This policy explains what personal data CookCalendar ([PLACEHOLDER — legal entity name], "we") collects, why, and your rights over it. We aim to collect as little personal data as possible.
Data we collect
- Account: your email address and a securely hashed password. A display name is optional and not requested at sign-up.
- Food preferences: diet, cuisines, household size, goals, calorie target, and any allergies you choose to enter. Allergy information is health-related data (a special category under GDPR) and is processed only with your explicit consent, solely to filter recipes. You can change or delete it anytime.
- App activity: meal plans, saved recipes, collections, pantry items, shopping lists, and any recipe ratings or content reports you submit.
- Technical: a strictly-necessary session cookie and, for security, the browser user-agent tied to your session. We do not store your IP address.
Why we process it (legal bases)
- To provide the service (planning, recommendations, shopping lists) — performance of our contract with you.
- Allergy data — your explicit consent, which you can withdraw at any time by removing it in Settings.
- Payments — where you subscribe, to fulfil the contract.
Who we share it with (processors)
- Stripe — payment processing. Card details go directly to Stripe; we never see or store them.
- Resend — sending transactional email (e.g. password resets).
- [PLACEHOLDER — hosting / database provider] — hosting the application and database.
- Our recipe catalogue is generated with Anthropic (text) and fal.ai (images). This uses only recipe topics — no personal data is sent to these providers.
Retention
We keep your data while your account is active. Deleting your account removes your personal data from our systems. [PLACEHOLDER — describe any backup retention window and inactive-account deletion policy.]
Your rights
Subject to applicable law, you can access, correct, export, or delete your data, and withdraw consent. Two of these are self-service in Settings: Export my data (a full JSON copy) and Delete account (permanent erasure). For anything else, contact us at [PLACEHOLDER — privacy contact email].
International transfers & children
[PLACEHOLDER — describe transfer safeguards if processors are outside your region.] CookCalendar is not directed to children under [PLACEHOLDER — age].
Changes & contact
We'll update this policy as needed and revise the date above. Questions or requests: [PLACEHOLDER — contact email / postal address / data protection contact].