Privacy Policy: a quiet counter

At a quiet counter, we respect your privacy. This Privacy Policy explains what personal information we collect, how we use it, and your rights in relation to it. We operate under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information We Collect

Information you provide directly

Account data: Your email address and your name when you register. Passwords are hashed and managed entirely by Google Firebase Authentication; we never see or store your plaintext password.
Using the app as a guest: You can use the app without registering. We then create a guest account that has no email address or name, only an internal account number, and keep what you make in it the same way as for any account. You can make it a full account at any time without losing anything. A guest account cannot be opened again after you sign out of it, and a guest account that has not been opened for 60 days is deleted together with everything in it, unless it holds a PLUS subscription.
Profile preferences: Your hemisphere/region, dietary preferences, household size, pantry exceptions, nutritional baseline (age, sex, weight, height, activity level), and onboarding responses.
Household people: The names and usual portion sizes of the people you cook for, and a photo of each if you add one. These can include people without an account, such as children; they are used only to size meals and share figures within your household.
Time zone: Your device's time zone, so that days, reminders and meal times line up with where you are.
App content: Recipes you import, create, or edit; weekly meal plans; grocery lists; cook notes; and library organisation choices.
Audio and visual inputs: If you use recipe photo reading, Snap-a-Meal, meal descriptions, Voice Import or video import, you provide photos, text, or temporary microphone audio. We ask your permission before any of this is sent to Google's AI services, and you can withdraw it at any time in Settings, under Preferences. Audio is processed in-memory only and is never stored on our servers after transcription.
Assistant conversations: If you use the Assistant chat, the messages you send and the replies you receive are saved to your own account so you can return to a conversation later. They are private to you, are never shown to other users, and are automatically deleted after 30 days. The one exception is if you choose to report a bad answer and separately agree to include the conversation: see 'Reporting a bad answer' below. See Section 5 for the commitment that they are also never used in any aggregated or commercial dataset.

Reporting a bad answer

If you rate an Assistant reply with a thumbs down, we receive the rating, the reason you chose, anything you typed in the report, and the reply itself. If, and only if, you separately agree to it, we also receive the messages in that conversation and a record of which of the Assistant’s tools it chose for them.

We do not receive your nutrition figures, your meal plan, your recipe library, or your grocery list, even when you have agreed to share the conversation. Those are stripped before the report leaves your device. You can withdraw your agreement at any time: the report window always shows your current choice, and switching it off there stops that report and any future report from including your conversation. Reports are used only to find and fix faults in the Assistant. They are never aggregated, licensed, sold, or used to train or evaluate a model, and they are deleted when you delete your account.

Information collected automatically

Usage analytics: We log anonymised interaction events (e.g., features opened, import method used) via Google Firebase Analytics (GA4) to improve the Service. These events do not contain recipe content or personally identifiable information. Usage analytics is off until you agree to it: the app asks you once, in your Library, and you can change your answer at any time in Settings, under Preferences ('Share usage analytics'). While it is off, no analytics events are sent from that device or any device you sign in to.
Cooking analytics on creator recipes: When you cook a recipe published by a Partner Creator using Cook Mode, we log which steps you view and how long you spend on them, in addition to the planning and shopping interactions we already log for every recipe. We collect this so the recipe's creator can see where cooks get stuck and which steps need clearer instructions; it helps them improve the recipe for everyone. The timing data is derived and aggregated on your device before it reaches our servers. We do not attach any per-user analytics identifier to it server-side, so it cannot be traced back to your account once received. It is combined with the same interactions from other households before anyone outside our engineering team sees it.
Crash reports: We use Sentry for error monitoring. Crash reports include device metadata (OS version, app version, device type) and your account's internal user ID, so we can find and fix a fault that affects your account. They never include recipe content, your email address or your name.
Local storage and IndexedDB: The app stores session state, offline recipe data (via Firestore offline cache), draft import data, and cover photos in your browser's local storage and IndexedDB. This data never leaves your device unless you explicitly save or sync it.
When you usually eat: If you leave the setting on, the app notes the times you log or mark meals cooked and keeps a typical time for each of breakfast, lunch and dinner on your own account. It is used only to fill in a time you have not set yourself, so the app can show the shape of your day without asking you questions. It is never shown to you as a finding about you, it is never shared with anyone including the other members of your household, and it is never used for analytics, research or advertising. You can switch it off at any time in Preferences, under Meal times.

