CookPot — Privacy Policy

effective 1 october 2026

CookPot helps you cook dinner from food you have already bought. You photograph a receipt or your groceries, and the app keeps track of what is in your kitchen. (Until 28 september 2026 the app was called CookFirst, and until 26 september 2026 ReciEats. Only the name changed.)

This page says what the app sends, what it keeps, who else sees it, and how to take it out or delete it. It describes the app as it is built today.

In short

• Our server never saves your photographs. They go through it to our AI provider, Anthropic, to be read (see What the AI is sent).
• We keep your kitchen's records — your food, shopping, recipes and settings — on our server, for your kitchen only.
• The AI is never sent your name, your email address, your account or your phone's identifier.
• No ads, no analytics services, no crash-reporting service, no trackers. Nothing is sold or shared.
• You can download or delete everything, at any time, from the app.

Who we are

CookPot is made by Tule Fog Games, LLC, of Davis, California, which is responsible for the data described here. Questions, requests or complaints: support@tulefoggames.com.

Who can use the app

You have to sign in, with Google or (on iPhone) Apple. There are five ways in:

• Open sign-up, while CookPot is in open testing. Anyone with a Google or Apple account can start a kitchen. It is free to use, with everything in it; a subscription gives bigger monthly allowances of planning and reading (see Subscriptions). To stop free trial after free trial: a person gets one trial (signing in again opens the kitchen they have); a phone gets two (a third account started on the same phone gets a kitchen, but its free days count from that phone's first trial); and the server starts only a limited number of new kitchens a day. For the phone limit, a kitchen started this way keeps the identifier of the phone that started it (see Phone identifiers). When open sign-up is off, the app is not open to the public.
• The allowed list. Whoever runs the server keeps a list of accounts that may start a kitchen. Anyone else without an invite or a tester code is refused before any account is created.
• An invite. A kitchen's owner can make an invite code (also as a link or QR code). It admits one person, even one not on the allowed list, into that kitchen only; they cannot start their own kitchen or invite anyone. It works once, lapses after 24 hours, can be withdrawn, and stops working if its maker leaves or is removed. We store a one-way hash of the code, not the code.
• More than one kitchen. If you are signed in and open someone's invite, the app first shows whose kitchen it is, and you choose whether to join. You can then switch between your own kitchen and the ones you joined, or leave one you joined. Switching only changes which kitchen your phone is showing: nothing is copied, merged or deleted between kitchens, and no new record is kept. The list of your kitchens is read from each kitchen's own list of members. If you are removed from a kitchen you joined, your phone opens your own kitchen again.
• A tester code. While CookPot is invite-only, whoever runs the server can make tester codes. A tester code lets one person (or up to a set number of people) start a kitchen of their own. We store a one-way hash of the code, not the code. When you start your kitchen with one, we record that your account used that code, and when, so whoever made it can see which codes are spent; they see the sign-in email address of the account that used it. Deleting your account removes your account from that record. A code can be withdrawn, and someone who already has a kitchen is signed into it without using the code.
• App Review's demo kitchen. Apple's reviewers sign in with their own Apple ID and type a review code, which puts them in one demo kitchen of made-up food and nowhere else. Nobody in it can invite anyone or join a real kitchen, and the code cannot be used by anyone who already has a kitchen. We store only a hash of the code and replace it when we choose. Reviewers are removed when a review is over, and their AI use there is capped at about one dollar a day.

People in a kitchen see each other. Everyone in a kitchen sees the same food, recipes, shopping list and history, and the list of members: each one's sign-in email address, role (owner or cook) and join date. An owner can remove a member; they lose access at once, and any unused invite they made stops working.

