Privacy Policy

1. Information We Collect

• Account info: email, name, profile picture
• Content: recipes, posts, Bites (short-form cooking videos), and comments you create
• Photos/images: images submitted for recipe import (processed in real-time, not stored)
• Recipe files (website): documents you choose to bring in to your recipes — Word, PDF, text and ZIP files. Word, text and ZIP files are read in your browser and only their text is sent to us; PDFs are uploaded for reading and deleted automatically within a day. For each file we keep a fingerprint (so the same file is not imported twice), its name, and which recipes came from it. Recipes found in your files are saved as private recipes in your account. Photos are not imported this way.
• Videos: cooking videos you upload as Bites, stored on Firebase Storage
• Organization: private tags you create for categorizing recipes (visible only to you)
• Cooking activity: recipes you like, rate, cook, and save; Bites you watch, like, and bookmark — used to build your taste profile for personalized AI recommendations
• Usage: app interactions, search queries
• Meal tracking (My Plate): meals you log and their estimated nutrition values — strictly private to you, never visible to other users, and permanently deleted with your account
• Health profile (My Plate, optional): height, weight and weight history, date of birth, sex, activity level, and goals you enter — used to calculate your personal calorie and nutrition targets; if you ask Cook AI, a short summary of it (such as current and goal weight, pace, goals and sex) may be included so the answer fits you (see the AI section); strictly private to you, never shown to other users, and permanently deleted with your account
• Activity data (Health Connect / Apple Health, optional): if you choose to connect Google Health Connect (Android) or Apple Health (iOS), we read your steps, workouts, calories burned, weight, and height to show your daily energy balance and personalize meal suggestions. With your separate permission, we may also write your logged meals and workouts back to these services so your health data stays complete across your apps. We store only daily summaries (never GPS routes, raw heart-rate, or sensor data) in your private account, never use health data for advertising, and never share it with third parties other than the AI service that answers your own Cook AI questions (see the AI section). You can disconnect at any time in the app and request deletion of stored activity data; deleting your account deletes it automatically.
• Sleep data (Health Connect / Apple Health, optional): if you grant sleep access, the app reads nightly sleep summaries (sleep time, wake time, duration) to show you how sleep and eating relate in your own data. Sleep information is processed on your device and is never stored on our servers. If you ask the in-app AI assistant a related question, a short summary computed on your device (such as your average sleep duration) may be included in that request to answer you; it is not saved. Sleep data is never shared and never used for advertising. You can revoke access at any time in Health Connect (Android) or the Health app (iOS)
• Device: device type, OS version (for bug fixes)
• Camera, photo library and microphone: used only when you choose to take or pick a photo or video (recipes, meals, your profile picture, Bites, stories, chats and shared cooking sessions) or to record a voice note in a shared cooking session
• Family dinner votes: when someone asks “what's for dinner?” with a vote link, the first name a family member types (optional) and the dish they pick are stored with that vote and shown to everyone who has the link; the phone keeps a random number so the same person can change their vote. A vote, its names and its picture are deleted automatically 30 days after it was made, and the organizer's votes are deleted with their account
• Voice notes (shared cooking sessions): voice notes you record are stored for that session and transcribed by Google Cloud Speech-to-Text so the other participants can read them; deleting your account deletes your voice notes

2. How We Use Your Data

• Provide app functionality
• Calculate your personal calorie and nutrition targets in My Plate (computed on your device from the optional health profile you provide)
• Show personalized content (followed users' posts)
• Send notifications you've enabled
• Improve the app experience
• Respond to support requests

3. Data Sharing

• Profile info is visible to other users (based on privacy settings)
• Recipe import photos are sent to Google Gemini AI for processing
• Cook AI requests are processed by Google Gemini or OpenAI (see the AI and Third-Party Services section)
• Search: what you type in recipe search, together with the data of recipes other people can see (public recipes and recipes shared with others: titles, ingredients, tags, author names), is processed by Algolia, our search provider
• Photo search: when you search for a photo (for a recipe, a community cover or a story), your search words are sent to Unsplash
• Recipe files you bring in on the website (the text of Word, text and ZIP files; PDFs as files) are sent to Google Gemini AI to find and extract the recipes in them; they are not stored by the AI service
• Recipe import videos (a cooking video you share or pick) are sent to Google Gemini AI to extract the recipe. A larger file is uploaded to that service only for as long as the analysis takes and is deleted immediately afterwards; we do not keep the video on our servers
• Meal photos and descriptions you log in My Plate are sent to Google Gemini AI for real-time nutrition estimation and are not stored by the AI service; nutrition values are estimates, not medical advice
• We don't sell your data to third parties
• Your My Plate health, nutrition, and body-measurement data is never used for advertising or marketing, and is never shared with or sold to advertisers or data brokers
• We may share anonymized analytics
• Legal requirements may require disclosure

