Privacy Policy

[KitchIcon] ("we," "us") operates KitchIcon at https://kitchicon.com.

For privacy questions or requests, contact: [kitchanadev@gmail.com]

This policy applies to the Service website and related applications. It does not cover third-party websites linked from the Service.

We collect the following categories of information:

• Account data: email address, authentication identifiers, sign-in provider metadata, account timestamps
• Taste profile: allergies, dietary restrictions, foods you avoid, cuisine preferences, skill level, cooking mode preferences, and optional notes
• Recipe and catalog data: saved recipes, ingredients, steps, ratings, feedback, and metadata you create or import
• Chat and session data: conversation messages, cooking session state, and companion interactions
• Uploads: recipe files you store in your private storage bucket (e.g., PDF, text, markdown)
• Usage and technical data: IP address, browser/device type, request logs, rate-limit counters, and aggregated analytics
• Billing data (if applicable): subscription plan, Stripe customer/subscription identifiers, and payment status—not full payment card numbers

Allergies and dietary restrictions may reveal health-related information. We treat this data as sensitive.

We use it only to personalize and filter suggestions, enforce safety checks, and operate the Service. We do not sell this data.

Separate AI Consent is requested during onboarding before we process this data with AI systems. See our AI Consent Policy.

We use personal data to:

• Provide, maintain, and secure the Service
• Authenticate you and manage your account
• Personalize recipe recommendations and chat responses
• Run cooking sessions and maintain your recipe catalog
• Process subscription status when billing is enabled
• Send transactional emails (e.g., sign-in links) via our email provider
• Prevent abuse, enforce rate limits, and debug operational issues
• Comply with legal obligations

Where GDPR or similar laws apply, we rely on: (a) contract performance to provide the Service; (b) consent for AI processing of taste/dietary data and optional features; (c) legitimate interests in security, analytics, and product improvement balanced against your rights; and (d) legal obligation where required.

You may withdraw consent for AI processing by deleting your account or contacting us. Withdrawal does not affect processing already performed.

We do not sell your personal information. We share data only with service providers that help us operate the Service, under contractual safeguards:

• Supabase — authentication, database, private file storage, and auth emails
• Anthropic — AI chat, recommendations, and taste summarization (see AI Consent Policy)
• Vercel — application hosting and privacy-oriented analytics
• Google — OAuth sign-in (if you choose that option)
• Tavily (or similar search APIs) — optional web recipe discovery, limited query context
• Stripe — payment processing when subscriptions are enabled

When you use AI features, we send relevant context to Anthropic's API—such as trimmed chat history, structured taste constraints, recipe details, and session state—not your email, payment identifiers, or full database exports.

We configure production API usage consistent with Anthropic's commercial terms, which generally prohibit using API inputs to train public models. Verify current Anthropic data policies for your account tier.

Automated systems may rank or filter recipes based on your preferences. You can update your taste profile, provide feedback, export data, or delete your account.

We retain personal data while your account is active and as needed to provide the Service.

When you delete your account, we delete associated database rows, storage objects, and authentication records, subject to limited backup retention and legal holds.

Server logs and aggregated analytics may be retained for a shorter operational window.

We use industry-standard measures including encrypted connections, row-level database security, private per-user storage paths, and server-side access controls.

No method of transmission or storage is 100% secure. Report suspected incidents to the contact email above.

Depending on your location, you may have rights to access, correct, delete, restrict, or port your data, and to object to certain processing.

Use Settings → Privacy to export a JSON copy of your data or delete your account.

You may also contact us at the email above to exercise rights. We may verify your identity before responding.

We use essential cookies for authentication sessions (Supabase SSR cookies).

We may use privacy-focused analytics (Vercel Analytics) that do not include chat message content.

You can control non-essential cookies through browser settings where applicable.

We and our processors may process data in the United States and other countries. Where required, we implement appropriate safeguards such as standard contractual clauses.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe we have done so.

We may update this Privacy Policy. The "Last updated" date will change and material updates may be communicated by email or in-app notice.

Privacy inquiries: [kitchanadev@gmail.com]

[KitchIcon] · https://kitchicon.com