And who did what. When a kitchen has a second member, the app asks each member once what the kitchen should call them. It suggests the first name it reads from the start of their email address, and they can change it. The name they give, and a two-letter mark made from it ("De"), are kept with their membership of that kitchen, and every member sees them. From then on the app shows the others who added or ticked an item on the shopping list, who picked tonight's dish, who is cooking, whose receipt or photo it was, and who said something in Talk or asked for a food to be left out. To do this, each of those entries records the account identifier of the member who made it, in the kitchen's files. The kitchen's download names the other members by the name and mark the kitchen calls them, never by their account identifier. In a kitchen of one, nothing is asked and nothing is shown.

Photographs

Anthropic is the company that processes your photos to identify the grocery items in them. A photograph goes from the app to our server and on to Anthropic's AI. We never save the photo on our server. Anthropic's handling of it is in Anthropic's privacy policy: https://www.anthropic.com/legal/privacy.

It has to leave your phone: reading it needs an AI model, and the key for that model lives on our server, not in the app. On the server the image is held in memory for that one request, passed to the model, and gone when the request ends. In production it is never written to disk and never attached to your account or your food. We do not claim "your photo never leaves your phone" — it does, and Anthropic reads it.

This is enforced in code. The app has two developer-only switches — one saves receipt images for measuring accuracy, one attaches a photo of a leftover to that food — and a production server told to turn either on refuses to start. The developer runs the app in development mode at home with the first switch on; the only photographs we keep are the developer's own receipts (see The developer's own receipts).

A small cut-out of a photo is kept on your phone, never sent to CookPot, to show what a question is about; it is deleted when you answer, after 14 days, or when you sign out. When the app is unsure what something in a photo is ("I think this is potato gnocchi. Is it?"), your phone cuts that part out of your photo while it still has it, and shows it beside the question. Our server keeps only where the thing was in the photo (four numbers and a few words, such as "top shelf, left"), so the question can still say where it was on another phone.

What the AI is sent

Reading photographs and suggesting dinners are done by Anthropic's Claude models, through Anthropic's API. There are five kinds of request:

1. Reading a photograph — the photograph and our fixed instructions. Whatever is in the frame goes with it; the model is told to report only food, the printed lines of a receipt or recipe card, and any cooking machine it is sure of.
2. Working out a printed line — the shop's name, and any line our dictionary does not already know: from a receipt, a label, a recipe card, or what you typed into the pantry or staples box.
3. Suggesting a dinner — your food with how many days each has left, your confirmed staples, what must be used first, what you have turned down, how many are eating and the age bands of any children, how much time you have, your word for the main meal, your cooking machines, whether you eat one dish or several, your diet, allergies, foods you won't eat, the religious or medical rules you set, and any religious period you are observing that day (such as Ramadan, Lent, Navratri or Passover), foods someone dislikes, a cuisine you tapped, what you told the kitchen about that day (a lean such as "lighter", or a dish you planned), and the four things the app works out from your records (next section). If an answer breaks one of your rules it is asked again with the reason, up to five times.
4. Planning the cooking — a dish's name and steps (text our model wrote), to suggest which steps go together. Nothing about your kitchen.
5. Talking to your kitchen — the message you typed or spoke, today's date, how many usually eat, the names you gave the people on your people card, and the foods in your kitchen, so it can tell which of your plans or foods you mean. When you speak, your phone turns your voice into text on the phone itself; the sound is never sent anywhere or kept. Only the text is sent, as if you had typed it. Your message is not saved on our server; what it changed is (a dinner for six on Saturday, a food marked as run out), so you can see it and undo it. At most three a day.

Your name, email address, account identifier and phone identifier are never sent.

What we can say is what we do: we send it to be read, and our server never saves a photograph. How Anthropic handles what it receives is set by Anthropic's own privacy policy, not by us: https://www.anthropic.com/legal/privacy.

To save time and cost, we mark the unchanging start of each request (our instructions, and for dinner the general shape of your meals and machines) for Anthropic's prompt caching. We never put a photograph in that part.

