Last updated: October 3, 2026
Chefbook AI is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our iOS application.
The AI in Chefbook AI is Google's Gemini, reached through Firebase. Before the first AI request of any kind — a photo analysis, a fridge scan, a Chef Chat message or a dish photo — the app shows a one-time screen that names Google and lists what is sent: the photos you take or choose and any note you add to them, the text you type in Chef Chat and any file you attach there, a short summary of your recent saved recipes (top cuisines, dietary tags and difficulty — never the recipes themselves), your city and country if you have allowed location, and the app's language. Nothing is sent until you agree; if you do not, the AI feature does not run. You can withdraw consent at any time in Settings › AI Data Sharing, and AI features stay off until you agree again. If what is sent changes, the app asks again.
When you take a photo for recipe analysis, or choose one from your photo library, the image is sent to Google's Gemini AI for processing. Choosing a photo needs no access to your library: iOS gives the app only the photo you pick. Photos are used solely for analysis and are not stored on our servers. What Google does with the image on its own servers is governed by Google's privacy policy.
With your permission we use your approximate location, requested at kilometre accuracy. Your coordinates are sent to Apple's geocoding service, which returns a place name; Apple's handling of that request is governed by Apple's privacy policy. Only the resulting city and country are included in the prompt sent to Google — your coordinates are never sent to our servers or to Google, and the neighbourhood the device also resolves is shown only on your own screen and is never transmitted at all. We do not store location history, and the nearby-restaurant lookup that earlier versions of this policy described has been removed from the app.
With your permission, the app schedules up to three recipe-inspiration notifications a week (Monday, Wednesday and Friday) and confirms purchases and renewals. Offers about Pro are a separate kind: they are off by default and are sent only if you switch them on in the app's Settings. You can turn either kind off in the app's Settings, or all notifications in iOS Settings. Cooking-timer alerts appear whenever notifications are allowed. All of this is scheduled on your device; nothing about it is sent to our servers.
Chefbook AI does not ask you to create an account. There is no email address, no password and no name. An anonymous identifier is created on first launch so your credits and subscription status can be held on our servers rather than only on the device. Our servers also keep a short event log tied to your anonymous account — account creation, reinstall, purchases and refunds — plus daily totals with no identifier, such as how many recipes were produced; they are used only to run the service and prevent abuse, and the log is deleted with your account.
Payments are handled entirely by Apple through StoreKit. We never see your payment details, card numbers or billing address. What we do store is the subscription status and expiry date on your profile, and — in a separate, top-level ledger — the identifier of each receipt we have honoured, together with the anonymous account that redeemed it. That ledger is what stops one genuine receipt being redeemed repeatedly, and for that reason it is not deleted with your account.
When a recipe needs a photo, our server generates one and keeps it in a shared cache so nobody has to pay for the same picture twice. The file is stored under a one-way hash of the dish name and its cuisine — not of you. Nothing in the cache is linked to an account, and the app sends only the dish name, its origin and its description to produce it. The bucket is private: the image comes back to the app as raw bytes, never as a public link. Because no entry points to any person, cached images are not deleted when an account is deleted. To make the picture, our server asks Google's Gemini image model — through Google Cloud, or through Google's Gemini API when that is busy. If our server cannot be reached, your device sends the same three details to Gemini directly, through Firebase AI Logic. New generations are capped by a daily limit per account; serving an image that already exists does not count against it.
When you write to us from Settings › Contact Support in the app, the ticket — your message, a short reference code, your anonymous account identifier, the app version, your language setting, and an email address or a 1–5 star rating if you add one — is stored on our server (Google Firebase), and we read it there. Our support chat on Telegram is only told that a ticket with that reference has arrived. App tickets are deleted with your account. The limit is ten messages a day and 2,000 characters each. The form on our support page is a separate route: Netlify, which hosts this site, receives the submission, filters spam and passes it to our server, where it is stored with its reference code and is not linked to any app account; Telegram again gets only a notice. Web tickets are kept as our support history, and we delete one — at Netlify too — if you ask. Earlier versions of the app and site posted support messages to the Telegram chat in full; if you wrote to us then and want that copy removed, tell us and we will delete it.
This list matches the privacy manifest inside the app. All of it is used only to make the app work — none of it for tracking or advertising, and none of it is sold: photos you take or choose for analysis, and any note you add to them; other content you create — the text you type in Chef Chat, any file you attach there, and a short summary of your recent saved recipes (cuisines, dietary tags, difficulty); coarse location, only as a city and country name; a device ID and an anonymous user ID; purchase history; an email address, only if you add one to a support message; customer support messages; and product interaction — the short event log described above.
