What KitchenSquire stores

KitchenSquire is a private app for a small number of invited people. This page says exactly what it keeps, in plain language. If anything here is unclear, that is a fault worth reporting.

Your email address and name, as Google gives them to us when you sign in.

The recipes you save: their ingredients, method, servings, any notes you write, and the address of the page you got them from.

For a supported social-link import, the recipe also keeps the original post link. Supported written-post and transcript readings retain their original text and source evidence privately with the recipe. These are not shown to public guests. The social service receives the post link you ask us to read, and the recipe website receives its page request. Their independent access logs follow their own policies.

Photographs and PDFs you upload, and pictures scraped from recipe pages.

Your shopping lists, what you ticked off, which meals you cooked, and the selected quantities recorded when you marked a planned meal as cooked.

Earlier shopping choices retained when an upgrade resets unbound completion marks.

Shopping visits you finish and the items filed as done, including later corrections.

Discover requests, microphone transcripts and checked recipe results are private to the person who requested them for up to 30 minutes. Clearing Discover, signing out or removing your household access erases that temporary text and those results. Normal backups exclude Discover text and results. Minimal generation markers prevent an old form from repeating work; billing receipts retain uncertain charges without request text. Discover and microphone request bodies are excluded from diagnostic recording.

An import you started and did not finish, including the file you uploaded and what was read from it. These are swept a day after you abandon them, and they go immediately if you delete your account.

The text of a recipe you pasted in, kept beside what was read from it so a bad reading can be corrected rather than retyped.

The cuisine a recipe's page said it was, and any you choose yourself.

Legacy page-guide dismissals, and your welcome guide progress and whether you completed or skipped it. Progress stays with your person record; removing a household member retains it with their inactive identity, while deleting the person or account removes it. Backups include progress, so restoring an older copy can restore older progress and show an unfinished welcome again.

The email address of anybody you invite, and who invited them, until the invitation is withdrawn or accepted. An accepted one stays as a record of how somebody joined your household.

How many recipes you have imported this month, so the cost stays bounded, and how many paid readings each person has caused, so a fault cannot run up a bill. That includes the size and cost of each reading, per person.

Social import jobs keep who started the job, its progress, expiry and whether its import allowance was returned. Supplier billing receipts keep reserved credits and known or uncertain costs. These receipts contain no recipe text or API keys. Uncertain charges remain reserved until reconciled. Deleting a household removes its identifiers from those receipts; anonymous billing receipts remain so paid allowances cannot be spent twice.

When an import fails, the address you gave, what the site or the reader said went wrong, and how long it took. This is the only place a web address is kept, it is there so a site that cannot be read can be fixed, and it is deleted after 30 days. If a later processing stage fails, a useful written draft can remain available for you to save; otherwise unfinished drafts follow the one-day cleanup described above. The service owner can read these records to investigate failures.

We keep unfinished recipe-review answers so you can view the original or finish later. Only the person reviewing can read those answers or include them in their export. They stay until you finish the correction or delete the recipe/account; removing your household access clears them. They are not included when you share a recipe.

Pending shopping additions remember your chosen recipe, portions and shopping list for 24 hours. A completed addition receipt stays with that shopping record so retrying does not add a second meal. Deleting the account removes these live records; earlier backups follow the backup policy below.

During this trial, KitchenSquire notes when something happens so the owner can see where people get stuck: that you signed in, that you tried to add a recipe and by which of the four ways, whether it worked or was refused and why, that you added a meal, finished a shop, or cooked something.

It records that these things happened, not what they were. No recipe names, no ingredients, no web addresses, no page contents. When adding a recipe is refused, what is kept is a short reason such as "the site refuses this program" - never the link.

These server event records stay separate from optional browser diagnostics. They are not sent to an analytics company, an advertiser, or anybody who would build a profile of you. It is kept in this application's own database, which is backed up to encrypted storage like everything else here.

Deleting your account deletes all of it, apart from what a backup already taken still holds.

You can accept session recordings in the privacy notice, or change your choice in Settings, to help the owner diagnose broken controls and browser errors. This is optional and off until you choose it in this signed-in browser. Public sharing pages, sign-in, research answers and account deletion are not recorded.

PostHog can receive what you see and type in the app, including recipe text, photos, notes and ordinary form values, navigation, taps, scrolls, browser errors and logs, network timings, request/response headers and bodies, and browser/device performance. This can include personal information that appears in that content. Passwords, credentials and security tokens stay hidden. Events use anonymous browser/session identifiers, rather than named analytics profiles. Capture follows the project's settings. Your IP address reaches PostHog for delivery; its storage is disabled.

PostHog stores recordings in its EU region for 30 days and browser logs for 14 days. Analytics and error events have a separate retention policy. Your Accept or Reject choice stays in this browser's signed cookie through sign-out for your next login. Clearing or expiring the cookie can require another choice. A broader recording policy also requires a new choice. Acceptance starts capture on the next eligible page. Turning recording off stops capture; signing out stops it while you are signed out. Another open tab can take up to 30 seconds to notice a session or global setting change. It does not erase an already delivered recording. Account deletion removes KitchenSquire data but does not automatically remove anonymous diagnostic data already sent to PostHog. Contact the owner if you need help with a recording.

