KleptoCook privacy policy
Last updated: 16 October 2026
This policy explains what personal data KleptoCook collects, why, who else handles it, how long we keep it, and what you can do about it. It covers the KleptoCook app for iPhone and Android, and our website, kleptocook.com. Most of the website sets no cookies and loads nothing from other companies; the pages where you sign up for news or the beta, suggest features or delete your account are different, as "Our website" explains. Porkbun, which hosts the website, receives your IP address and the details your browser sends when you open a page (see "Who else handles your data"). "We" and "us" mean the person who runs KleptoCook, named under "Who we are" near the end, and support@kleptocook.com reaches us about anything in this policy. The short version is at kleptocook.com/your-data/.
The short version
* You can use much of KleptoCook without an account. The recipes, meal plans and shopping lists you make are stored on your phone, not on our servers, unless you publish a recipe. Some of their text is sent to us to match ingredients and find prices. * From version 1.1.0 of the app, the recipes you import are read on your phone: their captions are not sent to us or to anyone else. A recipe from a website link is still fetched and read by our server. * An account needs an email address and a password, or you can sign in with Apple or Google instead. What you publish, comment, rate, scan, suggest or vote on with an account is stored on our servers in Ireland. * We use a few other companies to run the app. "Who else handles your data" lists each one and what it gets. * We do not sell your data. There is no advertising in KleptoCook, and we do not track you across other companies' apps or websites. * You can download a copy of what our servers hold about your account at kleptocook.com/download-my-data/. * You can delete your account in the app's Settings, or on our website at kleptocook.com/delete-account/. We delete it after 24 hours, apart from the things listed in "How long we keep things". Prices you scanned, stock and nutrition figures, and the products, pack sizes and brand names you added, stay in the shared database, as our terms say, and within a day of the deletion are no longer linked to you. Prices you saved from a shop's website are deleted.
Why we are allowed to use your data
Data protection law (the UK GDPR, and the EU GDPR for people in the European Economic Area) needs a reason, called a lawful basis, for each use of personal data. We use these:
* Contract. We need the data to give you something you asked for, such as an account, a published recipe or a search for shops. * Legitimate interests. We have a good reason, and it does not override your rights. We name the reason each time. You can object to these uses (see "Your rights"). * Legal obligation. When the law requires us to, for example to answer a request about your data. * Consent. For usage statistics, which are off until you turn them on, and for the emails you ask for on our website: news of the release, and the beta. You can withdraw it at any time.
Your phone's permissions. The camera, your location and notifications work only if you allow them on your phone. That is a control you hold, not our legal reason for using the data. You can turn any of them off at any time in your phone's settings (on an iPhone, the Settings app; on Android, Settings, then Apps, then KleptoCook), and the features that need them stop working. On Android you can also give the app only your approximate location. When you choose a photo, your phone's own photo picker gives the app only the photo you pick.
What we collect, and why
Using KleptoCook without an account
Most of the app works without an account. You get a random guest label, such as "guest-1029". It never leaves your phone.
Even without an account, some data leaves your phone, including:
* usage statistics, if you have turned them on (see "Usage statistics"); * a check for app updates each time the app starts from closed (see "App updates"); * your phone's identifier for this app, sent with requests to our server (see "Safety and preventing abuse"); * the area you are in, about 1 km across, if you open the Shopping map (see "Finding shops and prices near you"); * requests for the map around you, to Apple on an iPhone or to Google on Android, if you open the Shopping map; * requests to Instagram for a post's page and picture, if you share an Instagram post to KleptoCook (see "Importing recipes"); * the ingredient lines of recipes you save (see "What stays on your phone").
Your account
When you create an account, we collect:
* your email address; * your password, if you choose one, which our sign-in provider, Supabase, stores only in scrambled (hashed) form; * which version of our terms you agreed to, and when, going by your phone's or browser's clock. Agreeing includes confirming that you are 18 or over (see "Children").
Your account gets an ID, a long random code. It is how our systems tell accounts apart.
We email you a code to confirm your address, and, if you ask, a code to reset your password. These emails are sent through Resend, from noreply@kleptocook.com.
Leaked passwords. When you choose a password, in the app or on our website, to create an account or after a password reset, we check that it is not one already known from data breaches, using Have I Been Pwned's Pwned Passwords service. Your phone or browser scrambles the password (a SHA-1 hash) and sends only the first 5 characters of the result. The service sends back every scrambled leaked password that starts with them, and your phone or browser compares the rest itself. Your password, the rest of its scrambled form, your email address and your account ID are never sent. The service receives your IP address and the details your phone or browser sends with the request, as any website does. If it cannot be reached, your password is not checked and you can still use it.
Signing in with Apple or Google. Instead of a password, you can create an account or sign in with "Sign in with Apple" or "Sign in with Google", in the app or on our website. Apple or Google then asks you to confirm on its own screen, and tells us who you are. We never see your Apple or Google password. Before a new account is made this way, you agree to our terms, as when you create one with a password. If your Apple or Google account uses the same email address as an account you already have here, you sign in to that account.
* Apple gives us a user ID that Apple makes for KleptoCook, and an email address: your own, or, if you choose to hide it, an address Apple makes that forwards our emails to you (Apple's "Hide My Email"). On an iPhone the app asks Apple for your email address only, not your name. On Android, and on our website, you sign in on Apple's own web page, in your browser, and Apple's page may ask whether to share your name too; if you share it, we keep it with your account. Emails we send to a hidden address pass through Apple's relay service, which forwards them to you. * Google gives us a user ID, your Google account's email address, your name and the address of your Google profile photo. Google gives every app that uses its sign-in these details. We keep them with your account. The app does not show them: your profile in KleptoCook has only the username and photo you choose. Google's sign-in code in the app keeps nothing between sign-ins. On our website you sign in on Google's own page, in your browser.
Apple and Google know that you signed in to KleptoCook, and when, and handle that under their own privacy policies (Apple: https://www.apple.com/legal/privacy/; Google: https://policies.google.com/privacy). An account made this way has no password until you set one with "Forgot password?", and it does not need one, in the app or on our website. When you delete an account that signs in with Apple on an iPhone, the app asks Apple to confirm, and our server then uses the one-time code Apple gives it to end KleptoCook's access to your Apple ID. Nothing from that is kept. When you delete it on Android or on our website, or if that does not work, you can remove KleptoCook yourself at account.apple.com, under Sign-In and Security, Sign in with Apple. To end KleptoCook's access to your Google account, remove it under Third-party connections in your Google Account (https://myaccount.google.com/connections).
Before you sign in, create an account, ask for a new code or ask to reset your password, the app runs a check from hCaptcha to make sure you are a person. Signing in with Apple or Google needs no check from hCaptcha. hCaptcha is run by Intuition Machines, Inc., a US company. The app loads the check from hCaptcha's servers into a web view that you normally do not see. On our website the same check runs in your browser (see "Our website"). hCaptcha receives your IP address, information about your phone or computer and the app's web view or your browser, the date and time, and how you interact with the check, such as touches and key presses while a puzzle is showing. If it shows you a picture puzzle, it also receives your answers. hCaptcha says it uses puzzle answers, which are not linked to you, to label images for machine learning. Your email address and password never go to hCaptcha.
hCaptcha handles this data for us, as our processor, under its terms and data processing agreement. That agreement also lets hCaptcha use the data to build and improve its services, to detect security incidents and to protect against fraud, and to use it for its own business purposes once it has been combined with other people's data or stripped of anything that identifies you. hCaptcha says it keeps no long-term personal data about the people it checks, although it may keep data where it detects abuse. hCaptcha's privacy policy is at https://www.hcaptcha.com/privacy and its terms are at https://www.hcaptcha.com/terms. To ask about this data, email us rather than hCaptcha.
The check can save cookies from hCaptcha in the app's web view on your phone. hCaptcha says they are needed to run and protect its service: for security, routing traffic and anonymous statistics about the service. They last up to 30 days. The one we saw set each time the check loads lasts 30 minutes. We do not read them. On our website, hCaptcha can save the same kinds of cookies in your browser.
Your phone keeps you signed in with a session stored securely: in the keychain on an iPhone, and on Android encrypted with a key kept in the Android Keystore. Signing out removes it. Signing in on our website is kept separately (see "Our website").