Under the GDPR we rely on performance of our contract with you, for the features you use and for purchases and credits (Art. 6(1)(b)); our legitimate interest in preventing fraud and abuse, for receipt verification, the device hash and the daily limits (Art. 6(1)(f)); and your consent, for sending your content to Google's AI, for location and for notifications (Art. 6(1)(a)). Under Türkiye's KVKK the same processing rests on the performance of a contract and our legitimate interest (Art. 5(2)(c) and (f)) and on your explicit consent (Art. 5(1)). Withdrawing consent does not affect processing that took place before.
We use the following third-party services:
Google processes data on servers outside your country, including outside the European Economic Area and Türkiye; the dish-photo service runs in Google's “global” region rather than a fixed one. For transfers out of the EEA and the UK, Google's Firebase and Google Cloud data processing terms incorporate the European Commission's Standard Contractual Clauses. For transfers out of Türkiye we rely on the explicit consent you give in the app before the first AI request (KVKK Art. 9). Netlify, which hosts this site and receives the web support form, is based in the United States. Telegram receives no message text, email address or payment details from us; its short notices carry no account identifier and no message content, as described under Third-Party Services.
Your saved recipes, shopping lists and preferences are stored on your device using Apple's Core Data framework, and are never uploaded. On our servers we hold an anonymous profile: the account identifier, a device identifier, your credit balance, subscription status and expiry, the daily usage counters, and the support tickets you sent from the app. Credits are server-authoritative — the app can never write them itself, which is why they have to live there. Our servers also keep standard request logs — IP address, device type and the anonymous account identifier — for 30 days, for security and debugging. They expire automatically and are not used for profiling.
We implement industry-standard security measures including:
Deleting the app removes almost everything held on the device: saved recipes, shopping lists, chat history, cached dish photos and settings. The exception is the iOS Keychain, which iOS keeps even after the app is deleted. There the app keeps a random device token and a record of whether the free analysis was used — both used only to stop it being claimed again on the same device — and a cached copy of your subscription status and credit balance. Deleting the app does not touch your server profile either — that is a separate action, described next.
To delete your server profile, open the app and use Settings › Delete Account. It runs immediately — there is no request to file and no waiting period. It deletes your profile document, the credit charges and support tickets attached to it, and your anonymous sign-in account. It also deletes any monthly analyses and extra credits left on the account. It does not cancel an Apple subscription: to stop being billed, cancel it in iPhone Settings › your name › Subscriptions, or with Manage subscription in the app.
Two things are kept on purpose after deletion, and it is worth being precise about them. First, a one-way hash of your device identifier, written to a list of deleted devices: it is what stops the single free analysis being claimed again and again by deleting and reinstalling. Second, for anyone who bought something, the purchase records — the identifier of each receipt we honoured and the anonymous account that redeemed it. When that ledger lived inside the user document, deleting the account and starting over made one real receipt redeemable without limit, so it was deliberately moved out to survive deletion. Neither record contains a name, an email address, a photo or anything that describes you, and neither is used for advertising or profiling. Your profile and everything filed under it are gone, and our server request logs expire on their own within 30 days. Two details for completeness: the device hash covers both the device identifier and the random token kept in the iOS Keychain, and the purchase records also note which anonymous account holds each subscription. And if we ever changed your account by hand from our admin panel — credits, a gift, a block — the record of that change is deleted with your account too.
Chefbook AI is not directed at children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately.
Depending on your jurisdiction, you may have the following rights:
Under KVKK Art. 11 you can also learn whether your data is processed and request information about it, learn the purpose of processing and whether the data is used for it, know the third parties in Türkiye or abroad it is transferred to, ask that a correction or deletion be passed on to them, object to a result against you produced solely by automated processing, and claim compensation for damage caused by unlawful processing.
To exercise any of these rights, write to us through the support form or from Settings › Contact Support in the app. We reply within 30 days, or sooner where the law requires it. For deletion you do not need to wait for a reply: Settings › Delete Account does it immediately.
We may update this Privacy Policy from time to time; when we do, the date at the top changes. If a change affects what is sent to Google's AI, the app asks for your permission again before the next AI request.
Chefbook AI is developed and operated by Ince Ozgur, an individual developer based in Türkiye, who is the data controller for the app. If you have any questions about this policy or about your data: