Privacy Policy

Cookit Technologies Pty Ltd, ABN 70 702 762 187, ACN 702 762 187, of 520/7 Potter Street, Waterloo NSW 2017, Australia. Privacy contact: [email protected].

This is COOKIT's full Privacy Policy. It covers visitors, account holders, people contacting support and people whose information is received through community features. Short collection notices and permission prompts explain particular collections when they happen; they supplement this policy. Reading this policy does not itself give consent to optional sensitive-information collection or public sharing.

Some features described below are optional or are not yet available. Their inclusion explains how they handle information if offered; it does not mean that Premium, dating or Official Fridge publishing is currently open, or that COOKIT has launched in every country.

Account details: your email address and password (held by our authentication provider — we don't see your password).

Profile: your display name and, if you add one, a profile photo. A public display age is optional for ordinary Cook Connections and required if you choose dating.

Age and dating eligibility: if you choose to provide it, your date of birth, the date and version of the statement you confirmed, whether the result is self-declared or provider-backed, changes you make, and the resulting dating-eligibility state.

Cooking and food preferences: the number of people you normally cook for, fridge size, meals cooked at home, cuisines, disliked ingredients, cooking confidence, available cooking time, an optional grocery budget and optional goals.

Optional sensitive information: allergies, intolerances, dietary patterns and health-related goals. This is collected only with your express consent.

Food and kitchen data: fridge and pantry items you add (by hand, barcode or receipt), dates, quantities, cooked-meal history, shopping lists, fridge appearance and decorations, and any photos you upload.

Community and marketplace data: sharing settings, friend and group connections, listings, claims, exchange history, Fresh Points activity, reports you make and any evidence you attach.

Device and location data: your approximate area if you choose to provide it, and notification permissions if you enable reminders. We don't collect continuous background location.

Technical data: COOKIT does not use a third-party analytics provider. First-party crash reporting is disabled unless COOKIT deliberately enables its own crash-intake service; when enabled, those reports are held by COOKIT.

We hold your selected country, local-area and retailer preferences where you supply them. Saved receipt records can include the merchant, purchase date, item descriptions, quantities, prices and original currency, together with confirmed food items and shopping-list changes. A country preference does not establish your physical location or tax residence.

When you use households, invitations, groups, reviews or messaging, we process the membership, invitation, review and message information needed to provide those features. People you communicate or share with receive information within the relevant audience.

If you contact support or make a report, we collect your contact details, correspondence and any attachments or evidence you choose to supply. Avoid including unnecessary sensitive information about yourself or anyone else. Receipt scanning's on-device image processing does not prevent us receiving a photograph you deliberately attach to a separate support request or community post.

Most information comes from you when you register, enter food or preferences, use a feature, upload content or contact us. Our service also creates operational records such as consent history, account security events, exchange activity and subscription entitlements.

We may receive information about you from another member through household invitations, shared content, messages, reports or disputes, and from authentication, subscription or payment providers when you use those services. We use that information for the relevant service, account security, support or safety purpose. We take reasonable steps to provide any additional collection notice required by applicable law, subject to lawful exceptions, including protection of another person's privacy or safety. We do not automatically disclose a reporter's identity or evidence to the person reported.

To create and secure your account; to run your fridge inventory and your daily fridge update; to suggest recipes and rank them for the people you cook for; to operate community sharing and the food marketplace; to administer Fresh Points; to administer COOKIT Premium; to investigate reports, disputes and suspected fraud; to keep members safe; and to meet legal obligations.

You can read public pages without creating an account. An account needs an email address and authentication information; without these we cannot provide account-based features. You may make a general privacy enquiry without identifying yourself, but we may need proportionate identity checks before releasing or changing account information.

Allergy, intolerance and health-related information is optional and collected with express consent. You can change optional preferences, withdraw consent for future optional processing, disable sharing or revoke camera, location and notification permissions through the app or device settings. A feature that depends on that information may then be unavailable or less personalised. Withdrawal does not undo an earlier lawful disclosure or require deletion of records we must lawfully retain.

You can use COOKIT without providing a date of birth, allergy, dietary, health-goal, budget or location information. Without a date of birth, dating stays unavailable; ordinary Cookit and non-dating Cook Connections continue. Recipe suggestions will be more general, allergen filtering won't be applied, and location-based features will ask you for a suburb instead.

The current account sign-up also contains a separate 18+ declaration for the account Terms. That legal gate is not the dating birth-date record and remains subject to owner and legal review.

Dating is not currently public. You can skip date of birth and continue using your fridge, recipes, Neighbourhood, ordinary friends and groups, and non-dating Cook Connections. If you choose dating when it becomes available, both people must independently meet Cookit's server-owned adult-eligibility rule.

Your full date of birth is kept in a protected private record. It is used to calculate your current age and dating eligibility and is never placed on your general profile, dating card, map response, message, notification or analytics event. Other members may see only the public display age you separately include on a dating profile.