2. How We Use Your Information

To provide and personalise the Service (meal planning, recipe import, nutrition targets, grocery lists, and the times of day your meals are shown at).
To manage your subscription entitlement via RevenueCat.
To improve the app through anonymised analytics and crash reports.
To operate shared features such as household plans and the Discover feed.
To understand, in de-identified aggregate form, how the Service is used (see Section 5). We do not sell your personal data or insights derived from it.
To send transactional communications (email verification, password reset); we do not send marketing emails unless you opt in.

3. Third-Party Processors

We share the minimum data necessary with the following third-party services to operate the Service. We use each only under terms that require it to protect your information to the same or an equal standard as this policy, and to use it only to provide its service to us.

Google Firebase (Auth, Firestore, Storage, Analytics, Hosting): Your account, profile, recipe library, and usage events are stored on Firebase infrastructure, operated by Google LLC in the United States.
Google Cloud Vision and Gemini AI: Only after you allow it, the photos, text, audio, messages and figures you give an AI feature are sent to Google's AI APIs to carry out that task. This covers reading recipe photos, recordings and videos, logging a meal from a photo or a description, meal ideas and suggestions, working out the nutrition of ingredients, and the Assistant, which may also send your planned meals and your nutrition figures for the week when a question needs them. We use Google's paid API service, under which Google processes this data to provide the service and does not use it to train its AI models. Audio is never retained after transcription. You can withdraw permission at any time in Settings, under Preferences; the features that need it then ask again before sending anything.
Sentry: Crash diagnostics, tagged with your account's internal user ID. No recipe content, email address or name is included in error reports.
RevenueCat: For a quiet counter PLUS subscribers, we share your internal account number (Firebase UID) and device platform identifier to verify and manage your subscription entitlement. We do not process or store your payment card details.
Supadata: When you import a recipe from a social video (e.g., Instagram, TikTok, YouTube), the video URL is sent to Supadata to retrieve captions or transcripts.
Open Food Facts: Barcode numbers and product search queries are sent to the Open Food Facts API to retrieve nutritional data. Open Food Facts is an open-database project operating under its own open licence.
TheMealDB and Brave Search: In-app recipe search queries are routed through these services to find matching recipes on the web.

Sharing with a third-party AI: Google's Gemini and Cloud Vision

Some features work by sending what you give them to an artificial intelligence service run by Google LLC (Gemini, and Cloud Vision for reading text in photos). We do not use any other AI company. Nothing of your own is sent until you have said yes. The first time you use one of these features, the app shows a screen that says what will be sent and that it goes to Google, with Allow and Not now buttons. On the features that use your camera, microphone or photo library, that screen comes before your phone asks for access, so nothing is captured for this purpose until you have agreed. Your answer covers all of the features below, and you can change it at any time in Settings, under Preferences.

One exception: recipes from public web pages and videos. When you import a recipe from a public web page, or save one you found with recipe search, the recipe's title, ingredient lines and method as published on that page are sent to Gemini to tidy them into your recipe, without asking first, because that text is published openly and is not your personal information. The same applies to the published captions of a public video recipe once you have saved it (importing the video itself asks first). If you later edit any recipe, your changes are only sent once you have said yes.

What is sent, for each feature, and why:

Reading a recipe photo: the photos of the recipe you take or choose. Used to read the recipe text and turn it into a recipe in your library.
Recording someone cooking: the audio recording you make. Used to write the recipe in the cook's own words. The recording is deleted as soon as the recipe is written and is never stored on our servers.
Importing a recipe from a video: the video's captions or spoken words (retrieved by Supadata, above). Used to write the recipe.
Pasting recipe text: the text you paste. Used to tidy it into a recipe.
Logging a meal from a photo or a description: the photo of your meal, or what you write about it. Used to work out what is on the plate and its nutrition.
Scanning ingredients: the photo of your ingredients. Used to list the ingredients it shows.
Meal ideas and research notes: the ingredients, dish, notes and preferences you choose. Used to suggest dishes and write the note.
The Assistant: your messages and, when a question needs them, your planned meals and this week's nutrition figures. Used to answer you.
Working in the background, only once you have said yes: the ingredient lines of a recipe you paste or photograph (to match them to our ingredient list), the ingredient names in a meal you log (to fill in their nutrition), and today's planned meals (to suggest something that would go well with them). If you have not said yes, these do not run, and the app carries on without them.

