Privacy Policy

KitchenRun is a recipe-planning and shopping-list service operated by [Company name] Ltd (company number [company number]), registered in England & Wales at [registered office address]. For any privacy question or to exercise your rights, contact us at hello@kitchen-run.com.

We collect only what we need to run the service:

• Account data — your name and email address, set when you sign up. If you choose “Continue with Google”, Google shares your name, email address and profile picture with us instead; we don't receive your Google password.
• Profile & preferences — optional nickname, dietary preferences, preferred cuisines, default serving size, notification settings, and which What's new posts you have seen.
• Cooking activity — the recipes you add to a weekly run, your pantry items, and any ratings you leave.
• Your recipes & ingredient requests — recipes you create, which only you can see, and any ingredient you ask us to add to the catalog, with an optional note.
• Authentication data — a securely hashed password (or, if you sign in with Google, a link to your Google account) and session information, handled by our auth provider (Supabase).
• Limited technical data — basic, aggregated, and cookieless traffic statistics (see our Cookie Policy).

During the free beta we do not collect payment details — billing is disabled and no card information is taken. When paid subscriptions launch, payments will be handled by Stripe; we will never store your full card details.

• To provide the service (create your account, save your runs, generate shopping lists) — performance of our contract with you.
• To secure and operate the service (authentication, preventing abuse, keeping it reliable) — our legitimate interests in running a safe service.
• To review ingredient requests (decide whether to add an ingredient to the catalog) — performance of our contract. We review each request ourselves. If we decline it, we record a short reason, which you can see in your data export. We don't otherwise contact you about it.
• To send service emails (sign-up confirmation, password resets) — performance of our contract.
• To send optional marketing (newsletter, product tips) only if you opt in — your consent, which you can withdraw at any time in Settings.

We don't sell your data. We share it only with the service providers (sub-processors) that help us run KitchenRun, each bound by a data-processing agreement:

• Supabase — database, authentication, and hosting of your account data.
• Cloudflare — application hosting, content delivery, and cookieless analytics.
• Resend — sending account emails (sign-up confirmation, password reset).
• Google — sign-in, only if you choose “Continue with Google”. Google's own privacy policy covers what it processes on its side.
• Anthropic — suggests a catalog category for a requested ingredient. It receives the ingredient name only.
• Google (Gemini) — draws an icon for a requested ingredient. It receives the ingredient name only.
• USDA FoodData Central and Open Food Facts — public nutrition databases we search for a requested ingredient's calories, by ingredient name only.
• Discord and Telegram — we are notified of new requests by message. A message carries ingredient names only, never your note or who asked.
• Stripe — payment processing (only once paid subscriptions launch; unused during the beta).

Some providers may process data outside the UK. Where they do, appropriate safeguards (such as UK International Data Transfer Agreements or adequacy decisions) are in place.

We keep your personal data for as long as your account is active. When you delete your account, your profile, runs, ratings, pantry, preferences, recipes and ingredient requests are permanently removed (cascading deletes remove all related records). We may retain minimal records where the law requires it.

Our request-review tool runs on our own server in the UK. It keeps the ingredient names it has reviewed, and the notes of open requests, but never who asked. Its copy of open requests refreshes every five minutes, so a deleted request's note leaves it at the next refresh. Its encrypted backups keep older copies for up to six months.

Under UK GDPR you have the right to:

• Access and port your data — you can download a copy of your data at any time from Settings → Account.
• Correct inaccurate data — edit your profile and preferences in Settings.
• Erase your data — delete your account in Settings; this removes your data immediately.
• Object to or restrict processing, and withdraw consent for marketing at any time.

To exercise any right, use the in-app controls or email us at hello@kitchen-run.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We use only essential cookies needed to keep you signed in, plus cookieless analytics. See our Cookie Policy for the full list.

We may update this policy as the service evolves. The “last updated” date above shows the current version, and we'll tell you about material changes — particularly before introducing paid subscriptions.