CookCycle Privacy Policy

Last updated: 27 October 2026

CookCycle helps you plan meals that share ingredients, so you buy less and waste less. This policy explains what personal data the app uses, why, who else handles it, how long it's kept and what your rights are.

The short version

• We only use your data to run CookCycle for you. No ads, no selling data, no tracking you across other apps or websites.
• Your recipes, pantry, plans and lists are private: only you can see them.
• The AI features (scanning, importing and creating recipes) only send anything to our AI provider after you agree, and you can turn that off at any time.
• Allergies are health information: we only use them with your explicit permission, only to keep recipes with them away from you.
• You can see, change, download or delete your data, and delete your whole account in the app.

1. Who we are

CookCycle is made and run by Jakub Petelen, a sole trader based in the Netherlands. He decides how your personal data is used: in the words of the GDPR (the EU's General Data Protection Regulation), he is the "controller".

Contact: support@cookcycle.app. We answer in English or Dutch.

2. What we use, why, and on what legal basis

Your account

• What: your email address and password (stored only as a one-way scrambled "hash" by our sign-in provider; we can't see it). With Sign in with Apple: the email address Apple shares with us (which can be a private relay address) and, if you allow it, your name. Optionally a display name.
• Why: to create your account, sign you in, keep it secure and send account emails (confirming your address, resetting your password). We don't send marketing emails.
• Legal basis: performing our contract with you (GDPR Article 6(1)(b)).

Sign-in and security records

• What: when you sign in or your session is refreshed, our hosting provider records the time, your IP address and the type of device or browser.
• Why: to keep accounts secure and investigate misuse.
• Legal basis: our legitimate interest in keeping the service secure (Article 6(1)(f)).

Your preferences

• What: language and units, household size, diets, ingredients you dislike, kitchen equipment, recipe style, whether you want to see calories and your daily calorie target.
• Why: to suggest recipes and plans that suit you. Calorie figures are estimates for information only.
• Legal basis: performing our contract with you.

Your allergies (health information)

• What: the ingredients you tell us you're allergic to.
• Why: only to keep recipes containing them out of your recipe list and plans, to warn you on recipes, and, if you use it, to keep them out of AI-created recipes.
• Legal basis: your explicit consent (Article 9(2)(a), with Article 6(1)(a)). Allergies are health information, a special category of personal data under the GDPR, so the app asks for your explicit permission before saving them. You can withdraw it at any time in Menu → Food and kitchen → Allergies: your allergies are then removed. You don't have to give allergies to use CookCycle.

What you add

• What: your own recipes (written, imported or created with AI) and their photos, your ingredients, your pantry, saved recipes, meal plans, saved weeks, grocery lists, and the ratings and notes you give recipes.
• Why: this is the service: storing them and planning with them (your ratings steer which recipes plans pick). Only you can see them.
• Legal basis: performing our contract with you.

AI features (only with your permission)

Scanning a photo, importing a recipe from a website and creating a recipe with AI use an AI model from Anthropic. The first time you use one, the app explains what is sent and asks for your permission. You can withdraw it at any time in Menu → Privacy; the features then ask again before the next use.

• Scanning: the photo you take or choose (of your fridge, your shopping or a receipt), made smaller on your phone first. We don't store scanned photos.
• Importing: the web address you give us. Our server fetches the page itself (the website sees our server, not your phone) and sends the recipe text to the AI. The address is saved with the imported recipe. If the page has a photo of the dish, your phone fetches that photo from the website (the website then sees your phone, as when you visit it) and keeps a copy with the recipe; the photo isn't sent to the AI.
• Creating a recipe: what you ask for, the pantry ingredients you pick, and your diets, allergies, dislikes, kitchen equipment and recipe style, so the recipe suits you.
• With each of them: the language you use the app in, so the answer is written in it.
• Legal basis: your consent (Article 6(1)(a)); for allergies, your explicit consent (above).
• The AI's answer is always shown to you to check before anything is saved. Recipes written by AI are labelled "Written by AI".

AI use records

• What: for each AI request: which feature, when, whether it worked and how much text it processed. Not the content.
• Why: to apply the free tries and daily limits fairly and keep the service affordable.
• Legal basis: performing our contract with you (free tries) and our legitimate interest in preventing misuse (Article 6(1)(f)).

Subscriptions

• What: your purchases and subscription status, a random account ID (not your email), and basic technical details (device type, system version, app version, country and currency of your App Store).
• Why: to know whether your account has CookCycle Pro, and to restore it on another device.
• Legal basis: performing our contract with you. Payment itself is handled by Apple: we never see your card details.

Crash reports

• What: when the app crashes or hits an error: the device model, system and app version, the error and where in the app it happened. Not your name, email, IP address, or anything you typed or saved.
• Why: to find and fix bugs.
• Legal basis: our legitimate interest in a working app (Article 6(1)(f)).

