Privacy

Your account: a name, an email address, a handle, and either a password (stored only as an argon2 hash, never in a form anybody can read back) or a passkey, or both. Your kitchen: its name, its currency, your ingredients and their prices, your dishes and what they cost, your production batches and your orders.

Your customers' details — a name, a way to reach them, what they avoid eating — are kept because you entered them, and they are yours rather than ours. You are the one responsible for them: this app is the filing cabinet, not the owner. We never pool them across kitchens, never analyse them, and never show one cook's customers to another.

On managed PostgreSQL run by Neon, in Singapore, with the application hosted by Vercel in the same region. Singapore is chosen because the app makes many database queries per screen and that distance is paid many times, while the distance to you is paid once. It does mean your records sit outside the country you may be cooking in.

You, and anybody you deliberately add to your kitchen. Nobody else has a way in through the app: every query is filtered by kitchen before it reaches the database. The people who keep the app running can reach the database to fix things, and do so as rarely as possible.

Three, and none of them advertise to you. One keeps you signed in. One remembers your language. One remembers whether you agreed to be counted, so we do not ask again. If you did agree, Google Analytics adds its own — and if you did not, it is never loaded at all, so there is nothing of it on the page.

If you agree, Google Analytics tells us how many people arrive, roughly where from, and which pages they use. It sees pages, not people: never a recipe, never a customer, never a price, never an order. Your kitchen's data is not sent to Google and never will be. Refusing costs you nothing — the app is identical either way — and you can change your mind in settings at any time.

Settings → Delete account. It removes your account and every kitchen you alone own, along with the orders, customers, dishes and ingredients in them. A kitchen you share with somebody else stays, because it is theirs too. This is immediate and cannot be undone.

Neon stores the database. Vercel runs and hosts the app. Resend sends the codes that confirm your email address and reset your password. If you sign in with Google, Google tells us your name and email address and nothing else. Nutrition figures in the built-in catalogue come from USDA FoodData Central, which is public domain; figures fetched from a barcode come from Open Food Facts and are never stored in our shared catalogue. If you agree to being counted, Google Analytics also sees which pages are opened — never what is on them. Errors are reported to Sentry (Frankfurt) so a fault can be found and fixed — a message and a stack trace, never your data and never who you are.

Write to hello@foodculator.io. If you want a copy of what is held about you, or want it deleted, say so and it will be done.