Privacy Policy

1. Who We Are and What This Policy Covers

This Privacy Policy explains how Danville Digital Labs, LLC ("we", "us", "our") collects, uses, shares and protects personal information when you use the ReadyGoCook mobile apps for Android and iOS, our website at ready-gocook.com (including recipe share links under /r/ and family invite links under /join/), and related support services (together, the "Service").

If you have a question about anything in this policy, email support@ready-gocook.com.

2. Information We Collect

2.1 Information You Provide

• Account information: your email address and display name; a phone number if you sign in by SMS code; and an optional ZIP code used for grocery delivery lookups.
• Sign-in provider information: if you sign in with Google, Apple or Facebook, we receive the identifier, email address and name the provider shares. Sign in with Apple's "Hide My Email" relay addresses are supported.
• Profile and cooking preferences: cuisine preferences, skill level, household size, dietary preferences and food allergies. Dietary preferences and allergies are optional. Because they can reveal health-related information, we treat them as sensitive: they are used only to filter recipes and to build your meal-plan requests (see Section 4.2), and you can remove them at any time. On Android they are synced to your cloud profile; on iOS they stay on your device and are sent only inside a meal-plan request.
• Your content: recipes, ingredients, instructions, notes, ratings, collections, pantry items and expiration dates, grocery lists, meal plans and cooking history. For Pro and Premium subscribers this content is synced to our cloud so it is available on your other devices and, if you use family sharing, to the members of your family group.
• Import material: the web links, social-media links, photos, videos, screenshots and pasted text you ask the app to turn into recipes or pantry items.
• Voice input: when you add pantry items by speaking, your device's speech recognizer converts your speech to text. On Android this is Google's speech recognition, which may run on the device or on Google's servers depending on your device. On iOS this is Apple's speech recognition, which runs on the device when your device supports it. We never receive or store raw audio. If the recognized text is ambiguous, the text (not the audio) may be sent to our AI processor to structure it into pantry items.
• Family sharing: the names and email addresses of family members are visible to everyone in the same family group.
• Creator attribution: when you import a recipe from a social network, we store the creator's public handle, display name and profile link with your copy of the recipe so you can credit them.
• Purchase information: subscription status and the transaction identifiers Apple or Google provide to verify a purchase. We never see or store card or bank details; payment is handled entirely by the App Store or Google Play.
• Support messages: anything you send us by email.
• Website sign-up form: the email address you enter to request early access on ready-gocook.com.

2.2 Information Collected Automatically

• Device and app information: device model, operating-system version, app version, language and time zone.
• Crash reports: stack traces and device state at the time of a crash, collected by Firebase Crashlytics and tied to a pseudonymous user identifier.
• Usage analytics: which screens and features are used, collected by Firebase Analytics with advertising personalization disabled. Analytics and crash reporting are on by default and can be turned off in Settings > Privacy in the app.
• Security and rate-limiting records: a keyed hash (HMAC-SHA256 with a rotating secret) of your IP address, kept for about 25 hours to limit abuse of our import and AI endpoints. We do not store raw IP addresses in our database.
• Import telemetry: the domain name of imported links and whether the import succeeded, stored as daily counters without your identity, for 120 days.
• Server logs: our cloud functions write operational logs to Google Cloud Logging. These logs may include your pseudonymous user identifier and are kept for 30 days.

2.3 Information from Third Parties

• Sign-in providers (Google, Apple, Facebook, phone carrier verification) as described above.
• Public content you import: when you import from a website or social network we, and the processors in Section 4, fetch the public page, caption, images or transcript at the link you provide.
• Instacart: when you export a grocery list, Instacart returns a shopping-list link. We do not receive your Instacart account details or order history.

We do not knowingly collect precise location, contacts, biometrics, or financial account numbers.

3. How and Why We Use Information

Purpose	Data used	Legal basis (EEA/UK users)
Create and secure your account; sign you in	Account and sign-in provider information	Performance of a contract
Import, parse and organize recipes; suggest what to cook; estimate nutrition; generate meal plans	Import material, your content, cooking preferences, dietary preferences and allergies	Performance of a contract; your explicit choice to enter optional dietary and allergy information
Sync your content across devices and share with your family group	Your content, family member details	Performance of a contract
Build grocery lists and open them at a delivery service	Grocery list items, ZIP code	Performance of a contract
Verify subscriptions and prevent billing fraud	Purchase information	Performance of a contract; legal obligation; legitimate interests
Keep the Service secure, limit abuse, debug problems	Hashed IP records, crash reports, server logs	Legitimate interests
Understand how features are used and improve them	Usage analytics	Legitimate interests; consent where local law requires it (you can opt out at any time)
Send you notifications you have enabled (expiration alerts, meal reminders, weekly digest)	Your content, notification settings	Performance of a contract; you control each notification type in Settings
Respond to support requests and legal notices	Support messages, account information	Legitimate interests; legal obligation

We do not use your information for advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects.

4. Third-Party Processors and Services

We share personal information only with the service providers below, only for the purposes stated, and under contracts that restrict how they may use it. We do not sell personal information and we do not share it for cross-context behavioral advertising.