Usage statistics (you can turn these off)

• What: anonymous events such as "a week was planned" or "a grocery list was made", with numbers such as how many meals, plus the app version, device type, system version and language. They're tied to a random ID that isn't linked to your account, and never include your email, location, IP address or what's in your recipes, pantry or lists.
• Why: to see which features are used and where the app can be improved.
• Legal basis: our legitimate interest in improving the app (Article 6(1)(f)). These statistics are privacy-friendly (no profiles, no location, no sharing for other purposes), which Dutch law allows without asking first; you can still turn them off at any time in Menu → Privacy.

On your phone

The app stores some things on your phone itself:

• your sign-in session, in the phone's secure storage;
• a copy of your recipes (with their photos), pantry, plans and grocery list, so the app opens quickly and works offline (removed when you sign out);
• your appearance setting, and your other choices in the Menu about what the app shows and asks;
• how often you add each food, so your usual ones can be offered as quick adds (removed when you sign out; Menu → Pantry and Menu → Grocery list turn the quick adds off);
• the reminders and timer alerts you turn on (Menu → Notifications), scheduled on the phone itself: they don't go through any server, and they're removed when you sign out;
• changes you make without a connection, such as ticks on your grocery list, until they've been sent;
• the random usage-statistics ID and your choice about usage statistics.

These are needed for the app to work, or are covered by the privacy-friendly statistics described above.

When you contact us

• What: your email address, what you write, and anything you send us.
• Why: to answer you, and to handle requests about your data.
• Legal basis: our legitimate interest in answering you (Article 6(1)(f)), and our legal duties when you use your rights (Article 6(1)(c)).
• How long: as long as needed to help you; records of requests about your data for up to 2 years, to show we handled them.

What you don't have to give

Only an email address (or Sign in with Apple) is needed for an account. Everything else is optional, and leaving it out only means the app can't use it: for example, without allergies it can't keep recipes with them away from you.

3. Who else handles your data

We don't sell your data and don't share it for advertising. We use these service providers. Each of them may only use your data to provide its service to us, under a data processing agreement:

Apple is responsible for its own processing when you use Sign in with Apple, buy a subscription or download the app; see Apple's privacy policy.

What Anthropic keeps: it deletes the data we send within 30 days, and doesn't use it to train its AI models. Only if its automated safety systems flag a request as breaking its usage policy may it keep that request for up to 2 years.

What Brevo keeps: for each account email, the address it went to, when, and whether it was delivered. Whether the email is opened or its button tapped is only counted, without being linked to you. These records are deleted after a month.

Transfers outside the EU: where a provider (or its support staff) handles data outside the European Economic Area, mainly in the United States, the transfer is protected by the European Commission's standard contractual clauses in our agreements with them, or by the EU–US Data Privacy Framework where the provider is certified. You can ask us for more information or a copy.

We may also share data when the law requires it (for example, with a court or regulator), and if CookCycle is ever sold, with the new owner, who would have to respect this policy; we would tell you first.

Nutrition figures come from public databases (USDA FoodData Central and Open Food Facts). No personal data is sent to them.

4. How long we keep it

When you delete your account in the app (Menu → Profile → Delete account), your account and everything in it are deleted from our database straight away, and your subscription record at RevenueCat is deleted too. Copies in our hosting provider's routine backups are deleted as those backups are replaced. Deleting your account doesn't cancel a CookCycle Pro subscription: cancel it in your App Store account settings.

5. Your rights

You have the right to:

• access your data and get a copy;
• have it corrected if it's wrong;
• have it deleted;
• restrict how we use it;
• receive it in a common format and have it transferred to another service;
• object to uses based on our legitimate interests (such as usage statistics: you can also simply turn them off);
• withdraw consent at any time (AI features and allergies, in the Menu), without affecting what was done before.

You can change most things yourself in the app, and delete your account there at any time. For anything else, email support@cookcycle.app. We reply within one month, and may ask you to confirm it's really you.

If you think we handle your data wrongly, please tell us. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in the EU country where you live.

6. Automated decisions

CookCycle suggests meals and plans automatically, but it never makes decisions about you that have legal or similarly significant effects.

7. Children

CookCycle is not meant for children under 16. If you believe a child under 16 has given us personal data, contact us and we'll delete it.

8. Security

Your data travels over encrypted connections. Our database only lets each account read its own data, our server keys never ship inside the app, and access to the systems that hold your data is limited to what's needed to run CookCycle. If a breach puts your data at risk, we will tell the authority and, where required, you.

9. Changes

When we change this policy, we update the date at the top. If a change is significant, we'll tell you in the app before it takes effect.