What the app works out from your records

Each time you ask for dinner, the app works out four things from your own kitchen's records, and uses them only to shape that dinner:

• the cuisine your kitchen usually cooks, sometimes with a region (such as "South Indian"), from the foods you buy — the one thing worked out from your shopping;
• the ingredients you cook with most, from what you have cooked;
• whether today is an ordinary day or one with more time, from the day of the week and how long your dinners on that day usually take;
• whether your household eats leftovers, from what you did when offered one.

The result is kept only with the dinner it shaped (in that answer and its line of the cost log). We do not work out anything about your health, religion or circumstances. Anything of that kind the app holds — an allergy, a religious rule, a fast, a child's age — is there because you entered it. (An earlier version of this policy said we infer nothing from your shopping. That was wrong.)

What we keep

We keep what was read, not the picture. All of this is kept in your kitchen's own files on our server, and no other household sees it:

• your food — each item, how much, its price if the receipt showed one, when it was bought and when it is likely to go off;
• your shopping trips — shop, date and total;
• what each receipt said — the lines as printed with their prices and amounts, the shop, date and total, and when it was read, so a fix to the reader can be re-applied to old receipts. Text, not the picture. Non-food lines are kept like any other, so a receipt with a pharmacy purchase on it records that too;
• your cooking machines — when a photo shows an appliance the model is sure of: which one, how sure, any brand or model wording printed on it, and when. Nothing else in the photo is read or kept. A photo can add a machine but never remove one; you can remove any yourself;
• what you cooked and turned down, and whether it got eaten or binned;
• the dishes your Kitchen showed you, each with its day and what became of it (cooked, kept, turned down), for 90 days or the last 200 dishes, so you can find one again and cook it or put it back on tonight. When History first opens, the dishes from before it existed are filled in once from what your kitchen already held (what you cooked, and the dishes you took to the stove); nothing is invented and no AI is asked. A dish kept without its method shows "Get the recipe": tapping it sends the dish's name and its foods to the AI to write the method (see What the AI is sent), and the method is kept with that dish;
• what each change to your kitchen changed, for 7 days, so "Undo" (and "undo the onions" in Talk) can put it back: which part of your books it touched and what that part held before. Not your message itself. In a shared kitchen it records which member made the change, so Undo takes back the right one; a member who leaves the kitchen can still be named there until their changes are 7 days old. After 7 days each change is deleted;
• the days you opened the app — the date only, never the time, the screen or what you did, for your last 30 days. It is used to avoid sending you a reminder on a day you have already been in the app, and, across all kitchens, to count how many come back after a day, a week and a month. It is your kitchen's, not a person's;
• your shopping list, staples and saved recipes, including recipes read from a photographed card;
• your kitchen's profile — diet, allergies and rules, observances, how many eat and any children's age bands, your word for the main meal, when you eat and how much time you have;
• a cache of dinner answers, so the same question isn't paid for twice, filed under your diet and rules, the time, how many eat and the five foods going off first. Only your kitchen reads it; the dish itself, stripped of everything of yours, is also in the shared recipe library (see The shared recipe library);
• a cost log of our AI use: the kind of request, model, token counts, number of foods sent, and a short note (a cuisine label such as "indian", whether it was an ordinary day, and a food's name and unit when a suggestion used the wrong unit). A dinner that failed because answers kept breaking your rules is logged only as "breaks-diet" or "breaks-observance", never with the food or rule. Other failures keep the error message, which can name a food;
• dishes you share — a dish you share is a page you chose to publish: anyone with its link can see the dish (its name, ingredients and amounts, steps and time) and nothing else — never your name, email, receipts, shops, prices, household or kitchen. It is kept out of search engines, and "Stop sharing" at the foot of Pantry takes it down. If you photographed that dish, your phone draws your photo into the picture it hands your share sheet, so it goes only where you send it: the dish's page and its link preview never show it, and we never receive it;
• which phone added each entry (see Phone identifiers);
• your subscription record, if your kitchen subscribes (see Subscriptions).

It is used to suggest dinner and to show you your kitchen and spending. It is not sold, not shared with advertisers, and not used to build a profile of you. It all goes when your kitchen is deleted, and it is all in your download.

