Privacy Policy

Information you provide

We process account identifiers, email, authentication information, profile names, username, avatar and profile details. Google sign-in supplies identity information authorized through Google; we do not receive your Google password. We also process content you provide, such as recipes, source URLs, cooking photos, reviews, recreations, collections, shopping lists, meal plans, fridge items, search inputs and AI requests. Profile details and posts you choose to publish can be visible to other people.

Nutrition and activity information

If you use nutrition features, we process information you enter such as birth month and year, sex used for estimates, height, weight, build, goals, activity level, dietary preferences, food logs and workouts. With your separate permission, the iOS app can read Apple Health step totals and sync them to your CookSocial activity record. You can revoke Health access in device settings. These features can involve sensitive health-related information. Do not include unnecessary medical details in photos, prompts or public posts. We use Health data for the requested nutrition and activity functionality, not to target advertising. Revoking a device permission does not by itself erase information previously synced; contact us to request deletion.

Technical information and subscription records

Our systems and service providers process IP addresses, device and browser information, request timestamps, diagnostic errors, security logs and identifiers needed to operate and troubleshoot the app. We store subscription entitlements, purchase and renewal events, promotional-pass redemption and expiration, token balances and transaction records. We also record your account ID, the versions of the Terms and Privacy Policy acknowledged and the acceptance timestamp. Apple or another checkout provider handles payment credentials; CookSocial uses purchase status and transaction identifiers rather than your full payment card details.

How we use information

We use information to authenticate accounts, store your library, deliver community and planning features, process uploads and imports, generate requested AI outputs, estimate nutrition, synchronize activity, manage purchases and tokens, respond to support requests, prevent abuse, maintain security and diagnose service problems. Where data-protection law requires a legal basis, we rely on providing the service you request, complying with legal obligations, appropriate legitimate interests such as security and reliability, or consent where required. Separate permissions remain separate from agreeing to our Terms.

Service providers and AI processing

CookSocial uses Supabase for authentication, database and storage, Vercel for application hosting, Resend for authentication email, OpenAI for AI processing, and Qonversion and Apple for subscription validation and billing-related functionality. Information needed for the relevant function is transmitted to these providers. For example, an AI request may send uploaded food images, recipe text, ingredients, source extracts, transcripts or your instructions to an AI provider. Avoid including sensitive details that the task does not need. Provider processing, retention and safeguards depend on their service terms and our configuration; do not assume an upload stays only on your device or is instantly deleted after processing. Third-party search, recipe websites, social platforms and food-data services may receive requests when you use their content or open their pages.

Private library, public content and sharing

Recipes saved as private imports are intended for your personal library; publishing a recreation, profile, review or community recipe can make the selected content accessible to others. Under the public-content license in our Terms, we may also feature that public content, with its public creator name, handle or avatar, in CookSocial collections, newsletters, social channels and marketing, including through distribution and promotional partners. That permission does not cover your private imports, drafts, food logs or health information. Source URLs and attribution may appear with shared content. Some recipe, step and recreation images are delivered through public asset URLs: someone who obtains that URL may view the image even when the associated recipe is not listed publicly. Do not upload confidential images. Private does not mean end-to-end encrypted: authorized service providers and operators can process information to provide support, security and the service. Public content may be copied, indexed or retained by recipients. Photos or source links may reveal personal information; remove information you do not want to share before uploading or posting.

Other disclosures

We may disclose information when necessary to comply with law, respond to valid legal process, protect people or the service, investigate abuse or resolve rights complaints. If the business is reorganized or transferred, relevant information may be transferred with appropriate safeguards and notice where required. This policy does not authorize selling your private recipe or health records, or using health data for advertising. We will provide any legally required notice and choice before introducing a materially different use.

Cookies, device storage and permissions

We use cookies and local device storage for sign-in sessions, preferences, navigation, caching and continuity of requested features. Blocking these can prevent sign-in or other features from working. Camera, photo-library, notification and Health permissions are requested for the relevant device functions and can be changed in system settings. Visiting an external site in an embedded browser can involve that site's cookies and privacy practices.

Retention and security

We retain information as needed to provide the service, maintain account and subscription records, resolve disputes, prevent abuse and meet legal obligations. Different categories can have different retention periods. Deletion may take time to propagate to backups, logs and service-provider systems; records required by law or for legitimate security or dispute purposes may be retained with restricted use. We use access controls and other safeguards, but no internet service can promise absolute security.

Your choices and rights

You can edit available profile information, change permissions and remove content using the available app controls. Contact the address below to request account deletion, a copy of your data, correction or other privacy assistance. We may verify your identity before acting. Depending on your location and applicable exceptions, you may have rights to access, portability, deletion, correction, restriction, objection, withdrawal of consent or a complaint to a data-protection authority, and to exercise rights without unlawful discrimination. Withdrawing consent does not undo earlier lawful processing. Account deletion does not cancel an Apple subscription; manage billing separately in your store settings.

International processing, children and teenagers

Our providers may process information outside your country. Where required, appropriate transfer safeguards must apply to that processing. CookSocial is for users aged 13 and older, subject to any higher minimum age required locally, and is not directed to children below that age. Users under 18 need parent or guardian permission as described in our Terms. Agreement to the Terms is not a verified parental-consent process. If we learn that a child below the applicable minimum age has provided personal information, we will investigate, restrict the account as appropriate and take steps to delete information we are not lawfully permitted to retain. Parents and guardians may contact us about a child's account or a privacy concern. Teenagers should avoid posting their school, home address, contact details, sensitive health information or other identifying details in public profiles, photos and posts. Use device permissions carefully and ask a trusted adult for help with privacy choices.

Policy updates

We identify this policy by version and effective date. We will provide additional notice or request consent where legally required for material changes. The Terms agreement log records which privacy notice was presented; it does not replace any separate consent required for a new purpose.

Operator and contact

CookSocial

Operated by an individual based in Washington, USA

Contact: CookSocial development team