Privacy Policy
Last updated: August 28, 2026
Buna is a meal-planning app for households: recipes, meal plans, shopping lists, and an AI assistant you can type or talk to. Buna is operated by Ion Mesca, based in California, USA (“Buna”, “we”). This policy explains what we collect, how we use it, and the choices you have.
Contact for anything in this policy: support@heybuna.com
What we collect
Your account. When you sign in with Google or Apple, we receive your name, email address, and profile picture. We never see your password.
Content you add. Recipes and recipe photos, meal plans, shopping lists, pantry items, cooking history, and your household’s context notes, such as who is in your family, food preferences, and allergies. Context notes are free text; save only what you are comfortable storing.
Conversations with the assistant. Chat messages are saved to your household so conversations persist and other members can see what was planned. When you use voice, your speech is transcribed, and transcripts that produce replies or actions are saved the same way chat messages are.
Service records. Basic records of account and household activity, such as a change log, kept to make features like undo work and to keep the service secure. These logs are deleted after 90 days.
We do not collect your precise location, contacts, browsing history, or advertising identifiers. Buna contains no ads and no third-party trackers.
The waitlist
You can join the waitlist from our home page without an account. If you do, we store the email address you typed, the date, and which page it came from. That is the whole record, and its only purpose is to email you once, when Buna opens. We do not add you to a newsletter, and we do not send anything else.
We have no way to check that an address belongs to the person who typed it, so we treat a waitlist entry as interest and never as permission for anything beyond that one message. The list is kept apart from accounts, is never sold or shared, and being on it gives you no account and no access.
Removal. Your address stays on the list until Buna opens or you ask us to take it off, whichever comes first. Email support@heybuna.com and we will delete the entry. You do not need an account to ask, and we do not ask you to prove anything first.
When you submit the form, our backend holds the IP address the request came from for a few minutes, as the key that limits how many times one sender can submit. It is a defence against a script filling the list, it is never written to the database, and it is never attached to your address.
How the AI assistant uses your data
When you use the assistant, we send your message together with relevant household context (recipes, plans, context notes) to our AI providers to generate a response:
- OpenAI processes all voice audio (speech-to-text and text-to-speech) and may process chat messages. When you use voice, your audio is sent to OpenAI.
- OpenRouter routes some text requests to AI models.
- Tavily performs web searches the assistant makes on your behalf. It receives the search query, not your identity.
These providers process your data only to provide the service. Buna does not store your raw audio; audio is processed at the time you speak.
Households and sharing
Buna is built around shared households. Content a member adds belongs to the household and is visible to its members. If you leave a household, or delete your account, content you added to a shared household stays with that household, labeled with your display name, much like messages remain in a group conversation. Your personal data (your account, sign-in, and any household where you were the only member) does not stay.
If you share a shopping list by link, anyone with the link can view that list until sharing is turned off.
Service providers
We use a small number of providers to run Buna:
| Provider | Purpose |
|---|---|
| Convex | Database and backend hosting |
| Vercel | Web hosting |
| Google, Apple | Sign-in |
| OpenAI, OpenRouter, Tavily | AI assistant, as described above |
| Polar | Payment processing for subscriptions; Polar handles payment details and we never see your card |
We do not sell your personal information, and we do not share it with anyone else unless the law requires it.
Your rights
Deletion. You can delete your account from the app (Settings, Account, Delete account) or on the web at heybuna.com/account/delete. Deletion is immediate and permanent: your account, sign-in, and any household where you were the only member are erased, including their content. If you own a household with other members, you choose whether to hand it to another member or delete it entirely. Content you contributed to households that continue without you stays with them, as described above.
Export. Any household member can download the household’s data and their own profile as JSON from Settings.
Requests. Email support@heybuna.com to access, correct, or delete your data, or with any privacy question. We honor requests under the California Consumer Privacy Act, the EU General Data Protection Regulation, and similar laws, whichever applies to you, and we respond within the time those laws require. We do not discriminate against anyone for exercising these rights.
Retention
Your content is kept for as long as your account or its household exists. Service logs are deleted after 90 days. When you delete your account, deletion runs immediately; residual copies in our infrastructure providers’ encrypted backups expire on their schedules.
Children
Buna is not directed at children under 13, and we do not knowingly collect personal information from them. Household member profiles, such as a child’s food preferences, are entered and controlled by adult account holders.
Changes
If this policy changes in a way that matters, we will give notice in the app or by email before the change takes effect. The current version is always at heybuna.com/privacy.