Thymeline is operated by Brake Labs LLC ("Brake Labs", "we", "us", "our"). This Privacy Policy explains what information we collect, how we use it, and your choices regarding your data.
We collect only the data necessary to provide the Service. We do not sell your data. We do not run ads. We do not use third-party analytics or tracking pixels.
When you sign in with Google, we receive your name, email address, and profile picture from Google. We use this to create and identify your account. We do not access your Google contacts, calendar, or any other Google data.
We store the content you add to Thymeline, including:
If you join the waitlist from our marketing page, we collect the email address you submit. It is used only to contact you about access to Thymeline.
We track which AI features you use and how many tokens each request consumes. This helps us monitor costs and improve the Service. This data includes the feature name (e.g., "meal plan generation"), the AI model used, and token counts.
To catch quality problems (for example, an AI suggestion citing an ingredient a recipe doesn't contain), we retain short-lived quality audit records of AI planner output: the suggestion's stated reason and a snapshot of the referenced recipe's ingredient names. These records are deleted after about 7 days.
We keep per-request diagnostic logs (route, status, timing, and structured log lines) for 7 days to investigate errors and performance problems, after which they are automatically deleted. Logs are redacted before storage: AI prompts and responses, authentication tokens, and secrets are removed, and email addresses are replaced with pseudonymous placeholders.
Our authentication system records your IP address and user agent string when you sign in. This is used for session security and is stored in our database.
Thymeline uses a single authentication cookie to keep you signed in. No tracking cookies, advertising cookies, or third-party cookies are used.
The app also stores a cache of your own data (recipes, preferences) in your browser's local storage (IndexedDB) so pages load quickly and work offline. This cache stays on your device, is namespaced to your account, and is not shared with anyone.
| Cookie | Purpose | Duration |
|---|---|---|
| better-auth.session_token | Authenticates your session | 7 days |
We use a limited number of third-party services to operate Thymeline. Data is shared with these services only as needed to provide the Service, and never for advertising or unrelated purposes.
We use Google for sign-in only. We receive your basic profile information (name, email, profile picture). We do not request access to your Google Drive, Calendar, Contacts, or any other Google services.
When you use AI features (meal suggestions, recipe discovery, recipe generation, grocery list creation), your recipe data and preferences are sent to a third-party AI provider for processing. Our AI provider does not use API inputs to train their models.
When you import a recipe by URL, the page is fetched through a third-party web scraping service to extract page content. Only the URL you provide is sent to this service.
Weekly plan emails and occasional service notices are delivered through a third-party email provider (Brevo). Your email address and the content of the email (your plan for the week) are shared with them solely for delivery. You can unsubscribe from plan emails at any time via the link in each email or in your settings.
Your data is stored in a PostgreSQL database. Session tokens are encrypted. All connections to the Service use HTTPS.
We take reasonable measures to protect your data, but no system is perfectly secure. If you become aware of a security issue, please contact us immediately.
We do not sell, rent, or trade your personal information. We share data only:
You can:
Thymeline is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
We retain your data for as long as your account is active. If your account is disabled or deleted, we will delete your data within 30 days, except where retention is required by law.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service. Continued use after changes constitutes acceptance.
Questions or requests about your data? Reach out at [email protected].