Privacy policy

Effective 6 November 2026

Kitchen Squirrel is a household recipe, meal-planning and shopping app. This page says what the app and this website collect, why, who can see it, how long it is kept, and what you can ask us to do. We show no adverts and never sell your data.

Who we are

Kitchen Squirrel is run by Telescope Investing Ltd, a company registered in England and Wales, company number 13821866, registered office The Coach House, Dartford Road, Bexley DA5 2AS, United Kingdom. We decide how your data is used, which makes us its "controller" under UK data protection law. For anything on this page, email [email protected].

What we collect

• Your account — your email address (we email you a code to sign in), your display name (your household sees it; if you don't set one we use the first part of your email), your household's name, your role in it, when you joined and when you last used the app.
• What your household adds — recipes and your edits to them, notes, cookbooks, meal plans, dinner votes, shopping lists and trips, regular items, cooking history, ratings and their notes, favourites, leftovers, and settings such as cook nights, reminder times and your shop's aisle order.
• Recipes you capture — when you save a web link, our server fetches the page and keeps the recipe as structured data with a link back to the original. When you paste text or share a PDF, photo or screenshot, we read the recipe from it. Photos are shrunk on your phone first, which removes location and camera details. The photo itself is not kept once the recipe has been read, unless you choose to keep a picture of the dish from it (see the next item).
• The text we read — each time we read a recipe, we keep a copy of the text we read it from: what you pasted, the text of a PDF or web page, or the recipe as we read it from a photo. If you don't save the recipe, the copy of your own text, PDF or photo reading is deleted within about a day. If you do save it, we keep it with the recipe, so we can spot a recipe you already have and read it again with better tools, and it is deleted with your household. The text of a web page is kept as our copy of that page. Pasted text can include anything you copied with the recipe, such as names in a chat, so paste only the recipe where you can.
• Photos you add to recipes — your own photo, or a dish picture you chose to keep from a screenshot, is stored so your household can see it. It is stored at a web address that can't be guessed, and the app only shows it inside your household. Anyone who has that address could open it. Any member who can edit can remove it. Removing it deletes the file, though copies can stay in caches for a short time.
• Invitations — if you invite someone by email, we hold their address to send the invitation. If they don't join, it is deleted a day after the invitation expires, which is 14 days after it was sent.
• Reports — if you report something, we keep the reason, anything you write, your name and household's name, and a copy of what was reported at the time.
• Purchases — if you buy Pro, the store tells us which plan, when it runs until, and the store's transaction details, price and country. We never see your card details.
• Your phone — a push notification token if you allow notifications, and your app version, platform and update id.
• Measurements — how long the app took to open, sync and capture a recipe, and counts of which features were used. These are stored against your household, not your name. Each recipe capture also records who started it and the recipe's website. When one fails, we also record the link, so we can fix the problem and let you know.
• Reliability records — so we can tell why the app seemed to stop: how long the app was on your screen before you left it, how long it was away before you came back, any time it froze for about a second or more, and any request to our server that failed or took 5 seconds or more. Each record says when it happened. It can also say which kind of screen the app was on, such as "a recipe page", which kind of request it was, and how our server answered, if it did. It never says which recipe, a recipe's web address or anything you typed. Like the measurements, they are stored against your household, with the app version, platform and update id, not your name. They also carry a random label that the app picks each time it starts, and again whenever the phone changes household, and doesn't keep on the phone, so we can tell two phones in one household apart. It is not a device identifier. There is no switch in the app to turn these off, but you can object by emailing us.
• Crash reports — if the app crashes, or can't save to your phone's own storage, a report with your phone's model, its operating system, the app version and the error. No account details or recipe content.

How we use it, and why we're allowed to

• To run the app you signed up for: signing you in, syncing your household between phones, reading recipes, building shopping lists, share links, notifications and Pro. The legal basis is our contract with you.
• To keep it working and safe: logs, the reliability records above, limits against abuse, backups, crash reports, checking shared links, and dealing with reports. The legal basis is our legitimate interest in running a reliable, safe service.
• To improve it: the measurements above. There is no switch in the app to turn these off, but you can object by emailing us. Legitimate interests again.
• To contact you about your account, a report, or a capture that failed. We don't send marketing email. Legitimate interests.
• To keep financial records of purchases, because the law requires it. The legal basis is legal obligation.

