Privacy Policy

1. Information You Provide

• Account: email address and password, or, if you sign in with Google or Apple, the email and name those providers share with us.
• Profile: display name, avatar photo, bio, and up to three featured recipes — visible to your friends, and (name/avatar/bio only) to members of any cookbook you share.
• Content you create: recipes, ingredients and steps, photos you add to a recipe, meal plan entries, grocery lists, collections, cookbooks, likes, chat messages, and notification preferences.
• Friend connections: made by scanning or exchanging a short-lived code with another user — we do not access your contacts.
• Support requests: anything you send to [email protected].

2. Information Collected Automatically

• Device push token: a Firebase Cloud Messaging identifier used to deliver notifications you've opted into (a friend liked your recipe, a cookbook you belong to changed, a new chat message), removed automatically once it's no longer valid.
• Product analytics: we use PostHog to understand how the App is used — screens viewed, features used, app version, device/OS type, and general performance metrics. These events are linked to your account identifier so we can tell repeat use from new use, but they never carry your recipes, photos, chat messages, email address, or name. We do not use PostHog for advertising or cross-app tracking.
• You can turn product analytics off at any time in Settings → Share usage data. Turning it off stops collection on that device, including at launch — the App starts up with analytics disabled rather than sending events and going quiet afterward. Everything else in the App keeps working.
• We do not collect precise location, and we do not use advertising identifiers.

3. Information From Third Parties

• If you sign in with Google or Sign in with Apple, we receive the profile fields you authorize (typically email, and — for Apple, only on first sign-in — your name).
• Apple and Google tell RevenueCat, and RevenueCat tells us, whether your subscription entitlement is active. Neither Sous nor RevenueCat receives your card number or other payment details — that stays with Apple/Google as the merchant of record.
• If you extract a recipe from a YouTube link, we fetch that video's public title, description, and channel name from the YouTube Data API to help generate the recipe.

4. How We Use Information

We use the information above to: create and secure your account; provide the App's core features (saving, planning, and sharing recipes; grocery lists; chat); operate the friends and cookbook features you choose to use; send the notifications you've opted into; process AI recipe extraction/generation; verify and manage your subscription; respond to support requests; detect abuse and enforce our Terms of Service; and, once implemented, understand product usage through PostHog to improve the App.

5. AI Processing of Your Content

When you extract a recipe from a YouTube link, generate a recipe from a dish name, or use automatic grocery-aisle sorting, the relevant text (video metadata or, if needed, the public video itself; your typed dish name; or an ingredient name) is sent to Google's Gemini API to produce a result. We do not send your email, name, or other account identifiers as part of these requests. This processing is subject to Google's own API data-use terms.

6. How We Share Information

We share information only as follows:

• With other users, as you direct — a friend or cookbook member sees the profile fields, recipes, and messages you choose to share with them.
• With service providers who process data on our behalf: Supabase (database, authentication, file storage, and the server-side functions that power AI extraction and push delivery), Google (Sign-In, Gemini AI, YouTube Data API, Firebase Cloud Messaging), Apple (Sign in with Apple, App Store billing), RevenueCat (subscription entitlement checks), Resend (delivering account emails), and, once implemented, PostHog (product analytics).
• If required by law, legal process, or to protect the rights, safety, or property of Sous, our users, or the public.
• If Sous is involved in a merger, acquisition, or sale of assets, as part of that transaction, subject to this Policy continuing to apply to your information.

We do not sell your personal information, and we do not share it with third parties for their own advertising purposes.

7. Data Retention and Deletion

We keep your information for as long as your account is active. Deleting your account (Settings → Account → Delete Account) requires a fresh identity check and is immediate and permanent: your profile, recipes, meal plans, grocery lists, friendships, and messages are erased and cannot be recovered afterward — there is no grace period or reactivation window. Before deleting, you can export your recipes and collections from Settings → Export, and bring them into a new account later with Import; that export deliberately does not include friends, cookbooks, chat, or meal plan entries, since those describe relationships with other accounts that a file can't restore on its own.

One exception: product-analytics events already collected by PostHog are not erased by deleting your account. They record app usage (screens viewed, features used) against an account identifier — never your name, email, or anything you created — and once the account is gone that identifier no longer corresponds to a person we can look up. To have those events deleted too, email [email protected], ideally before you delete the account, while we can still match the identifier to your request.

8. Data Security

Data in transit and at rest with Supabase is encrypted. Access to your database records — recipes, meal plans, grocery lists, messages — is restricted by row-level security policies scoped to your account.

Uploaded files work differently, and it is worth being precise about it: recipe photos and profile avatars are served from a public storage bucket at long, randomly generated URLs. Anyone holding the exact URL for one of those files can open it without signing in, so they are protected by being unguessable rather than by an access check. We do not publish or index those URLs, but treat a photo you upload as shareable-by-link rather than strictly private.

Your session is stored on-device using the platform keychain/keystore, not plain storage. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

You can access and edit your profile, control per-category push notifications, turn off product analytics (Settings → Share usage data), export your recipes and collections, and delete your account at any time from within the App.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to access, correct, delete, restrict, or port your personal information, and to object to certain processing. If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and to opt out of any "sale" or "sharing" of it — rights that already reflect our practice, since we do not sell or share personal information. To exercise any of these rights, or if you cannot do so in-App, contact us at [email protected].

10. International Data Transfers

Sous and its service providers may process your information in countries other than the one you live in. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

11. Children's Privacy

The App is not directed at children under 13 (16 in the European Economic Area, the United Kingdom, and Switzerland), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

12. Third-Party Links

Recipes may link to their original source (for example, a YouTube video). Those third-party sites and services have their own privacy practices, which this Policy does not cover.

13. Changes to This Policy

We may update this Policy from time to time. If a change is material, we will notify you in the App or by email before it takes effect.

14. Contact Us

Privacy questions or requests: [email protected]. General support: [email protected].