Privacy Policy

Last updated 13 August 2026

In short

We collect what we need to run the service: your sign-in details, your chats and recipes, your dietary profile, and payment details handled by Stripe.
Your messages and photos are sent to OpenAI to generate recipes. OpenAI does not use API data to train its models by default.
Allergies and dietary preferences are health-related, so we only store them if you explicitly tick the box — and if you withdraw that, we delete them.
There is no advertising, no analytics, and no tracking cookies. You can delete your account and everything in it from Settings.

This summary is here to help you find your way around. It is not part of the agreement — the numbered sections below are.

1. Who we are

MYAICARDS LTD is the data controller for the personal data described in this policy. We are a private limited company registered in England and Wales (company number 16369856), with our registered office at Apartment 81 Circus Road East, London, England, SW11 8BB.

For anything about your personal data — including a request to access, correct or delete it — contact privacy@recipegpt.app. We have not appointed a Data Protection Officer, as we are not required to.

This policy applies to the RecipeGPT website and iOS app. It applies to adults only — the service is for people aged 18 and over.

2. What we collect and why

Data	Where it comes from	Why we hold it
Email address, and name and profile picture where your provider supplies them	Google, Apple, or the email sign-in code	To create and secure your account
An account identifier from your sign-in provider	Google or Apple	To recognise you on your next sign-in
Your messages, the recipes generated for you, and any photographs you attach	You	To generate recipes, and to show you your chat history
Your dietary profile: allergies, dietary preferences, goals, a free-text note, and your usual number of servings	You (the welcome questions or Personalisation)	To personalise recipes. See the next section — some of this is special category data
Saved recipes and folders	You	To keep your saved shelf
Your recipe display preference	You (Personalisation)	To show or hide estimated calories and macros on recipes
Subscription status, billing address and payment card details	You, via Stripe or Apple	To take payment and manage your subscription. We never receive your full card number
A one-way cryptographic hash of your IP address	Your request	To apply rate limits and prevent abuse. We do not store the IP address itself
Counts of how many requests you have made	Your use of the service	To apply the free-tier allowance
A hash of your session token	Signing in	To keep you signed in. The token itself exists only in your browser cookie
Your email preferences and a record of which one-off emails we have sent you	You, and our own sending	To respect your opt-out and avoid sending anything twice
A record of your acceptance of these terms and of your health-data consent	Signing up, and the consent checkbox	To evidence that we have your permission, as the law requires

We do not use advertising networks, analytics platforms, or third-party trackers of any kind, and we do not build profiles of you for advertising. We do not sell personal data, and we never will.

3. Allergies and dietary preferences (special category data)

Allergies and intolerances are information about your health. Some dietary preferences — halal and kosher, for example — can reveal religious or philosophical beliefs. UK data protection law treats both as 'special category' data, which needs a higher standard of permission.

We only store this information if you give explicit consent by ticking the box beside it. That box is never pre-ticked, and you can use the rest of the service without it — you simply will not get allergy-aware personalisation.

You can withdraw that consent at any time in Personalisation. Withdrawing is not just a preference change: when you withdraw, we delete your saved allergies and dietary preferences. The rest of your profile — your goals, your note and your usual servings — is ordinary personal data and stays until you change or delete it.

Your dietary profile is included in the instructions sent to our AI provider so that it can honour your allergies. It is never shown to other users and never appears in a shared recipe.

4. Our lawful bases

What we do	Lawful basis
Run your account, generate recipes, take payment	Performance of our contract with you
Store and use allergies and dietary preferences	Your explicit consent (Article 9(2)(a)) — withdrawable at any time
Rate limiting, abuse prevention, keeping the service secure	Our legitimate interests in protecting the service and its users
Occasional emails about your use of the service	Your consent, withdrawable with one click in any such email
Sign-in codes, receipts and other essential service messages	Performance of our contract — these are not marketing and cannot be turned off
Keeping records of consent and of transactions	Compliance with our legal obligations

5. How your content reaches the AI

RecipeGPT generates recipes using OpenAI's API. To do that, we send OpenAI the messages you write, any photographs you attach, the dietary profile you have consented to share, and the recipe being discussed. We also send your messages and images to OpenAI's automated moderation service to detect abuse.

OpenAI states that data submitted through its API is not used to train or improve its models unless the customer opts in. We have not opted in.
OpenAI retains API abuse-monitoring logs for up to 30 days.
Photographs you attach are stored by OpenAI to let the model see them, and we set them to expire after 30 days.
We send a pseudonymous identifier with each request so OpenAI can attribute abuse, rather than your name or email address.

