Privacy Policy

Last updated: October 5, 2026

Vibe Cook ("we", "us") is operated by Zack Katsiroubas as a sole proprietor, based in Ontario, Canada. This policy explains what information Vibe Cook collects, why, who it's shared with, how long it's kept, and how to delete it.

Vibe Cook is offered to users in Canada and the United States.

1. Information we collect

Account information. When you create an account, we collect your email address through Supabase Authentication. If you sign in with Google, we receive the email address associated with your Google account. If you sign in with Apple, we receive the email address Apple gives us, which may be a private relay address if you choose "Hide My Email". We do not receive or store your password in plain text — authentication is handled by Supabase.

Kitchen profile. To make the app useful without you re-explaining yourself every time, we store:

• Your name (as you choose to enter it)
• Your kitchen equipment
• Ingredients or foods you never want suggested ("no-go" list) — this is where allergy and medical-diet information would be entered if you choose to enter it, and the app asks for your consent before you can add anything to it or to your diet (see our Consumer Health Data Policy)
• Standing ingredient substitutions ("swaps")
• Your diet (e.g. vegetarian, gluten-free — as free text you provide)
• Spice level and cooking skill/detail-level preferences

Saved recipes. When you save a recipe from a chat, we store its title, the collection you filed it in, its ingredients and steps, your rating, when you last cooked it and how many times, and the recipe text itself.

Recipe photos. If you choose to, you can add one photo to a saved recipe — a picture of the dish you cooked. You take it with the camera or pick it from your photo library; the app only opens either one when you tap "Add a photo," and only the one photo you choose leaves your phone. Before uploading, the app re-saves the photo at a smaller size, which also removes the hidden details a camera embeds in a photo, such as where it was taken. Your photos are private to your account: no other user can see them, and they are not sent to OpenAI or any other company except Supabase, which stores them. Adding a new photo to a recipe replaces and deletes the old one. Adding photos is entirely optional.

Chat messages. When you chat with Vibe Cook, your messages are sent to OpenAI to generate a response (see "Third parties" below). We also store your recent chats in our own database so you can reopen or delete them in Settings → Recent chats, and so Vibe Cook can offer back a recipe you cooked but never saved: your messages, the replies, the recipe that was on screen, and whether you saved it to your cookbook. We keep your 50 most recent chats; older ones are deleted automatically. You can delete any chat yourself at any time.

Voice input. If you use the microphone to dictate a message, your speech is turned into text by Apple's speech recognition. On iPhones that support it, this happens entirely on your phone. On others, Apple processes the audio under its own privacy policy. We never receive or store the audio, only the text you then send.

Subscription and purchase information. If you start a free trial or subscribe to Full Kitchen Access, Apple processes the payment. We never see your card or payment details. We receive and store your subscription's status (for example, on a free trial, active, or ended), which plan you chose, when the current period ends, and whether it was a real or a test (sandbox) purchase. Our subscription service provider, RevenueCat, receives your purchase history from Apple (see "Third parties" below).

Free chat allowance. Without a subscription, you get two free chats a week. To enforce that, we store which chats were your free ones, when the week started, and how many of each chat's messages you've used.

Usage and security records. Each time the app asks OpenAI for a reply on your behalf, we record the time, the amount of text processed (measured in "tokens"), and which AI model was used. We use these records to apply usage limits and to understand our costs. To stop abuse of the service from a single location, we also store a scrambled, one-way version (a salted hash) of the IP address each chat request came from. We never store the IP address itself, and the hash can't be turned back into it.

Notifications. If you ask Vibe Cook to remind you before your free trial ends, or if notifications are on when your yearly plan is about to renew, the reminder is scheduled on your phone by iOS. We don't collect a notification token or send push notifications from a server.

What is not collected. Vibe Cook does not use analytics or crash-reporting tools, does not use advertising SDKs, does not track you across other companies' apps or websites, and does not sell your data to anyone.

2. Why we collect it

We use this information solely to operate the app: to authenticate you, to remember your kitchen setup and preferences so the chat can give you relevant answers, to store recipes you save, to generate chat responses, to know whether you have Full Kitchen Access, to apply the free allowance and usage limits, and to protect the service from abuse.

3. Who we share it with

We share information with the following third-party service providers, each of whom processes it only to provide their service to us:

Cross-border disclosure notice (Quebec Law 25): Your chat messages and profile information are sent to OpenAI, and your purchase history to RevenueCat, both of which process data in the United States. This means your personal information is transferred outside Quebec and Canada. We only send what's needed: to OpenAI, what's needed to generate a response; to RevenueCat, what's needed to check your subscription. By using the chat feature, or by subscribing, you consent to this transfer.

