Privacy Policy

Recipinned LLC, a limited liability company registered in Alaska (“Recipinned,” “we,” or “us”), provides recipe management, meal planning, shopping lists, and related services through our website, web app, and mobile app (together, the “Service”). This policy explains what information we collect, how we use it, who receives it, how long it is kept, and your choices. Contact us at [email protected] with privacy questions or deletion requests.

Information we collect and how we use it

Account and profile information. When you register or update your account, we collect information such as your email address, username, password credentials, display name, profile images, preferences, and account or organization memberships. We use it to create and secure your account, authenticate you, apply your preferences, and provide access to the Service.

Content you provide. We store recipes, ingredients, nutrition information, photos, meal plans, shopping lists, uploaded handouts, and other content you choose to add. We use this content to provide importing, organizing, editing, sharing, and export features. Content may include personal information you place in it.

Usage and diagnostic information. We collect information about activity in the Service, feature interactions, onboarding answers, page visits, errors, and technical operation. We use it to understand usage, improve the Service, investigate problems, and protect accounts. Analytics may be linked to your account; see “Analytics and session recordings” below.

Billing information. Stripe processes payments and subscription management. We send your account identifier and email to Stripe when you open checkout. We receive billing information such as customer name/email, customer and subscription identifiers, amounts, currency, and payment/subscription status. We use it to provide paid access and resolve billing issues. Stripe collects payment details through its hosted services; our checkout integration does not receive your full card number or security code.

Communications and signup requests. When you contact support, submit feedback, request a demonstration, or sign up for email, we collect the contact information and message you provide. Marketing forms may include referral and campaign information. We use this to respond, administer your request, and provide the communications described below.

Analytics and session recordings

We use PostHog for product analytics, error reporting, and session replay. Information shared with PostHog includes your account identifier, email, display name or username, family identifier, subscription/trial information, onboarding answers, and feature activity. Session recordings are linked to your email address and allow us to see your activity within the app. We use them to understand interactions and diagnose problems. Please do not upload sensitive information that is unnecessary for using the Service.

PostHog session recordings are retained for 30 days, PostHog logs for 14 days, and events and metadata for one year.

We also use Plausible to measure visits, referral sources, campaigns, and selected conversion events on the website and web app. Our website stores campaign attribution in your browser’s session storage and can attach it to a submitted signup request. Browser storage is also used for app preferences and analytics functionality.

At signup, you can choose whether to share optional usage analytics, session recordings, and error reports with PostHog. We ask for your permission before collecting this information, and you can opt out during registration. Declining prevents optional PostHog collection for your account. Your choice does not erase any information previously collected, which remains subject to the retention periods below. This choice is separate from AI consent and email subscriptions and does not change Plausible traffic measurement when you visit our public website. Contact [email protected] about your information.

AI features use OpenAI. Before AI is enabled for you, we ask for your permission to send selected photos and recipe content to OpenAI. Depending on the feature, this includes recipe or nutrition-label images, recipe text, ingredients, instructions, candidate tags or food matches, and content from recipe pages you import.

With AI enabled, some processing happens automatically as part of other actions, including tag suggestions, nutrition ingredient matching, recipe-layout repair, and an AI import fallback when a recipe page cannot be parsed normally.

You can turn AI off in Account → Privacy → Use AI features. Turning it off prevents future AI requests made for you, including the automatic uses described above. Shared family content follows the setting of the member whose action initiates processing; your setting does not change another member’s setting or stop processing they initiate.

We do not deliberately include your account email, name, or account identifier in these AI requests. Photos, imported pages, and recipe text can nevertheless contain personal information. Turning AI off does not remove information previously sent to OpenAI.

OpenAI states that API data is not used for model training by default unless the customer opts in. For the APIs we use, its standard abuse-monitoring retention is up to 30 days, with exceptions and other storage described in its API data controls documentation. We have not configured special retention or data-sharing settings.

Other service providers and disclosures

We share information needed to operate the Service with the following systems and providers:

Provider or system	Information and purpose
Stripe	Account/billing identifiers and payment/subscription information for checkout, billing, and subscription management. See Stripe’s Privacy Policy.
PostHog and Plausible	Usage and diagnostic information described above.
OpenAI	Consent-based AI processing described above.
Mailgun	Email address, recipient name, subject, and message content to deliver account communications and subscription emails.
Linode, Hetzner, Cloudflare R2, and hosting/CDN services	Linode hosts our application server in the United States. Hetzner hosts recipe-import processing. Cloudflare R2 stores uploaded files and encrypted database backups in Eastern North America. A content delivery network serves our website. Some uploaded assets are publicly accessible by URL; private handouts use restricted access links.
Grafana Cloud	Operational logs, traces and metrics to monitor reliability and investigate problems. Diagnostic records may contain account identifiers or information involved in an error.
Discord	App feedback, account and subscription notices, and website form submissions for our team. Account notices identify you by account identifier and a link to our admin tools, not by email or username. They can include feedback text, organization name, recipe/meal-plan counts, subscription payment amounts, and Stripe customer identifiers. Website form submissions, such as demo requests, include the contact details and message you enter.

The website also loads fonts from Google Fonts, which involves requests from your browser to Google. Importing recipes or following external links can involve requests to third-party websites.

