Privacy policy

Effective 30 September 2026

Kitchen Squirrel is a household recipe, meal-planning and shopping app. This page says what the app and this website collect, why, who can see it, how long it is kept, and what you can ask us to do. We show no adverts and never sell your data.

Who we are

Kitchen Squirrel is run by Telescope Investing Ltd, a company registered in England and Wales, company number 13821866, registered office The Coach House, Dartford Road, Bexley DA5 2AS, United Kingdom. We decide how your data is used, which makes us its "controller" under UK data protection law. For anything on this page, email [email protected].

What we collect

• Your account — your email address (we email you a code to sign in), your display name (your household sees it; if you don't set one we use the first part of your email), your household's name, your role in it, when you joined and when you last used the app.
• What your household adds — recipes and your edits to them, notes, cookbooks, meal plans, dinner votes, shopping lists and trips, regular items, cooking history, ratings and their notes, favourites, leftovers, and settings such as cook nights, reminder times and your shop's aisle order.
• Recipes you capture — when you save a web link, our server fetches the page and keeps the recipe as structured data with a link back to the original. When you paste text or share a PDF, photo or screenshot, we read the recipe from it. Photos are shrunk on your phone first, which removes location and camera details. The photo itself is not kept once the recipe has been read, unless you choose to keep a picture of the dish from it (see the next item).
• The text we read — each time we read a recipe, we keep a copy of the text we read it from: what you pasted, the text of a PDF or web page, or the recipe as we read it from a photo. If you don't save the recipe, the copy of your own text, PDF or photo reading is deleted within about a day. If you do save it, we keep it with the recipe, so we can spot a recipe you already have and read it again with better tools, and it is deleted with your household. The text of a web page is kept as our copy of that page. Pasted text can include anything you copied with the recipe, such as names in a chat, so paste only the recipe where you can.
• Photos you add to recipes — your own photo, or a dish picture you chose to keep from a screenshot, is stored so your household can see it. It is stored at a web address that can't be guessed, and the app only shows it inside your household. Anyone who has that address could open it. Any member who can edit can remove it. Removing it deletes the file, though copies can stay in caches for a short time.
• Invitations — if you invite someone by email, we hold their address to send the invitation. If they don't join, it is deleted a day after the invitation expires, which is 14 days after it was sent.
• Reports — if you report something, we keep the reason, anything you write, your name and household's name, and a copy of what was reported at the time.
• Purchases — if you buy Pro, the store tells us which plan, when it runs until, and the store's transaction details, price and country. We never see your card details.
• Your phone — a push notification token if you allow notifications, and your app version, platform and update id.
• Measurements — how long the app took to open, sync and capture a recipe, and counts of which features were used. These are stored against your household, not your name. Each recipe capture also records who started it and the recipe's website. When one fails, we also record the link, so we can fix the problem and let you know.
• Crash reports — if the app crashes, a report with your phone's model, its operating system, the app version and the error. No account details or recipe content.

How we use it, and why we're allowed to

• To run the app you signed up for: signing you in, syncing your household between phones, reading recipes, building shopping lists, share links, notifications and Pro. The legal basis is our contract with you.
• To keep it working and safe: logs, limits against abuse, backups, crash reports, checking shared links, and dealing with reports. The legal basis is our legitimate interest in running a reliable, safe service.
• To improve it: the measurements above. There is no switch in the app to turn these off, but you can object by emailing us. Legitimate interests again.
• To contact you about your account, a report, or a capture that failed. We don't send marketing email. Legitimate interests.
• To keep financial records of purchases, because the law requires it. The legal basis is legal obligation.

There is no advertising, no tracking for advertising, and no sale of personal data.

Who can see what

• Your household sees everything your household holds: recipes, notes, photos, plans and lists. Your name is shown next to your ratings, notes and votes. View-only members can see all of this but can't change it.
• Other households see nothing of yours, except through a share link you choose to send and through Discover (both below).
• Us. We can see account and household data, including recipes, notes and photos, through a protected admin tool. We look only to run the service: fixing captures and ingredient matches, dealing with reports and support, and keeping it secure. Our actions there are logged. Our own emails about reports and activity name households.
• Our service providers, for the jobs listed below.