What is not sent. We never send Google your email address, your name, your password, your payment details or your account settings. A request carries only what the feature needs.

How Google may use it. We use Google's paid Gemini API and Cloud Vision services. Under Google's terms for paid use of these services (the Gemini API Additional Terms of Service and Google's data processing terms), Google processes this data only to carry out our request, does not use it to train or improve its AI models, and is bound to protect it to a standard at least equal to the one this policy sets out. Google may keep a request for a short time to detect abuse, as its terms allow. Google may not use it for advertising.

4. Shared Caches and Aggregate Features

Import caches: Successful URL and video recipe imports are stored in a shared global cache to speed up the Service for all users. Your personal identity is never attached to cached import results.
Discover feed counters: When you add or cook a recipe from the Discover feed, we increment aggregate counters ("times added," "times cooked") on that Creator's public analytics record. Your individual identity is never disclosed to Creators.
Social graph: Your list of followed or muted creators is stored privately on your account. Creators cannot see who follows them, and no follower counts are displayed anywhere in the app.
Creator and brand metrics: We compile aggregate metrics from planning, shopping, and cooking interactions with a creator's published recipes, such as how often a recipe is cooked again, how many households a recipe reaches, and (for Cook Mode) how households move through the steps. We compile these so creators can see what genuinely works in real kitchens and make their recipes better, and so brands can judge a partnership on real cooking rather than clicks. Creators, and brands running a paid deal with a creator, can see these metrics as statistics only. A statistic is only ever shown once at least approximately 25 households contribute to it; below that threshold, we show nothing rather than a number that could point back to a smaller group. No creator or brand ever sees your individual activity, your identity, or any list tied to your account.

5. Aggregate Insights, and No Sale of Data

We do not sell your data. We do not sell, rent or licence your personal data, or insights derived from it, to anyone. We may aggregate and de-identify behavioural and consumption data (such as ingredient trends, seasonal planning patterns, and grocery list compositions) to understand how the Service is used and to improve it.

Our anonymisation commitment: Any aggregate data is structurally stripped of all PII (names, email addresses, household codes, exact locations). Data is grouped into large statistical cohorts, making individual re-identification technologically infeasible. No third party receives data from which they could identify you.

Assistant conversations are excluded entirely. What you type into the Assistant chat is never included in any aggregated dataset, cohort, market-research product, or dataset used to train or evaluate a model, in any form, anonymised or otherwise. This is a stricter commitment than the one above: the rest of this section describes data we may aggregate, and your conversations are simply not part of it. This holds for a conversation you choose to send us in a bad-answer report as well: we read it to fix the fault, and it enters no dataset of any kind.

6. Data Storage, Security, and Retention

Your data is stored on Google Cloud Platform (Firebase) infrastructure, using industry-standard encryption in transit (TLS/HTTPS) and at rest. While we implement robust security controls, no internet transmission or electronic storage is completely secure.

Assistant conversations are kept for 30 days. Each conversation is automatically deleted 30 days after you last used it, whether or not you delete it yourself; you can also remove any conversation immediately from the chat history list. Deleting your account removes them along with everything else. A bad-answer report you have sent is kept separately from your chat history, so we can still act on it after the conversation itself has expired; deleting your account deletes those reports too.

Guest accounts are deleted, with everything in them, after 60 days without being opened, unless they hold a PLUS subscription. You can delete a guest account yourself at any time in Account settings.

