Effective October 14, 2026.
ChefScan helps you save cooking recipes from food photos and webpages. This policy covers the ChefScan app and its optional signed-in AI service, including ad-supported use and explicitly granted complimentary access.
The existing Groq option uses an API key you provide and stores it on your device. Food photos or webpage recipe text are sent directly to Groq only when you request its AI processing. Local recipe extraction may work without AI. Saved recipes and associated photos are stored on your device; deleting a server account does not erase these local files. You can remove local recipes in the app or clear app storage.
If you sign in, Firebase Authentication processes your Google sign-in identity. When you request ad-supported Claude AI, Cloudflare Workers sends your selected photo or webpage text to Anthropic for token-count preflight before showing a rewarded ad. If the input, quotas and budget qualify, we reserve one generation for that input. After Google verifies the reward, we send that same input to Anthropic to generate a recipe. A cancelled or unavailable ad does not undo the earlier token-count transfer. Accounts explicitly granted complimentary AI access use the same token-count preflight and AI recipe generation, without an ad or ad-reward verification. We check their email against the verified Google sign-in and current Firebase account record to authorize this access. Our service does not persist submitted photo bytes or webpage text, and does not intentionally log credentials or submitted content. Providers apply their own data retention policies.
The service stores your Firebase user ID, input hash, job/reward identifiers, timestamps, generation state, quota counters and cost records. The app may retain one pending selected photo or webpage input on your device in encrypted storage so you can finish an interrupted generation, including after signing back into the same account. That input belongs to your account, is valid for 24 hours, and is removed after completion or account deletion, or at the next app cleanup after expiry. A pending deletion receipt may retain your recent sign-in token in encrypted device storage for up to four minutes only to finish an interrupted account deletion; our server never stores that token. Successful generated recipes are retained on the server for up to 24 hours for recovery. Job metadata is retained for up to 30 days; quota records remain until account deletion. Aggregate service spending is retained without a user ID after deletion. A one-way hash of a deleted user ID is retained for up to 24 hours only to block requests already in progress during deletion. Anthropic, Groq, Google and Cloudflare process data under their own policies; provider retention may differ from ours.
AdMob displays optional rewarded advertisements and may process advertising identifiers, device data and ad interactions. Google sends signed reward verification information to our service, including an opaque generation nonce and your service user ID. Consent and privacy-choice controls appear in the app when required. Firebase Analytics and Crashlytics process usage events, device/app diagnostics and crash reports. We do not intentionally send food photos, recipe page text, recipe contents, API keys or sign-in tokens to analytics/crash reporting.
If you choose to report a recipe, we send the displayed recipe text, selected reason, language and AI provider to our service for safety review. We do not include the photo, source URL, account identifiers, sign-in tokens or API keys. Recipe text may contain details you entered; review it before reporting. Reports are stored for up to 30 days and are not published. To limit abuse, we temporarily store a one-way hash of your network address with a daily random salt; the address itself is not saved in the report database. Reports are not linked to your sign-in account and expire automatically; contact us with the report reference if you have a privacy request.
You may continue using existing local/Groq features without signing in. Watching a reward ad is optional. One verified reward grants one AI attempt for the selected input. Its ticket expires 24 hours after you request it, as shown before the ad; daily/monthly limits and temporary budget availability apply. AI output may be incomplete or inaccurate. No payment is required for Google sign-in.
To delete your server account and personal server ledger, sign in again and use Settings → Delete account or our account deletion page. A completed deletion removes the Firebase account, user quota/job records and recovered recipe results; anonymous aggregate spending remains. If deletion is interrupted, the service freezes new AI work and immediately removes recovered recipe results. Personal service ledger records are also scheduled for local deletion after 24 hours, even if your short-lived retry receipt expires. This local cleanup does not confirm that Firebase deleted your sign-in account: if the Firebase step failed or could not be confirmed, sign in again and retry the deletion page or contact us. A new one-way deletion guard remains for 24 hours after local cleanup. If a provider request is in progress, its contents cannot be recalled from that provider. Local saved recipes are separately controlled in the app.
Contact davedvlee@gmail.com for privacy requests.