Privacy Policy

1. Introduction

Welcome to Cook or Delete ("we," "us," "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").

Cook or Delete is a recipe management app that helps you stop hoarding recipes and start cooking. When you save a recipe, you have 7 days to decide: cook it or delete it. The app includes AI-powered recipe extraction, meal planning, and a smart grocery list.

This Privacy Policy applies to all users of the Service, regardless of location. For users in the European Union, we comply with the General Data Protection Regulation (GDPR). For users in other jurisdictions, we comply with applicable local privacy laws.

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of your information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

We collect several types of information from and about users of our Service:

2.1 Information You Provide Directly

We collect information that you voluntarily provide when you:

• Create an account: Email address and authentication credentials. If you sign in with Google or Apple, we receive your name and email address from those services.
• Use the Service: Recipes you save (titles, ingredients, instructions, cooking times, categories, dietary tags), recipe photos you upload, meal plans you create, grocery list items, and your cook/delete decisions.
• Set preferences: Dietary preferences, pantry staple preferences, weeknight effort level, notification settings (reminder times and days), and language preference.
• Extract recipes: URLs you submit for AI-powered recipe extraction.
• Communicate with us: Contact information and message content when you reach out for support or feedback.

2.2 Information Collected Automatically

When you access the Service, we automatically collect certain information:

• Device information: Device type, operating system, app version, and platform (iOS or Android).
• Usage data: Features used, recipes viewed, recipes added, recipes cooked or deleted, meal plans created, grocery items checked, searches performed, and filters applied.
• Error and crash data: Technical error logs and crash reports to help us identify and fix issues.

2.3 Information from Third Parties

We may receive information about you from third-party sources:

• Authentication services: If you sign in using Google or Apple Sign-In, we receive your email address and basic profile information from those services.
• Payment platforms: Apple App Store and Google Play Store provide us with subscription status and transaction confirmations (we do not receive or store your payment card details).

2.4 Recipe Extraction Data

When you use our AI-powered recipe extraction feature, we collect:

• The URL you submit for extraction.
• Extracted recipe content (title, ingredients, instructions, cooking times, serving sizes).
• The source type of the recipe (URL extraction, manual entry, or public recipe).

2.5 Photos and Images

When you upload recipe photos (from your camera or photo library):

• Photos are compressed (max 800px width, 80% JPEG quality) before upload.
• Photos are stored securely in our cloud storage (Supabase Storage).
• Photos are associated with your user account and the specific recipe.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Maintain the Service

• Create and manage your account
• Process recipe extractions from URLs using AI
• Enable the 7-day "cook or delete" review cycle for saved recipes
• Generate and manage your meal plans
• Create smart grocery lists from your planned meals
• Synchronize your data across your devices
• Process and manage your subscription
• Provide customer support and respond to your inquiries

3.2 To Improve and Optimize the Service

• Analyze usage patterns to understand how users interact with the Service
• Improve our AI recipe extraction accuracy
• Identify and fix bugs and technical issues
• Develop new features and functionality

3.3 To Communicate with You

• Send push notifications for cooking reminders and recipe expiration alerts (if you enable notifications)
• Send transactional communications (account confirmations, password resets)
• Provide service announcements and updates

3.4 For Security and Legal Compliance

• Detect, prevent, and address fraud, abuse, and security threats
• Enforce our Terms of Service and other policies
• Comply with legal obligations and respond to lawful requests

4. Legal Basis for Processing (GDPR)

For users in the European Union, we process your personal data based on the following legal grounds:

• Contractual necessity: Processing necessary to provide the Service you've requested (account management, recipe extraction, meal planning, subscription services).
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving the Service, analytics, fraud prevention, and error tracking (balanced against your rights).
• Consent: Where you have given explicit consent for specific processing activities (push notifications).
• Legal obligations: Where processing is necessary to comply with legal requirements.

You have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

5.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Supabase: Our backend platform for database storage, user authentication, file storage (recipe images), and serverless functions for AI recipe extraction. Your recipes, meal plans, grocery lists, and profile data are stored on Supabase's secure servers.
• RevenueCat: Manages in-app subscriptions and communicates with the Apple App Store and Google Play Store on our behalf. RevenueCat receives your anonymous user ID and subscription status.
• Sentry: Error tracking and crash reporting service. Sentry receives technical error data and your anonymous user ID to help us diagnose and fix issues.
• Mixpanel: Analytics service that helps us understand how users interact with the app. Mixpanel receives anonymized usage events, device type, operating system, and app version.

These providers are bound by contractual obligations to keep your information confidential and use it only for the purposes we specify.

5.2 Payment Processing

All subscription payments are processed directly by Apple (App Store) or Google (Google Play). We never receive, process, or store your payment card details. We only receive confirmation of your subscription status.

5.3 Business Transfers

If Cook or Delete is involved in a merger, acquisition, asset sale, or other business transaction, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5.4 Legal Requirements and Safety

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, search warrants)
• Requests from law enforcement or government authorities
• Situations involving potential threats to safety or security
• Protection of our rights, property, or safety

5.5 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. For example, we may share general statistics about recipe extraction usage or cooking trends.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

6.1 Active Accounts

While your account is active, we retain your account information, saved recipes, meal plans, grocery lists, and usage data to provide the Service.

6.2 Deleted Recipes

When you delete a recipe (through the "cook or delete" decision or manually), the recipe data is soft-deleted in our database. Recipe images stored in cloud storage may persist until a periodic cleanup process removes them.

6.3 Account Deletion

When you delete your account:

• Your account and profile information are deleted within 30 days.
• Your saved recipes, meal plans, grocery lists, and uploaded images are permanently deleted within 90 days.
• Backup copies may be retained for up to 180 days for disaster recovery purposes.
• Some information may be retained longer if required by law (e.g., subscription records for tax compliance).
• Anonymized usage data may be retained indefinitely for analytics purposes.