Our own count of how new kitchens get on. Each week we count, across all kitchens, how many were made, and how many of those set up their table, read a first receipt, asked for a first dinner, cooked one (and two or three in their first week), came back on their first day, week and month, were still using the app in their second week, added a second cook, and subscribed. These are counts of how kitchens use the app, never what is in them. They are worked out on our server from what your kitchen already keeps, listed above (when it was made, the cost log, what was cooked, the days you opened the app, the subscription record): nothing new is stored for them, no analytics service is involved, and the result is numbers only: it names no kitchen or person and is not shared. A count drawn from fewer than five kitchens is never shown. Deleted kitchens are not in it, and our own and our testers' kitchens are not counted.

When a screen fails to draw. The app shows a "Try again" screen and sends our server a short error report: what went wrong in the app's code, which screen (its address, without anything after ? or #), and which version of the app. It goes to our server only, no crash-reporting company, and is kept in the server's log. It carries nothing about you — no name, email address, account, kitchen or phone identifier — and anything in it shaped like an email address, an id or a long number is removed on your phone before it is sent.

The shared recipe library

The dinners the AI writes are also kept, without anything of yours, in one recipe library that all kitchens share, so a dish already written need not be paid for again. What is kept of a dish is only the dish itself: its name, its foods (as general names such as "eggs", never the names or brands on your receipts), its method, its amounts per person, its time, its cuisine, the cooking machines it needs, and a few facts about it the AI gives with it (such as how spicy it is, its course, and whether it suits children or packs for lunch).

Nothing of yours goes in. Not your kitchen, account or phone, not your name or anyone's at your table, not your allergies or rules, not what else is in your kitchen, not how many you cook for, and not your own words or recipes, photos, or recipes you saved from the web. A dish whose method still mentions anything like that is not added. The library counts, per dish and per day, how often a dish was added, as numbers only, with no kitchen attached.

A dish from the library is never trusted as safe: when one is offered, it is checked again against your own table (allergies, diet, rules, observances, your machines and your food), exactly as a new answer is. Deleting your kitchen removes nothing from the library, because nothing of yours is in it.

The shop dictionary

A receipt says GRN GNT SWTCRN 198G; working out that it is sweetcorn costs an AI call. So the app ships with a dictionary that maps printed product text to a food and roughly how fast it goes off. It holds no prices and nothing about who bought anything — though text is stored as printed, so a printed count (1 X ICE TEA) is part of it, and your copy notes when it learned each word. The shipped dictionary is the same for everyone, and includes entries from the developer's own counter photos and one restaurant bill.

When your scan teaches the app a new word, it is saved in your kitchen only. It is not uploaded and does not reach other households. Words reach the shared dictionary only if a person at our end reviews them and puts them in a release.

Your account

We store:

• the id your provider uses for you — an opaque id, not your email;
• your email address, only if your provider says it is verified. It is shown to you and your kitchen's members, and never used to match or merge accounts;
• for each signed-in device, its model name (such as "Pixel 8" or "browser"), when that sign-in began and when it was last used, to the hour;
• a one-way hash of each session token, never the token. A sign-in ends after 30 days unused; using the app renews it (the daily reminder check does not). It also ends when you sign out, are removed from the kitchen or delete your account. Our record goes when you sign out or delete your account; a lapsed or removed one goes the next time anyone signs in. On Android the token is kept encrypted with a key in Android's keystore, and the app's data is excluded from cloud backup;
• which kitchens you belong to, your role, and when you joined and linked each sign-in;
• for invites, who made each one, who used it and when;
• if you sign in with Apple, the "refresh token" Apple issues to CookPot for you, kept only so we can ask Apple to revoke it when you delete your account, as Apple requires. It is stored encrypted, under a key kept on the server apart from the data. We never use it to ask Apple anything about you.

