Privacy.
How Lunchbox collects, uses, and protects your data.
1. Who we are
Lunchbox is built by 288 Labs, LLC. It is a lunch-planning tool used by parents and caregivers. Contact: privacy@288labs.com.
2. What we collect
Account (optional)
- An email address and name — via Sign in with Apple, provided by Apple only on your first sign-in (you may choose to hide your email behind Apple’s private relay). Used only to authenticate your account and sync your data — never for tracking, analytics, advertising, or marketing email.
- Account identifier.
Lunchbox works without an account. Signing in is optional and only used to back up and sync your data across devices.
Product data
- A child’s first name is optional and, if entered, is stored only on your device — it is never uploaded to our servers or included in backup/sync.
- The child’s age (optional) and food preferences, allergies, texture choices, and meal feedback — used only to personalize suggestions.
- Saved recipes, custom recipes you add, and weekly meal plans.
Lunchbox does not record audio and does not access your microphone, camera, contacts, photos, or location. Lunch suggestions are generated by an on-device recommendation algorithm, not by sending your data to an AI service.
Device + telemetry
- App version, OS version, device model.
- Anonymous usage events.
Subscriptions
- Subscription status via RevenueCat (no card numbers — Apple handles payment).
3. How we use your data
- Run the product (personalize lunches, sync, back up).
- Improve the product (anonymized analytics).
We do not sell your data. We do not show third-party ads. We do not use your content to train third-party AI models.
4. Sub-processors
- Clerk — authentication (Sign in with Apple).
- Neon — Postgres database storage. Region: US East.
- Cloudflare — API compute (Workers).
- RevenueCat — subscription state (no card numbers).
- PostHog — product analytics. Region: US. Events are anonymized; no child names, recipes, or emails are sent.
- Apple — App Store, in-app purchases, and Sign in with Apple.
5. Retention
- Account data, profiles, and meal plans — stored until you delete your account, after which it is removed from our database.
- Analytics events — retained up to 12 months, then aggregated.
- Audio recordings — none; we do not collect audio.
6. Your rights
You can permanently delete your account and all associated data from within the app: Profile → Delete account. You can also request access, correction, or export by emailing privacy@288labs.com; we action requests within 30 days.
EU / UK / EEA residents have rights under GDPR; California residents have rights under CCPA. We honor both globally.
7. Children
Lunchbox is a tool for parents and caregivers and is not directed at children under 13 (16 in some EU jurisdictions). It is not a Kids Category app and children do not create accounts. Any information about a child is entered by the adult account holder solely to personalize lunch suggestions: a child’s first name (if entered) stays on the device and is never uploaded, and the optional age is treated as that adult’s data under this policy.
8. Security
All data is encrypted in transit (TLS) and at rest. Access inside 288 Labs is restricted to a small number of authorized people.
9. Changes
Material changes get a new date above; significant changes also announced in-app or by email.