1. Who We Are

Cold-to-Cooked ("we," "us," or "our") is an iOS application that uses artificial intelligence to generate recipes from photos of your refrigerator. This Privacy Policy explains how we collect, use, share, and protect your information when you use our app and website.

Contact: support@coldtocooked.com

2. Information We Collect

2.1 Account Information

• Email address — collected when you create an account, used for authentication and support
• Authentication token — a secure JWT token stored locally on your device to keep you logged in

2.2 Health & Nutrition Data

• Calorie, protein, and water logs — entered by you when using the Health Tracker feature
• Personal health goals — calorie, protein, and water targets you set in the app
• Apple HealthKit data — only if you explicitly grant permission; we read and write dietary data to Apple Health. We never share HealthKit data with third parties for advertising or marketing.

2.3 Fridge & Recipe Data

• Photos — images you take or upload are sent to our server and to Anthropic's Claude API for ingredient detection. Photos are not stored permanently after processing.
• Saved recipes — recipes you choose to save are stored on our servers, linked to your account
• Recipe history — a log of recipes generated during your sessions
• Ingredient lists — the ingredients extracted from your photos

2.4 Usage & Analytics Data

• App events — actions like scans performed, recipes generated, and features used, collected via Mixpanel
• Crash reports — error data collected via Sentry to help us fix bugs
• Device type and OS version — used to optimize the app experience
• Streak and engagement data — consecutive days of use, stored locally in UserDefaults on your device

2.5 Payment Information

We do not collect or store payment card details. All subscription billing is handled by Apple's App Store. We receive confirmation of subscription status through RevenueCat.

3. How We Use Your Information

Purpose	Data used	Legal basis
Providing the app service (recipe generation, ingredient detection)	Photos, email, saved data	Contract performance
Authentication and account security	Email, auth token	Contract performance
Health tracking features	Nutrition logs, goals, HealthKit	Consent
App analytics and improvement	Usage events, device info	Legitimate interest
Bug fixing and crash monitoring	Error logs, device info	Legitimate interest
Subscription management	Purchase status via RevenueCat	Contract performance
Customer support	Email, account info	Legitimate interest

4. Third-Party Services

We work with the following trusted third parties to deliver our service:

Anthropic (Claude AI)

Your fridge photos and ingredient lists are processed by Anthropic's Claude API for AI-powered ingredient detection and recipe generation. Anthropic processes this data as a service provider. See Anthropic's Privacy Policy.

RevenueCat

Manages subscription entitlements and in-app purchase verification. RevenueCat receives your Apple subscription status and a pseudonymous user ID. See RevenueCat's Privacy Policy.

Mixpanel

Analytics platform used to understand how users interact with the app. Events are pseudonymous (no name or email is sent to Mixpanel). You can opt out of analytics tracking by contacting us. See Mixpanel's Privacy Policy.

Sentry

Error and crash monitoring. Sentry may collect device information and error stack traces when the app crashes. No personally identifiable information is intentionally sent to Sentry. See Sentry's Privacy Policy.

Unsplash

Recipe card images are fetched from Unsplash using recipe titles as search queries. No personal data is sent to Unsplash. See Unsplash's Privacy Policy.

Apple HealthKit

If you grant permission, we read and write dietary data to Apple Health. HealthKit data is never shared with advertisers, never used for profiling, and never sent to third parties other than as described in this policy.

5. Data Retention

• Account data — retained until you delete your account
• Recipe and health logs — retained until you request deletion
• Photos — deleted from our servers after ingredient detection is complete (not stored permanently)
• Analytics data — retained for up to 24 months in pseudonymous form
• Crash logs — retained for 90 days

6. Data Deletion

You can request deletion of your account and all associated data at any time by emailing support@coldtocooked.com with the subject line "Delete My Account." We will process your request within 30 days.

Within the app, you can delete individual saved recipes and health logs at any time.

7. Your Rights (GDPR — EEA/UK Users)

If you are located in the European Economic Area or United Kingdom, you have the following rights:

• Right of access — request a copy of the data we hold about you
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — ask us to limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — withdraw consent for health data processing at any time

To exercise any of these rights, contact support@coldtocooked.com. We will respond within 30 days.

8. Your Rights (CCPA — California Residents)

California residents have the right to:

• Know what personal information we collect and how it is used
• Request deletion of personal information
• Opt out of the sale of personal information — we do not sell personal information
• Non-discrimination for exercising privacy rights

To submit a CCPA request, contact support@coldtocooked.com.

9. Children's Privacy

Cold-to-Cooked is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will promptly delete it.

10. Data Security

We use industry-standard security measures including HTTPS/TLS encryption for all data in transit, hashed passwords, and JWT-based authentication. However, no method of transmission over the internet is 100% secure.

11. International Data Transfers

Cold-to-Cooked operates servers primarily in the United States. If you are located outside the US, your information may be transferred to and processed in the US. By using the app you consent to this transfer.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact

Questions about this Privacy Policy? Contact us at:

Email: support@coldtocooked.com
Response time: We aim to respond within 2 business days.