How we treat your stuff
A dinner says where you'll be, who's coming, and — if someone writes it — what they can't eat. So here are the rules of the place, in plain words.
A dinner is visible only to the people on it.
So is a trip, and so is an event. Every read and write is checked against membership in the database itself, not just in the interface. An invite link is the way in before someone has an account. Holding it reveals the name, when it is, the place when one is set, the names people gave — or a child's initial, when a parent has asked for that name to be hidden — and the shared list: each dish or item, and how much of it is covered. It does not include email addresses or what anyone can't eat. A reply sent with no account is left off those names, and a list kept to one person is left off entirely. Whether something is packed is hidden on that link; it reads as claimed. A short code, before anyone signs in, shows the name and the dates, not the people or the list. Treat an invite link like a spare key — share it with the people coming, not the group chat of a thousand.
Your email is for signing in. That's all.
No marketing, no newsletters, no “we miss you”. The other people on a dinner, a trip or an event never see your address — they see the name you give. Sign in with Google if you'd rather skip a password: we only ever ask it for the basic sign-in details Google shares (name, email and profile picture), and we don't send it the plan. Typing someone else's email to invite them sends one join link. Only you can see the address you entered. Everyone else sees that an invite went out. The service that sends it, Resend, receives that address, the name you typed for them, and the gathering's name, so it can deliver the link. When that person claims the name and joins, the address is cleared. There is no expiry: an invite nobody uses keeps the address on that dinner, trip or event.
Share as little as you like.
A dinner needs an idea and a place. The date can wait, and a cap on how many can come is optional. A guest can reply under a name, with no account. An account is for promising a dish yourself.
What you can't eat stays with the dinner.
You can write it in your own words, including with no account. On the reply form that is one need per line. Anyone on the dinner who has an account sees those words beside your name, so whoever is cooking can plan around them. A guest with no account sees their own, not everyone else's. The invite link does not carry them, and the invite email does not either. You can change them or take them off. The host can take them off too. If you have an account and choose “Keep for next time”, a copy stays on your account after the dinner is deleted. On a dinner you are still on, “Don't keep these” clears that copy — it shows only once keeping is already on, and only while you have needs written there. Deleting your account removes it.
No ads, no tracking, no analytics.
There are no advertising or analytics scripts on any page. Nothing watches how you move through the site, and nothing follows you afterwards. What we hold is what people put in — the dinner, the lists, the replies — and the name and email an account needs to sign in.
Deleting really deletes.
Remove a dish or an item and it's gone. Delete a dinner, a trip or an event and its lists, who promised what, and the notes go with it, immediately — not hidden, not archived. A trip or event's meal rota goes too. We ask you to confirm before the whole gathering is deleted. A copy of dietary needs you chose to keep, and gear you saved for yourself, stay on your account.
Your data lives in one database.
What we keep is stored in Postgres, hosted by Supabase. We don't sell it. Google is involved only if you sign in with it, and Resend only if you send an invite — both described above. A postcode is not part of starting a dinner. If one is added later, a forecast and a small map use three further services, set out under packing lists below.
Leave whenever, and take your stuff with you.
Every dinner, trip and event has an Export link on its details page. The file holds the gathering, the people, the lists and who promised what, the notes, dietary needs, messages and asks. It leaves out who is cooking which course. On a shared list, whether someone else has packed an item is hidden in that file the same way it is on the page. Your account page has a real “delete my account”, not a support ticket. If you own a dinner, trip or event that another person has joined with an account, deletion is refused until you delete that gathering, or until yours is the only account on it. A guest who replied with no account does not block this. There is no way to hand the gathering over to someone else.
If you use packing lists
Camping trips and one-day events are still here, on the same membership rules as a dinner. A list you keep to yourself, and publishing a list, work on a dinner's list too. Gear you share counts a dinner as a gathering you've been on together. The forecast and the map run only when a postcode is set.
A list marked “Just me” is only ever yours.
Everything else on a trip is visible to everyone on it, on purpose — that's how a group spots what nobody's bringing. A list you scope to just you is the exception: the others don't see its name, its contents, or that it exists at all, and it's left out of the invite preview, the “still needed” message you can copy into a group chat, and their export of the trip. That's checked in the database, not just hidden in the interface.
Sharing your gear with your crew is your choice, off by default.
Your gear list is private unless you mark a specific item as shared. A shared item becomes visible to people you've actually shared a dinner, a trip or an event with — including gatherings other than the one you're on now, so a new one can start from what your crew already owns — never to anyone else. Only the item itself: its name, category and photo, never which gathering it was on, your email, or anything else about you. Turn it off for an item and it stops being visible immediately.
On a trip or an event, the date and the place can stay vague.
The date can be as vague as “2027”, the location as vague as “somewhere in the Peaks”, and people can be on it under a name. An account is only needed when someone wants to tick things off themselves.
Publishing a list to the web is your choice, and it's not your dinner, trip or event.
Saving a list as a template never shares the dinner, trip or event — sharing it with other people on the app is a separate step, and putting it on the open web (searchable on Google, no account needed to view) is a further, separate step you take deliberately. What goes out is the list itself — item names, categories, quantities, notes, and a few frozen facts about its shape (nights, people, season) — never who was on it, or who brought what.
A postcode feeds a forecast and a map.
Adding one is optional. A new dinner does not ask for it. If a dinner, trip or event has one, postcodes.io turns it into coordinates and Open-Meteo returns a forecast for the header. postcodes.io sees the postcode. Open-Meteo sees those coordinates. Neither receives the name, the dates, or who's coming. OpenStreetMap draws the small map: our server fetches that picture and passes it on, so OpenStreetMap sees us asking about a place, never you looking at it. Directions is a separate link that opens Google Maps with the postcode; that click leaves this site. A short invite code's lookup can return a stored postcode. The page drops it, and does not print it.
Prefer it in formal shape? The privacy notice and the terms are the formal pages.