Supabase, which runs our sign-in, keeps its own logs of sign-ins, sign-outs, new accounts and code requests. They record the time, your IP address, your email address, your account ID and basic details about the app or browser and your device's software. Its logs of every request to our server also record your IP address, and an estimate of your town, postal code area and internet provider worked out from that address. They also record the address of each request, which often includes your account ID. The address of a photo includes the ID of the account it belongs to and, for a recipe photo, the recipe's ID. None of these logs includes your password or the code. Supabase keeps these logs for up to 7 days, and we have no way to delete them sooner. Supabase also keeps its own security records of connections to its systems, for a period it does not publish.
While you are signed in, our database keeps your IP address and those app, browser and device details with your sign-in session. The record is deleted when you sign out or delete your account. If a sign-out cannot reach our server, for example because you are offline, or if you delete the app while signed in, the record can stay until you delete your account.
Why: to create your account, sign you in, with Apple or Google if you choose, and check that the email address is yours. The captcha keeps automated sign-ups out.
Lawful basis: contract. The captcha: legitimate interests, protecting accounts and the service from bots.
Your profile
Other signed-in users can see your profile. It holds:
* your username. Until you choose one, it is "cook-" followed by six characters of your account ID; * a bio and a profile photo, if you add them; * a premium badge, if you have premium and choose to show it; * the date you joined; * your streak: how many days in a row you have opened the app, your best streak, and the date you last opened it; * your KleptoPoints: your total, and your points from the last seven days. Other people see them as they stood at the start of the day; you see your own as they are now; * how many recipes you have published, and their average rating.
Your username and profile photo are shown with your published recipes, your comments and your places on the leaderboards.
Your profile is created automatically the first time you open the Profile tab while signed in, choose a username in Settings or on our website, save a scan, or use the "Show me on leaderboards" switch.
While you are signed in, the app tells our server the date you first open the app each day. This keeps your streak.
Before a profile photo is uploaded, your phone crops it, resizes it and saves it as a new JPEG. The new file does not include the original photo's location, camera details or the time it was taken. A copy stays on your phone, kept for the account that chose it. If the upload does not go through and your account has no photo on our servers, the app uploads that copy later without asking again: when it next starts, when you next sign in to that account, or when you next open your profile. It does not do this while any photo of yours is stored on our servers, including one we removed from your profile.
Leaderboards. Your profile is listed automatically on each leaderboard you qualify for: points, points this week, published recipes, average rating (with at least 3 ratings) and longest streak (at least 2 days). To leave them, turn off "Show me on leaderboards" in Settings. It is on until you turn it off, and you can turn it back on at any time. While it is off, you are not ranked on any leaderboard, and nobody sees you on one, including you. It does not hide your profile: your points, streak, published recipes and rating still show there, so someone who compares your profile with a leaderboard could tell that you are not on it. People you have blocked, and people who have blocked you, do not see you on the leaderboards, and you do not see them. A suspended account is on no leaderboard.
Why: so other people can see who published a recipe or wrote a comment and how much each person has contributed, and to run the leaderboards.
Lawful basis: contract, for the profile you set up. Legitimate interests, for the automatic profile, the streak and the leaderboards: showing who contributes, and encouraging people to add prices.
Publishing recipes, and comments, ratings and saves
Publishing a recipe. When you publish, we store the title, servings, cooking time, method, tags, ingredients, any calories per serving you give, any original link, the photos you add, and whether you allow comments. The recipe's Notes field is not published. It stays on your phone. The publish screen starts with the recipe's own photo, if you took or chose one for it, and you can remove it before you publish.
If the first publish of a recipe does not finish, for example because you have reached the limit on published recipes, the app deletes from our servers what it had already sent, photos included. If it cannot, for example because the connection dropped, what was sent stays on our servers as a private copy that nobody else can see, with any photos it had uploaded, and each attempt like that can leave another copy. The app cannot delete these copies, so email us if you want them deleted.
If an update to a recipe you have already published does not finish, the changes that reached our servers before it stopped can already be showing to other people. Update it again, or unpublish it.
When you delete a recipe you have published (in Recipes, from its menu), the app asks whether to remove it from Discover too. If you do, it is unpublished first, and kept privately on our servers like any recipe you unpublish; if that does not work, for example because you are offline, nothing is deleted. If you delete it from your phone only, it stays published until you unpublish it from its three dots in Discover or on your profile.
Before upload, your phone crops and resizes each photo and saves it as a new JPEG, without the original photo's location, camera details or the time it was taken.
The original link is shown exactly as you give it. Links copied from Instagram can include a tracking code added by Instagram, so check the link before you publish.
Where your recipe appears in Discover. The "For you" order in Discover is worked out from how many people have saved a recipe, how it is rated (a rating counts once it is a week old), how many people have commented on it, how new it is, and a random shuffle that differs from one visit to the next. It uses nothing about you, the person browsing. So that unpublishing a recipe and publishing it again does not make it count as new, we note when you first made each recipe public, unpublished and deleted recipes included. We use only the last 60 days of these notes, delete older ones the next time you publish, and delete them all with your account.
Comments. We store what you wrote, which recipe it is on, when you wrote it, and that it was you.
Ratings and likes. We store which recipes you rated and how, which comments you liked, and when. If you rate the brands you used after cooking, we store those ratings too. Other users see brand ratings only without your name, as averages.
Saves. When you save someone's recipe to your phone, we record that you saved it, so the recipe can show how many people have. Your phone also downloads the recipe's first photo and keeps it with your copy, along with which published recipe the copy came from and the ID of the account that published it. The copy and its photo stay on your phone if the recipe is later unpublished or taken down.
Why: to show your recipes and comments to other people, to let people keep the recipes they save, and to count ratings and saves.
Lawful basis: contract.
Scanning prices and receipts
When you scan a product, we collect:
* the barcode, which is looked up on our server as soon as it is read; * the product's name, brand and pack size, if it is new to us; * the price, if you give one, whether it was in stock, the shop you chose and the time; * a nutrition panel, if you add one.
If you photograph a nutrition label, the photo is read on your phone and is not uploaded. Only the figures are sent, and only when you save. From version 1.1.0 of the app, on a phone with at least 4 GB of memory, it is read by the KleptoCook label reader, an AI model that runs on the phone. Once you are signed in and the recipe reader has downloaded (see "Importing recipes"), the app downloads the label reader, two files of 747 MB together, from Hugging Face (huggingface.co), on Wi-Fi, or on mobile data if you choose. Hugging Face sees your phone's IP address and the details the download request sends; nothing about you or your account goes with it. The files are kept in the app's temporary files, which your phone may clear when it runs short of space (the app then downloads them again), and deleting the app removes them. Until they have downloaded, labels are read by the phone's own text reader.
On Android, barcodes and the text in a photo are read on your phone by Google's ML Kit. The photo, and what is read from it, are not sent to Google. ML Kit may contact Google to download or update what it needs to read text, and sends Google figures about how it performs, with details of the app and your phone. Google handles those under its own terms.
Each saved scan is stored with your account ID. Other users see the product, and prices as a typical figure per shop with the day of the newest one, but not who added them.
Prices are in pounds, so for now a price or a receipt can be added only at a shop in the UK, the Isle of Man or the Channel Islands. Elsewhere you can still record whether something was in stock. We work out a shop's country from where it is on the map and, near the border with Ireland, from what OpenStreetMap says of it. Near the border, a shop whose country OpenStreetMap does not give takes no price until it does, even if it is in the UK.
Points for a price are held until another shopper confirms it. A product you type in earns points once someone else scans it. A price very different from what others have paid is kept, but left out of the shared figures until another shopper confirms it.
Receipts. Scanning receipts is switched off in the app at the moment. This is how it works when it is on. The receipt photo is read on your phone and is not uploaded. The item names and prices read from it are sent to our server straight away, to find matching products, before you save anything. You see every line before saving, and you can remove any line that is not an item, such as a card payment. When you save, we store the shop, the total, the number of lines and the time, with your account ID. Only you can see that receipt. Each line becomes a price, as with a scan.
Why: to build a shared database of grocery prices (at UK shops for now), stock and nutrition, and to award KleptoPoints.
Lawful basis: contract. Keeping contributions after you delete your account, no longer linked to you, is legitimate interests: keeping the shared database complete and accurate.
