketAI account, we store your account record (email address, display name, and the auth-provider associations you used to sign in) for as long as your account is active, and we delete it when you delete your account, as described below. Server logs are retained for a maximum of 30 days unless needed longer for a specific security investigation.

Deleting your account. You can delete your BasketAI account at any time from the app's Delete Account control. When you do, we permanently delete the account record and everything attached to it: your auth-provider associations (Google, Apple, or magic-link), your active sessions, your linked retailer connections, and your saved meal plans. We also delete in-app preferences (household size, dietary restrictions, disliked ingredients, calorie target, and macro split) and feedback (recipe ratings, cooked-recipe markoffs, out-of-stock reports, and ingredient suggestions) saved while you were signed in, including records written from another device, and any such records keyed to the browser you use to delete the account. Sign-in "magic link" tokens are single-use and expire automatically within a short window, so they are not kept as part of your account. One remaining limit: a preference or feedback record created while you were not signed in, in a browser that is not the one you use to delete the account, was never associated with your account and is not deleted.

13. Changes to this policy

We may update this policy as the Service evolves. Material changes will be noted on this page at least 14 days before taking effect, and where required the change date at the top will be updated. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

14. Contact

Belt Fed Labs LLC — BasketAI

Email: contact@beltfedlabs.io

Mailing address: 6545 Market Ave N Ste 100, Canton, OH 44721

Website: https://getbasketai.com/privacy