Kitchlaxy
Privacy Policy
Last updated: 10 October 2026
Kitchlaxy ("we", "us") is provided by Uzair Raza, Oman. This policy explains what we collect when you use the Kitchlaxy app and this website, why, who helps us process it, and your choices. Questions: support@kitchlaxy.com.
1. What we collect
| What | Examples | Why |
|---|---|---|
| Account details | Name, email address, password (stored only as a secure hash) | To create your account, log you in and send login codes |
| Your kitchen | Pantry and household items, amounts, shopping lists, leftovers, barcodes you scan | To plan meals and shopping |
| Your plans and recipes | Meal plans, check-ins ("How was it?"), recipes you write or save, dish votes | To plan meals and show your history |
| Household | Who is in your household, invites, requests between members | To share one kitchen with your family |
| Diets and allergies | Diets and allergies you add, and who they're for | To keep unsafe recipes out of suggestions. Allergies are health information: we use them only for this, and only because you chose to add them. You can remove them at any time. |
| Photos | Kitchen photos you take for the Copilot; profile and recipe photos | To recognise food in a kitchen photo; to show your pictures |
| What you say or type to the Copilot | "2 onions and a bag of rice" | To understand what you have. Voice is turned into text by your phone's own speech service; we receive only the text. |
| Device information | Push notification token, app version, phone type | To send notifications you've allowed, and to fix problems |
| Feedback | Messages you send us from the app | To answer and improve the app |
We don't sell your personal information, and we don't use it for advertising.
2. Who processes data for us
These services act only on our instructions:
- Hosting and database: Railway (servers in the European Union, the Netherlands).
- AI providers: OpenAI and Google (Gemini). They receive the text you give the Copilot, kitchen photos you choose to share, recipe and product names, and YouTube video links when you ask for a video's recipe. They send back what's in them. We use their business APIs, whose terms don't allow your data to be used to train their models.
- Email: Resend, to send login codes and household invites.
- Notifications: Expo, Google Firebase Cloud Messaging and Apple Push Notification service.
- Product information: Open Food Facts, when you scan a barcode (only the barcode is sent).
- Recipes: TheMealDB. We fetch recipes from it; none of your data is sent.
3. YouTube
Kitchlaxy uses YouTube API Services so you can follow cooking channels and save recipes from videos. By using these features you agree to the YouTube Terms of Service; see also the Google Privacy Policy. We store the channels you follow and the videos you save (title, channel name and picture). We refresh or delete this information at least every 30 days, and you can remove it at any time in the app.
4. Your household
Members of your household can see the household's plan, shopping list, pantry and dishes, and the names of the other members. Members can add an allergy, which the household owner is told about. If you leave or are removed from a household, you no longer see its data.
5. How long we keep data
- Your account data: while your account exists.
- When you delete your account (in the app: Settings → Profile and account → Delete account, or as described on kitchlaxy.com/delete-account): your personal data is deleted from our live database straight away, and from any backups within 30 days. If you own a household that others share, the household passes to the member who joined first; otherwise it is deleted with its data.
- YouTube data: 30 days at most (see section 3).
- Login codes: expire after 10 minutes.
- Feedback: kept for up to 2 years.
- AI usage records: these hold only counts and costs, never your text, and are kept for up to 13 months.
6. Your rights
Depending on where you live (for example the EU, UK, California, Brazil or India), you can:
- ask for a copy of your data;
- correct it, or delete it;
- object to or restrict some uses;
- withdraw your consent (for example for allergies) at any time.
Write to support@kitchlaxy.com from the email address of your account. We answer within 30 days. You can also complain to your local data protection authority.
Legal bases (GDPR):
- Contract: running your account and the app.
- Consent: allergies and diets (health data), and notifications.
- Legitimate interests: security, preventing misuse and fixing problems.
7. Children
- Kitchlaxy is for people aged 16 and over.
- Children can be part of a family's household (for example in the number of people cooked for), but don't have their own accounts.
- We don't knowingly collect data from children under 16. If you believe a child has an account, contact us and we'll delete it.
8. Security
- Passwords are hashed (scrypt), never stored as written.
- Data in transit is encrypted (HTTPS).
- Logins use short-lived tokens, and you can add fingerprint or face login on your phone.
- Access to production data is limited to the people who run the service.
9. International transfers
Your data is stored in the European Union. Some processors above work in other countries, including the United States (AI providers, notifications) and Japan (email delivery). Where the law requires, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
10. Changes
We'll update this page when what we do changes and, for important changes, tell you in the app.
11. Contact
Uzair Raza, Oman · support@kitchlaxy.com