We store no password (there is none), and not your profile photo, contacts, location, IP address or any payment details. Google tells us your display name at sign-in and we show it back to you; it is not saved. The only name we keep is the one you give a kitchen to call you by, with your membership of it (see Who can use the app).

Phone identifiers

The app gives each phone an identifier so that, when two phones write into one kitchen, it can say which phone added what. It is unique to this app — no other app or company can match it to theirs — and it is not an advertising identifier.

• On Android it is a one-way hash of Android's ID for this app, mixed with a fixed value of ours. It stays the same if you clear the app's data or reinstall, so a cleared phone doesn't appear as a second phone; it changes on a factory reset or a new phone.
• On iPhone it is a one-way hash of the identifier iOS gives our apps, kept in the iPhone's keychain, so it stays the same if you delete and reinstall the app; it changes when you erase the iPhone or move to a new one.
• In a browser it is a random identifier kept in that browser.

It is sent with what you add and stored with those entries in your kitchen. The Android app also sends it when you sign in; the server keeps it only if that sign-in starts a kitchen through open sign-up, on that kitchen's record, to count one phone's free trials. It is never sent to Anthropic or anyone else and is not used to track you.

Subscriptions

CookPot is free to use, for good, with everything in it: your kitchen, your shopping list, your cookbook and cooking from it, and the planning and reading it does for you — planning dinners from what you have, planning a cook's steps, reading receipts, grocery photos and recipes, answering you in Talk, and drawing new dish pictures. Nothing is kept for subscribers. What a subscription changes is how much each month: the planning and reading come in monthly allowances (so many dinner ideas, photos read and messages), full for 7 days from the day the kitchen is made (a kitchen made before 30 September 2026 keeps the 14 days it began with) and while subscribed, and smaller for a free kitchen after that. The app tells you when one is running low and when it renews. One subscription covers everyone in the kitchen.

Google Play or the App Store takes the payment, never us. Your card, name and billing address stay with the store, under its own privacy policy.

We keep, in the kitchen's records: which store, which plan (monthly or yearly), the store's identifier for the subscription (Google Play's purchase token or the App Store's original transaction id), the date it is paid until, and when we last checked. Not which member bought it. Our server checks with the store directly, with our own key, when you buy and when a paid period ends; no billing company is involved. The purchase is made under an identifier derived from the kitchen, never your name or email, so the store can tell us which kitchen it is for.

If a trial or subscription ends, nothing is deleted and nothing is locked away. Your kitchen stays open, with everything in it, on the free allowances; when one is used up, the app says when it renews and what you can do meanwhile, and the subscribe screen opens only if you choose it. Downloading and deleting work without paying. Subscribe again and the full allowances are back.

Messages to the studio

Any kitchen can tell the studio something from the app: in Settings, or under a line that says something did not work. A message holds:

• what you typed (up to 2,000 characters);
• the technical details, only if you tick "Include technical details": the app's version, whether it is a phone or a tablet, the phone's system version, and the last few errors the app saw (a page of ours and a code). Never your kitchen's food, household or words;
• a screenshot, only if you add one. We re-encode it on our server, which drops what the camera or phone wrote into the file (such as its location).

It is kept on our server as a ticket, with the account it came from, and it goes nowhere else: no email. The studio (the people who make CookPot, signed in to the app as its administrators) reads it in the app, with your sign-in email beside it, and answers in the app. You read the answer under "Tell the studio" in Settings, and your phone is told "The studio replied" (the studio's phones are told "A new message for the studio"); neither notification carries your words. To stop abuse, an account can send one message every ten minutes and five a day. Deleting your account deletes your messages, their screenshots and the studio's replies.

