Privacy Policy

Cooka (“we”, “us”) is operated by Cooka, which is the controller of the personal data described here. This policy explains what we collect when you use the Cooka app and website (the “Service”), why, who receives it, and your rights. It complies with the Brazilian General Data Protection Law (LGPD, Lei 13.709/2018) and, for people in the European Economic Area and the UK, the GDPR. Contact for all privacy matters: legal.support@cooka.app.

• Account data: your name, email address, sign-in method, and, if you sign in with Google, the basic profile Google shares with us (see section 3). We never receive your Google password.
• Preferences: interface language, units of measure, theme, and the languages in which your kitchen’s recipes are written.
• Optional profile details: gender and date of birth, if you choose to provide them in the app. They are visible only to you, are not shown to other members of your kitchen, and are never sent to analytics as raw values (only a gender category and an age band, and only with your analytics consent).
• Content you create: recipes, links, photos and text you submit, images you upload, books, weekly plans, shopping lists, and your kitchen’s name and members.
• Acceptance records: which version of the Terms you accepted, when, and your analytics choice.
• Usage and device data: standard technical logs (IP address, browser, timestamps) kept by our hosting and database providers for security and operation; and, only if you consent, product analytics (section 5).

Other members of your kitchen can see your name, email address and the content in the kitchen. Do not invite people you do not want to see them.

If you choose “Continue with Google”, we ask Google only for the basic scopes openid, email and profile. We receive your name, email address and profile picture identifier. We use them solely to create and identify your account, show your name in your kitchen, and contact you about your account.

We do not request access to your Google Drive, Gmail, Calendar, contacts or any other Google service, we do not sell this data, we do not use it for advertising, and we do not share it with third parties except the processors listed below that run the Service for us. Cooka’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can revoke Cooka’s access at any time in your Google Account settings, and ask us to delete your account at legal.support@cooka.app.

• To provide the Service (create your account, store and structure your recipes, plan your week, build shopping lists, share with your kitchen) — performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• To keep the Service secure, prevent abuse, handle IP complaints and enforce our Terms — legitimate interests and compliance with legal obligations (LGPD art. 7, II and IX; GDPR art. 6(1)(c)–(f)).
• To exercise and defend our rights, including keeping a record of your acceptance of the Terms — legitimate interests and regular exercise of rights (LGPD art. 7, VI and IX).
• To improve the Service through product analytics — only with your consent (LGPD art. 7, I; GDPR art. 6(1)(a)), which you can refuse or withdraw at any time without losing access to anything.
• To develop and improve our features and AI-assisted functions using the content you add, as described in the Terms (section 4) — legitimate interests, with aggregation or de-identification where feasible.

Product analytics (PostHog, hosted in the EU) are off by default. They run only if you tick the analytics option when you sign up or accept the Terms, or switch it on later in Profile › Preferences. With your consent we record product events (for example “recipe added”, with technical values such as the source type) linked to a pseudonymous account ID and your kitchen ID. We do not send the content of your recipes, your name or your email address to analytics. You can withdraw consent at any time in the same place; we then stop collecting and reset the analytics identifier in your browser.

We also use Vercel Web Analytics and Speed Insights, which measure aggregate page performance and visits without cookies or cross-site tracking.

Strictly necessary storage: sign-in session cookies (Supabase), a language cookie (NEXT_LOCALE), a theme cookie (cooka-theme), and local storage for your running cooking timers (cooka-timers). These are needed for the Service to work and for your settings, and do not require consent.

We do not sell personal data. We share it only with service providers that process it for us, under contracts that require appropriate protection:

• Supabase (database, authentication, file storage, realtime) — data hosted in the EU (Ireland);
• Vercel (hosting, serverless functions in Dublin, privacy-friendly analytics and performance measurement);
• OpenAI (AI processing): the text, page content, video transcripts or photos you ask us to turn into a recipe, and a recipe title and ingredients to generate a cover illustration, are sent to OpenAI for that purpose only;
• PostHog (EU cloud) — product analytics, only with your consent;
• Google — sign-in, and YouTube for videos you link; and
• professional advisers, authorities or a buyer of the business where required by law or a corporate transaction.

Some of these providers process data outside Brazil and the EEA (for example in the United States). Where this happens we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions, as permitted by the LGPD (art. 33) and the GDPR (Chapter V).

We keep your account and content while your account is active. When you ask us to delete your account we delete or de-identify your personal data within the period required by law, except what we must or may keep (for example records needed for legal compliance, to resolve disputes or to defend our rights), routine backups for a limited time, copies other users saved through sharing, and data already aggregated or de-identified. Acceptance records are deleted with your account.

Under the LGPD (art. 18) and, where applicable, the GDPR, you may ask us to confirm that we process your data; access it; correct it; anonymise, block or delete unnecessary or unlawfully processed data; receive it in a portable format; learn with whom we share it; withdraw consent; object to processing based on legitimate interests; and review decisions. Email legal.support@cooka.app from your account address and we will respond within the legal deadlines. You can also complain to the Brazilian National Data Protection Authority (ANPD) or your local supervisory authority.

At present, account deletion and data export are handled by email rather than inside the app.

The Service is a general-audience cooking tool and has no minimum age. We process the data of children and teenagers in their best interest, and we only knowingly create accounts for children under the age of digital consent with the involvement of a parent or guardian, who can contact us at legal.support@cooka.app to review or delete the account. We do not use children’s data for advertising.

We use access controls (including database row-level security so that each kitchen sees only its own data), encryption in transit, and limited-access credentials. No system is perfectly secure; if a security incident affects your personal data we will notify you and the authorities as required by law.

We may update this policy. For material changes we will update the date of the Terms version and ask you to accept again. The current version is always available at the link in the app and on our website.