A date of birth you supply yourself is labelled self-declared, not verified. Provider-backed verification is a separate future process and is not available in this build. Cookit does not infer adulthood from profile text, email, membership, administrator status or editable account metadata.

You can correct your date of birth in Settings. Corrections are audited and rate-limited for safety. If a correction makes dating eligibility uncertain or unavailable, dating discovery and matched access close without affecting ordinary Cookit features. Your private birth date and its eligibility history are included in your data export and deleted with your account.

COOKIT Free and COOKIT Premium · Monthly are private to you. Your membership is never shown on your public profile, on listings, on the map or to any other member, and it is never used to rank or promote anything you list.

Premium can be purchased through Apple, Google or COOKIT's web checkout when those channels are made available. Apple or Google processes an in-app purchase. RevenueCat operates the subscription service and may operate the web checkout using its payment gateway, including Stripe. COOKIT does not receive or store your full card number or security code. We store the account-to-membership status, product and store identifiers, purchase and expiry timing, and the provider transaction references needed to supply and reconcile access, cancellations and refunds. The payment provider may separately hold billing contact, payment-method and tax information under its own privacy terms.

A fridge skin you claim as a Premium member stays yours permanently. Cancelling, pausing or letting Premium lapse never takes one back.

COOKIT's recipes come from its own catalogue, matched against what is in your fridge. Your ingredients, dietary preferences and allergies are not sent to an AI provider, and no part of COOKIT sends your information to one.

This was not always so. Premium once wrote a recipe around your fridge by sending your ingredient names, dietary preferences and allergies to an outside AI provider. That feature has been withdrawn and nothing goes there any more. Recipes you saved while it existed stay in your account, yours to keep or delete like anything else you saved.

Allergies you record are used to exclude recipes before you are shown them, by COOKIT's own rules. That is a filter rather than a guarantee: ingredient and allergen information is always to be read alongside the packet.

Camera access is optional. The barcode scanner reads the code on your device; it does not upload the camera image. COOKIT checks its own catalogue and can use Open Food Facts for a missing barcode. The lookup payload contains the barcode, rather than your account, fridge or allergy profile. Network services also receive the connection metadata needed to deliver a request. Community product information is not an allergy or food-safety guarantee.

Receipt photographs are read on your device rather than uploaded to an OCR service. You review the extracted information before saving. Confirmed receipt and food records are stored to provide receipt history, inventory and shopping features. COOKIT may process receipt text through its own service; the statement that a photograph stays on-device does not mean all resulting receipt information stays on-device. Product lookup results may be cached on your device for a day and cleared at sign-out. We do not send your product corrections or photos to Open Food Facts.

When you put leftovers back in your fridge, COOKIT records which meal they came from, the storage estimate it suggested, the date you chose and whether you chose a later one. That is kept so the estimate stays explainable if the guidance changes.

Storage dates are estimates drawn from published Australian food-safety guidance, not guarantees, and COOKIT says so every time. Adding leftovers to your fridge never lists them in the Neighbourhood; that always needs a separate, explicit action.

Official Fridge publishing is not currently available, is not switched on, and nothing has been published. When it is offered, publishing will place a privacy-safe visual description of your fridge — its shape, colours from COOKIT's own palette, and approved decoration positions — into a public record on Base.

It will never include your notes or their text, personal photos, photo magnets, your nameplate, anything in your inventory, your name, your location or any database identifier.

COOKIT will never ask for or hold a recovery phrase, a private key or a wallet password. Only a public address you prove you control is linked to your COOKIT account. Publishing requires you to approve a transaction in your own wallet and may require ETH for the Base network gas fee and a separately disclosed COOKIT service fee. COOKIT does not take custody of your wallet or crypto-assets and offers no payout.

A public wallet address, transaction hash, contract address, token or publication identifier, and the privacy-safe fridge record can be visible permanently on a public blockchain and through Base infrastructure, RPC providers and block explorers. Anyone can inspect a public address's blockchain balance and transaction history even though COOKIT does not collect or store that balance or unrelated history in your account. Public blockchain records cannot be edited or erased by COOKIT after confirmation. Publishing is not an investment, and COOKIT makes no promise of resale, profit, returns or future monetary value.

Service providers who help us operate COOKIT: our hosting, database, authentication and file-storage provider (Supabase); our subscription provider (RevenueCat, which receives account and subscription identifiers and tells us which account holds an active membership); Apple and Google for in-app purchases and push notifications; Stripe or another payment gateway used by RevenueCat for web checkout; and Open Food Facts (which receives a barcode and nothing else, when you scan a product our own catalogue does not have). If you choose Official Fridge publishing after it is switched on, the privacy-safe record and public wallet or transaction identifiers are sent to Base network infrastructure, an RPC provider and any configured distributed-storage provider, and then become publicly available as described above. COOKIT does not use a third-party analytics provider. No age-verification provider is configured in this build.