4.1 Hosting and Infrastructure

• Google Firebase / Google Cloud Platform (United States): authentication, database (Cloud Firestore), cloud functions, crash reporting (Crashlytics), usage analytics (Firebase Analytics), server logging (Cloud Logging) and encrypted database backups. Google acts as our processor under the Google Cloud Data Processing Addendum.
• Google Play and Apple App Store: purchase verification and subscription-status notifications. Apple and Google are independent controllers of your store account.
• Cloudflare: hosts ready-gocook.com and provides bot protection and email-address obfuscation for the website. Cloudflare processes visitor IP addresses to deliver and protect the site.

4.2 AI Processing (Google Vertex AI)

Recipe parsing, "What can I cook", meal-plan generation, ingredient substitutions, nutrition estimates and voice-text structuring are performed by Google's Gemini models through Vertex AI, accessed by our servers under Google Cloud's enterprise terms. Under those terms Google does not use your prompts or outputs to train its models. The data sent depends on the feature: the link, caption, page text, photo, video or transcript you are importing; the pantry items and recipes needed for a suggestion; and, for meal plans, your dietary preferences and allergies so that the plan respects them. Requests may be routed through Vertex AI's global endpoints. Results are returned to your device and stored as your content; we do not keep the raw prompts beyond the cache described in Section 12.

4.3 Recipe Import Helpers

To read the link you paste we may use, on our servers, one of these specialized services. Each receives only the link and the public content at that link, processes it, and returns the result; none of them receives your account details.

• ScrapFly: fetches recipe web pages that block ordinary requests.
• ScrapeCreators: retrieves the public caption, images and creator handle of a social-media post.
• Supadata: retrieves the public transcript of a video.

4.4 Grocery Delivery (Instacart)

When you choose to export a grocery list, we send the list items and, if you have entered one, your ZIP code to Instacart so it can build a shopping list at a nearby retailer. From that point Instacart's own privacy policy and terms apply. Instacart, the Instacart logo and Instacart marks are trademarks of Maplebear Inc. d/b/a Instacart; ReadyGoCook is not affiliated with, endorsed by, or sponsored by Instacart. We currently do not integrate with any other grocery delivery service.

4.5 Sign-In Providers

• Google Sign-In and Sign in with Apple: authenticate you and share the identifier, name and email address you approve.
• Facebook Login (Meta Platforms): authenticates you and shares your name and email address. The Meta SDK is embedded in the app for this purpose only. We configure it to disable automatic app-event logging and advertising-identifier collection; that configuration is live in the current iOS app and ships in the next Android release. The Meta SDK is never used for advertising or measurement.

4.6 Website Only

• Formspree: receives the email address you submit in the early-access form on ready-gocook.com.
• Google Fonts: the website loads its typeface from Google's servers, which means your browser sends your IP address to Google when the page loads.
• jsDelivr: serves the open-source cookie-consent library used on the website.

4.7 Other Disclosures

We may disclose personal information when required by law or legal process, to protect the rights, safety or property of our users or the public, to investigate fraud or abuse of the Service, or as part of a merger, acquisition or sale of assets (in which case this policy will continue to apply until you are told otherwise).

5. Cookies and Website Technologies

The ReadyGoCook website uses very few cookies:

Cookie / technology	Set by	Purpose	Duration
Cloudflare security cookies (for example __cf_bm, cf_clearance)	Cloudflare	Strictly necessary: distinguishes humans from bots and protects the site	Up to 30 minutes, or as set by Cloudflare
cc_cookie	ready-gocook.com	Remembers your cookie-consent choices	182 days

We do not currently run analytics or advertising cookies on the website. The website does make requests to Google Fonts, jsDelivr and (when you submit the sign-up form) Formspree, as described in Section 4.6. You can review or change your choices at any time using the "Cookie Settings" link in the footer, and you can block cookies in your browser settings.

The mobile apps do not use cookies. They use the Firebase SDKs described above, which you can control in Settings > Privacy.

6. Data Storage and Security

• On your device: on Android, your local database is encrypted with SQLCipher (AES-256) and the key is protected by the Android Keystore; sign-in and integration tokens are stored in encrypted preferences. On iOS, your local database is protected by iOS Data Protection (encrypted while the device is locked) and tokens are stored in the Keychain.
• In transit: all traffic between the app, our servers and our processors uses TLS. Connections to our servers are certificate-pinned.
• On our servers: data is stored in Google Cloud data centers in the United States and encrypted at rest by Google. Our endpoints require a signed device attestation (Firebase App Check) and are rate-limited.
• Logs: we do not write email addresses, tokens or other direct identifiers to logs or crash reports.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you and the relevant authorities without undue delay and as required by applicable law.

7. Data Sharing Within the App

• Family sharing: recipes, meal plans and grocery lists you add to a family group are visible to every member of that group, together with your name and email address. Leaving a family removes your access; the owner can remove members.
• Recipe share links: when you create a share link, a public copy of that recipe (title, description, ingredients, instructions, image, source link and creator attribution) becomes viewable by anyone who has the link, without signing in, until you revoke the link. Share pages do not show your name, email address or account identifier and are marked so search engines do not index them.