Blocked scripts, an ad blocker, network failure and a browser without JavaScript can prevent diagnostics. A missing recording does not prove there was no problem.

Your browser remembers a simple preference when you confirm you have added the app icon, or when it observes KitchenSquire opening as an app or being installed. This hides the Add app icon suggestion. It contains no account or recipe details and is not sent to our server or used as usage analytics. Clearing browser storage resets it. Different browsers or the installed app may keep separate storage.

Reminder setup is optional. We store your selected types and timezone, automatic timing and any earlier saved weekly times. Legacy phone-type hints remain compatible. Your first explicit setup selects planning, shopping and cooking reminders and saves consent for your selected phone. You can turn each type off. Existing choices, including Off, stay unchanged. browser permission alone does not enable reminders.

Unfinished choices expire after 30 days. They are hidden immediately at expiry, then cleared by startup and periodic maintenance independently of backups. If maintenance fails, physical removal waits until it works again.

Chosen times retained with Not now are available for a voluntary return. Only you can read your choices, not other household members. They do not enter usage events or session cookies. Removing you from a household clears your choices; minimal revision and any prior Not now preference remain with the identity. Account deletion removes the live record. Earlier backups may retain settings under the backup policy below.

Optional delivery stores an endpoint and encryption keys for your selected phone, with your consent revision. Minimal attempt history prevents duplicate or too frequent reminders; it does not prove you read a notification. Attempts expire after 30 days through independent startup and periodic maintenance; a stopped server or cleanup failure can delay physical removal. The browser and OS push provider handle routing and timing metadata. Notification content stays generic, without recipe or household details.

Normal backups exclude phone subscription details, active delivery consent and pending sends. Chosen times and minimal recent attempt history can remain. A supported restore clears delivery before the restored database is used and delays scheduled reminders for seven elapsed days, even after you enable them again. A test still needs valid recovery preparation. Normal restart does not create this delay. Older backups may retain data under the policy below.

Delivery remains off during setup. When enabled, reminders continue after passive sign-in expiry. Turn off removes the selected phone details and pending work; chosen times and recent frequency history remain. Sign out disconnects this browser's selected installation before clearing the session when its saved identity is available. A cleanup failure never prevents sign-out and may leave reminders active.

When this browser observes a different account, it tries to remove its old browser subscription without enabling the new person's reminders. A lost local identity or a failed browser cleanup can prevent immediate removal. Device notification settings and Settings' Turn off remain available; a notification already sent may still arrive. Removing a person clears their choices, subscription and attempts. Minimal revision and a previous Not now choice remain to prevent stale forms from restoring consent. Account deletion removes these live records. Normal backups exclude phone keys and active consent.

You can answer or skip. It opens only when you select the quiet optional cookbook link and never blocks normal navigation. The app no longer asks automatically. We keep the question version, server response, answer and skip dates, and whether you already had access when it was introduced. An existing user's answer is not treated as a first-use baseline. The response date records the server finishing its attempt to send the question; it does not prove your browser received it or that you read it. These response dates are historical; you can return to an unanswered question through the cookbook.

Your answer is visible to only you and the owner, not other household members. It is not sent to a model, and not to usage events or logs.

The raw answer is kept for 90 days from collection. After that it is hidden from live reads. Removal runs at startup and every 15 minutes, independently of backups; if the service is stopped or maintenance fails, physical removal waits until maintenance works again. Completion dates remain without creating another invitation to answer after expiry.

Removing a person from a household deletes their question records and answer from live storage. Deleting the account removes everybody's records. Ask the owner if you want an answer removed without leaving your household.

Backups can still contain answers after live removal: all copies last 30 days, then weekly copies last about six months. The newest backup can remain longer if backups stop. Restoring a copy hides and removes expired answers before normal use, subject to the same maintenance failure limit. An older restored backup can bring back an answer removed on request; the owner must repeat its removal before using that copy. Private copies made by the owner are outside automatic expiry and must be removed separately.

Sharing is optional. A sharing page reveals the original website link, the recipe title and the sharing name you choose (Someone if blank), never your email. Your saved ingredients, method, pictures and cooking notes are not shown to guests. Anyone holding the unlisted link can forward it. Search-index exclusion is not a confidentiality guarantee. Links expire after 180 days from creation, or sooner if the owner stops one or its creator, recipe or account is removed. Archiving a recipe stops sharing too. Expired links refuse access immediately; startup and periodic cleanup remove them and their stored notes. Downtime or cleanup failure can delay physical removal. Contact the app owner to stop a link sooner.

Sharing a link does not approve beta access. New accounts still need the app owner's email approval. Ordinary household invitations keep their existing rules. The sharing name you confirm is remembered for future links; you can change it in Account. Removal from a household clears this choice, and account deletion removes it.

