Privacy policy

Henning Witzel-Açikgöz, Bötzowstraße 86, 10407 Berlin, Germany

Email: hello@whatwecook.app

WhatWeCook is an app for households to collect recipes, plan the week and shop. We only process what it needs, sell no data and show no ads.

Account: name, email address, your sign-in codes (only as a check value), where you came from when you signed up (the linking website and tags in our links, no cookie), language, and optionally a profile photo, a line about you and what you like or avoid eating.

Welcome questions: if you answer them, who you cook for and the first names of the people you cook with, how often you cook and what gets in the way, what you like and don’t eat, an age band and where you heard of us. Every answer is optional. We use them to fit the Kitchen’s suggestions to you and, in our product analytics, to understand who uses WhatWeCook. You can redo or delete them under You → Profile.

Content: your recipes with photos and videos, cookbooks, weekly plan, shopping list, comments, likes, who you follow and which households you share.

Creator pages: when you import a recipe from Instagram, TikTok or YouTube, we also store the public name and username of whoever posted it, as the post shows them, and from their public profile their picture, description and follower count. From that, the community gets a page showing which recipes WhatWeCook households saved from them (title, our photo, number of households, link to the original) — not who saved them. The page is not that person’s account. Anyone who wants such a page removed can write to hello@whatwecook.app; we take it down right away.

Order at Knuspr with Maia: when you tap it, your device sends the chosen items of your shopping list as text to Knuspr (Großer Kern GmbH), in the Knuspr app or on knuspr.de. It does not go through our server; what Knuspr does with it is covered by Knuspr’s privacy policy.

Putting the basket together (REWE or Knuspr, in the iPhone app): we look for products that match the chosen items of your shopping list. For that the lines go to an AI model (see below) and, as search terms, to the shop: for Knuspr from our server, for REWE from your device. For REWE our server asks REWE for your delivery store with your postcode; the postcode is kept only on your device, not by us. “Warenkorb füllen” puts the products straight into your cart at REWE (REWE Markt GmbH) or Knuspr inside the app; what happens there is covered by their privacy policies.

Imports: links and photos you import are read and turned into a recipe; public pages (e.g. Instagram, TikTok, YouTube, recipe sites) are fetched to do so.

YouTube videos: when a recipe comes from a YouTube video, we show its preview picture (from YouTube’s image server). Only when you tap play does YouTube’s player load, in its privacy-enhanced mode (youtube-nocookie.com); from then on Google’s privacy policy applies.

Waitlist: name and email address when you ask for access on the website. If you tick the box for the Kitchen’s ideas by email, we also keep your language and when you confirmed it by link.

Notifications: the address your device receives push notifications at, if you turn them on. In the iPhone app this is a device token that Apple issues for delivery through the Apple Push Notification service (APNs); we store it with your account and send it only to Apple to deliver notifications to you. If you delete your account we delete it at once; if you turn notifications off, we delete it as soon as Apple reports it as no longer valid.

The iPhone app: it is an app around the same service and processes nothing beyond it. For the widget it keeps a small extract on your device (today’s dish, the next days and open shopping items); it does not leave your device. We use the camera only when you choose “Take a photo” to scan a cookbook page; the pages are processed like imported photos. Through “Share” you hand us only the link or text you share. Cooking timers appear as a Live Activity on the Lock Screen. The app contains no advertising or tracking software.

Community: what you share in the community (cooked meals, comments) is seen by people who follow you. You can report content and block people; we store a report with the reported content and your account, send it to ourselves by email and review it within 24 hours.

Feedback and errors: what you write to us, and for errors the page and your browser (user agent). Photos from failed photo imports are kept so we can find the cause; the import screen says so.

Technical logs: our hosting provider processes IP address, time and requested page to deliver and protect the app.

To run the app for you (Art. 6(1)(b) GDPR).

Security, debugging and improving the app (legitimate interest, Art. 6(1)(f) GDPR).

The waitlist and push notifications at your request (Art. 6(1)(b) or (a) GDPR); you can turn notifications off at any time in settings. The Kitchen’s emails: in the app as part of the service (turn off under You → Notifications or by the link in every email); from the waitlist only with your confirmed consent (Art. 6(1)(a) GDPR, double opt-in), withdrawable any time by the link in every email.

Before content goes to these models for the first time, we ask you (in the app and on the website); you can change it any time under You › AI in WhatWeCook. Apple Intelligence on the iPhone (shopping list, Ask, search) processes content on the device only; nothing goes to us or anyone else.

For imports, recipes written from an idea, translations, shopping lists, putting grocery baskets together, AI photos, videos, “What’s at home?” (photos of your fridge and pantry, which we only read and don’t keep) and the WhatWeCook Kitchen’s daily ideas, we send the content needed (e.g. recipe text, ingredients, photos) to AI models, through the Vercel AI Gateway; the models are by Anthropic, Google, Black Forest Labs and Perplexity. Your content is not used to train these models, as far as the providers commit to that. Recipes, photos and videos made by AI are marked as such.

Vercel Inc. (USA): hosting the app and website, server functions (Frankfurt region), photo and video storage, AI Gateway.

Neon Inc. (USA): database, hosted in Frankfurt (EU).

Resend, Inc. (USA): sending emails (e.g. sign-in codes, invites), EU region (Ireland); data processing agreement and EU Standard Contractual Clauses.

Vercel Inc. (USA): anonymous usage statistics (Vercel Web Analytics) — no cookies and no profiles; it counts pages viewed and a few steps (e.g. waitlist, sign-in), not who you are.

PostHog Inc. (USA), EU cloud in Frankfurt: product analytics for the app and website — which pages and features are used, so we can improve the app. No cookies and nothing stored on your device. Also recordings of sessions (which screens you see, where you tap and scroll), so we can see where things get stuck; everything you type and your sign-in code are masked. In the app under your internal user id, never your name or email address. Data processing agreement and EU standard contractual clauses.

Anthropic, Google, Black Forest Labs, Perplexity: AI models, through the Vercel AI Gateway.

Apple Inc. (USA): delivering push notifications to the iPhone app through APNs, if you turn them on. Google, Mozilla, Microsoft: the same for browser notifications.

Transfers to the USA rely on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.

We only set cookies the app needs: your sign-in, your language, your active household and view settings (e.g. sorting). Small preferences are kept in the browser’s local storage. No tracking, no advertising cookies — which is why there is no cookie banner. The iPhone app runs the same service; your sign-in and settings are kept in the app’s storage on your device, likewise without tracking.

As long as you have your account. If you delete it (You → “Delete my account”), it is deleted at once with your recipes, photos, videos, plans and everything else that is yours. Recipes other people saved from you stay with them. Waitlist entries are deleted once you are invited or ask us to. Our hosting provider deletes technical logs automatically after a short time.

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and to withdraw consent. Write to the email address above.

You can complain to a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

If something important changes, we say so in the app.