Browsing shops' websites
When you are signed in, the card of a Tesco, Sainsbury's or Morrisons shop on the Shopping map offers "Browse items". It opens that shop's own website inside the app and searches it for each item on your shopping list in turn. You do the browsing: the app types each search, and reads the product page you have open only when you tap "Read this".
* The shop's website. The pages come from the shop, not from us. The shop receives your IP address, details of your phone and the app's web view, the item names the app searches for and what you look at, as it would in any browser, and can set cookies in the app's web view. It handles all of this under its own privacy and cookie policies, and any cookie choice it offers you is yours to make. Its cookies stay in the app's web view between visits until you delete the app. We do not read them, and nothing about your account goes to the shop. * What we save. When you save a product, the app sends our server what it read from the page: the product's name, brand, barcode if the page shows one, pack size, price and nutrition figures per 100 g. It never reads member prices (such as Clubcard or Nectar prices), photos, descriptions or reviews. We store this with your account ID, the shop (the chain, not a branch), the shop's own number for the product, the list item's ingredient and the time. The app also sends the page's address, which our server uses only to check that it is on the shop's website, and does not keep. Pages you look at without saving are not recorded. * What happens to it. The product goes into the shared product database. Where we already have it, we match it by barcode, by the shop's number, or by its brand, name, pack size and nutrition; if it has no ingredient yet, it is linked to the one on your list. The price is shown to other users as a price at that chain's shops near them, without who added it, and only where nobody has priced that product in person at that shop. A price very different from what others saved is kept but not shown. Prices saved this way earn no KleptoPoints. If you later scan the same product in a shop of the same chain, that scan earns extra points, once per product and chain.
How long: the prices you save this way are deleted with your account. The products, pack sizes and nutrition figures stay, as with a scan, no longer linked to you.
Why: to fill in the products, nutrition and prices that nobody has scanned yet, so that a shopping list can be priced.
Lawful basis: contract, for pricing your list. Legitimate interests, for adding what you save to the shared database: keeping it complete and accurate.
Finding shops and prices near you
KleptoCook asks for your location when you open the barcode or receipt scanner, the Shopping map or the Wanted list, and when you open the Shopping tab while you are signed in and your shopping list has items on it, to price them. It never asks when the app starts. It uses your location only while you are using the app, never in the background.
Your exact position never reaches our server. Your phone sends only the area about 1 km across that you are in, then works out which shops are within reach and how far away each one is.
* Shops near you. The area is sent to our server. If it has not been searched in the last 30 days, or was searched over a smaller area, our server asks an OpenStreetMap search service (overpass-api.de, or overpass.kumi.systems if that one is busy or does not answer) for the shops around the middle of the area. That request comes from our server, not your phone. It carries no account details and not your IP address. We keep a note that the area was searched: the middle of the area, and the time. It is not linked to your account. We also keep your IP address for 7 days, to limit how often one address can search. For those 7 days, the note, and anything you add soon after a search, such as a price, could be matched to that IP address by their times. * Prices and Wanted items near you. The same area is sent to our server to find prices and wanted items around it, and, for a shopping list, to check whether it is where prices are taken (see "Scanning prices and receipts"). Your phone keeps the ones within 5 km of you. We do not store the area. * The map. On an iPhone, Apple Maps draws the Shopping map, so your phone loads the map around you from Apple. On Android, Google Maps draws it, so your phone loads the map around you from Google, which receives your IP address, the area shown and details of the app and your phone, under Google's privacy policy (https://policies.google.com/privacy). The map shows your position with a dot, worked out on your phone and not sent to us.
We do not store your position with your account. But the shops you can choose from are the ones near you (within 2 km in the scanners), so a price you save records, against your account, the shop you picked and when.
Without your location you cannot choose a shop, so you cannot add prices or receipts.
On Android, your phone works out where you are through Google Play services, which can use Wi-Fi and mobile networks as well as GPS. If Google Location Accuracy is on in your phone's settings, Google receives that information under its own terms.
Supabase's logs of requests to our server record that your phone asked for shops, prices or wanted items nearby: when, from which IP address, and an estimate of your town and postal code area worked out from that address. The area travels inside the request, and these logs do not record it. Supabase keeps these logs for up to 7 days.
Why: to find shops and prices near you.
Lawful basis: contract. You can turn location off at any time in your phone's settings.
Importing recipes
* From a website link. Our server fetches the page, not your phone, so the website sees our server and not you. If we can read a recipe on the page, it becomes a shared copy on our servers, with the page address and the author's name as the page gives it. Any signed-in user can read that copy. It is stored without your account ID. If we cannot read a recipe on the page, we note the page address, without your account ID. Nothing uses this note yet, and it has no time limit at present. * From Instagram. When you share a post to KleptoCook or paste a post link, your phone asks Instagram for the post page and its picture. When the app looks for the rest of a recipe, your phone may also open the creator's Instagram profile or link-in-bio page. These requests come from your phone, so those services see your IP address, and the requests say they come from KleptoCook. If that leads to the creator's website, or we guess the website from their handle, our server searches that site for the dish by name, as with a website link. The post's picture is saved on your phone with the recipe. It is not uploaded. * Reading the recipe. From version 1.1.0 of the app, your phone reads a caption, or text you paste or share, into a recipe itself, and tidies a recipe read from a website the same way. The text is not sent to us or to anyone else. On a phone with at least 4 GB of memory it uses the KleptoCook recipe reader, an AI model that runs on the phone. A phone with less reads a caption with simple rules, and keeps a recipe from a website exactly as the page gives it. Nothing is sent to Google's Gemini service any more: versions of the app before 1.1.0 used it to read captions until October 2026, and Google deletes what it was sent within 55 days. * The recipe reader. On a phone that can run it, once you are signed in, the app downloads the recipe reader, a 529 MB file, from Hugging Face (huggingface.co): on Wi-Fi, or on mobile data if you choose. Hugging Face sees your phone's IP address and the details the download request sends; nothing about you or your account goes with it. The file is kept in the app's temporary files, which your phone may clear when it runs short of space (the app then downloads it again), and deleting the app removes it. Imports wait until it has downloaded. * Counting the day's imports. Each account can import a limited number of recipes a day. When your phone reads a caption, the app sends our server a scrambled (hashed) form of its text, with the post's link and up to five web addresses the caption names, so that the same caption counts once however often it is read. Our server keeps only your account ID, the day (UK time) and scrambled (keyed hash) forms of what was read, never the caption, the link or the addresses themselves, and deletes them the next night. Recipes imported from a website link are counted the same way. * The share panel key. Versions of the iPhone app before 1.1.0 have a share panel, and while you are signed in they keep a key in your iPhone's keychain that lets the panel show how many imports you have left today (until October 2026 it also let the panel read posts). We store only a scrambled (hashed) version of it, and signing out of one of those versions cancels it. From version 1.1.0 there is no share panel: sharing a post or a link to KleptoCook opens the app, as it does on Android. The app makes no key, and if an older version left one on your iPhone, the app cancels it and deletes it from the keychain the next time you open it signed in. The Android app never had a share panel or a key. * From a photo or a spreadsheet. A photo of a list of dishes, or a spreadsheet, is read on your phone and is not uploaded. On Android the text is read by Google's ML Kit on your phone (see "Scanning prices and receipts").
Why: to import the recipe you asked for.
Lawful basis: contract.
Notifications
If notifications are allowed for KleptoCook on your phone, signing in registers your phone with Expo's push service and stores the resulting push token with your account. On Android, the app first asks Google's Firebase Cloud Messaging for a token for your phone, which also creates a Firebase installation ID; it does this only once you have allowed notifications. That includes permission you gave earlier for meal reminders or cooking timers. If notifications are not allowed yet, the app asks when you sign in.
We use the token to tell you when someone comments on your recipe or likes your comment. If you have scanned something in the last 30 days, we also tell you once a week when KleptoBoost points are on offer. Moderators are also told about new reports.
Notifications travel through Expo and then Apple, to an iPhone, or Google's Firebase Cloud Messaging, to an Android phone. They can contain other people's usernames, recipe titles and up to 120 characters of a comment.
Once you have allowed notifications, the app keeps your phone registered with Expo's push service, even while you are signed out. That registration carries no account details.
The token is removed from your account when you sign out. If your phone is offline at that moment, or notifications for KleptoCook are switched off, the token stays with your account, and your notifications can still reach the phone, until someone signs in on it with notifications allowed. It is also removed when you delete your account, or when your phone stops accepting notifications.