New sharing links let admitted, signed-in beta users explicitly save an independent copy of your saved recipe, edits, pasted source text, recipe picture and all attached original PDFs/images. They get the recipe as it is when they save it; subsequent edits and deletion stay independent. Anyone with the link and beta access can save it. Your own cooking notes are included only if you choose Include cooking notes; the selected notes are frozen when you share. Recipients can edit their own copy. Existing source-only links retain the original website-import/review flow, with any selected notes in the recipient's matching import review. Unfinished drafts are removed by startup/periodic cleanup after 24 hours; downtime or cleanup failure can delay removal. Saved notes follow recipe retention; stopping your link cannot recall delivered notes, recipes or files.

We keep the frozen website link, title, chosen sharing name and any opted-in cooking notes while it is shared. Legacy beta admission and revocation records remain compatible with earlier versions, including invitation dates and your household's spent count. Legacy admission means an independent household; the owner may end beta access. New links grant no recruitment places. Stopping a link cannot recall a copy already delivered. A temporary identifier-only receipt prevents repeated saves of a live link into the same household. It expires with that link and is removed on household deletion or supported restore. Failed file copies are removed; unreferenced copy directories left by a crash are removed after24hours by startup/periodic maintenance. Downtime or cleanup failure may delay removal. We do not keep a long-lived sender-recipient relationship or record which shared recipes people read. Temporary verified identity and import handoffs expire after 15 minutes; live reads refuse them then. Startup and periodic cleanup remove them independently of backups, but a stopped service or cleanup failure delays physical removal. Account deletion removes its sharing data.

Older backups can retain this information under the archive policy below. An older restored copy can also bring back private recipient notes or drafts; their normal deletion and cleanup limits still apply. Supported restoration invalidates recovered sharing links and handoffs before use; raw manual database replacement is not detected. This cannot recall copies. The supplied server command disables application access logs; operators must also exclude these URLs from other request logging. Sharing adds no URL usage events, food-preference profile or guest-conversion tracking.

No passwords. Signing in is done by Google and KitchenSquire never sees one.

No payment details, ever.

The key used to read recipes belongs to this service, not to you. It is held in the server's configuration and never written to the database (D78).

You, and anybody the cookbook creator invites into your household - they see the same cookbook and the same shopping list, because that is what the invitation is for.

The owner of this service, who can read the database in order to run it.

People holding a sharing link can see its public source, recipe title and chosen sharing name; admitted recipients can deliberately save the shared recipe and its original files, with cooking notes only when you include them. Nothing is shared with anyone by default.

Google signs you in. They know you use this app.

OpenAI reads recipes you import. The page text, photograph or PDF, and relevant written post or transcript text, is sent to them to be read. Your email address is not.

When you use Discover, OpenAI also receives your request and relevant recipe ingredients, methods and descriptions to compare recipes. Optional Speak sends your short recording to OpenAI for transcription, then automatically searches for recipes using your words. The recording is held in memory and is not saved in your cookbook or backups. Discover results expire after thirty minutes, and Clear or signing out removes your current request and results from KitchenSquire. OpenAI background responses have temporary polling retention of roughly ten minutes; clearing KitchenSquire does not delete a provider copy immediately, and OpenAI's own retention policies apply.

ScrapeCreators can receive a public social-post link to retrieve post details and available transcripts. It may generate a transcript from the post's audio when needed. The source steps run automatically after you add a supported link. KitchenSquire does not send it your sign-in credentials or browser cookies.

Discover sends your typed or transcribed recipe request to ScrapeCreators for Google search. That search service does not receive your cookbook, cooking notes or raw audio recording.

Fly.io hosts the app and its database.

Tigris holds the encrypted backups.

Only the cookbook creator can delete the shared account from the Account screen. This removes everyone's access and the shared recipes, lists, notes and uploaded files immediately. Contributors can ask the creator to remove their access.

Backups are the exception, and it is worth saying plainly. Deleting your account does not reach a copy that was already taken. Every archive is kept for 30 days, and then one archive a week is kept for about 6 months - so a copy holding your recipes can exist for that long afterwards.

The most recent archive is never deleted, whatever its age, because a rule that can empty the bucket is worse than no rule. A backup runs every day and after every restart, so that copy is normally replaced within hours - but if nothing were ever backed up again, one copy would remain until something was.

Backups are encrypted, and are not read unless something has to be restored after a failure.

The waiting list keeps two things: the email address you gave, and what you wrote about planning meals. Nothing else, and no account is made.

Nothing is sent to that address except one note from the owner if there is room, written by a person. It is not a mailing list and there is nothing to unsubscribe from.

Ask at desmond@quietedge.io and the entry is deleted. You do not have to explain why.

What you wrote is kept exactly as you wrote it, with your account beside it, so somebody can look at what happened. Nothing is sent anywhere and there is no ticket system: a person reads it.

It is not mixed into the usage record above. That one can only hold a short list of fixed words and has nowhere to put a sentence, which is how the promise on this page is kept in code rather than in good intentions.

Deleting your account deletes what you wrote here with it.

Ask for anything, including a copy of your data or its deletion, at desmond@quietedge.io.