Privacy, explained.

The essentials

Your cookbook, pantry, menus and grocery lists are stored on your device. You can use the local kitchen tools without a PennyPlate account. Using hosted AI is a separate choice: with your permission, relevant information is sent to our server and OpenAI to handle your request.

PennyPlate is coming soon. Account, subscription and hosted-AI features described here apply when they are available in your version of the app.

Website & launch list

When you join the launch list, we store your email address, signup time and a record of the launch-update consent you gave. We use the list to tell you when PennyPlate is ready. Signup records currently have no automatic expiry; you can request removal at any time.

Our website host, Cloudflare, processes connection information needed to deliver and protect the site. The signup service uses an hourly hash derived from your IP address to limit repeated submissions. That hash is stored separately from the subscriber list; the signup database does not store your raw IP address alongside your email.

The website does not add advertising trackers or third-party analytics scripts. Fonts and images are served with the site.

You can request removal from the launch list. Joining the list does not create an app account or subscribe you to Premium.

Your app & account

Local kitchen information can include recipes, pantry items, household preferences, allergies, meal plans and grocery lists. It is not automatically synchronized to a PennyPlate account. If you choose an online feature, the information needed for that feature may leave your device.

Sign in with Apple supplies the identity we use for your PennyPlate account. We keep account and session identifiers, your AI permission choice, security records and the information needed to maintain sign-in and process account deletion. PennyPlate does not receive your Apple password.

For Premium, we keep subscription identifiers, purchase verification and renewal information, the PennyPlate account associated with the purchase, and AI allowance and usage records. Apple processes your App Store payment; PennyPlate does not collect your payment-card details.

When you choose hosted AI

Before using PennyPlate-hosted AI, the app asks for permission to share your messages and relevant kitchen information with OpenAI through PennyPlate’s server. Depending on the request, this may include household preferences and allergies, selected recipes, pantry items, menus and grocery lists. Recipe searches can also involve web search. Search providers may receive the query used to find relevant pages.

We process the request, generated response and any approved kitchen action to deliver results, recover interrupted work and account for AI usage. We also record operational information such as the model used, request timing, outcome and usage counts.

You can withdraw permission in Settings → Account & AI privacy. This stops pending hosted work; it does not undo kitchen changes already saved on your device. On-device features do not use this hosted-AI permission. If you choose Apple cloud AI in a supported build, your message and relevant kitchen context are sent to Apple’s Private Cloud Compute under Apple’s controls and availability.

Who helps provide PennyPlate

• Cloudflare hosts our website and hosted account/AI services and stores the records those services need.
• Apple provides Sign in with Apple, App Store purchases and device security checks.
• OpenAI processes the information sent for PennyPlate-hosted AI when you give permission.
• Instacart receives your selected grocery-list title, items and quantities through PennyPlate’s shopping service when you choose to prepare an Instacart shopping link. Shopping and checkout then happen with Instacart.

These providers process information to deliver their services. Their own policies also apply to services you use directly. See Cloudflare’s privacy policy, Apple’s privacy information and OpenAI’s privacy policy. Provider processing may occur outside your country.

Importing a recipe contacts the source website to fetch its content. Loading remote recipe images or playing embedded videos can also contact the source host or video platform, such as YouTube, TikTok or Facebook. Those services can receive connection information and apply their own privacy practices. The same applies when you open a recipe source or another external link.

Retention & account deletion

Hosted content is kept for limited periods to complete requests and recover interrupted work. Unused request quotes expire after five minutes. Working request context becomes eligible for scheduled cleanup 24 hours after work finishes or fails. Recoverable results expire after seven days; content from completed kitchen actions becomes eligible for cleanup seven days after execution closes. Classifier metadata and completed provider-attempt metadata become eligible after 90 days. Scheduled cleanup removes eligible content; an unfinished request or a cleanup interruption may delay removal. Save recipes you want to keep to your local cookbook.

Deleting your PennyPlate account removes hosted AI content, ends account access and signs out your devices. Your local cookbook, pantry, menus and groceries remain on the device. Account deletion does not cancel an App Store subscription; cancel it separately with Apple.

Some records remain after deletion: the association with your Apple sign-in, subscription ownership, allowance and accounting records, and records that prevent duplicate requests or transfers. These records are currently retained without a scheduled deletion date. In the upcoming account-enabled release, after deletion finishes, you can use the same Apple sign-in to create a fresh PennyPlate account. This does not restore deleted hosted content or repeat a welcome bonus. Free points already used in the current month still count toward that month’s allowance. Creating a fresh account does not transfer an existing subscription from the deleted account. Apple sign-in credentials needed to finish revocation are removed after revocation succeeds.

The launch list is separate from your app account. Deleting your app account does not remove a website signup. Ask us separately to remove your email from that list.

Your choices & questions

Use Settings → Account & AI privacy to manage hosted-AI permission, sign out or delete your account. For a privacy question, access or correction request, or help with deletion, contact PennyPlate. We may need to verify that a request concerns your information before acting on it.

We will update this page when our practices change. Review the policy when you choose new online features.