Privacy Policy

Last updated: 12 November 2026

This policy explains what data CulinoFood (the "app", operated by Click Webstudio Inc.) collects, why we collect it, how we store it, and the rights you have over it.

1. Data we collect

• Account: email, name, handle, optional avatar and bio.
• Nutrition profile: diet, allergies, favorite cuisines, spice level, household size, cooking skill, calorie and macro goals, and weight if you enter it. Some of this is health-related, and you choose what to provide.
• Cooking data: pantry items, shopping lists, meal logs, weight entries, planned meals, cook history, favorites, recipes you create.
• Community content: posts, comments, likes, follows, blocks, reports you submit.
• Chat: messages exchanged with Chef Mila (our AI sous-chef).
• Photos: dish/pantry/receipt/profile photos you upload. Stored on Cloudflare R2.
• Diagnostic: crash reports and basic device info (model, OS version) used only to fix bugs.
• Authentication: Google ID tokens when you sign in with Google. We never receive your Google password.

2. Why we collect it

• To operate the features you use (meal planning, scans, chat, community).
• To send transactional email (welcome, password reset).
• To enforce community safety (moderation, reports, blocks).
• To improve the product (error tracking).

We do not sell personal data. We do not show third-party ads.

3. Third-party processors

• AI service provider — a third-party provider of the AI models behind recipes, chat, photo analysis, meal plans, translation and content moderation. What it receives, and only with your permission, is described in section 4. It does not use that content to train its models for our requests.
• Google (Imagen) — recipe and product image generation. Sent: recipe titles, ingredients and product names only — never your photos or conversations.
• Cloudflare R2 — image storage.
• Cloudflare Email Service — transactional email delivery.
• Apple (App Store, Sign in with Apple) — billing, account.
• Google Sign-In — authentication.

4. AI features and your consent

Chef Mila, dish, pantry and receipt scans, AI recipes, meal plans, ingredient swaps, voice shopping entries and the safety check on community posts are powered by a third-party AI service provider. Before the app first sends your content to that provider it asks for your permission, and nothing is sent until you agree. If you decline, the rest of the app keeps working, but those features and posting to the community do not.

Depending on the feature, the request sent to the AI service provider contains:

• what you type, say or photograph: chat messages and the conversation so far, photos (dishes, pantry, receipts, chat attachments, post photos), spoken shopping entries as text, web page text from a recipe link you import, and the text of posts, comments and bios you publish;
• details used to personalize the result: your diet, allergies, favorite cuisines, spice level, household size, cooking skill, calorie goal, pantry items and app language.

It does not include your name, email address or account ID. The provider processes it on our behalf to produce the response or the safety decision and, under its terms for API customers, does not use it to train its models for our requests. We keep your chats and results in your account as described in section 5.

You can withdraw your permission at any time in Profile → AI & data sharing; the app then asks again before the next AI request. Withdrawing does not delete what you have already sent. To delete it, delete your account.

5. Data retention

We keep your data as long as your account is active. Deleting your account permanently erases all personal data within 30 days. You can delete your account from Profile → Delete account.

6. Your rights (GDPR / CCPA / CPRA)

• Access & export: in-app at Profile → Export my data.
• Correction: edit your profile in-app.
• Deletion: in-app at Profile → Delete account.
• Portability: the export includes all data in JSON.
• Withdraw consent: for AI features, in-app at Profile → AI & data sharing; for everything, delete your account.
• Complaint: contact your local data protection authority.

7. Children

CulinoFood is not directed at children under 13 and we don't knowingly collect their data. If you believe a child has created an account, email us and we'll remove it.

8. Security

Passwords are stored hashed with bcrypt. Tokens are HMAC-signed JWTs. Transport is HTTPS only. Photos are served over a CDN with HTTPS. We rate-limit AI endpoints to prevent abuse.

9. Changes

We'll update this page when our practices change and bump the date at the top. Significant changes will be notified inside the app.

10. Contact

Privacy questions: hello@culinofood.com
Click Webstudio Inc., Canada.