Last updated 23 August 2026
Your recipes, shopping list, meal plan and pantry live on your device. We do not read them, and they are not sent anywhere unless you turn on household sharing.
Sharing is off until you turn it on, and it is the only thing that ever sends what you have written anywhere. The meal plan never travels on Android, and photographs never travel on either.
If you create or join a household, your book, plan and list are stored on our server so that the phones in that household can share them. They are readable only by members of that household — enforced by the database itself, not by a promise. We do not read them. Accounts are anonymous: no name, no email, no password.
Unless you turn it off in Settings, the app reports counts of what gets used — how many recipes were saved, whether a meal was cooked, whether the free book filled up — along with the app version, your iOS or Android version, and a random installation identifier that is not connected to you, to your Apple ID, or to your Google account.
In the UK, the EEA and Switzerland this starts switched off, and nothing is reported unless you turn it on.
It never includes anything you have written: not a recipe, not an ingredient, not a line on your list. The app has no way to send those, by design. This is how we decide what to build next, and you can switch it off at any time in Settings.
The Android app records no sessions at all. On iPhone, unless you turn usage reporting off in Settings, the app records how a session moves through it — which screens you opened, where you tapped, where you scrolled, where you stopped — using Microsoft Clarity. These recordings are played back as placeholder shapes: every piece of text and every image on screen is masked before it leaves your phone, so what we see is the shape of a session and never a recipe, an ingredient, a line on your list, or a photograph.
Microsoft processes these recordings on our behalf and is bound by their privacy statement. The same Settings switch that turns off usage reporting turns this off too.
If you send feedback, we receive what you typed, plus the app version and your iOS or Android version. If you choose to leave an email address, we use it only to reply to you.
A note sent from the cook, recipe or shopping screens also carries the shape of what was on screen — how many steps, how long the app thinks they take, which step you were on. Counts and minutes only: never a title, an ingredient, or a line of method.
Subscriptions are handled by Apple on iPhone and by Google Play on Android. We never see your payment details. Whether you subscribe is known to the app through the store, not through any account of ours.
We do not sell your data, share it with advertisers or data brokers, track you across other apps or websites, or use anything here for advertising. There are no third-party advertising or analytics SDKs in the Android app at all. On iPhone the only company that receives anything is Microsoft, and only the masked recordings described above.
Deleting the app removes everything held on your device and ends the installation identifier. To delete a shared household, or feedback you have sent, contact us and we will remove it.
You can also stop all reporting without deleting anything: Settings → Reporting.