Privacy Notice

What We Collect

What you give us:

• Your account: your email address, and your first and last name.
• What you add: recipes and their photos, private notes, reviews, ratings, comments and their photos, records of what you cooked (with any notes and photos), favorites, menus, meal plans, shopping lists, the kitchen equipment you own, and the Families you create or join.
• Invitations: the email address of anyone you invite. When someone whose invitation expired asks to join the waiting list, the email address they give us.
• Asking to join: when you ask to join from a recipe a member shared with you, the name and email address you type.
• Messages you send to Support.

Collected Automatically

• Your last 10 searches that led to a recipe, offered as suggestions when you search again. Clear Search History on Manage Profile erases them.
• When you last read the comments on each of your own recipes, so the site can show how many are new.
• The technical details every website receives: your IP address and your browser and device type. Our host records them in its logs, and the limits on repeated attempts count requests against a scrambled form of your IP address or against your account.
• Page views and loading speed (see Site Measurement) and error reports (see Error Monitoring).
• If you use the Alexa skill, which recipe and step you are on, so you can pick up where you left off.
• When you log a meal, your browser's time zone (such as “America/New_York”), so the meal is dated by your own calendar day. We use it for that date and don't keep it.

How We Use It

To run the site: to sign you in, show your recipes and what is shared with you, and send sign-in links, invitations, notices that someone asked to join, and account email. To keep it safe: to limit repeated attempts, stop abuse, and find and fix errors. To keep your recipes safe: nightly backups. And to answer you when you contact us, and to comply with the law.

We don't sell or rent your information, share it for advertising, build advertising profiles, or use it to train AI models.

Who Can See What

• Your Private recipes: you, and any Family you share them with.
• Your Public recipes and menus: every member. Any member can also send someone who isn't a member a preview link to a Public recipe. For 7 days it shows the recipe, its photo, your name as the person who added it, and the name of the member who shared it.
• What you type to ask to join: only the member who shared the recipe, on their Invite Friend page, labeled as typed by you. The email we send that member says someone asked to join and names the recipe; it holds neither your name nor your email address.
• Your name: beside your Public recipes, reviews and comments, and to the members of your Families.
• Your email address: to the members of your Families, and to anyone you invite, since the invitation comes from you.
• The site's administrator can see members' names and email addresses, invitations and the waiting list, and can hide Public recipes or remove comments that break the Terms of Use. The administrator's tools don't show your Private recipes.

Recipes are not listed in search engines, and preview links are kept out of them too.

Photos

Photos are stored at long, randomly generated web addresses rather than behind a sign-in. The site shows a photo only to people who can see what it belongs to, but anyone given its address can open it, even for a Private recipe. Photos are resized in your browser before upload, which normally also removes the location data phones store in pictures.

AI Assistants

Nothing is connected unless you set it up yourself, and you can disconnect at any time from Manage Profile.

Claude, made by Anthropic. Once you connect it, Claude looks up what it needs to answer you (a recipe, a search of your cookbook, your notes or your shopping list), and what it reads is sent to Anthropic. That can include recipes other members shared with you, and other members' Public recipes when you ask it to search everything. What Anthropic does with it is governed by your own agreement with them, not by this notice. The connection's access key lasts an hour and renews automatically. The connection ends a year after you last used it, or sooner if you disconnect. Disconnecting stops any further access; it doesn't delete what Anthropic has already received.

Alexa, made by Amazon (being tested, and not yet open to every member). Amazon turns what you say into text and sends us that text, such as the recipe names you ask for and any note you dictate, with a code that identifies your Amazon account. It never sends us the recording. We send back the recipe text for Alexa to read aloud or show on a screen, and your first name so the skill can greet you. Your email address never goes to Amazon. Timers you set are Amazon's own. When you log a meal by voice, we ask Amazon for your Echo's time zone, to date the meal by your own day, and don't keep it.

Other members' assistants. A member who has connected Claude can have it read anything they can see here, including your Public recipes.

Neither can write or rewrite a recipe on its own. A new recipe, or a change to one you already have, only ever becomes a draft that you review and approve here on the site.

But both can change some things straight away, without asking. Claude can do five: add a recipe to your shopping list, record that you cooked something, favorite or unfavorite a recipe, hide or unhide one of your own recipes, and write or clear a private note (clearing a note deletes it). Alexa can do three: add a recipe to your shopping list, record that you cooked something, and write or replace a private note. None of these changes a recipe's words, and you can undo every one of them yourself, but they are real changes.

Neither can delete a recipe, publish or share anything, write a review or a comment in your name, or touch your account, your Family or your menus.

Service Providers

Running the site means using a few specialist companies. Each receives what its job needs:

• Vercel hosts the site, stores photos (in Vercel Blob), and measures page views and speed. Everything you see and send passes through it, and its logs record IP addresses.
• Neon provides the database: your account, your recipes, your notes and your lists. Temporary copies of it are made to test changes to the site before they go live, and removed once that work is finished.
• Resend sends our email. It receives the address and the message, which can include names and a recipe or menu title.
• Upstash keeps short-lived counters, 24 hours at most, that limit repeated attempts at signing in, uploading, importing and using the assistants. One lasts longer: a count of wrong sign-in codes typed for an address, kept for up to 60 days and cleared as soon as that address signs in. It is stored under a scrambled form of the address, never the address itself.
• GitHub stores our nightly backups of the database and photos. Each backup is deleted automatically after 15 days.
• Sentry receives error reports (below).
• Google Workspace hosts our support mailbox, so email you send us is stored there.