There is no advertising, no tracking for advertising, and no sale of personal data.

Who can see what

• Your household sees everything your household holds: recipes, notes, photos, plans and lists. Your name is shown next to your ratings, notes and votes. View-only members can see all of this but can't change it.
• Other households see nothing of yours, except through a share link you choose to send and through Discover (both below).
• Us. We can see account and household data, including recipes, notes and photos, through a protected admin tool. We look only to run the service: fixing captures and ingredient matches, dealing with reports and support, and keeping it secure. Our actions there are logged. Our own emails about reports and activity name households.
• Our service providers, for the jobs listed below.

Discover

When a household saves a recipe from a web link, including a public social media post, the recipe's public source details can appear in Discover: its title, link, picture link, times, servings, tags and the creator's name on the source website. Never your notes, edits, photos or ingredients. Recipes you type in or capture from a photo or pasted text never get a listing of their own, though one that links to a page already in Discover counts towards that listing's totals. Discover shows totals across households: how many kitchens saved a recipe, how many cooked it, and its average rating. No names or notes are shown.

Share links

A recipe you share from the app can be sent as a link to a page on kitchensquirrel.com. The link carries only the public details of the recipe's source — its original title, cooking times, servings, the website and the creator's name there — a link to the original, and a card image the app makes from those details. It never carries your edits, notes, photos or ratings, and neither the page nor the app says who shared it. A recipe you typed in yourself or captured from a photo gets no page of its own. Unless it links to a web page already in Discover, its card is sent from your phone instead.

We record which recipe each link points to, when it was made, which account made it and its card image, so that a link can be switched off and a report dealt with. That record is never shown to anyone who opens the link. A link keeps working until we switch it off, take the recipe down, block its website, stop your household sharing, suspend the account that sent it or your household, or turn share links off altogether, or until your household is deleted. Removing the recipe from your own household does not switch the link off. To switch one off, email us.

The page sets no cookies and has no advertising or tracking. We count how many times each link is made, opened and saved, as plain totals; nothing about who opened it is kept with the count. To stop the page being flooded, your IP address is used to limit how often it can be opened or reported. It is held in our server's working memory for that purpose only and is never written to a database or a log. Your browser type is checked to tell people from link-preview robots, and is not kept. Cloudflare, which serves the site, handles your IP address to deliver the page.

Anyone can use "Report this page" on a shared page. We keep the reason, anything written in the report and the recipe's details, so we can look into it; we do not record who sent it. We may take a page down, or stop a household sharing, after a report. When a link is sent to you, nothing is added to your library unless you choose to save it, and the app lets you report it or block shares from the household that sent it. If you block a household, we keep that choice until you undo it.

Before a link is made, the recipe's website name is checked with Cloudflare's family filter and against published lists of unsafe sites. Only the website's name is sent, to Cloudflare, for that check.

Pictures and links to other websites

We keep a cached copy of a recipe's picture in our own storage, so it still shows after the website's link expires. A picture we haven't cached yet loads straight from the original website, so that website can see your phone's IP address, just as when you visit it. "View original" opens the source website, which has its own privacy policy.

Reading recipes with AI

Before the app sends a photo, a screenshot, text you paste or share into it, or a PDF to be read, it asks you, once on each phone. If you allow it, what you chose is sent to OpenRouter, which passes it to an AI model, run by its maker or by a cloud service that hosts that model. We choose the model and may change it; today we use models made by Google and Anthropic, and this page names the makers we use. It is sent only to read the recipe. A photo or screenshot is sent as it is, so anything else in it, such as names in a chat, goes too.

You can turn this off at any time in Manage → Reading with AI, and signing out or deleting your account turns it off on that phone. Turning it off stops the app sending your photos and text to be read. It doesn't undo what was sent before.

