CookFrom — Privacy Policy

Last updated: 2026-09-04

Who this policy covers

This policy applies to the CookFrom mobile application ("the app"), developed by HomeLab. CookFrom helps you decide what to cook using ingredients you select, a photo of your ingredients, or a direct dish request.

Contact for privacy questions or data-deletion requests: support@homelabcore.dev.

Data we process, and where it goes

On your device (never leaves your device except as described below)

The app stores the following locally, on your device only:

• Recipes you generate or save, and your recipe history.
• Ingredients you add, edit, or mark as favorites.
• Your dietary preferences, allergies, and disliked ingredients — these are used only to shape the recipes the app suggests for you.
• Your selected app language and Home cuisine preference.
• A randomly generated device identifier (see "Device identifier" below).
• App settings such as your chosen AI model and whether you've enabled AI finished-dish photo generation.

We do not require you to create an account, and we do not collect your name, email address, or any other directly identifying information to use the app.

Sent to our server for AI processing

When you ask the app to recognize ingredients in a photo, or to generate a recipe, the relevant content — your photo and/or your text request and selected ingredients — is sent over an encrypted connection to our backend (a Cloudflare Worker we operate), which forwards it to Google's Gemini AI API to generate a response. The response is returned to your device and shown to you; it is not otherwise stored on our server.

Our backend logs only non-content technical metadata for abuse prevention and reliability, specifically: a timestamp, a hashed version of your device identifier, which AI model was used, whether the request succeeded, response time, request size in bytes, and rate-limit status. We do not log your photos, your prompts, the recipes generated for you, or any allergy/dietary information you entered.

Google processes the photo/prompt content you send as part of generating the AI response, under Google's own applicable terms for the Gemini API. We do not control how Google's infrastructure handles that processing beyond the request itself.

Device identifier

On first launch, the app generates a random identifier stored only on your device. It is sent with each AI request so our backend can apply fair-use rate limits and detect abuse. It is:

• not tied to your name, email, or any account;
• not advertising or tracking identifiers used for marketing;
• reset if you uninstall and reinstall the app.

Subscriptions and purchases

CookFrom Pro is an optional paid subscription, purchased through Google Play Billing (or activated with a redeemable code instead, with no purchase at all). If you subscribe:

• Google Play processes your payment directly — we never see or store your card details, billing address, or Google account information.
• After checkout, the app sends the purchase token Google Play hands it to our backend, which verifies that token directly with the Google Play Developer API before trusting it.
• We record the resulting subscription status (active, expired, or canceled), its expiry date, and the purchase token itself in our database (Cloudflare D1), keyed to your device identifier — never to your name or Google account.
• This record is used only to decide whether your device currently has Pro access; it is not used for any other purpose.
• If you cancel or your subscription lapses, our record is updated on your next check. See "Data retention and deletion" below for how long this record is kept.

Google's own Play Billing terms govern how Google itself processes your payment; we have no visibility into or control over that part.

Camera and photo library access

If you use the "recipe from photo" feature, the app requests access to your camera and/or photo library, only at the moment you choose to take or select a photo. The photo is used solely to identify ingredients for that one request and is not saved by us after the AI response is returned. The app may keep the photo temporarily in memory during the request; it is not uploaded anywhere except the one AI request described above.

Analytics

CookFrom does not currently collect or transmit any product analytics. If we introduce analytics in the future, it will be:

• explicit opt-in, disabled by default;
• limited to a documented, reviewed list of event types;
• never include your photos, prompts, generated recipes, custom ingredient names, allergies, or any household/personal identity information.

This policy will be updated, and the update dated, before any analytics collection is enabled.

What we do not do

• We do not sell your data.
• We do not show third-party advertising.
• We do not require an account or collect your name/email to use the app.
• We do not use your photos, prompts, or recipes to identify you personally.

Data retention and deletion

• Locally stored data (recipes, preferences, favorites, etc.) stays on your device until you delete it in the app or uninstall the app.
• You can delete individual saved recipes and custom ingredients directly in the app.
• Uninstalling the app removes all locally stored data and resets your device identifier.
• Backend request logs (the non-content metadata described above) are retained only as long as needed for abuse prevention and reliability, and do not contain content that could be linked back to a specific recipe, photo, or person.
• To request deletion of anything associated with your device identifier from our backend logs, contact us at support@homelabcore.dev — since the identifier is not linked to personal information, include the approximate date/time of use so we can locate relevant log entries.
• Subscription/purchase records (status, expiry, purchase token) are kept for as long as your device identifier has an active or recently-expired subscription, so Pro access is applied correctly on your next check; the same deletion-request process above covers them too.

Children

CookFrom is intended for a general audience and is not directed at children. We do not knowingly collect personal information from children.

Changes to this policy

We will update the "Last updated" date above whenever this policy changes, and — for material changes to how AI processing or logging works — describe the change in the app's release notes.

Third-party processors involved

• Google (Gemini API) — processes photos/text you submit for AI recipe/ingredient generation.
• Cloudflare — hosts the backend Worker that relays your request to Google and applies rate limiting, and hosts the database (D1) that stores your device identifier's rate-limit and subscription records; does not receive your photos/prompts for any purpose beyond the relay.
• Google Play Billing / Google Play Developer API — processes your CookFrom Pro subscription payment and reports purchase/subscription status to our backend for verification; we do not receive your payment details.

No other third party receives your content.