Meal reminders, and the alarms of timers you start in cook mode, are different. They are set up on your phone and never go through our server. Starting a cooking timer asks for permission to send notifications, if you have not given it yet, so that its alarm can reach you.
Why: to tell you about activity on your recipes and comments, about boosted points, and, for moderators, about new reports.
Lawful basis: legitimate interests: keeping you up to date with activity on your content, dealing with reports quickly, and telling people who add prices when points are boosted. The KleptoBoost notification may count as marketing. The app has no separate switch for it yet. To stop it, turn off KleptoCook's notifications in your phone's settings, or email us and we will stop sending it. On an iPhone that stops the others too; on Android you can turn off only the kind called "Other", which is the one that carries it. You can turn all notifications off at any time in your phone's settings.
Usage statistics
Usage statistics are off until you turn them on. There is a "Share usage statistics" switch on the last card of the app's short tour, which the app shows when you first open it, and the same switch is in Settings. When you turn usage statistics on, the app records on your phone which wording you agreed to and when. That record stays if you turn them off again. If we change what the switch says, usage statistics stay off until you turn them on again: if you had turned them on, the app asks you once, with the new words, the next time it starts. Like the rest of KleptoCook, usage statistics are only for people aged 18 and over, so if you are under 18, please leave them off. While they are off, the app does not contact PostHog, except that if you turn them off while using the app, a batch already on its way may still arrive. If you turn them on, the app sends usage statistics to PostHog, an analytics service.
What is sent:
* which tab or panel you open; * on your first start, which cards of the app's short tour you see, and whether you then create an account, sign in or continue without one; * when you save, import, plan or publish a recipe, or make a shopping list, with a count or a type, never the content; * when the app is installed, opened, updated, brought to the front or put in the background; * your phone's make and model, operating system and its version, app version, language and region settings, time zone and screen size; * a random session ID, and which version of the statistics wording you agreed to; * a random ID and, once you sign in, your account ID. Signing in links your use on this phone since the last sign-out to your account. After you sign out, the next statistics sent use a new random ID, so what you do afterwards is not linked to that account, and two accounts used on the same phone are not linked to each other. There is one exception: if you signed out while usage statistics were off, then when they are next turned on, a record that the app was opened or updated can still be linked to the account that signed out; * your IP address, which PostHog receives with every request your phone makes. PostHog uses it to estimate your town, postal code, region, country, approximate map position and time zone, and stores those estimates with your statistics and your profile there. It does not store the IP address itself.
We send no names, email addresses, recipe text, photos or links to PostHog.
To stop, go to Settings and turn off "Share usage statistics". Nothing more is sent from that moment: anything not yet sent is thrown away. A batch already being sent as you switch may still arrive.
Deleting your account does not delete your usage statistics at PostHog. PostHog keeps usage statistics for at least a year on its free plan and at least seven years on its paid plans, and says only that it may delete them after that. It keeps the profile it holds for your account ID until we delete it. You can ask us to delete your statistics and that profile at any time. Statistics never include a price, a product or a barcode, but they do record when you opened the scanner, so if you delete your account and want nothing left that could be matched to when you added a price, ask us to delete your statistics too. Statistics sent from a phone after you signed out of it are not linked to your account, apart from the one exception under "What is sent", so we cannot find them.
Why: to learn which parts of the app are used, so we know what to improve.
Lawful basis: your consent, which you give by turning usage statistics on and withdraw by turning them off.
Safety and preventing abuse
* Device identifier. The app sends your phone's identifier for this app with requests to our server. On an iPhone it is the one Apple gives each app maker, so other companies' apps see a different one. On Android it is the Android ID, which is different for each app maker's signing key, so other companies' apps see a different one too; it stays the same if you reinstall the app, and changes if you reset your phone. When you save a scan or a receipt, our server stores a scrambled (hashed) copy of it, and of your network address, against your account. It deletes each one 30 days after it was last seen. If two accounts are used on one phone, or on one home network, we record that they are linked. Linked accounts cannot confirm each other's prices or count as separate reporters, and accounts used on one phone cannot each earn the same points bonus for a product. We keep that record until one of the accounts is deleted. * Accounts under review. If many of an account's prices look wrong, the account is put under review. Its points are held. The prices it adds are labelled "account under review" in our shared data and left out of shared figures until confirmed. * Reports. When you report something, we store who reported it, what was reported, the reason, any note you add, a copy of what was reported, and when. Only we can see who reported what. Moderators get a notification with the reason and the first 100 characters of what was reported. A person looks at every report within 24 hours. * Blocks. We store who you blocked and when. Only you can see your blocked list. The person you block is not told. * Moderation. If we hide something you posted or suspend your account, we keep a record of what we did and why. We delete reports and moderation records 2 years after they were made, except that while an account is suspended, the reports and records about it are kept until the suspension ends. A suspended account cannot comment, rate, like comments or publish, or suggest, vote on or report features on our website; other people stop seeing its profile, recipes, comments and feature suggestions, and it is left off every leaderboard. * Words that are not allowed. Usernames, bios, comments and published recipes are checked automatically against a list of words that are not allowed. * Usage limits. So that no single account can overload the service, we record when your account imports a recipe, adds a price, posts a comment, reports something, downloads a copy of its data or uses certain other features. These records are deleted after 7 days, or when your account is deleted if that is sooner. Sign-ups on our website are counted the same way, under a scrambled (keyed hash) form of the email address instead of an account (see "Our website"). * Security log. When our servers change data about you using our administrator key, we keep a record that includes your account ID. It helps us spot misuse of that key. We delete each record 2 years after it was made. When your account is deleted at your request, we take your account ID, and the IDs of the records it named, out of that log: what stays says which kind of record was changed, when, and from which IP address and app the change came, but not whose record it was. If an account is deleted without such a request, for example through misuse of that key, or if that key changed the account's data without one of the reasons we know of, we keep its account ID in the log for 7 days so that we can look into it, and then take it out. A request counts only if you made it yourself, in the app or on our website, or we made it for you after you emailed us. Changes we make directly in the database are not in this log. Moderation decisions are recorded in the moderation records instead.
Some of these decisions are automatic: whether a price looks wrong, whether points are held, whether an account is put under review, and whether something is hidden after enough people report it. None of them has a legal or similarly significant effect on you. If you think one is wrong, email us and a person will look at it. Whether a report counts towards hiding something depends on how old and how active the reporting account is.
Why: to prevent fraud and abuse of KleptoPoints, keep the community safe, and meet the App Store's and Google Play's rules for apps where people post content.
Lawful basis: legitimate interests, preventing fraud and abuse and keeping people safe.
App updates
Each time the app starts from closed, it checks Expo's update service for a new version, and uses a new version from the next time it starts. The check sends a random ID for this install, the app version and your IP address. If a serious error stopped the app while it was starting, the check also sends the error message.
Why: to deliver fixes without a new App Store or Google Play release.
Lawful basis: legitimate interests, keeping the app working and secure.
Contacting us
If you email support@kleptocook.com, Porkbun's email forwarding service passes your message on to our mailbox at iCloud Mail (see "Who else handles your data"). We receive your email address and whatever you write. If you tell us somebody published your recipe, we record your name, email address, what you claimed and what we did about it. We keep these emails and records with no time limit at the moment.
Why: to answer you and deal with complaints.
Lawful basis: legitimate interests, answering you and dealing with complaints. For requests about your data: legal obligation.
Our website
Most pages of kleptocook.com set no cookies, have no forms and load nothing from other companies. Five kinds of page are different.
News of the release, and the beta. On "Notify me when it's out" you can leave your email address to hear when KleptoCook is out, and on "Help test KleptoCook" you can offer to test it before then. We store:
* your email address, which list you joined, and which phones you picked; * for the beta, your confirmation that you are 18 or over, your name and phone model if you give them, and, if you test on Android, the email address of the Google account on your phone; * which version of the sign-up wording you agreed to, when you signed up, when we last emailed you, when you confirmed (and, if you wrote to us to be confirmed instead of using the link, that we confirmed you and why), when we added your Google account to the Android test, when we invited you to test on each phone, when we emailed you that KleptoCook is out on each phone, when a KleptoCook account with the same email address asked to be deleted, and, if you leave, when.