4. Data Storage

• Data is stored securely on Firebase (Google Cloud)
• Images and cooking videos are stored on Firebase Storage
• We retain data while your account is active
• When you sign up with an email and password, we email a confirmation code to that address. The code is stored only in a scrambled form and is deleted with your account. To prevent misuse, we also keep a scrambled, one-way form of the address with a count of codes sent and wrong attempts; it cannot be turned back into the address and is deleted automatically after 30 days
• Data is encrypted in transit

5. Your Rights

• Access your data via profile/settings
• Delete your account and data
• Export your recipes
• Control notification preferences
• Manage privacy settings (public/private account)

6. Data Deletion

In-App Deletion (Recommended):

• Open the Cooking Together app
• Go to Profile → Settings → Delete Account
• Confirm by entering your password (or re-authenticating with Google, Apple, or Facebook)
• Your account is deactivated immediately and permanently deleted after 60 days; signing back in within those 60 days restores it

Email Request:

If you cannot access the app, email us at support@cookingtogether.app with the subject “Data Deletion Request” and the email address associated with your account. We will process the request within 30 days.

What Gets Deleted:

• Your profile and personal information (name, email, profile picture, bio)
• Your recipes, posts, comments, ratings, and stories
• Your My Plate data (meal logs, daily nutrition totals, weight history, and health profile)
• Your name and photo on your messages: in a conversation or shared cooking session with other people, what you wrote stays readable to them without your name or photo; one that only you took part in is deleted
• Your followers, following, and bookmark relationships
• Your shopping lists, meal plans and saved recipes
• Your media uploaded to our servers (images, videos)
• Your subscription and notification preferences

Stays after deletion: recipe copies you shared into a family space stay with that family, shown with your name as the contributor, and entries in a community's admin audit log stay until that community is deleted. Also kept: purchase records (which subscription was bought, in which store, and when it ends, linked to your account identifier) for accounting, refunds and disputes; and a minimal record that an account was deleted (the dates and how many items were removed, with no name or email) for 2 years. Backups: our database and file backups are deleted within 8 weeks, so deleted data also disappears from them within that time. Deleting your account does not cancel a store subscription; cancel it in the App Store or Google Play.

Timeline: In-app deletions become permanent after a 60-day grace period. Email-based requests are processed within 30 days. Some anonymized analytics may be retained.

7. Cookies & Tracking

• We use Firebase Analytics (in the app) and Google Analytics (on the website) to improve the app and website
• We use Google AdMob (mobile) and Google AdSense (web) to display ads; these services may use cookies and device identifiers for ad personalization
• Premium subscribers see no ads, except in Bites (short cooking videos), which carry ads for everyone
• On iOS, the Facebook (Meta) SDK that provides Facebook sign-in also sends basic app events (such as app installs, app opens and subscriptions) to Meta, which we use to measure our advertising

Visitors in the European Economic Area, the United Kingdom, and Switzerland: Before any personalized ads are shown to you, Google's certified Consent Management Platform asks for your permission to use cookies and process personal data for advertising and measurement. You may decline personalized ads at any time. Declining does not block access to the site — you will still see non-personalized ads. Your consent choice is stored on your device and can be changed at any time by clearing your browser's storage for this site.

8. Children's Privacy

• App is not intended for users under 13
• We don't knowingly collect data from children
• We do not provide calorie, nutrition, or weight-loss targets to minors
• Contact us if you believe a child has provided data

9. Security

• Data encrypted in transit and at rest
• Regular security reviews
• Secure authentication through Firebase (email, Google, Apple, Facebook)
• Password protection for email accounts
• App integrity checks: the app may ask Google Play (Android) or Apple (iOS) to confirm it is our genuine, unmodified app before it talks to our servers. We receive only a short-lived pass, not information about your device

10. International Data Transfers

Your data may be processed in countries where Google Cloud (Firebase) operates. We ensure appropriate safeguards are in place.

11. Changes

We'll notify you of significant privacy changes through the app or email.