Discover

When a household saves a recipe from a web link, including a public social media post, the recipe's public source details can appear in Discover: its title, link, picture link, times, servings, tags and the creator's name on the source website. Never your notes, edits, photos or ingredients. Recipes you type in or capture from a photo or pasted text never get a listing of their own, though one that links to a page already in Discover counts towards that listing's totals. Discover shows totals across households: how many kitchens saved a recipe, how many cooked it, and its average rating. No names or notes are shown.

Share links

A recipe you share from the app can be sent as a link to a page on kitchensquirrel.com. The link carries only the public details of the recipe's source — its original title, cooking times, servings, the website and the creator's name there — a link to the original, and a card image the app makes from those details. It never carries your edits, notes, photos or ratings, and neither the page nor the app says who shared it. A recipe you typed in yourself or captured from a photo gets no page of its own. Unless it links to a web page already in Discover, its card is sent from your phone instead.

We record which recipe each link points to, when it was made, which account made it and its card image, so that a link can be switched off and a report dealt with. That record is never shown to anyone who opens the link. A link keeps working until we switch it off, take the recipe down, block its website, stop your household sharing, suspend the account that sent it or your household, or turn share links off altogether, or until your household is deleted. Removing the recipe from your own household does not switch the link off. To switch one off, email us.

The page sets no cookies and has no advertising or tracking. We count how many times each link is made, opened and saved, as plain totals; nothing about who opened it is kept with the count. To stop the page being flooded, your IP address is used to limit how often it can be opened or reported. It is held in our server's working memory for that purpose only and is never written to a database or a log. Your browser type is checked to tell people from link-preview robots, and is not kept. Cloudflare, which serves the site, handles your IP address to deliver the page.

Anyone can use "Report this page" on a shared page. We keep the reason, anything written in the report and the recipe's details, so we can look into it; we do not record who sent it. We may take a page down, or stop a household sharing, after a report. When a link is sent to you, nothing is added to your library unless you choose to save it, and the app lets you report it or block shares from the household that sent it. If you block a household, we keep that choice until you undo it.

Before a link is made, the recipe's website name is checked with Cloudflare's family filter and against published lists of unsafe sites. Only the website's name is sent, to Cloudflare, for that check.

Pictures and links to other websites

We don't copy pictures from recipe websites. The app shows them straight from the original website, so that website can see your phone's IP address, just as when you visit it. "View original" opens the source website, which has its own privacy policy.

Service providers

These companies process data for us, only for the job named:

• Hetzner — the server that runs our app service, its logs and the nightly backups.
• Supabase — our database, which holds everything described above.
• Cloudflare — carries all traffic between the app and our server, hosts this website and its share pages, stores the photos you add and the share cards, holds the iPhone waiting list, and receives email sent to [email protected].
• Google — Google Play sells Pro and takes payment; Firebase Cloud Messaging delivers notifications to Android phones; Google Drive holds an off-site copy of our backups.
• Our email provider — holds the emails you send us at [email protected].
• OpenRouter, and the AI models it passes requests to (currently from Google and Anthropic) — reads recipes when our own rules can't: the text of a web page, text you paste, a PDF, or a photo or screenshot, which is sent as an image and may show anything else on it, such as names in a chat. It also estimates macros from a recipe's title, servings and ingredients, matches ingredient lines to our ingredient list, and suggests swaps for a single ingredient. We never send your email or account details.
• RevenueCat — records Pro purchases against an internal account number, not your name or email.
• Expo — delivers app updates, and passes notifications to Google (and to Apple on iPhone). A notification's text can include a household member's name and a recipe title.
• Resend — sends sign-in codes and invitations (an invitation names the person who invited you and their household), and our own notices about reports, activity and faults, which can include household names and report text.
• Sentry — crash reports, as described above.
• Apple — on iPhone, when that app is available: notifications, and App Store payments.

Data travelling between your phone and our server is encrypted.

Where your data goes

Some of these providers are outside the UK, mainly in the United States. Where they are, we rely on the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for providers certified under it) or on the UK's International Data Transfer Agreement or Addendum, which bind the provider to protect your data to UK standards.

