CookBook Privacy Policy

Effective date: 2026-11-12

Unified AI consent and necessary data

Only when you submit an AI task does CookBook send the data needed for that task over HTTPS. Signing in does not upload your personal recipe library, photo library or entire fridge.

Text import and web recipe extraction send your submitted prompts, text or web page content. Image recognition sends the selected image. Speech tasks send only the confirmed transcript to CookBook AI. Transcription takes place on your device when supported, otherwise through Apple speech services. Recordings are not sent to CookBook AI.

Recipe generation sends your recipe name, ingredients, servings, time, cuisine and instructions, together with the dietary preferences, allergies, restrictions and notes used for generation. Fridge suggestions also send relevant available inventory names, amounts, units and remaining proportions.

AI calorie estimation sends the current recipe name, ingredients, steps and servings. Photo estimation also sends the selected photo. Photos are not automatically saved as recipe covers. Local nutrition database calculations do not send recipes to AI.

This content passes through CookBook on Tencent Cloud in Shanghai to Qwen models in Alibaba Cloud Model Studio in China (Beijing). See below for temporary-content retention, provider processing and deletion. CookBook does not authorize advertising or model-training use of your inputs or outputs.

AI may make mistakes or miss information. Check ingredients, allergies, steps, quantities and calories before using results. Declining or withdrawing consent does not affect local features. Processing already dispatched may not be retractable. Once this account consents on this device, AI features do not ask again unless the notice changes or consent is withdrawn.

Overview

CookBook is maintained by an individual developer. Local features do not require registration. Optional AI image and text processing, web recipe extraction, ingredient normalization, recipe generation and photo calorie estimates require Sign in with Apple and explicit permission. CookBook has no advertising or cross-app tracking SDK. Personal content is local by default; iCloud is opt-in.

AI consent, dietary preferences and availability

No AI task content is sent before you read the full AI notice, check the agreement box and choose to process it. Selected images, text, accessible web page text or ingredients are transmitted over HTTPS to the CookBook service on Tencent Cloud and Alibaba Cloud Bailian. Recipe generation also uses the selected dietary restrictions, allergies, preferences and notes. Declining does not affect local features. Material policy or purpose changes require renewed permission. Do not include unrelated personal information.

AI features and available regions depend on the service policy and app version. Users outside mainland China may try to connect; availability depends on their network, and the full overseas workflow has not been verified. Data passes through CookBook on Tencent Cloud in Shanghai, China, to the current Alibaba Cloud Model Studio service; this is not a separate overseas deployment. The Apple-verified sandbox has separate accounts, data and budgets and grants no production credits. Review ingredients, allergens, steps and calories: AI can make mistakes or omit information.

Personal credits and service protection

The 15 lifetime free credits and 200 credits per Beijing calendar month for members are personal allowances. The production service separately applies a shared 2000-dispatch daily cost-protection limit and concurrency limits. Service limits may cause delays even when personal credits remain. Unsuccessful tasks do not spend personal credits and no new paid task is silently retried. Development and sandbox traffic do not use the production daily budget.

Original and derivative images

Derivative images for display, featured content and AI transfer may be resized, color-managed and compressed on the device or server for their purpose; no fixed compression ratio is guaranteed. Transfer optimization does not batch-replace saved originals. Complete backups and personal sync retain the full-frame assets already saved by CookBook and crop parameters. Initial photo storage continues to remove location and unrelated metadata.

Local content and photos

Recipes, steps, notes, meal plans, fridge ingredients, shopping lists, bento content, cooking progress and images are stored on your device by default. When a photo is first saved, location and other unnecessary metadata are removed. A high-quality image and crop settings are retained for future editing, without automatically saving to your system photo library. Regular recipe photos and notes are not uploaded to CookBook servers. Images you explicitly submit for AI recognition are processed as described below.

Optional AI, speech and calorie processing

For text or voice ingredient entry, the text prepared after you finish is sent to CookBook servers and Alibaba Cloud Bailian. Live speech transcription is performed on-device when supported, otherwise by Apple speech services. Recordings are not sent to CookBook AI or retained; text is sent only when you confirm generation. Results are saved to the fridge only after you review and confirm them.

