Privacy Policy

01 Who We Are

Cook AI is an iOS application published by Skaly Consulting (“we”, “us”, “our”), a company registered in France. Cook AI helps you turn the ingredients you already have into personalised, AI-generated recipes.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have over it. By downloading or using Cook AI, you acknowledge that you have read and understood this policy.

Data controller: Skaly Consulting — support@getcookai.com

02 Data We Collect

Account Information

When you create an account, we collect your email address and a hashed password (or your Apple / Google sign-in token). This is used to authenticate you and sync your content across sessions and devices.

Profile & Preferences

We store your chosen cuisines, dietary preferences, saved recipes, grocery lists, and any personal settings you configure. This allows Cook AI to personalise your experience.

Usage & Analytics Data

We collect anonymised usage signals — feature interactions, error logs, and crash reports — to understand how the app is used and to improve stability and quality. This data does not identify you personally.

Subscription Status

We receive a record of whether your Cook AI Premium subscription is active, expired, or in trial from RevenueCat and Apple. We never receive your payment card number, bank details, or full Apple ID credentials.

Support Communications

If you contact us by email, we keep a record of the correspondence, including your email address and the content of your messages, to resolve your query and improve support quality.

03 Ingredient Photos & AI Processing

Cook AI's core feature is scanning your ingredients with your camera. Here is exactly how your photos are handled:

• When you tap Scan, the photo is sent to OpenAI's Vision API to identify the ingredients it contains.
• OpenAI returns a list of detected ingredients, which are then used to generate a personalised recipe.
• Photos are ephemeral — they are transmitted for processing and are not stored by Cook AI on our servers. We do not build an image database of your kitchen or fridge.
• Photos are never used to identify you personally, never shared publicly, and never used for advertising purposes.
• OpenAI's handling of API inputs is governed by their API data usage policy.

04 How We Use Your Data

We use the data we collect strictly to operate and improve Cook AI:

• Provide the service: authenticate your account, recognise ingredients, generate recipes, save your preferences and grocery lists.
• Manage subscriptions: verify Premium access, process trial periods, and handle purchase restores.
• Improve quality: analyse anonymised usage to fix bugs, improve features, and enhance AI accuracy.
• Provide customer support: communicate with you when you reach out by email or in-app.
• Comply with legal obligations: maintain records required by applicable French or EU law.

05 Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR:

• Performance of a contract (Art. 6(1)(b)): processing your account data, photos, and preferences to deliver the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): anonymised analytics, crash reporting, and security monitoring, where these do not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)): where retention is required by French or EU law (e.g. accounting records).
• Consent (Art. 6(1)(a)): for optional features or communications where we ask for your explicit consent beforehand.

06 Third-Party Sub-processors

We rely on the following trusted providers. Each processes your data only to the extent necessary to perform their specific function and is bound by a data processing agreement.

07 Cookies & Local Storage

Cook AI is a native iOS application and does not use browser cookies. Within the app, we use local device storage (AsyncStorage / iOS Keychain) to keep you signed in, cache preferences, and improve performance. This data stays on your device and is not transmitted to our servers unless required to sync your account.

Our marketing website (getcookai.com) may use essential session cookies for navigation. We do not use tracking or advertising cookies on the website.

08 Data Retention

• Account data & saved content: retained for as long as your account is active.
• Ingredient photos: ephemeral — processed in real-time and not stored on our servers.
• Anonymised analytics: aggregated data may be retained indefinitely; identifiable logs are purged after 90 days.
• Support emails: kept for up to 3 years for quality and legal purposes.
• After account deletion: personal data is removed from our active systems within 30 days. We may retain certain accounting or tax records for up to 5 years as required by French law. Data that has been fully anonymised (and cannot identify you) is not subject to deletion.

09 Data Security

We implement appropriate technical and organisational measures to protect your data:

• All data in transit is encrypted with TLS 1.2+.
• Data at rest in Supabase is encrypted with AES-256.
• Access to production data is restricted to authorised personnel only, with multi-factor authentication enforced.
• We conduct regular security reviews and apply security patches promptly.

No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please disclose it responsibly to support@getcookai.com.

10 Children's Privacy

Cook AI is not directed at children under the age of 13. Users in the EU who are under the age of 16 may be subject to additional parental consent requirements under GDPR Article 8. We do not knowingly collect personal data from children under these ages. If you believe we have inadvertently collected such data, please contact us immediately at support@getcookai.com so we can delete it promptly.

11 Your Rights (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right of rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure / “right to be forgotten” (Art. 17): request deletion of your personal data.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format (JSON or CSV).
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to restriction of processing (Art. 18): request that we limit how we use your data in certain circumstances.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

12 International Data Transfers

Some of our sub-processors (OpenAI, RevenueCat, Apple) are located in the United States. When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on sub-processors who participate in recognised data transfer frameworks.

User account data is stored on Supabase infrastructure in the EU region (AWS eu-west) by default, limiting cross-border transfers for your primary data.

13 Contact & Updates

For any questions about this Privacy Policy, to exercise your rights, or to report a privacy concern, please contact us:

Skaly Consulting
Email: support@getcookai.com

We may update this Privacy Policy from time to time. Material changes will be communicated via an in-app notice or by email. The “Last updated” date at the top always reflects the most recent revision.