Content delivery network. The app loads a software library (@supabase/supabase-js) from a third-party content delivery network (jsDelivr) each time it starts. This means jsDelivr's servers receive a request from your device, which typically includes your IP address, in the same way any website visit would. This is standard practice for web-based apps and is not something we can disable without hosting the library ourselves.

We do not sell your personal information to anyone, and we do not share it for advertising purposes.

4. How long we keep it

We keep your account information, kitchen profile, saved recipes and their photos, subscription status, free chat allowance, and usage records for as long as your account exists. We keep your 50 most recent chats; when you start a 51st, the oldest is deleted automatically, and you can delete any chat sooner yourself. A separate log of recent chat attempts, which holds only the scrambled IP value and a time, is deleted after 25 hours.

If you delete your account, all of this data is deleted, and we also ask RevenueCat to delete its record of your purchases (see "Deleting your data" below). Apple keeps its own record of your purchases under its own policies. We do not control how long OpenAI retains chat messages sent to it — see OpenAI's own data usage and retention policies for their API.

5. Your rights and choices

Access and correction. You can view and edit your kitchen profile at any time in the "My Kitchen" screen, view and manage your saved recipes and their photos in "My Cookbook," view your recent chats in Settings → Recent chats, and see your subscription in Settings → Subscription. Settings is in My Kitchen, under "Account & more."

Deletion. You can delete a single chat by tapping the trash icon next to it in Settings → Recent chats. Deleting a saved recipe also deletes its photo. You can permanently delete your account from Settings → Delete account. This immediately and irreversibly deletes your account, your kitchen profile, your chats, every saved recipe and recipe photo, your subscription status, and your usage records, and asks RevenueCat to delete your purchase history. This cannot be undone. Deleting your account does not cancel a Full Kitchen Access subscription. Cancel it with Apple (iPhone Settings → your name → Subscriptions) so you aren't charged again.

Data portability (known gap). At this time, Vibe Cook does not offer a self-serve tool to export a copy of your data before deleting it. If you would like a copy of your data, contact us at the address below and we will provide it manually. Building an automated export tool is tracked as upcoming work — see docs/legal/status.md.

Opting out of sale. We do not sell personal information, and we do not share it for targeted advertising, so there is nothing to opt out of. We are stating this explicitly to satisfy applicable "right to opt out of sale" requirements even though the underlying practice does not occur.

Withdrawing consent. You may withdraw your consent to our processing of your information at any time by deleting your account. Because chat responses require sending your message to OpenAI, you cannot use the chat feature while withholding that specific consent — the alternative is not sending a message.

6. Children's privacy

Vibe Cook is not directed at children and is not intended for use by anyone under the age of 13. We do not knowingly collect information from anyone under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

7. Legal basis and your privacy rights (Canada / PIPEDA / Quebec Law 25)

We collect and use your information based on your consent, given when you create an account and again whenever you use a feature (like chat or a subscription) that involves sharing data with a third party. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us or deleting your account.

If you are a Quebec resident, you have rights under Quebec's Act respecting the protection of personal information in the private sector (Law 25), including the right to access and correct your personal information and to be informed of automated decision-making (Vibe Cook does not use automated decision-making that produces legal or similarly significant effects on you).

8. If you live in the United States

Wherever you live in the United States, you can ask us to tell you what personal information we hold about you, to give you a copy, to correct it, or to delete it. Most of this you can do yourself in the app (see "Your rights and choices" above); for anything else, email us at the address below. We'll respond within 45 days, and we won't treat you differently for making a request. We may need to confirm the request comes from your account's email address before acting on it.

The categories of personal information we collect are the ones listed in "Information we collect": identifiers (your email and a random account ID), the content you give us (your kitchen profile, recipes, and chats), purchase history, and usage records. We collect them only from you and from the services listed in "Who we share it with", use them only for the purposes in "Why we collect it", and disclose them only to those service providers. We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months.

Your kitchen profile may include information about allergies or medical diets, if you choose to enter it. The app asks for your consent before you can add any, we use it only to tailor recipe suggestions to you, and we never sell it or use it for advertising. Our separate Consumer Health Data Policy (in the app under Settings → About, and on our website) explains how we handle it under the health-data laws of Washington, Nevada and Connecticut.

9. Our Privacy Officer

Under Canadian privacy law, we've designated a Privacy Officer responsible for our compliance with this policy:

Zack Katsiroubas
Email: vibecook.official.toronto@gmail.com

10. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top and, where required, provide additional notice.

11. Contact us

Questions about this policy or your data can be sent to vibecook.official.toronto@gmail.com.

This is written to be accurate to the app's actual behavior.