Other members see only what your sharing settings allow: your display name and photo, your listings, and — once you accept a claim — the pickup details you choose to share. An opted-in dating card may show your separate public display age, but never your date of birth, birthday, verification evidence or provider data. Your exact address is never shown publicly.

Cloudflare delivers and protects our public website. Hosting, authentication and network providers process technical information needed to handle connections and protect the service, such as IP addresses, request times, requested URLs and browser or device information. These operational records are separate from optional crash reports. COOKIT does not currently use a third-party analytics provider.

COOKIT uses browser local storage or device storage for authentication, settings and feature caches. The remember-device setting controls whether the authentication session persists on that device; turning it off does not erase server-side account records. Hosting or security providers may use necessary cookies when their security features require them. Blocking storage or cookies can affect sign-in or service operation.

Retailer, regulator and other external links take you to services with their own privacy practices. Opening a retailer link lets that retailer receive the request and information in that link; it does not give the retailer unrestricted access to your COOKIT account.

We may use or disclose relevant information where required or authorised by law, to respond to a lawful regulatory or court request, to address a serious safety threat, or to investigate fraud, abuse or a dispute where the law permits. Support and administration access is limited to people authorised for the relevant work; it is not general public access. Content shared with another person may be copied or kept by that person outside COOKIT, so choose your audience and pickup details carefully.

COOKIT is operated from Australia. Our primary Supabase database, authentication, file storage and Edge Functions are hosted in AWS Asia Pacific (Singapore), region ap-southeast-1. Selecting New Zealand as your country does not move those records to New Zealand.

If you use subscription services, RevenueCat states that customer data is sent to AWS data centres in the United States. Apple, Google and any enabled payment gateway may also process relevant purchase, notification or billing information internationally under their service arrangements. Cloudflare operates a distributed global delivery and security network. Consequently, limited provider, network, support or payment processing may occur outside Australia and Singapore, including in the United States.

We distinguish providers processing information on our behalf from services receiving information for their own purposes. Applicable overseas-transfer requirements continue to apply; this policy is not a blanket waiver of your rights. Contact us for more information about relevant providers and destinations. We will update this policy as arrangements change.

We use account authentication, access restrictions and transport security to protect personal information, and restrict administration according to role and purpose. No online service can guarantee absolute security. Use a strong password, protect your device and tell us promptly about suspected account misuse. Where a privacy breach meets a legal notification threshold, we will notify the relevant regulator and affected people as required.

We keep account, profile, date-of-birth, fridge, pantry, receipt and cooked-meal information while your account is active. If you request account deletion, you have seven days to cancel. After that period, we delete or de-identify this information unless a limited record is still reasonably needed for legal compliance, fraud prevention, safety, a dispute or transaction integrity. Removing the account-to-wallet link does not and cannot erase a transaction or record already confirmed on a public blockchain.

Financial records that COOKIT is required to retain under the Corporations Act are kept for at least seven years after the relevant transaction is complete. Exchange, Fresh Points, safety, moderation, dispute and fraud-prevention records may be retained for up to seven years after the relevant activity or matter is closed where reasonably necessary, and are then deleted or de-identified unless Australian law or a court or tribunal order requires longer retention.

Deletion is subject to operational processing, limited lawful holds and provider backup lifecycles; it does not mean every backup or record held independently by another member, payment provider or public blockchain disappears immediately. Retention must remain tied to a lawful purpose rather than keeping all information indefinitely.

You can change profile and preference information in the app and request an export or account deletion through Settings. You can also contact [email protected]. Tell us what you need and the account concerned, but do not email a password, authentication code or unnecessary identity documents. We may request reasonable evidence that the information belongs to you.

We respond within the period required by applicable law. For Australian requests, we aim to respond within 30 days. Where the New Zealand Privacy Act applies, access and correction decisions are generally due within 20 working days, subject to lawful extensions. We will explain a refusal or limitation and available complaint options, unless the law permits otherwise. We may redact another person's information or withhold material where a lawful exception applies. If we decline a correction, you can ask us to associate a statement of your requested correction with the record where the law provides that right.

Account deletion is not an unconditional right to erase every record. We explain relevant retention limits above. There is no charge to make a privacy request; if a lawful access charge would apply, we will explain it before proceeding.

The owner currently handles privacy enquiries for Cookit Technologies Pty Ltd. Contact [email protected] or write to the business address shown above. Explain your concern and preferred contact method. We will acknowledge it, investigate relevant records, seek any necessary clarification and provide an outcome. We aim to respond within 30 days and will tell you if more time is needed.

If you remain dissatisfied, you can contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints. Where New Zealand privacy law applies, you can contact the Office of the Privacy Commissioner at https://www.privacy.org.nz/your-rights/making-a-complaint/. These avenues are subject to the relevant regulator's jurisdiction and complaint requirements.

We publish the current policy at https://cookit.food/privacy with its effective date and version. We will draw material changes to your attention through an appropriate service notice. Where a change requires fresh consent, publishing a revised policy alone does not replace that consent. You can request a copy of this policy or help accessing it by contacting our privacy contact.