Privacy Policy

SupplementSmith (“we” or “us”) operates supplementsmith.com, where people design and order custom dietary supplement blends. This policy explains how we handle information for visitors and account holders. You can reach us anytime at support@supplementsmith.com.

We keep this deliberately narrow — only what we need to build and ship your order:

• Account details: your name, email address, and a password stored only as a salted, one-way hash (we can't read it). If you sign in with “Continue with Google,” we store the email address and name your Google account provides.
• Order & shipping details: shipping address, order contents, totals, order history, shipping tracking details, and any discount or referral code you use.
• Your formulas: the custom blends you build, adjust, and save.
• Label photos (optional): if you use “Snap a label,” the photo is sent to our vision provider to read the ingredient panel, used to pre-fill a blend, and not kept afterward.
• Ingredient requests (optional): if you suggest an ingredient we should carry, we keep your email address and note with the request so our team can review it and follow up.
• Support messages: emails and questions you send us.
• Usage data: basic, privacy-friendly analytics (pages visited, device type, approximate region) to understand what's working.

We do not ask for — and you should not send us — health conditions, diagnoses, medication lists, lab results, or other sensitive health information. The builder works entirely from the ingredients and amounts you choose. Caution information is shown the same way to everyone; nothing about it is personalized to your health.

• To build, review, produce, and ship your custom orders.
• To power your account: saved blends, reorders, and order tracking.
• To send transactional email (order confirmations, review and shipping updates, security codes).
• To provide support and respond to your questions.
• To keep order and lot records required for product traceability and safety.
• To protect the service against fraud and abuse, and to improve it.

We do not sell or rent your data. We share the minimum necessary with a short list of service providers that process it on our behalf under contract:

• Stripe — payment processing. Your card details go directly to Stripe; we receive only a reference and the last four digits.
• Resend — sending transactional email.
• Vercel — website hosting and privacy-friendly analytics.
• Turso — our managed database.
• OpenAI — reading the ingredient panel in a label photo, only when you use “Snap a label.”
• Google — only if you choose “Continue with Google” to sign in. Google learns that you signed in; we receive your Google account email and name, and nothing else.
• Shipping carriers, to deliver your order.

We may also disclose information if required by law, or to protect the rights, safety, and property of our customers or ourselves.

We use a small number of cookies that are necessary for the site to work — keeping you signed in and remembering your cart. We use privacy-friendly analytics that avoid cross-site tracking and don't build advertising profiles. We don't run third-party ad trackers on the site.

You can request deletion of your account and saved formulas from your account settings at any time. We delete that data on request, except records we're legally required to keep — for example, order and lot records for product traceability and tax purposes — which we retain for the required period and then delete.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to opt out of the “sale” or “sharing” of it. Because we don't sell or share your data for advertising, there's nothing to opt out of there — but you can still exercise the other rights.

• Email us to access, export, or delete your data — we honor these requests for everyone. (Account deletion can also be requested from your account settings.)
• Unsubscribe from any non-essential email using the link in the message.
• California residents (CCPA/CPRA) and other state residents may make these requests free of charge, and we won't discriminate against you for doing so.

To make a request, email support@supplementsmith.com. We may need to verify your identity first.

Traffic is encrypted in transit (HTTPS). Passwords are salted and hashed, never stored in plain text. Access to customer data is limited to what's needed to run the service. No system is perfectly secure, but we work to protect your information and to respond quickly if something goes wrong.

The site and products are intended for adults 18 and older. We don't knowingly collect information from children. If you believe a child has provided us information, contact us and we'll delete it.

We may update this policy as the service evolves or the law changes. When we do, we'll revise the “last updated” date at the top, and for material changes we'll give notice through the site or by email.