Nothing is added to a list until you confirm. We email you a link through Resend. Until you press the button it opens, we send you nothing more, unless your address is entered on the form again, which sends a new link in place of the old one (no more often than the limits below allow). The link works for 48 hours, and we delete sign-ups nobody confirms 7 days after the last email. After that we email you only about what you picked: for the release list, when KleptoCook is out on your phone; for the beta, an invitation and news of test versions. Every email has a link to leave.
To invite you to the beta we email you a link through Resend. On an iPhone it is the link to Apple's TestFlight app: we do not give Apple your email address, and when you join, Apple runs the test through your Apple Account under its own terms. Apple does not tell us who joined with that link, so on an iPhone you leave the test yourself: in TestFlight, open KleptoCook and tap Stop Testing. On Android we give Google your Google account's email address, so that Google Play lets that account install the test version, and Google handles it under its own terms.
Before a sign-up is sent, the page runs hCaptcha's check that you are a person (see "Your account"). To stop the form being used to flood someone's inbox, our server keeps, for 7 days, a scrambled (keyed hash) form of the email address with the time of each sign-up, and sends at most one email an hour, and three a day, to one inbox. Spellings of an address that reach the same inbox count as one: before it is scrambled, any +tag is taken off, and for Gmail the dots too.
Why: to tell you what you asked to hear about, and to run the beta. Lawful basis: your consent, which you withdraw by leaving the list. The check and the limits: legitimate interests, keeping the form from being misused.
Feature suggestions. Anyone can read the suggestions on "Suggest a feature", without the name of who made them. To suggest a feature, vote for or against one, or report one, you sign in with your KleptoCook account, or create one there on the same terms as in the app. We store each suggestion, when it was made and your account ID, your votes, and your reports with the reason and any note; we delete each report 2 years after it was made. Signed-in users see the username of who suggested something and how many people voted each way, but not who. Suggestions are checked against the same list of words that are not allowed, and moderators can hide one or mark it as planned, in progress, done or not planned. You can withdraw your suggestions and change your votes at any time, and they are deleted with your account. Why: to learn what people want KleptoCook to do. Lawful basis: contract; for moderation, legitimate interests.
Signing in on the website. Signing in, creating an account, confirming your email and resetting your password work as in the app, with the same hCaptcha check, which loads only when you use one of those forms, and the same leaked-password check (see "Your account"). "Sign in with Apple" and "Sign in with Google" work there too, with no hCaptcha check: the page sends your browser to our sign-in server at Supabase, which passes it to Apple's or Google's own page and then back to the page you started on (see "Signing in with Apple or Google"). Before a new account is made this way, or if your account has never agreed to our terms, you agree to them on the page first. While your browser is away, the page keeps in that tab's session storage a random one-time code that proves the sign-in was started in that tab, which of Apple or Google you chose, the page to come back to and when you started, and, if you were creating an account, which version of our terms you agreed to and when. It removes them the moment you come back, and a sign-in that has not come back within 10 minutes is forgotten. The page keeps your sign-in in your browser's session storage for that tab, never in a cookie. It removes it when you sign out, and your browser deletes it when the tab's session ends, although a browser that reopens closed tabs can bring it back with the tab. Signing out on the website does not sign you out of the app. Once you are signed in, "Suggest a feature" asks you to choose a username if yours is still the one starting "cook-", and you can change it there or on the deletion page. Choosing one works as it does in Settings, and creates your profile if you have none (see "Your profile"). If you answer "Not now", the page also keeps your account ID in that tab's session storage, so that it does not ask again in that tab, and it is removed when your sign-in is. The website does not count visits, and PostHog is not on it.
Deleting your account. kleptocook.com/delete-account/ explains how to delete your account in the app, and lets you ask for it by signing in: the same 24 hours apply, and the app on your phone is signed out within the hour.
Downloading your data. Sign in at kleptocook.com/download-my-data/ (again, if your last sign-in was more than 10 minutes ago) and it gives you a copy of what our servers hold about your account, as a JSON file, with links to your photos that work for an hour. The file is made in your browser and goes nowhere else. Each download is a usage-limit record, and you can download at most 3 a day (see "Safety and preventing abuse"). The copy leaves out other people's data (reports about your content show the reason and the day, never who made them or the time), scrambled identifiers and keys, and photos held out of sight after a takedown or suspension. A suspended account gets its copy by email instead.
These pages talk to our server at Supabase straight from your browser, so Supabase's logs record your IP address and browser details for up to 7 days, as "Your account" describes. The only cookies are hCaptcha's.
What stays on your phone
These are stored on your phone, not on our servers:
* your recipes, including imported ones, and their photos; * the recipe reader's file, if your phone has downloaded it (see "Importing recipes"), and the label reader's files, if it has downloaded them (see "Scanning prices and receipts"); * meal plans, shopping lists and cookbooks; * your settings, calorie goal and preferences, including the usage statistics switch and the record of which wording you agreed to and when; * the streak your phone counts, and your guest label; * whether you have seen the app's short tour; * the getting-started checklist on the Profile tab, for each account signed in on it: which of its steps are done, and whether you hid it. The app works them out on your phone, from what is on it and from your own account's username, scans, ratings and published recipes, which it reads from our server; * when the weekly KleptoPoints goal was last celebrated, for each account signed in on it, so that it is celebrated at most once a week; * meal reminders, and the cooking timers you start in cook mode with their alarms.
Some of it is sent to us briefly:
* When you save a recipe with new or changed ingredients, its ingredient lines are sent to our server to match them to foods, for calorie counts. Foods we cannot match are added to a list of missing foods, with no link to you. If you are not signed in, our server refuses the request and records nothing. * When you are signed in, the item names on a shopping list are sent to our server to find prices.
Why: calorie counts and prices.
Lawful basis: contract. The list of missing foods: legitimate interests, improving the food database.
When the picture of a post you imported shows Instagram's play symbol, or text laid over the dish, the app removes them on your phone with AI models that run on the phone, and the recipe shows the cleaned copy. It keeps the original for 60 days, in case the cleaning went wrong, and then deletes it. None of this is uploaded.
Photos you take or choose to read a receipt, a label or a list stay in the app's temporary files until your phone clears them. The app does not delete them, and they are not uploaded. Photos you replace in a recipe or in your profile, and the photos of recipes you delete, stay in the app's files on your phone until you delete the app.
Your phone also keeps the first photo of each published recipe you saved. With each recipe you published or saved, it keeps which published recipe it is or came from, and the ID of the account that published it. It also keeps a copy of the profile photo each account chose on it, and the IDs of the accounts that have signed in on it, so that the app can tell which published recipes are whose, and whose getting-started checklist is whose.
None of this belongs to an account. Anyone who uses KleptoCook on your phone can see and change its recipes, meal plans and shopping lists, whichever account is signed in, or none. Only the account that published a recipe is offered the controls for its publication.
On an iPhone, what is on your phone is included in the iPhone's backups (iCloud or computer), under Apple's terms. Deleting your account does not remove it. Deleting the app does, except for a few small items in the iPhone's keychain, which iOS currently keeps after an app is deleted: your sign-in, a share panel key if a version before 1.1.0 left one (see "Security"), and, if you set up notifications, a random ID that Expo's notification code keeps.
On Android, Google's backup of your phone takes only a few small settings files from the app, not your recipes, plans, lists, photos or sign-in. They hold your scheduled meal reminders and cooking timer alarms, which name the recipes, a random ID for this install that the update check sends, the app's record of which permissions it has asked for, and settings kept by the code libraries the app uses, which can include Firebase's notification settings. Google handles backups under its own terms. Deleting your account does not remove what is on your phone; uninstalling the app removes all of it.
People who are not KleptoCook users
Some of the data we handle is about people who do not use KleptoCook.
* Recipe authors. When someone imports a recipe from a website, we keep the page address and the author's name, as the page gives it, with the shared copy of the recipe. Any signed-in user can read them. * Instagram creators. When someone imports a post, its caption is read on their phone. To count their imports, our server receives a scrambled form of the caption and the post's link, keeps only scrambled forms of them, and deletes those the next night. We do not keep the caption. The recipe, with its link, is saved on that person's phone. If they publish it with the link, the link is kept in our list of recipe sources. * People who tell us about their recipes. See "Contacting us".
Where it comes from: public web pages and posts that our users choose to import.
Why: to import the recipe someone asked for, and to credit the person who wrote it.
Lawful basis: legitimate interests, letting people keep recipes they found and crediting the people who wrote them.