Who else is involved

• Anthropic — the company that processes your photos to identify the grocery items in them, and suggests dinners. We never save the photo on our server; Anthropic's handling is in Anthropic's privacy policy: https://www.anthropic.com/legal/privacy.
• Google — sign-in. On Android it goes through the phone's Google account; in a browser the sign-in screen loads a script from Google, so Google receives your IP address and browser details. Google tells us an opaque id, your verified email and your display name.
• Apple — sign-in on iPhone. Apple tells us an opaque id and, if you share it, your email address (or a relay address that forwards to it). When you delete your account we send Apple back its token to be revoked.
• Google Play and the App Store — take subscription payments, and tell us only which plan, until when, and their identifier for it.
• Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) — deliver the notifications we push: a change to a shared shopping list, and "The studio replied" (see Notifications). They receive the notification's line (for example "Ama added lemons"), which list item its "Got it" button ticks, and your phone's push token. Nothing else from your kitchen. On Android, Google's Firebase library in the app also gets an installation identifier to deliver them. It starts only after you have signed in, and no Firebase analytics is used.
• Amazon Web Services — hosts our server.
• Replicate — draws the picture on a dish card, from the dish's name only. It is sent nothing about you: no name, account, kitchen or household detail. The picture is an illustration, kept on our server and shown to anyone whose dinner is the same dish.

Nothing is sold or shared with anyone else.

Security and where your data is

The app talks to our server only over HTTPS (through nginx, with the hop behind it encrypted too); plain HTTP gets only a redirect, and the app is built to refuse unencrypted connections. We do not keep your IP address or your browser or phone's details in our server logs.

Your kitchen's files are not encrypted by the app on our server. They can be read by the server's operator and nobody else. Who can get in is decided by sign-in (see Who can use the app).

Our server is in the United States, in Amazon's us-east-2 region (Ohio). If you use the app from elsewhere, your data is transferred there.

Our server's own log holds, for whoever runs it: a sign-in refused because the account was not on the allowed list, with that account's provider id and email address, so it can be added if it should have been; refused invites and sign-ins (the reason only); and unexpected errors. It is not sent anywhere.

Notifications

If you allow them, the app sets one alarm a day at an hour learned from when you usually cook. It then wakes briefly, asks our server for tonight's meal from what is already in your kitchen, and shows a notification. Nothing is sent to Anthropic and nothing new about you to us. The hour is stored on your phone. You can turn notifications off in your phone's settings.

Buttons on a notification. Some notifications carry buttons: "Cook" or "Another" on tonight's dinner, "+2 min" or "Next step" on a pan timer, and on a quick question about your kitchen ("Out of milk?") its two answers. An answer tapped on the notification is sent to our server with your sign-in, exactly as if you had answered in the app. It is kept with your kitchen's records.

A shared shopping list. In a kitchen you share, when someone adds or removes an item, the others can be told. The person who made the change is never told. Whoever is at the shop hears at once, and everyone else gets at most one short summary every few hours, never between 21:30 and 08:00. The line names the person by the first name we read from the start of their email address ("Ama added lemons"). To send it at once, our server keeps your phone's push token and hands the line to Google's or Apple's notification service (see Who else is involved). Where the server has no push keys, your phone asks our server instead. To do this, our server records for a day which member made each change to the list, and who is at the shop. You can turn these notices off under Settings & account.

A reply from the studio. When the studio answers a message you sent it (see Messages to the studio), our server pushes "The studio replied" to your phone the same way. The notification carries only that line.

Download your data

In the app, Download at the bottom of the screen gives you everything we hold for your kitchen as one JSON file: every file in it (food, history, recipes, list, staples, profile, learned words, dinner cache, cost log, subscription record) and your own account record (your linked sign-ins, when you linked them, and your kitchens). It changes nothing and you can do it as often as you like. It holds only your own kitchen and account, never anyone else's sign-in details or the server's session records. Where an entry records another member of your kitchen, the download gives their name and mark, not their account identifier.

Deleting your CookPot account

To delete your CookPot account and its data, use either way below.

In the app: at the bottom of the screen, tap Delete, then confirm. It happens at once.

Without the app: email support@tulefoggames.com from the address you signed in with (or tell us which Google or Apple account it was) and ask us to delete your account. We will delete it and everything below by hand. You can also ask us to delete only some of your data.

