Privacy Policy

• We collect the email address you give us, plus optional survey answers, plus basic analytics on how you use the Service.
• We use that information to send you waitlist updates, run and improve the Service, and decide what to build next.
• We do not sell your personal information. We do not share it with advertisers.
• You can ask us to delete your information at any time by emailing support@getgoodenough.com.

Information you give us. When you join the waitlist or sign up for the app, we collect your email address. If you choose to fill out the optional fields on the waitlist form, we also collect what you tell us about yourself (e.g., your role and your top health-related pain).

Information about food you scan. Inside the GoodEnough mobile app, you may scan or photograph foods. We process those images to return a verdict, store the verdict alongside your account so you can see your history, and use aggregate, de-identified scan data to improve our analysis. We do not share food scan data with third parties for advertising.

Information collected automatically. When you visit the Service, our infrastructure providers automatically receive standard request data, including your IP address, the page or screen you accessed, the date and time, your device type and operating system, and the referring URL or marketing source (UTM parameters). This is normal web traffic data and is used to operate, secure, and improve the Service.

What we do not collect. We do not collect precise location, contacts, biometric identifiers, financial account credentials, or government identifiers. We do not ask for or store information about minors.

• To deliver the Service you signed up for.
• To send you transactional email related to your account (welcome emails, magic-link sign-in, beta invites).
• To send you product updates roughly every two to four weeks, which you can unsubscribe from at any time.
• To analyze how the Service is used, identify bugs, and prioritize what to build next.
• To enforce our Terms of Service, prevent abuse, and comply with legal obligations.

We rely on the following legal bases:

• Contract. We process your information to deliver the Service you requested.
• Legitimate interests. For analytics, fraud prevention, security, and product improvement, where those interests are not overridden by your rights.
• Consent. For optional marketing emails or cookie-based analytics where consent is required.

We use a small set of trusted infrastructure providers (“sub-processors”) to operate the Service. Each sub-processor only receives the information they need to do their job. As of May 8, 2026, our sub-processors are:

• Supabase, Inc. — Hosts our application database, including your waitlist email and any optional fields you submit.
• Resend, Inc. — Sends transactional and product email on our behalf.
• PostHog, Inc. — Provides product analytics so we can understand how the Service is used. We use privacy-friendly defaults and do not feed PostHog data into advertising networks.
• Vercel, Inc. — Hosts the GoodEnough website and supports email-deliverability infrastructure for the domain.

Some of these providers may process your information in the United States or other countries. Where required, we rely on standard contractual clauses or equivalent safeguards for international transfers.

When we add or change a sub-processor, we will update this page and the “last updated” date above.

The GoodEnough website uses a small number of cookies and similar technologies for two purposes:

• Strictly necessary. To remember your session, prevent abuse, and remember which UTM parameters referred you so we can credit the correct source.
• Analytics. To help us understand which pages, links, and CTAs are useful. We aim to use privacy-friendly analytics that do not build cross-site advertising profiles of you.

You can clear cookies at any time from your browser's settings. Doing so may sign you out and reset your preferences.

We keep your information only as long as we need it to operate the Service or as required by law. Specifically:

• Waitlist email and optional answers. Until you ask us to delete them, or until two years after your last interaction with the Service, whichever comes first.
• App account data. For the life of your account. When you delete your account, we delete the associated personal information within 30 days, except for limited records we are legally required to retain.
• Server logs and analytics. Typically 12 months in identifiable form, longer in aggregated form.

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain uses. You may also have the right to opt out of the sale or sharing of your personal information — we do not sell or share for advertising purposes.

To exercise any of these rights, email support@getgoodenough.com. We will respond within 30 days. We may need to verify your identity before acting.

You can also unsubscribe from any product email by clicking the unsubscribe link in the footer of that email.

We use industry-standard technical and organizational safeguards: encryption in transit (TLS), encryption at rest for databases, access controls, audit logging, and regular dependency review. No system is perfect, and no online service is 100% secure.

GoodEnough is intended for adults age 18 and over. We do not knowingly collect personal information from children under 13 (or, where applicable, under 16). If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this policy from time to time. When we do, we will update the “last updated” date at the top of this page and, for material changes, give you notice by email or through the Service.

If you have questions about this policy or want to exercise any of your rights, email support@getgoodenough.com.