How long: the shared copy and the author's name have no time limit at present. If the person it names asks, we remove the name, or take the shared copy down so that nobody can see it on our servers. Copies people have already saved to their own phones are out of our reach.
If this is about you, you have the same rights as anyone else (see "Your rights"). To object, or to ask us to remove your name or your recipe, email support@kleptocook.com.
What other people can see
People who are not signed in cannot look up your profile, published recipes or comments, in the app or through our database. But a copy of your recipe that someone saved to their phone, a recipe someone shares outside the app, or a photo link they pass on (which works for an hour), can reach anyone. Feature suggestions on our website can be read by anyone, without the name of who made them (see "Our website").
Other signed-in users can see:
* your profile, as described above; * recipes you publish, while they are published, with your username and photo; * your comments, with your username, photo and when you wrote them; * how many people have saved each of your recipes; * where you are on the leaderboards, with your username and photo, unless you have turned off "Show me on leaderboards" in Settings, or one of you has blocked the other; * feature suggestions you make on our website, with your username, and how many people voted for and against each. Nobody sees who voted which way.
The app's screens show only part of what signed-in users can read. Someone who reads our database directly, rather than through the app, can also see:
* your account ID; * the date you last opened the app, and when your profile last changed; * which recipes you rated and how, and which comments you liked; * your profile photos, including ones you have replaced and any we removed from your profile.
Blocking someone hides their recipes, comments, feature suggestions and places on the leaderboards from you, and yours from them. Neither of you can comment on or rate the other's recipes, or vote on the other's suggestions, and they can no longer open your profile. It does not stop direct reads of the database.
Prices, stock, nutrition figures, products and brand names you add are visible without your name or account ID. Anyone can read brand names and barcodes, signed in or not.
Anyone who saves a recipe you published keeps a copy of it on their phone, with its first photo and your account ID. The copy stays there after you unpublish the recipe, after we take it down and after you delete your account, and we cannot reach it. After you unpublish a recipe, a phone that was already showing it can still load its photos for up to an hour. A phone that has shown your recipe photos or your profile photo can also keep them in the app's image cache for a while, and we cannot reach that either.
If you use the Share button on a recipe, the recipe goes, with its creator's username, to whoever you send it to.
Who else handles your data
We do not sell your data, and we do not use it for advertising. We share it only with the services below, to run the app.
* Supabase, run by Supabase Pte. Ltd. of Singapore (our database, sign-in, file storage and server code). Everything we store on our servers, plus Supabase's own logs of requests to them. Supabase handles it only on our instructions, under its data processing agreement. Where: our database, sign-in and files are in Ireland (EU). Our server code runs in the Supabase data centre nearest to you, which can be outside the UK and EU, depending on where you are. Supabase keeps its logs on separate systems and does not say where. Supabase's staff around the world, and Supabase, Inc., which provides its support, can reach the data from outside the UK and EU (see "Data sent to other countries"). Supabase uses other companies of its own, such as Amazon Web Services and Cloudflare for hosting. It lists them at supabase.com/legal/customer-resources/subprocessor-list. Our website's sign-up, feature and account pages send what you enter to Supabase straight from your browser. * Resend, run by Plus Five Five, Inc. (sends the emails with sign-in and password reset codes, the emails that confirm a sign-up on our website, and the invitations to test KleptoCook). Your email address and the email itself, which contains the code or the link. It does not record whether you open the email. Where: the United States. Resend uses other companies to run its service, all in the United States, including Amazon Web Services, which hosts its systems and sends email. * hCaptcha, run by Intuition Machines, Inc. (the check that you are a person, before you sign in, create an account, ask for a new code or reset your password, in the app or on our website, and before you sign up for news or the beta). Your IP address, information about your phone or computer and the app's web view or your browser, how you use the check, and your answers if it shows a picture puzzle. It handles this for us under its data processing agreement. Where: mostly on servers near you and in its main data centres in Europe. Some data goes to the United States, where the company is based. * Google, for the Android app and for signing in with Google, through Google LLC (and, for people in the EEA or Switzerland, Google Ireland Limited). If you sign in with Google, on an iPhone, on Android or on our website, Google confirms who you are and gives us your Google user ID, email address, name and profile photo address (see "Your account"), and handles the sign-in under its own privacy policy. Google Maps draws the Shopping map: your IP address, the area shown, and details of the app and your phone. Firebase Cloud Messaging delivers notifications: a token and a Firebase installation ID for your phone, and what each notification says. ML Kit reads barcodes and text on your phone, and may send Google figures about how it performs and details of the app and your phone, never the photo or what is read from it. Google Play services works out your phone's position, under your phone's location settings. Google handles the Maps, ML Kit and Play services data under its own privacy policy (https://policies.google.com/privacy), and the Firebase Cloud Messaging data for us under the Firebase data processing terms. If you join the beta on Android, we give Google Play your Google account's email address, which Google handles under its own terms. Where: any country where Google has facilities, including the United States. * PostHog, run by PostHog, Inc., a US company (usage statistics, only if you turn them on). What "Usage statistics" lists. Where: PostHog's EU cloud, on Amazon Web Services in Frankfurt, Germany. The app's request to PostHog for its settings goes through Cloudflare, a network company PostHog uses, which has servers around the world and sees your IP address. PostHog may also handle the data in the US (see "Data sent to other countries"). PostHog lists the companies it uses to run its service, and where they work, at posthog.com/subprocessors. We have switched off PostHog's features that send data to other companies' AI services, and PostHog does not use our data to train its own AI. * Expo, run by 650 Industries, Inc. in the United States (push notifications and app updates). For notifications: your phone's push token from Apple or, on Android, from Firebase Cloud Messaging, a random ID that Expo's code keeps on your phone, the app's identifier, your IP address, and what each notification says. For updates: a random ID for this install, the app version, which update the app is running, your IP address and, if the app failed while starting, the error message. Expo says it handles this data on our behalf. Its terms also let it use the data in combined or de-identified form to improve its own services. Expo keeps push tokens so that notifications can be sent, and publishes no fixed period for keeping them or its records of update checks. It keeps what a notification says only until it has passed it to Apple or Google, and its staff may see it while fixing a problem with the service. Where: the United States. Expo's services run mainly on Google Cloud, and update files are delivered through Cloudflare's network. * Apple delivers notifications to iPhones (your push token and the notification text) and draws the Shopping map on iPhones. If your phone cannot be reached, Apple may keep one notification for up to 30 days and try again. If you join the beta on an iPhone, you install the test version with Apple's TestFlight app and your Apple Account; we do not give Apple your email address. If you sign in with Apple, Apple confirms who you are and gives us the user ID and email address described in "Your account"; if you hide your email address, our emails to you pass through Apple's relay. When you delete such an account on an iPhone, our server sends Apple the one-time code your iPhone got from Apple, to end KleptoCook's access to your Apple ID. Apple handles all of this under its own privacy policy. * OpenStreetMap search services, which find the shops around a point: overpass-api.de, run by FOSSGIS e.V., a non-profit association in Germany, and, if that one is busy or does not answer, overpass.kumi.systems (now also called overpass.private.coffee), run by Private.coffee, a non-profit association in Austria. The middle of the area being searched, a point rounded to about 1 km and not your exact position, sent from our server with no account details and not your IP address. They see our server's address, not yours. Private.coffee may keep the first part of that address, the time and our app's name for up to 48 hours (its privacy policy: https://private.coffee/privacy.html). FOSSGIS handles what it receives under its own privacy policy (https://www.fossgis.de/datenschutzerklärung/). Where: Germany and Finland (FOSSGIS), Austria (Private.coffee). * Instagram (Meta), link-in-bio services and recipe websites, when you import from them, as described in "Importing recipes". They handle what they receive under their own policies. * Tesco, Sainsbury's and Morrisons, when you open their websites with "Browse items", as described in "Browsing shops' websites". You visit their websites yourself, inside the app, and they handle what they receive under their own privacy and cookie policies. We send them nothing about you. * Have I Been Pwned, run by Superlative Enterprises Pty Ltd in Queensland, Australia (the leaked-password check when you choose a password in the app or on our website; see "Your account"). Your IP address, the details the request sends, and the first 5 characters of the scrambled password, with nothing about you or your account. It handles the request under its own privacy policy (https://haveibeenpwned.com/Privacy), which says its web server logs are kept for up to 31 days, and uses Cloudflare, a network company with servers around the world, to deliver the service and block abuse. Where: Australia, and wherever Cloudflare serves you from. * Hugging Face, run by Hugging Face, Inc. in the United States (hosts the recipe reader's and the label reader's files, which your phone downloads; see "Importing recipes" and "Scanning prices and receipts"). Your phone's IP address and the details its download request sends, each time it downloads them, with nothing about you or your account. Hugging Face handles the request under its own privacy policy, as for anyone downloading a public file, and serves the file through a content delivery network with servers around the world. Where: the United States, and wherever its network serves you from. * Porkbun, run by Porkbun LLC (forwards email sent to support@kleptocook.com to our mailbox, and hosts our website). For email: your email address and your message. For the website: your IP address and the details your browser sends when you open a page. Porkbun handles these under its own privacy policy, which does not say how long, if at all, it keeps forwarded messages. Where: the United States. * Apple (iCloud Mail, our support mailbox, where Porkbun delivers email sent to support@kleptocook.com). Your email address and your message, which we keep there (see "Contacting us"). Our mailbox is on an iCloud account in the UK, which Apple provides through Apple Distribution International Limited in Ireland, and Apple handles the mail under its own privacy policy. Where: Apple generally stores data with Apple Inc. in the United States.