12. AI and Third-Party Services

• Recipe import (URL, text, photo, video, recipe files) uses Google Gemini AI
• Recipe file import (website): the files you choose are read by Google Gemini AI only to extract the recipes in them; uploaded PDFs are deleted within a day, and the import records (file fingerprints, names and results) are deleted with your account
• Photos submitted for import are processed in real-time and not stored by our servers
• Nutrition analysis, recipe scaling, and ingredient alternatives use AI-powered estimation
• Cook AI features (AI recipe search, recipe Q&A, recipe modifications) send your recipe data and queries to an AI service — Google Gemini or OpenAI — for real-time processing
• To fit its answers to your day, Cook AI may include short summaries of your own data in that request: your My Plate meals and targets, health-profile goals (such as current and goal weight, pace and sex), activity, sleep, shopping list and family plans. They are used only to answer you and are not used for advertising
• Your cooking activity (likes, ratings, cook history, saved recipes) is used to build a taste profile that personalizes AI recommendations
• Taste profile data is sent to the AI service (Google Gemini or OpenAI) when you use Cook AI features; it is not shared with other users
• AI conversation history is automatically deleted after 7 days; daily usage counters are deleted after 30 days
• All AI-related data is deleted when you delete your account
• Camera, photo library and microphone permissions are used only when you choose to use them (see Information We Collect)
• AI data processing is performed by Google (Gemini) and OpenAI under their API data processing terms, under which data sent through their APIs is not used to train their models

13. AI Chef Accounts

Cooking Together includes AI Chef accounts — fictional cooking personas that publish AI-generated recipes, posts, stories, and images.

How AI Chef content is generated:

• Text content (recipes, posts, stories) is generated by Google Gemini using a persona prompt that does NOT include any individual user's data, taste profile, recipes, or activity.
• Images and short videos are generated by AI image and video models (from OpenAI, Google and xAI) using a prompt derived from the recipe/post text plus the chef's general culinary style. No user photos or content are used as inputs.
• Each generated draft is reviewed by our team before publication.

What AI Chef accounts do NOT do with your data:

• AI Chefs do NOT read, ingest, or learn from your recipes, posts, comments, likes, taste profile, or any other content you create.
• Your interactions with AI Chef content (follows, likes, comments, bookmarks) are stored alongside your normal interactions and do not feed back into how AI Chef content is generated for you or others.
• AI Chefs are not personalized per user — every user sees the same chef-authored content.

Identification & transparency:

• AI Chef accounts display an "AI Chef" badge next to their name throughout the app — in feeds, profiles, comments, search, and notifications — in app version 1.6.9 and later. On the website, AI Chef recipes carry an "AI chef" label next to the author's name.
• Older app versions (pre-1.6.9) may not display the badge; the disclosure in this Privacy Policy and the Terms of Service is the canonical identification mechanism in those versions. Update to the latest version for the in-UI badge.

Storage & deletion:

• AI Chef accounts are persistent system accounts. Their content remains live in the feed until removed by our team.
• If you delete your account, your interactions with AI Chef content (likes, comments, etc.) are deleted along with your other data; the AI Chef accounts themselves are not affected.

14. Subscription and Billing Data

• Purchase tokens (Android) and transaction IDs (iOS) are sent to our server for subscription validation
• Subscription status (active/expired) is stored in your user profile
• We do not store credit card numbers or payment details — all payments are handled by Google Play or the App Store
• Subscription data is used solely to manage your premium feature access

15. Sign-In Providers (Google, Apple, Facebook)

You can create an account and sign in with Google, Apple, Facebook, or an email address and password. When you sign in with Google, Apple or Facebook, we request only your basic profile: your name, email address, and profile picture. We never request access to your contacts, calendar, files, or any other data held by those services.

• What we use it for: to create and identify your Cooking Together account, show your name and picture on the recipes and posts you share, and let you sign in again on your other devices
• What we store: your name, email address, and profile picture URL in your user profile, and the sign-in provider you used (so we can sign you in the same way next time)
• What we never do: sell it, use it for advertising, or share it with anyone outside Cooking Together except the service providers listed in this policy (Firebase, which operates our sign-in and database), who process it only on our behalf
• Google user data specifically: our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements
• Revoking access: you can disconnect Cooking Together from your Google account at any time at myaccount.google.com (Security → Third-party apps), and from your Apple ID or Facebook account in their respective settings. Deleting your Cooking Together account removes the stored profile data (see Data Deletion above)

16. Contact

For privacy-related questions, contact us at: