Privacy Policy

This explains what Otterli collects about you, why, who else sees it, and what you can ask us to do about it. We've written it as a plain account of how the site actually works, because a policy you can't check is worth very little.

Otterli is run from the United Kingdom, and we are the data controller for everything described here. You can reach us about anything on this page at support@otterli.com. If you'd like a postal address for a formal request, ask and we'll provide one.

The short version

• There are no accounts and no passwords. You can use the whole site, including the meal planner, without telling us who you are.
• Your meal plan lives on your device, not in an account with us. We only receive it if you choose to email it to yourself.
• We only ever ask for your email address, and only when you export a plan or sign up to the newsletter. Marketing emails are opt-in — we don't add you to anything you didn't tick a box for.
• Analytics and session recordings happen only if you accept cookies. If you decline, we count the visit anonymously and nothing else.
• We don't sell your data, run adverts, or share anything for marketing.

What we collect, and why

Everything Otterli collects is in this table, along with the lawful basis we rely on under the UK and EU GDPR.

That's the complete list. We don't ask for your name, address, date of birth, payment details, or anything about your health or diet beyond the recipes you choose to put in a plan.

Cookies and your choice

When you first visit, a banner asks whether you accept analytics cookies. Until you choose, and permanently if you choose Essential only, we set no analytics cookies and store nothing on your device for analytics.

If you choose Essential only we still count the visit, but anonymously. PostHog combines your IP address, browser details and a secret that changes every day into a one-way hash, then discards the IP address once the day's figures are worked out. It can't be reversed, and because the secret changes daily it can't link you from one day to the next. No profile is built and no recording is made.

If you accept, PostHog sets a first-party cookie so a returning visit is recognised, and records how you use the site — pages viewed, clicks and form submissions, errors and page performance, and session recordings, a replay of your visit showing scrolling, clicks, and typing into non-sensitive fields. We use these to find where the planner is confusing. Recordings are kept for 90 days.

You can change your mind whenever you like using the Cookie settings link in the footer of any page. Withdrawing takes effect immediately and deletes any analytics cookie already set. Refusing costs you nothing — every part of Otterli works the same either way.

Our Cookie Policy lists every cookie and storage item by name, with its purpose and lifetime.

Exporting a meal plan

This is the one moment your meal plan reaches us, so it's worth setting out plainly. When you enter your email address and export a plan, two things happen:

• We email you the plan as a PDF with a grocery list.
• We send ourselves a notification containing your email address and the meals in the plan, with the day each was placed on, plus your measurement and servings settings.

The export form also carries an unticked box offering occasional emails about Otterli. That box is the only way onto our mailing list. If you leave it alone we don't create a contact record for you at all — your address is used once to send the plan and nothing more, and you'll never hear from us again.

None of this happens unless you export. Every email we send has an unsubscribe link, and unsubscribing stops the marketing emails without affecting anything else.

What we don't do

• We don't sell or rent your personal data, and we don't share it for anyone else's advertising.
• There are no advertising networks, social media pixels, or third-party trackers anywhere on Otterli.
• There are no affiliate links on the site, so no affiliate network receives anything about you.
• We don't take payments. Premium plans are switched off and nothing on the site can charge you.
• We don't make automated decisions about you or profile you in any way that has a legal or similarly significant effect.
• Otterli isn't aimed at children, and we don't knowingly collect anything from under-13s. If you believe a child has given us their email address, tell us and we'll delete it.

Who else sees your data

We use two outside providers. Both act as our processors — they hold data on our behalf, under contract, and are not permitted to use it for their own purposes.

• PostHog — analytics and session recording. We use their EU instance, so this data is stored on servers inside the European Union.
• Resend — email delivery and our mailing list. They only ever see your address if you export a plan or sign up to the newsletter. Resend is based in the United States, so your email address is transferred there. That transfer is covered by the standard contractual clauses in their data processing agreement, which is the safeguard UK and EU law requires.

Everything else — the recipe search, the content database, the newsletter list, our caches, and our server logs — runs on infrastructure we operate ourselves. It isn't handed to anyone else.

We may also disclose data if the law requires it, but we'll tell you unless we're legally prevented from doing so.

Your rights

Under the UK GDPR and the EU GDPR you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that's wrong.
• Delete what we hold. In practice this usually means removing your email address from our mailing list and any export notifications.
• Restrict or object to how we use it, including anything we do on the basis of legitimate interest.
• Receive it in a portable format you can take elsewhere.
• Withdraw consent at any time, for analytics or for marketing. This doesn't affect anything done before you withdrew it.

Write to support@otterli.com and we'll respond within one month. We won't charge you, and we won't treat you differently for asking.

If you're unhappy with how we've handled it, you can complain to the UK's Information Commissioner's Office, or to the data protection authority in your own EU country. We'd rather you came to us first, but you don't have to.

If you're outside the UK and EU

This policy describes everything we collect, wherever you are, and we apply the same choices and the same cookie banner to everyone. Your local law may give you additional rights — write to us and we'll do our best to honour them. We don't sell or share personal information in the sense those terms are used in US state privacy laws.

Keeping it safe

The site is served over HTTPS, our providers are chosen partly for their own security posture, and access to the small amount of personal data we hold is limited to the people who run Otterli. We collect as little as we can, which is the most effective protection available to a site this size.

No system is perfect. If something goes wrong in a way that puts your data at risk, we'll tell the ICO within 72 hours and tell you directly where the law requires it.

Changes and contact

If we change how we use your data, we'll update this page and change the date at the top. If a change goes beyond what your existing cookie choice covered, we'll reset that choice and ask you again rather than quietly extending it.

Questions about any of this: support@otterli.com. See also our Cookie Policy and Terms.