What is deleted, straight away:

• every device is signed out and all your sessions are destroyed;
• your account: your sign-in identities, provider ids, email addresses and dates;
• every unused invite you made (and your name comes off every used invite — the invite stays with the kitchen, without you);
• your messages to the studio: their tickets, screenshots and the studio's replies;
• if you signed in with Apple, we first ask Apple to revoke CookPot's token, then delete our copy. If Apple can't be reached, your account is deleted anyway and the app tells you; you can also remove CookPot in iPhone Settings → your name → Sign-In & Security → Sign in with Apple;
• any kitchen you were the last person in, completely — every file, including its dinner cache, cost log and subscription record. Removed from the disk, not marked deleted.

What stays:

• A kitchen other people are still in stays with them. Your phone's push token, your notice setting and the day's record of your changes to its shopping list are deleted from it. Its records describe what that household has and eats. They record which phone added an entry and, from 28 September 2026, which member's account did (see Who can use the app). You leave, and the name and mark the kitchen called you by go with your membership. If you were its only owner, the longest-standing member becomes owner. Your entries keep the identifier of the phone and of the account that added them, and nothing on the server connects either one to you once your account is gone.
• For a year, one line to stop a second free trial — only while open sign-up is on, and only for accounts made after subscriptions began: a keyed one-way hash of each Google or Apple id your account had and of the phone that started your kitchen, and the date your free trial began. No name, email, food or kitchen. The key exists only on our server, so nobody without it can match the line to your account; we match it only if you sign up again, so your free days count from your first trial. It is deleted a year after your trial began.
• A line in our server's log about a sign-in refused before you were on the allowed list stays until the log is cleared.
• On your phone, until you uninstall, the hour it learned you usually cook. The phone identifier is worked out again if you reinstall — that is its purpose.
• The demo kitchen: a reviewer who deletes their account leaves it, and it stays for the next reviewer. Its food is made up.

Deleting your account does not cancel a subscription. Google Play or the App Store keeps billing until you cancel it there. The delete screen says so.

There is no undo and no grace period. You have to confirm your own account to delete it, so it can't happen by a stray tap, and downloading your kitchen first is one tap away. Our server keeps no photographs in production, so we have none to delete.

The developer's own receipts

To measure how accurately the app reads, we hand-labelled eleven photographs of our own receipts, counter and fridge. Nothing from a user is in this set. The photographs stay on the developer's machine while they are the accuracy yardstick and are then deleted; the hand-written labels (line text and prices from those receipts) are in our source history permanently. Measuring against anyone else's photographs would need their specific, informed and revocable consent first. No such study exists.

Children

The app is for adults and is not directed to children. We do not knowingly collect data from anyone under 13.

Your rights

Depending on where you live, you may have the right to see, correct or delete what we hold about you, to object to or restrict how we use it, to withdraw consent for the dietary and religious information you gave, and to get your data in a portable form. Download and delete in the app cover the last two with no request. For anything else, write to us.

If you are in the UK, EU or EEA, the dietary, medical and religious information you enter is special-category data. We process it only because you chose to give it, so the app suggests meals you can eat. You can withdraw it at any time by clearing those fields or deleting your account, and you can complain to your local supervisory authority.

If a breach affects your personal data, we will tell you and the relevant authority where the law requires it.

Changes

A new version of this policy is posted here with a new effective date. If a change materially affects what we collect or who we send it to, we will say so in the app before it takes effect.

1 october 2026 — A photo's question shows what it is about: a small cut-out of the photo, kept on your phone and never sent to CookPot (see Photographs). And you can join a kitchen while signed in, switch between your kitchens, and leave one you joined (see More than one kitchen). Nothing we collect, keep or send is different for either, so neither is a material change.

28 september 2026 — The app is now called CookPot. Only the name changed: nothing we collect, keep or send is different, so this is not a material change.