We may also share data if the law requires it, for example because of a court order. If KleptoCook passes to a company, such as one the owner sets up, your data would go with it and this policy would still apply.
Data sent to other countries
Our database and files are in Ireland, and the OpenStreetMap search services are in Germany, Finland and Austria. UK law treats the EU as protecting personal data adequately, so no extra safeguard is needed for them, and for people in the EEA they stay inside it.
For the services that handle data outside the UK and EU:
* Supabase (Supabase Pte. Ltd., Singapore): we rely on the standard contractual clauses with the UK International Data Transfer Addendum, which are part of Supabase's data processing agreement. They cover its staff and its support company reaching the data from outside the UK and EU, and the logs it keeps on systems whose location it does not publish. * Google, for the Android app and for signing in with Google (Google LLC, and Google Ireland Limited for people in the EEA or Switzerland): Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework, so we rely on the UK-US data bridge. For Firebase Cloud Messaging, Google's data processing terms also put standard contractual clauses in place. * Resend (Plus Five Five, Inc.), hCaptcha (Intuition Machines, Inc.), PostHog (PostHog, Inc.) and Expo (650 Industries, Inc.): each is certified under the UK Extension to the EU-US Data Privacy Framework, so we rely on the UK regulations that approve transfers to US organisations certified under it (the "UK-US data bridge"). Resend's data processing agreement also puts standard contractual clauses with the UK Addendum in place. hCaptcha's includes them too, and they would apply if that approval stopped covering it. * Hugging Face (Hugging Face, Inc., United States), which hosts the recipe reader's and the label reader's files: your phone downloads them as it would from any website, and Hugging Face handles the request under its own privacy policy. Hugging Face does not say it is certified under the UK Extension to the EU-US Data Privacy Framework, and we have no agreement with it, so no transfer safeguard is in place between us and Hugging Face. Its privacy policy says it collects the IP address of people who use its services. * Have I Been Pwned (Superlative Enterprises Pty Ltd, Australia), which checks whether a password you choose has leaked: your phone or browser asks it as it would ask any website, and it handles the request under its own privacy policy. UK law does not treat Australia as protecting data adequately, and we have no agreement with it, so no transfer safeguard is in place between us and Have I Been Pwned. What it receives is your IP address and 5 characters of a scrambled password shared by many other passwords. * Porkbun (Porkbun LLC, United States), which forwards support emails and hosts our website: Porkbun is not certified under the UK Extension to the EU-US Data Privacy Framework and does not offer a data processing agreement, so no transfer safeguard is in place between us and Porkbun. It handles your email and your visits to our website under its own privacy policy. * Apple (Apple Distribution International Limited, Ireland), for our support mailbox: UK law treats Ireland as protecting data adequately. Apple's privacy policy says that its transfers of personal data from the UK to Apple Inc. in the United States are governed by standard contractual clauses. * Apple, which delivers notifications: Expo passes each notification to Apple's push service, which delivers it to your iPhone. Expo lists Apple among the companies it uses to send notifications. Apple is not certified under the Data Privacy Framework. Its privacy policy says that personal data about people in the UK is controlled by Apple Distribution International Limited in Ireland, and that Apple's transfers of personal data from the UK are governed by standard contractual clauses. On Android, Expo passes each notification to Google's Firebase Cloud Messaging, covered by the Google entry above. * Apple, for signing in with Apple: you sign in with Apple yourself, and Apple handles that under its own privacy policy. When you delete an account that signs in with Apple on an iPhone, our server sends Apple the one-time code your iPhone got from it. Apple's privacy policy says that personal data about people in the UK is controlled by Apple Distribution International Limited in Ireland, and that Apple's transfers of personal data from the UK are governed by standard contractual clauses.
If you are in the EEA, the EU GDPR's rules on transfers apply in the same way. Where this section relies on the UK Extension to the EU-US Data Privacy Framework, we rely on the EU-US Data Privacy Framework itself, under which the same companies are certified. Where it relies on standard contractual clauses with the UK Addendum, we rely on the EU standard contractual clauses in the same agreements. Porkbun, Hugging Face and Have I Been Pwned have neither.
How long we keep things
Your account. We keep your account until you delete it. You can delete it in the app's Settings, or on our website. We then wait 24 hours, as our terms say, and delete it. If you sign back in during those 24 hours, you can keep it.
Deleted with your account: your email address (except for the copies listed below), password, terms record, the link to Apple or Google if you signed in with them and what they gave us, profile, current profile photo, comments, likes, recipe and brand ratings, saves, prices you saved from shops' websites, feature suggestions, your votes on them and your reports of them, receipts, push tokens, share panel keys, blocks, device and network hashes, linked-account records, review flags, usage-limit records, the photos of your recipes on our servers, and your account ID in our security log (see "Safety and preventing abuse", which says when we keep it for 7 days first).
A few copies outlast your account, and we cannot delete them sooner. Supabase's logs keep your email address, IP address and account ID from sign-ins, and from other requests your IP address, the estimate of your town, postal code area and internet provider worked out from it, and request addresses that can include your account ID, for up to 7 days. Those logs, and the IP addresses we keep for 7 days to limit shop searches (see "Finding shops and prices near you"), also show when each request was made, so for those 7 days they could be matched to what you added, such as a price. Deleting your account is itself logged, with your email address, for the same period. Your account, and what linked you to the things you added, also stay in any backup of our database made before you deleted it, until that backup expires (see "Other time limits").
Kept after you delete your account, not linked to you:
* prices you scanned, and stock and nutrition figures you added (from a scan or a shop's website), as our terms say; * products, pack sizes, and product and brand names you added or corrected.
Within a day of your account being deleted, we rewrite these records so that nothing in our database groups them as having come from one account. Until then, someone with direct access to our database who knew when your account was deleted, or who read a moderation record about your account, could still tell which of them were yours. Records you added at the same moment, such as the lines of one receipt, still show that they were added together, but not by whom. Apart from that and the copies described above, nothing we keep connects them to your account ID, your username or your email address.
Kept after you delete your account, without your account ID:
* the text and ingredients of every recipe you sent to our servers, published or not, including any copy left by a publish that did not finish. They are taken down so that nobody can see them on our servers; * the original links you gave when publishing, in our list of recipe sources, which signed-in users can read; * reports you made, including any note you wrote; * reports and moderation records about things you posted, with a copy of what was reported. Reports and moderation records are deleted 2 years after they were made.
These hold your own words, so someone who saw a recipe while it was published under your name could still recognise it. Someone with direct access to our database could also tell that they came from one account and, if we suspended your account over one of them, which account.
Copies of your recipes that other people saved to their phones while they were published stay on those phones, with the recipe's first photo and your account ID (see "What other people can see").
Kept after you delete your account, still with your account ID:
* reports and moderation records about your profile, with a copy of your username and bio at the time, until 2 years after they were made; * our security log, for 7 days, if your account was deleted without your request, or if our administrator key changed your data without one of the reasons we know of (see "Safety and preventing abuse"); * usage statistics at PostHog (see "Usage statistics").
