cookly-legal

Privacy Policy for Cookly

Last updated: 2026-04-26

Cookly (“the App”, “we”, “us”) is a mobile application that generates cooking recipes from a list of ingredients you provide. This policy describes what information the App collects, how it is used, and the choices you have.

1. Data we collect

When you use Cookly, we collect and process the following data:

• Account data. If you sign in with Google, we receive your email address, display name, profile photo URL, and a Google-issued user identifier. If you sign in anonymously, we only store a randomly-generated user identifier — no email, name or contact information is collected.
• Ingredients you enter. The list of ingredients you type into the app.
• Generated recipes. The recipes produced by the App, including title, ingredient list, steps, estimated time, and difficulty.
• Favorites. Recipes you explicitly save as favorites.
• Usage counters. A per-account count of how many recipes you have generated, used solely to enforce usage limits.

We do not collect precise location, contacts, photos, or any biometric data. We do not show third-party advertising.

2. How we use the data

Your data is used only to:

• Authenticate you and keep your session.
• Send the ingredient list to OpenAI to generate a recipe.
• Show you your own past recipes and favorites.
• Enforce per-account generation quotas and prevent abuse.
• Measure aggregate usage and cost (token counts) for operational purposes.

We do not sell your data, and we do not use it for advertising.

3. Third parties we share data with

Cookly relies on the following processors:

• Google Firebase (authentication, Firestore database, Cloud Functions, hosting). Governed by Google’s privacy terms.
• OpenAI (recipe generation). When you tap Generate Recipe, the list of ingredients plus your language preference is sent to OpenAI’s API. Per OpenAI’s API data policy, API inputs are not used to train OpenAI’s models by default.

No other parties receive your data.

4. Data retention

We retain your data for as long as your account exists. You can request deletion of all your data at any time by writing to the contact address below. On receiving a deletion request we remove your user record, generated recipes, and favorites from our systems within 30 days.

5. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. To exercise these rights, contact us at the address below.

5.1 Brazilian users — LGPD (Lei nº 13.709/2018)

For users located in Brazil, Cookly acts as the controlador of your personal data under the LGPD. In addition to the general rights above, Article 18 of the LGPD specifically guarantees you the right to:

• Confirm whether we process your data, and access that data;
• Correct incomplete, inaccurate, or out-of-date data;
• Anonymize, block, or delete unnecessary or excessive data, or data processed in non-compliance with the LGPD;
• Port your data to another service provider, on request;
• Delete personal data processed under your consent, except where retention is required for legal, contractual, or regulatory reasons;
• Be informed about the public and private entities with which we have shared your data;
• Be informed about the possibility of refusing to give consent and the consequences of refusal;
• Revoke consent at any time.

The legal bases on which we process your data under LGPD Article 7 are execution of the contract with the data subject (providing the recipe-generation service) and legitimate interest (preventing fraud and abuse via usage counters and quota enforcement). To exercise any LGPD right, write to the contact address in Section 9 — we will respond within 15 days as required by Article 19.

6. Children

Cookly is not directed at children under 13 and we do not knowingly collect data from children under 13. If you believe a child has provided us data, please contact us and we will delete it.

7. Security

We rely on Google Firebase’s security model. Access to recipes and favorites is restricted server-side so that each account can only read and write its own data. API keys for third-party services are stored as server-side secrets and are never embedded in the app.

8. Changes

We may update this policy. Material changes will be announced in the app and via the Last updated date at the top of this document.

9. Contact

Questions or deletion requests:

Email: dionesxxx@gmail.com