Permissions on your phone

• Camera and photos — only the pictures you choose to take or share.
• Contacts (Android) — asked for only when you tap "Choose from contacts". Only the email address you pick goes into the invitation; nothing else is read or kept.
• Notifications — optional. You can turn them off in your phone's settings.

The app keeps a copy of your household's data on your phone so it works offline. Uninstalling the app removes it. The home-screen widget, if you add one, shows tonight's dinner and what's left to buy to anyone who can see your screen.

Logs and IP addresses

Our server keeps short technical logs of the requests it receives. They record the address asked for and the result, not your IP address. The exception is when someone asks for too many sign-in codes, or tries to get into our admin tool: then that IP address is logged. The logs are overwritten as new ones come in, and errors from them are emailed to us. Otherwise your IP address is used only in working memory, to limit repeated sign-in attempts and share-page requests. Cloudflare handles it to deliver traffic.

This website

kitchensquirrel.com sets no cookies, runs no analytics and loads nothing from other companies. If you join the iPhone waiting list, we keep your email address, when you joined, the address of the page you were on and your rough country, only to tell you when the iPhone app is out. Your browser also remembers the address so the form knows you've joined. We delete the list once we've told you, or sooner if you ask. The basis is your consent, which you can withdraw by emailing us.

How long we keep it

• Your account and household's data: while your account and household exist.
• Recipes you remove, and any photo on them: hidden at once, but kept, so we can bring one back if you ask, until your household is deleted. Email us if you want one erased sooner.
• Sign-in codes: deleted a day after they are used or expire.
• Invitations nobody accepted: deleted a day after they expire.
• Working copies of a capture request: what you sent is removed as soon as we start reading it; the rest of the request is deleted within about eight days.
• The text we read for a capture: deleted within about a day if you don't save the recipe; kept with the recipe if you do, and deleted with your household.
• Performance timings: 180 days.
• Feature counts: kept, but your id and any link are removed when you delete your account.
• Reports: kept as a record of what was reported and what we did.
• Share link records: until the link's household is deleted.
• Crash reports: deleted automatically by our crash-reporting provider after a limited period.
• Backups: daily copies for 30 days (40 days for the off-site copy), monthly copies for about 13 months, and our database provider keeps its own copies for a short period. They are used only to recover from a failure.
• Purchase records: kept as financial records, which the law requires for at least six years.
• A log of actions we take in our admin tool, such as deleting an account: kept indefinitely as a security record.

Deleting your account

Follow the steps on our delete account page, or email [email protected] from the address you sign in with. We confirm by reply and delete within 30 days.

• If others remain in your household, we delete your email, name, sign-in records, ratings and their notes, favourites and notification tokens. The household's recipes, plans and lists stay with the other members; things you added stay without your name. If you are the only Manager, make someone else Manager first.
• If you are the last member, we delete the whole household: recipes, photos, plans, lists, cookbooks, history, share links, and the text we read for the recipes it saved.

What we keep, and why:

• Purchase records, as financial records (see above).
• The admin log entry for the deletion, which includes your email address, as a security record of what we did.
• Records of what our AI provider was used for and cost, which hold no content.
• Reports, with the copy of what was reported at the time, as a record of what we did. If others remain in your household, that includes reports you made and ones about something you wrote, which can show your name. If you are the last member, the reports your household made go with it; reports others made about its share links are kept.
• The text we read for captures that aren't behind a saved recipe, which isn't linked to you (see above).
• Discover's public source details and anonymous totals, which don't identify you.
• Backups, until they age out (about 13 months at most).
• Outside our database: RevenueCat's purchase record (email us and we'll delete it too), crash reports until they expire, email delivery logs, our own emails about reports, and emails between you and us.

Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play first.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit what we do with it, to object to how we use it, or to send it to you in a form another service can read. Email [email protected] from the address you sign in with. We reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd like the chance to put it right first.

Children and younger members

You must be 18 or over to start a household. Someone younger may use Kitchen Squirrel only in a household an adult has invited them into, and must be at least 13. The adult who invites them is responsible for their use of it. If you think we hold data about a child who shouldn't be using the app, email us and we'll delete it.

Changes

If this policy changes, the date above will be updated and this page will always hold the current version. If a change matters to how your data is used, we'll also tell you in the app or by email before it takes effect. Our terms of use cover the rest of how the app works.