6.4 Inactive Accounts

Accounts inactive for more than 3 years may be automatically deleted after notice is sent to your registered email address.

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

7.1 Access and Portability

• Right to access: Request a copy of the personal information we hold about you.
• Right to data portability: Receive your data in a structured, machine-readable format (GDPR).

7.2 Correction and Deletion

• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data (subject to legal obligations).

7.3 Restriction and Objection

• Right to restriction: Request that we limit the processing of your personal data in certain circumstances.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.

7.4 Consent Withdrawal

• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.

7.5 How to Exercise Your Rights

To exercise any of these rights:

• Email us at contact@cookordelete.com with your request.
• Delete your account through the app settings.

We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

7.6 Right to Complain

If you are in the European Union and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority.

8. Data Security

We take the security of your personal information seriously and implement appropriate technical and organizational measures to protect it:

8.1 Technical Safeguards

• Encryption in transit: All data transmitted between the app and our servers is protected using TLS/SSL encryption.
• Secure token storage: Authentication tokens are stored in encrypted secure storage on your device (iOS Keychain / Android Keystore).
• Row-level security: Our database enforces row-level security policies, ensuring users can only access their own data.
• Input validation: URLs and user inputs are validated and sanitized before processing.

8.2 Your Responsibility

You are responsible for:

• Maintaining the confidentiality of your account credentials.
• Using a strong, unique password.
• Notifying us immediately of any unauthorized access to your account.

8.3 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law, typically within 72 hours of becoming aware of the breach.

8.4 Limitations

While we strive to protect your information, no security system is impenetrable. We cannot guarantee the absolute security of your data. You use the Service at your own risk.

9. Device Permissions

The app may request the following device permissions. All permissions are optional and you can deny or revoke them at any time through your device settings:

• Camera: To take photos of your recipes and meals. Photos are uploaded to our secure cloud storage so you can view your digital cookbook on any device.
• Photo Library: To select existing food photos from your library to add to your recipes. Selected photos are stored securely on our servers.
• Notifications: To send you cooking reminders, recipe expiration alerts, and weekly review reminders. You can customize notification timing in the app settings.

The app does not request or use location data.

10. International Data Transfers

Cook or Delete is based in Germany. Your information may be transferred to, stored, and processed in countries other than your own, including countries that may have different data protection laws.

10.1 EU Users

For users in the European Economic Area (EEA), we ensure that international transfers comply with GDPR requirements through:

• Transfers to countries with adequacy decisions from the European Commission.
• Use of Standard Contractual Clauses (SCCs) approved by the European Commission.
• Other appropriate safeguards as required by applicable law.

10.2 Data Processing Locations

Your data may be processed in:

• European Union (primary data storage via Supabase)
• United States (third-party services such as Sentry, Mixpanel, and RevenueCat)

11. Children's Privacy

The Service is not intended for children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at contact@cookordelete.com. We will take steps to delete such information from our systems.

12. Third-Party Services and Links

The Service may interact with third-party websites and services:

12.1 Recipe Source Websites

When you submit a URL for recipe extraction, our AI processes the content at that URL to extract recipe information. We are not responsible for the privacy practices of the source websites. We only store the extracted recipe data and the source URL.

12.2 Public Recipe Database

The app allows browsing of public recipes from TheMealDB, a free, open-source recipe database. No personal data is shared with TheMealDB when browsing public recipes.

12.3 iOS Share Extension

Our iOS Share Extension allows you to share URLs from other apps (such as Safari) directly into Cook or Delete. The Share Extension only passes the URL to the main app for recipe extraction; no data is stored by the extension itself.

13. Analytics and Error Tracking

We use analytics and error tracking tools to improve the Service:

13.1 Analytics (Mixpanel)

We use Mixpanel to understand how users interact with the app. We track events such as recipe additions, cooking decisions, meal plan usage, and feature interactions. We associate analytics data with your anonymous user ID, subscription tier, and general device information (OS, platform, app version). We do not use analytics for advertising or share analytics data with advertisers.

13.2 Error Tracking (Sentry)

We use Sentry to track crashes and errors in the app. Sentry receives technical error information and your anonymous user ID to help us identify and fix bugs. Error tracking is disabled in development builds.

13.3 No Advertising

We do not display advertisements in the app. We do not use advertising SDKs, tracking pixels, or share your data with advertising networks.

14. In-App Purchases and Subscriptions

Cook or Delete offers a free tier and a premium subscription ("CookOrDelete Pro") with monthly and annual plans.

14.1 What We Collect

We use RevenueCat to manage subscriptions. RevenueCat communicates with the Apple App Store or Google Play Store to process purchases. We receive:

• Your subscription status (free or premium)
• Subscription type (monthly or annual)
• Purchase and renewal dates

We do not receive or store your payment method, credit card number, or billing address. All payment processing is handled by Apple or Google.

14.2 Subscription Management

You can manage or cancel your subscription at any time through your device's App Store or Google Play settings. Deleting the app does not cancel your subscription.

15. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about what personal information we collect, use, and share.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information as defined by the CCPA.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at contact@cookordelete.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes to this Privacy Policy, we will:

• Update the "Last updated" date at the top of this policy.
• Notify you via the app or email (for registered users) when required.

Your continued use of the Service after changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

General Inquiries

Email: contact@cookordelete.com

Mailing Address

Cook or Delete
Mainz, Rheinland-Pfalz
Germany

Response Time

We aim to respond to all privacy-related inquiries within 30 days (or as required by applicable law).