Anthropic and Amazon receive information only through an assistant connection, as described above. None of these companies receives your information for advertising.

Cookies and Browser Storage

The site uses only the cookies it needs to work:

• a sign-in cookie that keeps you signed in for up to 60 days;
• a few short-lived cookies that carry you through signing in or connecting an assistant, one of which holds the email address you are signing in with.

It also keeps a few things in your own browser: that you dismissed a notice, an import in progress, and your place in a long list.

There are no advertising, tracking or analytics cookies, and no other company tracks you through this site. Because nothing here follows you from site to site, the site works the same whether or not your browser sends a “Do Not Track” signal.

Site Measurement

Vercel counts page views, and measures how quickly pages load and whether anything moves while they do. Neither uses cookies or identifies you, and neither can be traced back to your account. What they record is the page's address, the page you came from, your country, and your browser and device type. A page's address can include a recipe's name or words you searched for.

Error Monitoring

We use Sentry to find and fix bugs. When something goes wrong, technical details about the error, such as the page and the steps leading up to it, are sent to Sentry. It is set up to leave out your name, your email address and what you typed, though a report can include the code that identifies your account inside the site. Reports your browser makes when it blocks something our security settings don't allow pass through our own server first, so your IP address isn't shared with Sentry.

How Long We Keep It

We keep your information while your account is open.

Deleting your account. You can delete your account at any time from Manage Profile. It is locked immediately and deleted 30 days later, and we email you 5 days and 1 day before. Signing in during those 30 days cancels the deletion and restores your account, except that any invitations you had sent stay canceled. When the 30 days are up:

• Deleted permanently: your email address and sign-in, your private notes, your Private and hidden recipes, your Private menus, and everything else nobody else uses.
• Kept, because other members rely on them: recipes and menus you made Public that are still visible, credited to you by name (a kept menu stops being shared with anyone you had shared it with), and your reviews, comments and records of cooking on anything that remains, shown as “User Deleted”. A Public recipe you or an administrator had hidden is deleted with the rest.
• Other members' records stay theirs: a member's record of having cooked one of your recipes keeps the recipe's name and the date, even when the recipe itself is deleted, and copies they saved remain theirs.
• Copies left behind: backups hold a copy for up to 15 days, and error reports and our host's logs keep what they recorded for their own limited periods.

Invitations and the waiting list. An invitation nobody accepted, email address included, is deleted 90 days after it expires, or sooner if the member who sent it deletes their account or the person it was sent to asks us. An accepted invitation is kept as the record of who invited whom. Waiting-list requests, email address included, are kept, and we will delete one on request.

Requests to join. The name and email address someone types to ask to join are deleted as soon as the member answers, or when that member's account is turned off or deleted. A request nobody answers is deleted within a day after 30 days. Approving a request sends an ordinary invitation, or, while the site is full, adds the person to the waiting list; either is kept as described above.

Sign-in codes. The 6-digit code in a sign-in email is stored with your email address, only in a scrambled (hashed) form we can check a code against but can't read back, and works for 10 minutes. It is deleted as soon as it's used or a newer email replaces it, and otherwise within a day of expiring.

Your Choices

• Correct it: change your name on Manage Profile. To change the email address you sign in with, contact us.
• Control it: choose who sees each recipe, and change it at any time.
• Download it: Export My Data on Manage Profile gives you your recipes and the full-size photos you have uploaded, including the photos on your reviews, comments and cook history; your reviews, comments and private notes; your favorites; your cook history; your shopping list and meal plan; your menus, both the ones you made and the ones you saved, cooked or reviewed; your recent searches; the equipment you have marked as owned; your Family memberships; invitations you sent, including any you requested while the site was full; and invitations sent to your address by somebody else, and any request they made to add you, as a zip file you can read in any web browser, plus a machine-readable copy for moving it elsewhere. It leaves out recipe drafts you haven't finished, and the site's own bookkeeping, such as your assistant connections and when you last read your recipes' comments; ask us and we will send those too. If a cookbook is too large to export whole, the export says what it left out.
• Delete it: delete your account (above), or disconnect an assistant.
• Ask us: to see, correct or delete anything we hold about you, email support@cookingwithmom.app. We will answer within 30 days. That includes anyone who was invited, asked to join or joined the waiting list and wants their email address removed.

Security

There are no passwords to steal: each sign-in email signs you in once, by its link, which expires after 24 hours, or by its 6-digit code, which expires after 10 minutes and stops working after 5 wrong tries. The site is served only over encrypted connections, limits repeated attempts, and tells browsers to block content from anywhere it doesn't expect. No system is perfectly secure, and if something goes wrong that affects your information, we will tell you.

Children

The site is not meant for children under 13, and we don't knowingly collect information from them. If we learn that a child under 13 has an account, we will delete it. If you are a parent and think your child has signed up, please email us.

Where It Is Stored

The site and its information are hosted in the United States. If you use it from elsewhere, your information is transferred to and stored in the US.

Changes to This Notice

When this notice changes, the date at the top changes. If a change affects how your information is used, we will tell members by email before it takes effect.

Contact Us

Questions or requests about your information: email support@cookingwithmom.app, or see the Support page.