Some things are sent even with it off. When you capture from a link, or save a recipe from Discover or a share link, the text of that public web page or post may be sent if our own rules can't read it. If you have Pro and ask for a recipe's macros, its title, servings and ingredient lines are sent, including ones you typed yourself; asking for swaps sends one ingredient's name. We never add your name, email or other account details to anything sent.

Service providers

These companies process data for us, only for the job named:

• Amazon Web Services (AWS) — the server that runs our app service, its logs and the nightly backups, in Ireland.
• Hetzner — the server that runs our app service, its logs and the nightly backups.
• Supabase — our database, in Ireland, which holds everything described above.
• Cloudflare — carries all traffic between the app and our server, hosts this website and its share pages, stores the photos you add, cached recipe pictures and the share cards, and receives email sent to [email protected].
• Google — Google Play sells Pro and takes payment; Firebase Cloud Messaging delivers notifications to Android phones; Google Drive holds an off-site copy of our backups.
• Our email provider — holds the emails you send us at [email protected].
• OpenRouter, and the AI models it passes requests to (the models we choose, today made by Google and Anthropic, and run by their makers or by cloud services that host them) — reads the recipe from a photo, a screenshot, text you paste or share, or a PDF, once you've allowed it in the app (see Reading recipes with AI, above). A photo or screenshot is sent as an image, so anything else in it, such as names in a chat, goes too. It also reads the text of a public web page or post when our own rules can't, estimates macros from a recipe's title, servings and ingredient lines, and suggests swaps for a single ingredient. We never add your name, email or other account details to anything sent.
• RevenueCat — manages Pro purchases from both stores. It holds an internal account number, not your name or email, and that number's purchase history, which we keep so that Restore purchase works, even after you delete your account. Ask and we'll delete it.
• Expo — delivers app updates, and passes notifications to Google (and to Apple on iPhone). A notification's text can include a household member's name and a recipe title.
• Resend — sends sign-in codes and invitations (an invitation names the person who invited you and their household), and our own notices about reports, activity and faults, which can include household names and report text.
• Sentry — crash and storage-error reports, as described above.
• Apple — on iPhone: notifications, and App Store payments.

Each of them processes your data only on our instructions, under a contract that requires it to give your data the same protection as this policy does. The exception is payment: Google Play and the App Store sell Pro and take payment under their own terms and privacy policies.

Data travelling between your phone and our server is encrypted.

Where your data goes

Our server and our database are in Ireland, in the EU, which UK law recognises as protecting personal data adequately. Some of our other providers are outside the UK, mainly in the United States. Where they are, we rely on the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for providers certified under it) or on the UK's International Data Transfer Agreement or Addendum, which bind the provider to protect your data to UK standards.

Permissions on your phone

• Camera and photos — only the pictures you choose to take or share.
• Contacts — used only when you tap "Choose from contacts", which opens your phone's own contacts picker. The email address of the person you pick goes into the invite box, for you to check and send; nothing else from your contacts is kept or sent to us. From Kitchen Squirrel 0.10.0, no contacts permission is asked for: the app never gets access to your contacts, only to the person you pick. On Android, Kitchen Squirrel 0.9.0 asks for the contacts permission when you tap "Choose from contacts", and never before.
• Notifications — optional. You can turn them off in your phone's settings.

The app keeps a copy of your household's data on your phone so it works offline. Uninstalling the app removes it. The home-screen widget, if you add one, shows tonight's dinner and what's left to buy to anyone who can see your screen.

Logs and IP addresses

Our server keeps short technical logs of the requests it receives. They record the address asked for and the result, not your IP address. The exception is when someone asks for too many sign-in codes, or tries to get into our admin tool: then that IP address is logged. The logs are overwritten as new ones come in, and errors from them are emailed to us. Otherwise your IP address is used only in working memory, to limit repeated sign-in attempts and share-page requests. Cloudflare handles it to deliver traffic.