We retain your personal data for as long as your account is active. If you delete your account, your Firebase profile, recipe library, nutrition history, Assistant conversations, and plan data are purged from active databases. Anonymised, de-identified aggregate data derived from your usage may be retained indefinitely as it cannot be traced back to you. Crash logs and analytics events are retained according to each processor's standard retention period (typically 90 days for Sentry; up to 14 months for GA4).

7. International Data Transfers

Your personal information is processed and stored on servers operated by Google LLC in the United States, and by other processors whose infrastructure may be located outside Australia. By using the Service, you consent to this transfer. We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.

8. Your Rights and Choices

Access: You can view your profile data and export a snapshot of your recipe library from within the app.
Correction: You can update your profile preferences and nutritional baseline at any time in Profile settings.
Connected apps: You can see every app or assistant you have connected, and disconnect any of them, under Profile, then Connected apps (see Section 11).
AI features and analytics: You can grant or withdraw permission to use Google's AI features, and turn usage analytics on or off, at any time in Settings, under Preferences.
Deletion: You may delete your account at any time in Settings, under Account (the Delete account option in the Danger zone). This permanently removes your personal data from our active systems.
Complaints: If you believe we have mishandled your personal information, please contact us first at [email protected]. If we cannot resolve your concern, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Creator metrics visibility: If you are a Partner Creator, your aggregate metrics (Section 4) are visible to you and, where applicable, to a brand you are running a paid deal with, by default. You can turn off the version shown to brands at any time in Partner Studio, under My public profile, in the Directory visibility setting. Turning this off removes the published aggregate figures at the next nightly refresh; it does not affect the private metrics you can still see about your own recipes, and it does not affect any household's underlying app data, which was never identifiable to begin with.

9. Children's Privacy

The Service is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you become aware that a child under 16 has provided us with personal information, please contact us at [email protected] and we will delete the account and data promptly. The app never works out a weight-loss calorie target for anyone under 18.

10. Cookies and Local Storage

We do not use third-party advertising cookies. The app uses browser-native storage mechanisms (localStorage and IndexedDB) to persist session state, offline data, and draft imports on your device. Firebase and Google Analytics may set first-party cookies for session management and anonymised analytics. You can clear this data at any time via your browser's storage settings.

11. Connected Apps and Assistants

With a quiet counter PLUS, you can connect an app or an AI assistant of your choosing (for example Claude or ChatGPT on your computer, or a fitness or coaching service) so that it can read your data and act on your behalf. Connecting is always your decision: it starts from the other app, you sign in to your account at a quiet counter on a consent screen we run, and you approve exactly what that app may do before it can do anything.

What a connected app can be given. You approve some or all of these, in these words, and nothing beyond them:

Read your saved recipes.
Read your meal plan, kitchen stock and grocery list.
Read your nutrition figures.
Add and remove items on your grocery list.
Schedule, move and remove meals on your plan.
Save new recipes to your library.
Log meals you have eaten.
Set your calorie and macro targets.

A connected app never receives your email address, your password, your subscription or billing details, your Assistant conversations, or any other person's data. If you are in a shared household, a connection you approve acts as you in the shared plan, in the same way you can.

Once data leaves us, it is theirs to govern. What a connected app does with the data you let it read is covered by that app's own privacy policy, not this one. Please read it before you approve a connection.

You are in control. Every connection is listed in the app under Profile, Connected apps, with what it may do and when it last used that access. You can disconnect any of them there at any time; disconnection takes effect within a minute and stops all future access. It cannot recall data the app has already read. If your PLUS subscription lapses, connected apps lose access automatically and regain it if you resubscribe, without reconnecting.

What we keep about a connection. The name of the app, what you approved, when you connected it and when it last used its access, and a count of how often it does, so we can stop a misbehaving app. We never sell, licence, aggregate or use for market research anything about your connections or anything a connected app reads or writes, over and above the commitments in Section 5, which apply unchanged.

12. Changes to This Policy

If we make material changes to how we handle your data (especially regarding third-party sharing or commercialisation), we will notify you via an in-app modal that requires explicit review before you can continue using the Service. The "Last Updated" date at the top of this policy reflects the date of the most recent revision.

Questions or concerns? Contact us at [email protected]