8. Affiliate Disclosure

We participate in the Instacart Affiliate Program and may earn a commission on qualifying orders placed through shopping lists created in the app. Affiliate commissions do not change the price you pay, do not influence which products or recipes we show you, and do not change how we handle your personal information: we do not share your data with affiliate partners for marketing. We indicate in the app when you are being sent to a service where we may earn a commission. This disclosure is provided in accordance with the Federal Trade Commission's guidelines on endorsements.

9. Your Rights and Choices

• Access and correction: you can view and edit your profile, preferences and content in the app at any time.
• Deletion: Settings > Delete Account removes your account and your data from our servers immediately (see Section 12 for the few records we must keep for a limited time). You can also email us to request deletion. See our account deletion page.
• Portability and export: you can export any individual recipe from the app. To receive a complete copy of your account data in a machine-readable format, email us and we will provide it within 30 days.
• Analytics and crash reporting: turn off in Settings > Privacy.
• Notifications: each type can be turned off in Settings or in your device settings.
• Dietary preferences and allergies: optional; you can clear them in your profile at any time, after which they are no longer included in meal-plan requests.
• Sign-in providers: you can revoke ReadyGoCook's access in your Google, Apple or Facebook account settings.
• EEA/UK users: you also have the rights to restrict or object to processing based on legitimate interests, to withdraw consent at any time without affecting prior processing, and to lodge a complaint with your local data protection authority.

To exercise any right, email support@ready-gocook.com from the address on your account. We may ask you to confirm your identity, and we respond within the time required by applicable law.

10. California Privacy Rights (CCPA/CPRA)

This section applies to California residents. In the preceding 12 months we have collected the following categories of personal information, from you directly, from your device, and from the sign-in providers and public sources described in Section 2. Each category is disclosed only to the service providers named in Section 4 for the business purposes in Section 3.

Category	Examples	Collected
Identifiers	Name, email address, phone number, pseudonymous user ID, hashed IP address	Yes
Customer records	ZIP code, subscription status, transaction identifiers	Yes
Commercial information	Subscription purchases, grocery lists you export	Yes
Internet or network activity	App usage analytics, crash reports, import-link domains	Yes
Audio, visual or similar information	Photos and videos you submit for import	Yes
Sensitive personal information	Allergies and dietary preferences (health-related); account log-in credentials	Yes, optional
Geolocation, biometric, employment, education, protected classifications	—	No

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We use sensitive personal information only to provide the features you request, so the right to limit its use does not require a separate opt-out; you can delete it at any time.

You have the right to know what personal information we collect and how we use it, to delete it, to correct it, and not to be discriminated against for exercising these rights. You may designate an authorized agent to make a request on your behalf; we will ask the agent for proof of authorization and may verify the request with you directly. Submit requests through the app or by emailing support@ready-gocook.com.

11. Children's Privacy

ReadyGoCook is not directed at children. You must be at least 13 years old to create an account, and at least 16 (or the age of digital consent in your country) if you live in the European Economic Area or the United Kingdom. Grocery delivery through Instacart requires you to be at least 18, as Instacart's terms require; some items available through delivery services (such as alcohol) carry a 21+ requirement set by the retailer. We do not knowingly collect personal information from children under these ages. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Data Retention

Data	Retention
Account, profile, preferences and content	Until you delete your account or ask us to delete it. Server-side deletion happens immediately on request.
Encrypted database backups	Deleted 30 days after creation; a deleted account is therefore gone from backups within 30 days.
Billing and fraud-prevention records (purchase and transaction identifiers)	90 days after the related event. The record linking a store purchase to your account is kept while the subscription is active so that renewals and refunds are honored.
Import cache (fetched page or post content, keyed by link)	7 days
Instacart shopping-list links	24 hours
Hashed IP rate-limit records	About 25 hours
Creator-import records (which public creators you imported from)	60 days
Import telemetry counters (domain and outcome, not tied to you)	120 days
Server logs (Google Cloud Logging)	30 days
Account audit-log entries	Deleted with your account
Support emails	As long as needed to resolve your request and for our records

Third-party processors delete the content they handle on our behalf according to their own retention terms; the import helpers in Section 4.3 process content transiently and do not keep your account information.

13. International Users

Danville Digital Labs, LLC is located in the United States, and your information is processed and stored in the United States (AI requests may also be routed through Vertex AI's global endpoints). If you use the Service from the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States. Google, our main processor, is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, and our contracts with processors include the European Commission's Standard Contractual Clauses where required. We have not appointed a representative in the EU or UK; contact us at the address in Section 15 for any request.

14. Changes to This Policy

We may update this policy as the Service changes. We will post the new version on this page with an updated "Last Updated" date, and for material changes we will also notify you in the app or by email before they take effect. Continued use of the Service after the effective date means you accept the updated policy.

15. Contact Us

Questions, requests and complaints about privacy:

• Email: support@ready-gocook.com
• Company: Danville Digital Labs, LLC, Danville, CA 94526, United States