You may choose to submit accessible webpage text for AI recipe organization. CookBook does not fetch arbitrary URLs from its servers or bypass logins or CAPTCHAs. The source is retained for you to review steps and amounts. Recipe calorie calculations use the nutrition records, gram weights and servings you select; missing nutrition values are not treated as zero. Photo calorie estimates use only the photo you select for that request; it is deleted after use and is not used as a cover. Estimates require confirmation and may have substantial errors due to portions, occlusion or hidden oil and sugar.

Optional AI image entry and accounts

AI requires an app version supporting the current service availability. When you choose recognition, CookBook removes unrelated photo metadata and uploads the selected image over HTTPS to its Tencent Cloud server in Shanghai, China, then to Alibaba Cloud Model Studio for ingredient recognition. Do not upload identity documents, payment details or unrelated personal information. Review and edit results before saving to the fridge. Unknown quantities may remain empty; expiry dates are calculated only from the dates or shelf life you provide and require review.

CookBook removes input images after successful processing. Encrypted input for failed tasks may remain for retry until at most 24 hours after creation, then expires. Recognition drafts remain in separate encrypted server/device temporary storage for at most 24 hours for recovery, outside normal backups and iCloud. Confirmed ingredients become local data. These limits apply to CookBook; provider records and backups follow the third-party processing section.

AI requires Sign in with Apple. CookBook stores an HMAC derived from the stable Apple identity for account verification and preventing repeated free claims, without long-term storage of the raw Apple subject, name or sign-in email. This is a linkable pseudonymous identifier, not anonymous data. Identity and minimal aggregate credit counts support active accounts. After deletion, only the HMAC, identity provider, necessary timestamps, lifetime free-use total and current member-month total remain for up to 30 days for abuse prevention. Expired markers for accounts not reactivated are removed; recreated accounts inherit only retained counts, without old recipes, photos or recognition content. AI includes 15 lifetime free uses or 200 active-member uses per Beijing calendar month.

Task text, images and full results are encrypted in a separate temporary area until at most 24 hours after creation. Input text and images are removed after successful processing; failed input can support a user-initiated retry within that period. Temporary content is excluded from routine, deployment and exported backups. Operational details support security, troubleshooting and reconciliation for at most 180 days. Account-linked task identifiers, call details and related ledger entries are then deleted, leaving monthly statistics without personal identifiers and aggregate lifetime free-use counts for active accounts. Counts contain no individual inputs, timestamps or task references. Accounts and applicable transaction state are retained until account deletion or the end of their necessary service purpose.

The AI account screen offers sign-out, withdrawal of local upload consent and account deletion. Signing out does not delete an account. Withdrawing consent stops new submissions but may not retract dispatched processing. Deletion revokes CookBook sessions and Apple authorization and removes the account, task content, call details and associated transaction records, while keeping local recipes and fridge data. Only the minimal abuse-prevention marker and aggregate credit counts described above remain for up to 30 days. Encrypted server backups are kept for at most 28 days; restores must apply the latest deletion records to prevent deleted accounts from returning. Apple controls its own transaction records. Deleting the AI account does not cancel subscriptions; cancel them in Apple subscription settings.

Optional iCloud sync

If you enable Profile → Data → iCloud Sync, supported recipes and images, tags, meal plans, shopping lists, fridge entries, bento content and content settings are uploaded to your current Apple account’s private CloudKit database for your compatible devices. Processing is subject to Apple’s iCloud terms and privacy policy. Cooking progress, timers, notification permissions, reminder preferences, display layout and onboarding progress are not synced. Signing out or changing accounts pauses sync; a new account requires confirmation to enable it again. Sync is free and off by default; membership expiry does not affect it.

Apple membership subscriptions

Apple handles purchases, trials, payment and renewals. CookBook uses StoreKit to verify transactions and validity periods to determine membership access; it does not receive payment card details. Membership status is not included in recipe backups. Expiry does not delete existing content; additions beyond free limits are restricted, but free iCloud sync is unaffected. Manually disabled sync stays off. Apple Account changes or unsafe data states require confirmation or recovery first.

Featured content, nutrition updates and network services

CookBook downloads public featured catalogs, recipes, tips and images over HTTPS from Alibaba Cloud OSS, including attributed third-party content with license information. By default it checks and prefetches featured content on launch or return to the foreground, subject to refresh intervals. Disable automatic caching or clear the cache in Featured settings; manual browsing and refresh may still make requests. Nutrition includes offline data; relevant pages may check public update catalogs and download updates.

To deliver content, hosting providers process necessary network information such as IP address, request time, resource path and response status. The developer uses aggregate request and traffic metrics to maintain the service. Necessary access logs may be retained privately for up to 30 days for security troubleshooting and content download statistics, without individual browsing profiles, cross-app tracking or ad targeting. Downloads do not represent unique readers. Requests do not include a proprietary account or advertising identifier and do not upload private recipes, plans or fridge content. Nutrition sources and versions are shown in the app. Changes are reflected in this policy and store disclosures.

Web and file imports

CookBook contacts a website directly only when you enter or paste its URL for import. The website may process network information such as your IP address. If an imported file references remote images, CookBook may request those image URLs. The app does not upload browsing history. You choose ZIP, Markdown and other import files; temporary import files are cleaned up after completion, cancellation or failure. When importing or sharing, also consider the source website’s and recipient’s data practices.

System permissions

CookBook does not upload your other calendar events or reminders to the developer. Exported content may sync through your system account. Disabling CookBook sync or uninstalling the app does not delete exported events or lists. Declining a permission affects only the associated feature.

Backups, sharing and deletion

You can choose to export a full backup or share recipes. Exported files are stored with the destination or recipient you choose; keep them safe. Recently Deleted retains recipes and bento content until you permanently delete them manually. Clear All Data in Profile removes supported local content and associated notifications. With sync enabled, restoring or clearing may propagate to other synced devices after confirmation. Turning sync off retains both local and cloud content, and uninstalling does not automatically delete iCloud data. Local sync safety copies and conflict records must be removed separately.

Feature suggestions and reports

On the first visit or without consent, browsing public proposals requires no AI sign-in and does not request or send a feedback credential. Before submitting suggestions or reports, voting or blocking, you must agree to the purpose explanation. CookBook then requests a random credential issued by the server, stored in the device Keychain and valid for at most 180 days and removed on expiry. An invalid credential is replaced only on the next user-initiated submission or interaction; previous votes, blocks and quotas do not transfer automatically. While consent remains enabled, subsequent reads may send an existing credential to show votes, quota and blocked sources. Turning consent off stops sending it without affecting public browsing. Legacy installation identifiers are not automatically migrated; old votes, blocks and quotas do not transfer. Proposals store a category, title, description and a pseudonymous credential identifier. Nicknames and email are optional; only approved titles, descriptions and nicknames are public, while email is encrypted and private. Private reports are visible only to the developer for at most 180 days; block and ban markers last at most 365 days. Proposals remain until deletion or no longer needed for display; email us to request deletion. Anonymous quota events last only for the current week. Credentials are never used for advertising or cross-app tracking; removing a credential does not delete submitted content. To prevent abuse, public reads, credential issuance and writes derive a private HMAC from the connection IP. The rate-limit database records only an HMAC scope and timestamp, not the raw IP. Events serve a rolling 60-second window and expired events are removed during later writes or maintenance. The HMAC itself does not change every minute and is not an anonymous identifier; network-provider access logs follow their separate retention rule in this policy. The server stores only a credential digest, pseudonymous identity and expiry, never the raw credential. New server backup exports exclude feedback credentials and short-lived rate-limit events. Older app versions can still browse public proposals but must update before submitting, reporting, voting or blocking. You can also contact the developer by email. Public proposals and development plans support paginated loading.

Connection checks and private diagnostics

You can explicitly check service connectivity without uploading AI text or images, invoking a model or spending credits. Error diagnostics remain in memory and include app version, device model, system, language, available storefront, time, error category and request references. They are not uploaded automatically. Review before copying, sharing or emailing. Your chosen email service handles sent messages; do not include credentials, photos or private recipes. The server records necessary request references, status and duration for troubleshooting under the existing operational retention rules.

