← Back

WhatToCook Privacy Policy

Last updated: 7 August 2026

This Privacy Policy explains how personal data is processed when you use the WhatToCook mobile application and related websites (together, the “Service”).

Controller
The controller of your personal data is the publisher of WhatToCook, established in Portugal and reachable at support@what-to-cook-app.com (postal address available on request and on the Apple App Store / Google Play store listing for WhatToCook).

If you have questions about this policy or wish to exercise your rights, contact support@what-to-cook-app.com.

1. Scope
This policy applies to the WhatToCook iOS and Android apps and any official WhatToCook website pages that link to this policy (including Privacy and Terms pages).

2. Data we process
Depending on how you use the Service, we may process:

Account and identity
- Email address and password (if you create an account with email)
- Display name
- Authentication identifiers from sign-in providers you choose (for example Apple or Google), as provided by those providers

App preferences and content you create
- Language preference
- Cuisine, diet, allergy, liked and disliked ingredient preferences
- Staple pantry items and fresh ingredients you enter
- Favorites, ratings, cook history stored on your device, and optional custom meals you save
- Household / family size setting

Purchases
- Subscription status and related entitlement records needed to provide Pro features
- Product identifiers and purchase / restore metadata from Apple App Store or Google Play (payment card details are processed by Apple or Google, not by WhatToCook)

Optional Pro features
- Photos you choose to submit for ingredient detection (camera or photo library)
- Ingredient lists and preference context sent to our servers to generate meal ideas with AI

Device and technical data
- Device type, operating system, app version
- Basic diagnostics needed to operate and secure the Service
- Push notification permission status and your preferred local notification time (notifications are scheduled locally on your device for inactivity reminders)

We do not require you to create an account to browse free catalog content on device. Some features (including Pro subscription binding and cloud sync of favorites) require an account.

3. How we obtain data
- Directly from you (forms, settings, fridge ingredients, photos you upload)
- Automatically from the app and your device (technical and permission status data)
- From Apple or Google when you purchase or restore a subscription
- From authentication providers when you choose Apple or Google sign-in

4. Purposes and legal bases (GDPR)
We process personal data to:

Provide the Service (contract — Art. 6(1)(b) GDPR)
- Match meals to ingredients and preferences
- Deliver Pro AI meal generation and photo ingredient detection when subscribed
- Maintain your account, preferences, favorites, and subscription entitlement

Communicate about the Service (contract / legitimate interests — Art. 6(1)(b)/(f))
- Respond to support requests
- Send local push reminders you enable (you can turn these off in Settings or system settings)

Security, abuse prevention, and service integrity (legitimate interests — Art. 6(1)(f))
- Authenticate users, prevent fraud, enforce rate limits, protect AI endpoints

Legal obligations (Art. 6(1)(c))
- Keep records required by applicable tax, accounting, or consumer law
- Respond to lawful requests by authorities

Where we rely on legitimate interests, we balance those interests against your rights and expectations as a user of a consumer cooking app.

Where consent is required (for example certain optional device permissions such as camera, photos, or notifications), we process that data based on your consent (Art. 6(1)(a)). You may withdraw consent by changing device or in-app permissions; withdrawing consent does not affect prior lawful processing.

5. AI processing
If you use Pro AI features, we send relevant inputs (for example ingredients, preferences, language, serving size, and, for photo detection, the image you submit) to our servers hosted with Supabase in the European Union, which call Google Gemini (or a successor model we configure) to generate outputs.

AI outputs may be inaccurate or incomplete. Do not rely on them as medical, nutritional, or allergen-safe advice. Always verify ingredients and allergens yourself.

Photos submitted for detection are processed to return ingredient suggestions and are not used to train a WhatToCook public model. We do not sell your photos. We retain AI request logs only as needed for security, abuse prevention, debugging, and service quality, then delete or anonymize them.

6. Sharing and processors
We do not sell your personal data.

We use service providers that process data on our instructions:

- Supabase (EU region) — authentication, database, and edge functions
- Google (Gemini API) — Pro AI generation and photo ingredient detection when you use those features
- Apple and Google — account sign-in (if chosen) and in-app subscription payment processing
- Hosting providers for the WhatToCook website and email for support@what-to-cook-app.com

These providers may process data in the EU/EEA or in other countries. Where transfers outside the EEA occur, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider’s approved transfer mechanism.

We may disclose data if required by law, to protect rights and safety, or in connection with a merger, acquisition, or transfer of the Service (in which case we will continue to protect data as described here or give notice of changes).

7. Retention
- Account data: kept while your account is active; deleted or anonymized after you request deletion, subject to legal retention needs
- Preferences, favorites, and similar account content: while the account remains, or until you delete them
- On-device data (fresh ingredients for the day, cook history for the day, local notification schedule): stored on your device and cleared according to in-app rules or when you uninstall the app
- Purchase / entitlement records: retained as needed to provide Pro access and meet accounting / consumer obligations
- AI and photo-detection logs: short-term retention for security and reliability, then deletion or anonymization
- Support emails: retained as needed to resolve your request and for legitimate follow-up

8. Your rights (EEA / UK and similar laws)
Subject to applicable law, you may request:

- Access to your personal data
- Rectification of inaccurate data
- Erasure (“right to be forgotten”)
- Restriction of processing
- Data portability
- Objection to processing based on legitimate interests
- Withdrawal of consent where processing is consent-based

To exercise these rights, email support@what-to-cook-app.com. We may need to verify your identity.

You may lodge a complaint with the Portuguese Data Protection Authority (CNPD) or your local supervisory authority in the EU/EEA.

9. Children
WhatToCook is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Where a higher age of digital consent applies in your country, we do not knowingly collect data from children below that age. If you believe a child has provided personal data, contact support@what-to-cook-app.com and we will take appropriate steps.

10. Security
We use appropriate technical and organizational measures to protect personal data, including encrypted transport (HTTPS/TLS), access controls on backend systems, and limiting Pro AI access to entitled accounts. No method of transmission or storage is completely secure.

11. International users
The Service is operated from Portugal in the European Union. If you use the Service from outside the EEA, your data may be processed in the EU and in other countries where our processors operate.

12. Changes
We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Material changes will be indicated in the app or on the website where appropriate. Continued use after an update constitutes acceptance of the revised policy where permitted by law.

13. Contact
Email: support@what-to-cook-app.com
Subject line suggestion: “Privacy request”