Material changes, newest first. When one comes to apply to your kitchen, the app shows its first screen again the next time you open it, with a link to this policy:

• 1 october 2026 (notice 2026-10-03) — Two records the app already keeps, now listed in what I keep. What each change to your kitchen changed, for 7 days, so Undo (and "undo the onions" in Talk) can put it back: which part of your books it touched and what that part held before; not your message itself, and in a shared kitchen, which member made the change, so Undo takes back the right one (someone who leaves the kitchen can still be named there until their changes are 7 days old). And the days you opened the app: the dates only, never the time, the screen or what you did, for your last 30 days, so I don't send you a reminder on a day you've already been here, and to count, across all kitchens, how many come back. Nothing new is collected: these are records the app already kept, now listed.
• 1 october 2026 (notice 2026-10-02) — Your dish History. The policy's list of what I keep did not include it: the dishes your Kitchen showed you, each with its day and what became of it, kept for 90 days or the last 200 dishes, so you can find one again. It does now, with how its past was filled in once from what your kitchen already held (no AI asked), and "Get the recipe", which sends a dish's name and its foods to the AI to write its method. Nothing new is collected: this is a record the app already kept, now listed. And three earlier changes to what I keep were shown only to kitchens that pay, so they are said again here for every kitchen: a message you send the studio is kept as a ticket with the account it came from (only a subscribed kitchen can send one), and the name you give a kitchen to call you by is kept (1 October); a kitchen started through open sign-up keeps the identifier of the phone that started it, and deleting an account made that way leaves one line for a year, a keyed one-way hash of its sign-in ids and phone and the date its free trial began (26 September); and a subscription's record is kept: which store, which plan, the store's identifier for it and the date it is paid until (25 September). And the shared recipe library: the dinners the AI writes are also kept, stripped of everything of yours, in one library all kitchens share (see The shared recipe library); nothing of your kitchen goes into it.
• 1 october 2026 — Messages to the studio. A subscribed kitchen can send the studio a message from the app. It is kept on CookPot’s server as a ticket, with the account it came from, and goes nowhere else; the studio reads it and answers in the app, and your phone is told “The studio replied”. It carries only what you typed, the technical details if you tick them (the app’s version, the kind of phone, and the last few errors: a page and a code), and a screenshot if you add one. Nothing from your kitchen goes with it. Deleting your account deletes your messages, their screenshots and the replies. And free to use, with everything in it: after a kitchen's first 7 days, the planning and reading it does come in smaller monthly allowances instead of needing a subscription, which keeps the full ones. And a correction: the account section said no name of yours is kept, but the name you give a kitchen to call you by is.
• 30 september 2026 — Free to use. CookPot stays free for good; the planning and reading it does for you are free for a kitchen's first 7 days (14 for a kitchen started before 30 September 2026), then need a subscription bought through Google Play or the App Store. When they end, nothing is locked away or deleted. Nothing CookPot collects, keeps or sends changes.
• 28 september 2026 — Who did what. In a kitchen with more than one member, each is asked once what the kitchen should call them, and the app shows the others who added or ticked a shopping-list item, picked tonight’s dish, is cooking, scanned a receipt or said something in Talk. Each of those entries records the account identifier of the member who made it; the kitchen’s download names the other members instead.
• 26 september 2026 — Open sign-up for open testing. While CookPot is in open testing, anyone can start a kitchen. To limit free trials, a kitchen started that way keeps the identifier of the phone that started it, and deleting an account made that way leaves one line for a year: a keyed one-way hash of its sign-in ids and phone, and the date its free trial began.
• 25 september 2026 — Subscriptions. A kitchen is free for its first 14 days, then needs a subscription bought through Google Play or the App Store. The store takes the payment; we keep only its record of the subscription (which store, which plan, the store’s identifier for it and the date it is paid until), and our server asks the store to confirm it. Downloading your kitchen and deleting your account never need one.

Contact

Questions, or a deletion request: support@tulefoggames.com.