Third-party processing and protection

AI processing uses Alibaba Cloud Model Studio provided by Tongyi Yunqi (Hangzhou) Information Technology Co., Ltd., currently through Qwen endpoints in China (Beijing). Network and storage also involve Tencent Cloud and Alibaba Cloud OSS. We send only necessary data to processors under service agreements, do not authorize advertising, sale or model-training use, and require instruction-based processing, restricted access, encryption and necessary retention consistent with this policy and Apple requirements. Section 6 of the Model Studio agreement limits unauthorized use and disclosure, supports deletion or correction instructions, and describes necessary retention and delayed backup erasure. Providers may retain invocation data under applicable terms and legal duties; their retention is not CookBook's 24-hour limit and is not described as zero retention. Contact CookBook's privacy email for assistance with access, correction or deletion requests.

Backups and deletion requests

Server routine, deployment and exported backups exclude temporary text, images, full results, sessions and Apple refresh tokens. Server backups last at most 28 days; historical deployment snapshots follow the same redaction and rotation. Backups are used only for controlled recovery with current identity and deletion records applied first. Delete AI accounts in the app; contact the privacy email for access, correction or deletion of other personal data, proposals or emailed diagnostics. After necessary identity verification, we respond under applicable legal deadlines, usually within 30 days, and explain any extension. Emailed diagnostics are not public proposals. The developer clears unnecessary email content within 30 days after resolution; any legally necessary minimal records have a stated purpose and retention period. New restore tools reject server backups older than 28 days using authenticated encryption time and, when available, the database snapshot time. Copying, downloading again or changing file timestamps does not extend the window. This rule does not limit personal recipe backups exported by you. Production recovery must reconcile against the corresponding online authoritative database and deletion journal under a locked view. Bundled sidecars, hashes or asserted timestamps do not prove freshness. Recovery is refused if the authority is unavailable. Offline checks validate integrity in memory only, create no restored database and do not prove current deletion state.

Content safety and moderation

Illegal, harassing, hateful, sexual, dangerous or infringing content is prohibited. Public proposals are reviewed before display; touch and hold to report or block an author. AI results and task screens offer private reporting, with independent email as an alternative. Reports are private to the developer. We review concerns, remove content, block abusive sources or suspend AI accounts, normally starting review within 48 hours. Model safety and rules cannot detect every violation; please report concerns.

Model Studio privacy and security · Model Studio service agreement

Contact and policy updates

For privacy and data-processing questions, contact raven42lee@outlook.com. Do not include passwords, payment information or unnecessary private recipes in feedback. Changes will be published on this page with an updated effective date.

Home · Privacy policy · Support

Speech and calorie estimates

Speech is transcribed on-device when supported, otherwise by Apple speech services. Recordings are not sent to CookBook AI or retained; only the transcript is sent when you choose generation. Calorie photos are single-use and are not used as covers. Estimates may be wrong because of occlusion, portions or cooking methods and require confirmation. Ingredient calorie calculations retain amounts, sources and calculation evidence with the recipe, including its backup and sync.

Sensitive settings and version differences

Allergies, dietary health notes and religious choices are sensitive personal settings. New versions supporting privacy isolation exclude these settings and restrictions automatically added by religious presets from personal sync, conflict copies and newly exported ordinary backups. Ordinary tastes, cuisines and non-religious dietary preferences can still sync. Sync and restore preserve sensitive settings already on the current device; enter them again on a new device. Older versions may include these fields. After upgrading and connecting to the original iCloud account, cloud content is migrated and redacted; failed cleanup can be retried. Check and delete older backups you saved elsewhere. Do not put health information in ordinary recipes or notes you sync; the app does not automatically identify or remove private text you write.

Date calculations and safety limits

Expiry dates are calculated only from dates or shelf life you provide: an explicit expiry date takes priority, followed by shelf life from production, purchase or entry date. The basis is retained for review. Food safety is not inferred from appearance; freshness states and reminders are not food-safety guarantees.

AI membership allowance and recovery

An active Apple subscription and a synced AI membership allowance are separate states. AI requires a CookBook account and explicit upload consent. A subscription remains linked to its original CookBook account; if accounts conflict, sign in to the original account or contact the developer instead of purchasing again. Retry sync on the AI account page after a network failure. Shared daily and concurrency limits may cause delays even when personal allowance remains. No personal credit is charged without a valid successful result.