This website

kitchensquirrel.com sets no cookies, runs no analytics and loads nothing from other companies. On an iPhone or iPad, Safari may show Apple's own App Store banner at the top of an invitation or a shared recipe's page, to get Kitchen Squirrel or open it. Safari fetches that banner from Apple, not from us.

How long we keep it

• Your account and household's data: while your account and household exist.
• Recipes you remove, and any photo on them: hidden at once, but kept, so we can bring one back if you ask, until your household is deleted. Email us if you want one erased sooner.
• Sign-in codes: deleted a day after they are used or expire.
• Invitations nobody accepted: deleted a day after they expire.
• Working copies of a capture request: what you sent is removed as soon as we start reading it; the rest of the request is deleted within about eight days.
• The text we read for a capture: deleted within about a day if you don't save the recipe; kept with the recipe if you do, and deleted with your household.
• Performance timings: 180 days.
• Reliability records: 30 days.
• Feature counts: kept, but your id and any link are removed when you delete your account.
• Reports: kept as a record of what was reported and what we did.
• Share link records: until the link's household is deleted.
• Crash reports: deleted automatically by our crash-reporting provider after a limited period.
• Backups: daily copies for 30 days (40 days for the off-site copy) and monthly copies for about 13 months. They are used only to recover from a failure.
• Purchase records: kept as financial records, which the law requires for at least six years.
• A log of actions we take in our admin tool, such as deleting an account: kept indefinitely as a security record.

Deleting your account

Delete your account in the app: open Manage and tap Delete your account, then type your email address to confirm. Deletion in the app is immediate. If you can't open the app, follow the steps on our delete account page, or email [email protected] from the address you sign in with. We confirm by reply and delete within 30 days.

• If others remain in your household, we delete your email, name, sign-in records, ratings and their notes, favourites and notification tokens. The household's recipes, plans and lists stay with the other members; things you added stay without your name. If you are the only Manager, the app asks you to choose who takes over; by email, make someone else Manager first.
• If you are the last member, we delete the whole household: recipes, photos, plans, lists, cookbooks, history, share links, and the text we read for the recipes it saved.

What we keep, and why:

• Purchase records, as financial records (see above).
• The admin log entry for the deletion, which includes your email address, as a security record of what we did.
• Records of what our AI provider was used for and cost, which hold no content.
• Reports, with the copy of what was reported at the time, as a record of what we did. If others remain in your household, that includes reports you made and ones about something you wrote, which can show your name. If you are the last member, the reports your household made go with it; reports others made about its share links are kept.
• The text we read for captures that aren't behind a saved recipe, which isn't linked to you (see above).
• Discover's public source details and anonymous totals, which don't identify you.
• Backups, until they age out (about 13 months at most).
• Outside our database: RevenueCat's purchase record, which we keep so that a purchase can be restored into a new account (email us and we'll delete it too), crash reports until they expire, email delivery logs, our own emails about reports, and emails between you and us.

Deleting your account does not cancel a subscription. Cancel it first in the store you bought it from: Google Play, or the App Store on iPhone.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit what we do with it, to object to how we use it, or to send it to you in a form another service can read. Email [email protected] from the address you sign in with. We reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd like the chance to put it right first.

Children

Kitchen Squirrel is for adults (18+): you must be 18 or over to use it. From Kitchen Squirrel 0.10.0, when you sign in on an iPhone with a US App Store account, or on an Android phone in the US, the app may ask whether you're 18 or over: on an iPhone, Apple's Declared Age Range answers from your Apple Account; on Android, Google Play answers through its age signals. If your Apple Account or Google Play says you're under 18, the app won't let you sign in. The answer is used once, on your phone: it isn't kept, and it isn't sent to us or anyone else.

We don't knowingly hold data about anyone under 18. If you think we do, email [email protected] and we'll delete it.

Changes

If this policy changes, the date above will be updated and this page will always hold the current version. If a change matters to how your data is used, we'll also tell you in the app or by email before it takes effect. Our terms of use cover the rest of how the app works.