Privacy policy

This policy covers the Cook with Kre app and this website. Krenis [OWNER: legal entity type and registered address] makes the app and is responsible for your data. Write to [OWNER: support email] with any question about it.

Data we collect

• Your sign-in. You sign in with Apple or Google; there is no password of our own. We keep the account ID Apple or Google gives us, whether the email is verified, whether it is an Apple private relay address, and a hashed copy of the sign-in email (a keyed hash, so the address itself is never stored). Our sign-in service holds an account number we make up, not your email.
• Your recipes. The recipe links you add, the recipe text read from those pages, and any recipe text you paste. We keep a copy of each recipe's source with your recipes.
• Your meals. The plan Kre makes, the number of people you cook for, your timers, the conversation with Kre as text, and whether you cook by voice or by touch.
• Your voice. While Kre is listening, audio goes from your phone straight to Deepgram, which turns it into text. Our servers receive the text, not the audio.
• Device and diagnostic data. A device identifier, the app version, daily usage counts and app logs about requests and errors. Logs are scrubbed of secrets before they are written.
• Email you send us. Support emails and launch-notice requests, with the address you send them from.
• This website. The site sets no cookies and runs no analytics or third-party scripts. The hosting service can record each request: the page, the referring page, your browser and your IP address. [OWNER: confirm website access logging and how long its logs are kept]

You don't have to give us anything the law requires. Without a sign-in and a recipe, the app can't make you a meal.

How we use it

• To run the app: sign you in, read and plan your recipes, and talk you through the meal. Legal basis: performing our contract with you.
• To send your words and recipes to the AI providers below. Before your first cook the app tells you where your voice and text go and asks you to continue. Legal basis: your consent, which you can withdraw by deleting your account.
• To keep the service secure and working: logs, abuse protection and fixing errors. Legal basis: our legitimate interest in a safe, working app.
• To answer your emails and send one launch email if you asked for it. Legal basis: your request.
• To meet legal obligations. Legal basis: legal obligation.

We show no ads and build no advertising profile. No decision with legal or similarly significant effect on you is made by automated means alone.

Service providers

These companies process data for us to run the app. Each link goes to its own privacy terms.

• Google Gemini receives recipe and turn text: the recipes you add and your conversation with Kre as text.
• Deepgram receives voice audio to turn it into text, and Kre's spoken reply text to turn it into speech.
• Amazon Web Services hosts the app and this website: our servers, database, file storage, logs and sign-in service, in the United States.
• Sign in with Apple and Google Sign-In confirm who you are when you sign in.
• The email service that hosts our support address. [OWNER: email provider that hosts the support address]

If you live outside the United States, your data is transferred there. [OWNER: transfer safeguards, such as standard contractual clauses, if the app is offered in the EU or UK]

AI processing

Kre's replies come from Google Gemini. We send Gemini text under Google's paid API terms, under which Google says it does not use that text to improve its products and keeps it for a limited time to detect abuse. [OWNER: confirm the production Gemini project stays on paid billing]

Deepgram may keep audio and use it to improve its models, under its own terms. The app does not currently ask Deepgram to opt out of that.

Kre can be wrong. It can't see or taste your food; it goes by what you tell it and by the timers.

Google user data

If you sign in with Google:

• Access. We ask Google only for basic sign-in: your Google account ID and email address, and whether the email is verified.
• Use. Only to sign you in and to recognise the same person signing in again.
• Storage. We keep the Google account ID and a keyed hash of the email, never the address itself. Both are deleted with your account.
• Sharing. We don't share Google user data with anyone, don't sell it, don't use it for ads and don't use it to train AI models.

Retention

• Your account, recipes and meals: until you delete them or your account.
• Records with an expiry, such as sign-in sessions, request records and daily usage counts: deleted automatically when they expire.
• App logs: 14 days.
• Operator audit log: a record of each time we look into an account to give support or fix a problem, kept 400 days and not editable.
• Firewall logs for the app's API traffic (not this website), including IP addresses: 90 days.
• Database backups: up to 35 days, after which deleted records are gone from backups too.
• Recipe files: our file storage keeps prior versions of files. When you delete a recipe, a meal or your account, prior versions of those files currently persist as stored versions. We can't promise full erasure of them until we add a rule that removes old versions; this policy will change when we do.

Deleting your data

You can delete your account in the app at any time. Deleting it removes your sign-in, your recipes and your meals. The delete your account page has the steps, a way to ask without the app, and what is kept afterwards.

Your rights

Depending on where you live, including under the EU and UK GDPR and US state laws such as California's, you can ask to access, correct, delete or receive a copy of your data, to restrict or object to how we use it, and to withdraw consent at any time. Email [OWNER: support email]; we won't treat you differently for asking. You also have the right to complain to a supervisory authority, such as the data protection authority where you live.

[OWNER: EU representative, if the app is offered in the EU] [OWNER: confirm no data protection officer is appointed]

Do not sell or share

We do not sell or share your personal information, and we haven't in the past 12 months. In that time we disclosed identifiers, recipe and conversation text, voice audio and app activity only to the service providers above, to run the app.

We don't track you across other companies' sites or apps. We treat a Do Not Track or Global Privacy Control signal as a request not to sell or share your data, which we already honour for everyone.

Children and 18+

You must be 18 or older to use Cook with Kre. It isn't meant for children. If we learn an account belongs to someone under 18, we delete it.

Changes

When this policy changes, we update the dates at the top. For a material change, we tell you in the app before it takes effect.

Contact

Krenis, [OWNER: legal entity type and registered address]. Email [OWNER: support email].