Privacy notice

Draft dated 11 October 2026.

The short version: this site has no accounts, and what you enter stays on your own device. We do not receive it, so we cannot see it, sell it or share it.

Who we are

Measured Plate is a food reference and calculator. In this notice "we" means the people who run it. "The site" means the pages at this address.

You can reach us at hello@measuredplate.example.

What stays on your device

When you use the site, these things are saved in your browser's own storage, on the phone, tablet or computer you are using:

the daily limits you type in, and the date you typed them
the foods and portions you add to a day, and your recent days
foods and packs you save, and foods you looked up recently

None of this is sent to us or to anyone else. There is no account, no sign-in and no copy on our systems.

Because it lives only on your device, it is not on your other devices, and we cannot get it back if it is lost. Clearing your browser's data, or using a private window, removes it.

The site may also keep copies of pages and food data on your device so that it works without a connection. These copies hold nothing about you.

What you type into the search box is matched on your device. It is not sent to us.

How to see, export or erase it

One page lists everything the site has stored on your device: Stored on this device. From there you can save a copy for yourself, or erase all of it. You do not need to ask us.

What our host sees

The site is delivered by Cloudflare, Inc., a company in the United States. To send a page to you, any web host must receive some facts from your browser. For each page or file your browser asks for, Cloudflare receives:

your internet (IP) address
the address of the page or file asked for
the date and time
the address of the page that linked you here, if your browser sends it
what your browser says about itself, such as its name, its version, your kind of device and your language

Cloudflare uses this to deliver the site and to protect it from attack. Its own privacy policy describes how it handles this information and how long it keeps it.

Because each food has its own page, the address of a page shows which food page was opened, and the address of a comparison shows which two foods were compared. This information does not include your limits, what you added to a day, your totals or what you typed in the search box. Those never leave your device.

We have not switched on any service that gives us a record of individual visits.

Page counts, if switched on

No page counting is switched on today.

If we switch it on, it will count pages, not people. It will tell us only totals: how many times a page was viewed, from which country, and which site linked to it. It will use no cookies and will not follow anyone from page to page or from site to site.

We may also count how often a feature is used, as a plain tally, for example that limits were entered. Such a tally would never include the food, the limit or the total, or anything that points to a person.

This notice will be changed before any counting begins.

What we do not do

No cookies that follow you.
No advertising, and no advertising or social media trackers.
No sale of data and no sharing of data with other companies. We hold none to sell or share.
No scripts, fonts or other files loaded from other companies' sites.

When you follow a link from this site to another site, we ask your browser not to tell that site where you came from.

If you write to us

If you send us an email, we receive your email address and whatever you write. We use it to answer you and, for a report about a number, to check and correct the figure. We keep a record of what was corrected and when. The public record of corrections does not name the person who reported them.

Please do not send details of your health. We cannot answer health questions.

You can ask us to delete your message at any time.

Children

The site is written for adults. It is not directed at children, and it does not ask for anyone's age, name or contact details.

Where the site is offered

The site is written for people in the United States. It uses United States food data, measures and label rules.

If this notice changes

The date at the top shows when this notice was last changed. If we ever plan to move anything you enter off your device, for example for an account, we will ask you first, and this notice will be changed before that happens.

Questions

Write to hello@measuredplate.example.

For the reviewer

This box is not part of the page above. It lists points a professional must check. It is shown only on the staging site and is left out of the public site.

This draft was prepared by an AI assistant, not by a lawyer. It makes no claim that the site complies with any law. Every point below needs a professional's view.
FTC Health Breach Notification Rule (16 CFR Part 318): confirm whether the site is a "vendor of personal health records" when everything a person enters stays in the browser and nothing is held by the operator. Confirm again before page counts, email sign-up or accounts are switched on.
FTC Act section 5: every statement above is a promise. Confirm each one matches the site as launched: no third-party requests, no cookies, the Referrer-Policy header, search matched on the device, nothing sent off the device.
State consumer health-data laws, such as Washington's My Health My Data Act and Nevada's similar law, and state comprehensive privacy laws such as California's: confirm whether the operator "collects" consumer health data when it is stored only on the person's device, and whether a separate consumer health data privacy policy and a link on the home page are needed.
HIPAA: this draft does not assume HIPAA applies and does not mention it to readers. Confirm that the operator is neither a covered entity nor a business associate, given that the author is a doctor. Confirm the site is kept separate from any clinical practice.
Children: confirm the position under COPPA. The site is not directed at children and collects no personal information through the site itself.
GDPR and UK GDPR: the site targets the United States, but it can be reached from anywhere, and the host receives IP addresses. Confirm whether the site is "offered" to people in the EU or UK, and what follows if so (a lawful basis, the special category for health data, a representative, transfer terms with the host).
The host: confirm Cloudflare's role and terms for this plan (its privacy policy, effective 4 November 2025 when read on 11 October 2026, describes end-user log data as IP addresses, system configuration information and other information about traffic). Confirm what the operator can see in the Cloudflare dashboard on the plan used, and whether the sentence "We have not switched on any service that gives us a record of individual visits" is exact.
Email: name the email provider that will hold messages sent to the contact address, how long messages are kept, and who can read them. The contact address is a placeholder until the owner sets one up.
The operator: this draft names no legal entity and gives no postal address. Decide who the operator is (the author personally, or a company) and whether an address must be shown.
Page counts: the section "Page counts, if switched on" describes a plan (docs/06 section 6.8). When a service is chosen, name it, say what it receives, and check the Content Security Policy still holds.
Offline copies: confirm the sentence about copies of pages and food data against the service worker as built.
Accounts, an encrypted copy on a server, and payments are built but switched off. This notice describes the site with them off, and it would be untrue with them on. Before that switch is turned on, this notice must be rewritten as a whole and reviewed by a professional (docs/03 section 3.5). First drafts of the paragraphs that would change are kept with the wording of the paid part in src/ui/strings.ts, under "legal". They appear on this page only in a build that has the paid part.