Website sign-ups: deleting your account also deletes your sign-ups to the release list and the beta list on our website made with your account's email address. If your Google account is on our Android test, your beta sign-up is kept for up to 30 days after the deletion, without your name and phone model, so that we can take your Google account off the test, as when you leave the beta. If we delete your account without a request from you, that beta sign-up stays until you leave the beta.
Not yet deleted: profile photos you replaced, a profile photo we removed from your profile, and any recipe photo left over because a publish broke off part way or an old photo could not be removed. These stay on our servers even after you delete your account, and anyone signed in who reads our storage directly can still see the profile photos among them.
We also keep the date on which an account was deleted, with nothing else, as a record that we did it.
Other time limits:
* Reports, moderation records and our security log: 2 years after they were made. While an account is suspended, the reports and moderation records about it are kept until the suspension ends. * Device and network hashes: 30 days after they were last seen. * Sign-ups on our website that nobody confirms: 7 days after the last confirmation email. * The release list: until you leave it, or until we have emailed you that KleptoCook is out on the phones you picked. We delete your sign-up three months after the last of those emails. * The beta list: until you leave it or the beta ends. When you leave, or the beta ends, we delete your name and phone model at once and the rest 30 days later, which is how long we allow ourselves to take your Google account off the Android test. If you were never invited and your Google account was never added to the Android test, we delete your sign-up as soon as the beta ends. On an iPhone you take yourself out of the test, in TestFlight (see "Our website"). If you had been invited, or your Google account had been added to the Android test, signing up again with the same address changes nothing until we have taken your Google account off the test, if it was on it, and cleared your earlier sign-up. * Scrambled forms of sign-up email addresses, kept to limit sign-ups: 7 days. * IP addresses kept for shop searches: 7 days. * Usage-limit records: 7 days, or until your account is deleted if that is sooner. * Notes of searched areas: kept. For their first 7 days they could be matched to the IP address that searched (see "Finding shops and prices near you"); after that they are not linked to anyone. * Recipes you unpublish, and any copy left by a first publish that the app could not delete: kept privately on our servers, with their photos. The app cannot delete them yet, so email us if you want them deleted. If you delete your account, their text is kept, taken down and without your account ID, and their photos are deleted. * If you start creating an account but never enter the code, your email address stays in our sign-in system until you ask us to remove it. * Emails at Resend: 30 days. Resend keeps each email it sends for us, including any code or link, and its records of delivering it for 30 days. If an email from us to you bounces, or you mark it as spam, Resend keeps your email address on a list of addresses not to send to, with the date and the reason, until we remove it. Deleting your account does not remove it: we keep it so that no more email goes to an address that refused it, which protects the delivery of everyone's codes. We will remove it if you ask, for example so that you can sign up again. * Data from the hCaptcha check: hCaptcha says it keeps no long-term personal data about the people it checks, and that some of its error logs may hold IP addresses for a limited time. Its privacy policy allows technical data to be kept for up to a year after a cookie expires, usually without anything that identifies you, and for longer where it detects abuse. * Backups of our database: our hosting plan gives us no backups of the database at present. Supabase may keep its own backup copies, for a period it does not publish, and something deleted can stay in them until they expire. Photos are not in database backups. * Support emails, and records of what you told us about a recipe: no time limit at the moment.
Your rights
Under data protection law (the UK GDPR, and the EU GDPR if you are in the EEA) you have the right to:
* access: get a copy of your personal data. You can download what our servers hold about your account yourself, at kleptocook.com/download-my-data/; * rectification: have wrong data corrected; * erasure: have your data deleted; * restriction: ask us to limit how we use your data, for example while we look into a complaint; * objection: object to anything we do on the basis of legitimate interests. We will stop unless we have strong reasons to carry on. You can leave the leaderboards yourself at any time, with "Show me on leaderboards" in Settings. If something we send you counts as marketing, such as the weekly KleptoBoost notification, you can object at any time and we will always stop; * portability: get the data you gave us in a common, machine-readable format, such as that download, which is a JSON file; * withdraw consent: you can turn usage statistics off at any time in Settings. That does not affect what was sent while they were on. Separately, you can turn off any permission on your phone at any time in its settings. You can leave the release list or the beta at any time, with the link in our emails or by emailing us.
In the app, or on our website where it says so, you can:
* change your username, bio and photo, and hide your premium badge; * leave the leaderboards, and rejoin them; * withdraw a feature suggestion you made on our website, and change or remove your votes; * unpublish any recipe you have published, or switch its comments off or on, from its three dots when you open it in Discover or on your profile, or from "Manage publication" in its menu in Recipes, and unpublish it when you delete it from Recipes; * delete your comments and clear your recipe ratings; * unblock people; * switch off usage statistics; * delete your account (Settings, then "Delete account"), or ask for it on our website at kleptocook.com/delete-account/; * download a copy of your data, on our website at kleptocook.com/download-my-data/.
For anything else, including your usage statistics, or a copy of your data if you cannot sign in, email support@kleptocook.com, ideally from the email address on your account. We may ask you to confirm who you are. We reply within one month. If you have forgotten your password, you can reset it with a code, in the app or on our website. If you cannot sign in, email us and we will help, including with deleting your account, which we then delete in the same way as one deleted in the app.
Some rights have limits. For example, we keep your contributions to the shared price database, no longer linked to you, as our terms say, and we cannot delete copies of your recipes, or their photos, that other people saved to their phones.
Complaints
If you are unhappy with how we use your data, please tell us first at support@kleptocook.com. You can also complain to the data protection authority where you live, where you work or where you think the problem happened. In the UK that is the Information Commissioner's Office (ICO): ico.org.uk, or 0303 123 1113 (+44 303 123 1113 from abroad). In the EEA, the European Data Protection Board lists each country's authority at edpb.europa.eu.
Children
KleptoCook is for adults aged 18 and over, as our terms say, and we do not knowingly allow anyone under 18 to use it.
When you create an account, you confirm that you are 18 or over. We do not ask for your date of birth or check your age. If you are under 18, please do not create an account. If we learn that an account belongs to someone under 18, we will delete it.
Much of the app works without an account. Guests are not asked their age, and we cannot tell how old a guest is. Usage statistics are off for everyone until they are turned on, and they are only for people aged 18 and over: if you are under 18, please leave them off. A guest's phone still sends the app's identifier for the phone and, if they use the shop features, their location, as described above.
On our website, the beta and the feature board are for people aged 18 and over too, and the beta form asks you to confirm it. The release list asks only for an email address; if you are under 18, please do not sign up.
Security
* The app talks to our servers only over encrypted connections (HTTPS). * On an iPhone, your sign-in is kept in your iPhone's keychain, and so is a share panel key if a version of the app before 1.1.0 made one (from 1.1.0 the app deletes it, see "Importing recipes"). They can move to a new iPhone in an encrypted backup, and signing out removes your sign-in. iOS currently keeps keychain items when an app is deleted, so if you delete KleptoCook while signed in, they stay on your iPhone and reinstalling the app may sign you back in. To remove them, sign out before deleting the app. On Android, your sign-in is encrypted with a key held in the Android Keystore and is left out of backups; uninstalling the app removes it. * On our servers, passwords and share panel keys are stored only in scrambled (hashed) form. * On our website, your sign-in is kept in your browser's session storage for the tab you signed in on. It is removed when you sign out, and your browser deletes it when the tab's session ends (a browser that reopens closed tabs can restore it with the tab). The pages that need it allow scripts only from our website and hCaptcha. * The links in our sign-up emails are stored on our servers only in scrambled (hashed) form. * Our database lets each account read and change only what it is allowed to. * A security log records changes made through our servers with the administrator key, so misuse of that key can be spotted.
No system is completely secure. If a breach puts you at risk, we will tell you, and the ICO or the other authorities concerned, as the law requires.
Changes to this policy
When we change this policy, we change the date at the top. If a change affects how we use data you have already given us, we will tell you in the app before it applies.
Who we are
KleptoCook is run by Matthew Wilde, 11 Foundry Mews, Tavistock, PL19 0BQ, United Kingdom ("we" and "us" in this policy).
We decide how your personal data is used, so we are the "controller" under the UK GDPR and the Data Protection Act 2018, and, for people in the EEA, the EU GDPR.
Email support@kleptocook.com about anything in this policy, including any request about your data.
Contact
support@kleptocook.com, or by post to the address under "Who we are".