Draft — under review. This policy was AI-drafted and has not yet been through legal review. If you rely on any specific point, please email
hello@trydonebylunch.com to confirm.
Privacy
What we collect, what we don't
Last updated 2026-08-26.
The short version
We collect the minimum needed to give you an account, keep the site working, and eventually deliver Pro when the payment provider is chosen. We don't sell your data, we don't build advertising profiles about you, and we don't rent your email to third parties.
What we collect
- When you join the notify list — just your email address and a source tag (e.g. pro_notify) so we can email you when Pro opens and understand which page brought you in. Stored in a Cloudflare KV bucket keyed by a SHA-256 hash of the email. No name, no IP, no cookies attached to the record.
- When you create a free account — email address (for magic-link login or Google sign-in) and, optionally, a display name and role category you tell us about yourself. Stored in Supabase Auth + a profiles table.
- When Pro opens — a future payment provider will handle payment and receive whatever it needs to charge you (name, email, billing address, payment details). It will be a named third party whose privacy policy governs their handling; we will publish the name here the moment Pro launches. We ourselves will only receive your email and the fact that Pro is active on your account. No provider is active today.
- When you browse the site — Cloudflare's edge logs (IP, user-agent, request path) for security and diagnostics, plus lightweight event counters (page views, which prompts were opened) so we can improve the library. These are aggregated, not tied to your account.
- Marketing pixels — Meta and TikTok pixels fire on public marketing pages when we're running ads. They record that a visitor from those platforms hit the landing page. You can block them with a standard ad blocker or by opting out through Meta's / TikTok's own settings; they never fire inside the paid vault.
What we don't collect
- The prompts you write, the answers you get from AI tools, or anything you paste into them — those live between you and the AI vendor you use (ChatGPT, Claude, Gemini). The library is a static document; it doesn't call home.
- Credit-card numbers — we don't touch card data at all today, and when Pro opens the payment provider (not us) will hold them.
- Contacts, location, camera, or microphone.
How to reach us
Email hello@trydonebylunch.com — we'll answer within two business days. To delete your account and any associated data, ask us there.
Legal basis (for EU/UK visitors)
Contract (delivering the account and, when Pro opens, what you paid for), legitimate interests (running the site securely), and consent (marketing pixels — refusable via the site's cookie/ad-blocker controls or platform settings).
DoneByLunch is operated by an independent seller. Questions about the underlying data flow? Start with us — we'll walk you through it.