OpenAI processes this data as our processor, under its own terms and privacy policy: openai.com/policies. Please do not send the assistant information you would not want processed this way — it only needs to know about your cooking.

6. Who else we share data with

We share personal data only with the providers we need to run the service. Each acts on our instructions under a contract, and none of them may use your data for their own purposes.

Provider	What they receive	What for
OpenAI	Your messages, attached photos, dietary profile, recipes	Generating recipes and moderating content
Stripe	Your email, name, billing address, card details, subscription history	Taking payment. Stripe is an independent controller for its own compliance purposes
Apple	Purchase and subscription data for in-app purchases; your sign-in identifier if you use Sign in with Apple	App Store billing and authentication
Google	Your sign-in identifier, email, name and picture if you sign in with Google	Authentication
Cloudflare	Website requests, and outbound email	Hosting the website and routing email
Fly.io	Application requests and stored data	Hosting the application and its database

We may also disclose personal data where the law requires it, to establish or defend legal claims, or to protect the rights and safety of people using the service. If the business is sold or reorganised, data may transfer to the buyer, who would remain bound by this policy.

7. International transfers

Some of our providers — including OpenAI and Stripe — process data outside the United Kingdom, principally in the United States. Where personal data leaves the UK we rely on the safeguards UK law provides for such transfers, in particular the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with the additional protections in those providers' own commitments.

You can ask us for more detail about these safeguards at privacy@recipegpt.app.

8. How long we keep things

What	How long
Your account, dietary profile, saved recipes and folders	Until you delete your account
Chats and their messages	30 days after a chat was last used, then deleted automatically
Photographs you attach	Up to 30 days, then they expire at our AI provider. The small thumbnail in your chat is deleted with the chat
Sign-in sessions	Until they expire or you sign out
Email sign-in codes	Minutes — they are swept once used or expired
Generated recipes	Kept indefinitely, without any link to you — see below
Payment and subscription records	As long as the law requires us to keep financial records, typically six years

Generated recipes are kept permanently as anonymous items, so that share links carry on working. Once your account is deleted there is nothing connecting a recipe to you: no name, no email, no account identifier. A recipe contains only the dish itself — its ingredients, steps and timings.

9. Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data deleted — you can do this yourself at any time under Settings → Data & privacy;
ask us to restrict how we use your data, or object to us using it on the basis of our legitimate interests;
ask for a copy of the data you gave us in a portable format; and
withdraw consent at any time, including your health-data consent and your email preferences. Withdrawing does not affect anything we did lawfully beforehand.

You can delete your account yourself under Settings → Data & privacy. Deleting removes your account record, your sessions on every device, your chats and messages with their photo thumbnails, your saved recipes and folders, your dietary profile, your consent records, your email records, and your usage counters. If you subscribe through the App Store, cancel there first — we cannot cancel an Apple subscription for you.

To exercise any of these rights, email privacy@recipegpt.app. We will respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.

10. How we protect your data

All traffic is encrypted in transit.
We never store your card details; payment is handled entirely by Stripe or Apple.
Session tokens are stored only as one-way hashes — a copy of our database does not let anyone sign in as you.
IP addresses are stored only as one-way hashes, so we can rate-limit without holding the address.
Our application logs are built never to contain the contents of your messages or recipes — only counts, lengths and identifiers — and we have an automated test that fails our build if that stops being true.
Dietary information is excluded from logs by the same rule.

No service can promise perfect security, but if a breach ever put your rights at risk we would tell the Information Commissioner's Office and, where required, you.

11. Cookies

We use two cookies, both strictly necessary: one that keeps you signed in, and one short-lived cookie that protects the sign-in process against tampering. That is all.

We do not use analytics, advertising or tracking cookies, which is why you have not been asked to accept any. Strictly necessary cookies do not require consent. You can clear them in your browser, but you will be signed out.

12. Children

RecipeGPT is for adults: you must be 18 or over to use it, as set out in our Terms of Service. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we will delete it.

13. Emails we send

Some emails are part of the service and always send: your sign-in code, and receipts or confirmations about your subscription. Others are occasional and optional — a nudge if you have not cooked anything yet, and a note when your free allowance resets.

Optional emails carry a one-click unsubscribe link and an unsubscribe header your email client can use, and you can also turn them off in Settings. Turning them off never affects the essential ones.

14. Changes to this policy

We will update this policy when what we do changes. The date at the top always shows the current version, and if a change materially affects your rights we will tell you directly rather than relying on you to notice.

15. Contact us

Email privacy@recipegpt.app, or write to MYAICARDS LTD, Apartment 81 Circus Road East, London, England, SW11 8BB.