We require providers processing information for us to protect it consistently with this policy and the applicable App Store privacy requirements, and to use it only for the authorized service purposes, subject to their applicable legal obligations.

We do not sell or rent your personal information or share it with third parties for their own direct marketing without your consent.

We may disclose information when needed to comply with law, address fraud or security incidents, enforce our terms, or protect people’s rights and safety. Information may also transfer as part of a merger, acquisition, financing, or sale of the business, subject to applicable protections.

Shared content and organization accounts

Other people can access content you share with them or make public. Public content and profile information may appear in search engines or copies outside our control.

If your account belongs to an organization’s site, its administrators can see and manage your account, including your name, email, role, sign-in activity, and lock status. They can access content saved in the organization’s sites, including recipes, meal plans, and shopping lists. Treat content you save there as visible to that organization.

Email communications

We send account communications such as verification messages, password resets, billing-related messages, and important service notices. Unsubscribing from promotional email does not stop necessary account messages.

When you set up your account, you can choose to join our email subscription list. We add you only if you say yes. We manage the subscription list ourselves. Mailgun receives your email address and name to deliver subscription emails. You can also sign up through our website. You can unsubscribe at any time using the instructions in the email.

We also use PostHog to send lifecycle emails based on your account activity, such as onboarding and engagement messages. You can unsubscribe using the link in those emails. This is separate from your newsletter subscription.

Retention

We keep account information and content to provide the Service while your account remains active, subject to deletion requests and any applicable legal retention requirements.

Database backups: We retain six months of database backups. Deleted account information may remain in existing backups until those copies expire.
Operational logs, metrics, and traces: We retain these records locally and in cloud monitoring systems for 30 days. PostHog logs have the separate period below.
PostHog: Session recordings are retained for 30 days, logs for 14 days, and events and metadata for one year. Previously collected PostHog information remains until its applicable retention period expires, including after account deletion.
Stripe: Stripe retains records under its own policy, including where necessary for financial, legal, and fraud-prevention purposes. Account deletion and stopping billing do not necessarily remove records Stripe must keep. See Stripe’s retention policy.
OpenAI: Provider retention is described in the AI section above; account deletion does not itself erase provider-held records.
Mailgun: Our Mailgun Foundation plan provides up to one day of email message storage and five days of delivery event/log retention. These periods apply to message content and delivery logs; unsubscribe and bounce records may be retained separately. See Mailgun Foundation plan details and message retention settings.
Discord: We do not routinely delete forwarded app notices or feedback messages, including after account deletion; we retain them indefinitely. They are not covered by our 30-day operational-log period. Discord also processes information under its retention policy.
Support, lead, billing, and subscriber records: We retain Recipinned support correspondence, lead records, first-party billing records and newsletter subscriber information indefinitely, including after account deletion. Unsubscribing stops the relevant promotional emails but does not itself erase the subscription record. These are separate from Stripe-held records and Mailgun message/delivery logs. Your applicable privacy rights are described below.

Account deletion and your choices

For an individual account, request deletion by emailing [email protected]. We validate the identity of the account holder before beginning deletion. Once your identity is verified, we remove account data from the live app within 48–72 hours and stop any future Stripe billing.

If your account belongs to an organization, the organization must handle the deletion request. Contact your organization administrator; we verify the request through the organization administrator email address on file. Your organization administrator can arrange deletion of the account and its content, including shared content and uploaded handouts.

Account deletion removes account data from the live app; it does not erase all information described in this policy. Existing database backups can retain deleted account data for up to six months. Historical PostHog information expires on its retention schedule, and the other retained records described above remain subject to their stated periods or criteria.

We retain deleted account identifiers so we can remove the associated records again if a database backup is restored. This deletion-tracking record uses your account identifier rather than your name or email.

You can update available account information in the app, export your recipes from Account settings, decline optional usage analytics and error reports at signup, turn off AI in Account → Privacy, and unsubscribe from promotional emails. Depending on where you live, you may have additional rights to access, correct or delete information or object to particular uses. Contact [email protected] to make a privacy request, including a request concerning sharing for direct marketing.

Security and international processing

We use safeguards such as access controls, private storage for restricted files, and encrypted database backups. Publicly accessible assets and content you share remain subject to their sharing settings.

Recipinned LLC is registered in Alaska. Our application server is hosted by Linode in the United States. We also use Hetzner for recipe-import processing. Our Cloudflare R2 storage is located in Eastern North America. Our content delivery network and other providers may process information in other locations, including countries other than your own.

Our providers publish international-transfer safeguards, including standard contractual clauses and, where applicable, recognized adequacy arrangements or participation in the Data Privacy Framework. The mechanisms used depend on the provider, the applicable agreement, the data and the transfer. Details are available in the published terms for Cloudflare, PostHog, Stripe, Mailgun/Sinch, Grafana, OpenAI, Linode/Akamai, and Discord. We do not guarantee that all processing occurs within the United States.

Children

The Service is not intended for children under 13, and we do not knowingly collect their personal information. If you believe a child has provided personal information, contact [email protected].

Changes and contact

We will update this policy on our website and in the app and revise the date shown above. Users will be asked to reconfirm the updated policy at their next sign-in.

For questions about this policy or to request deletion, contact [email protected].