Privacy Policy

Effective: 26 October 2026

Who is responsible

Fox Labs Limited operates Prep and Chef and is responsible for the personal information described here. We are a New Zealand company, NZBN 9429053694737. Our correspondence address is 62 Hector Street, Seatoun, Wellington 6022, New Zealand. Contact our privacy officer at support@prepandchef.com.

This policy covers our iOS app, share extension, web app, public website, recipe-sharing links and related communications. Our initial app launch countries are New Zealand, Australia and the United States. Our Consumer Health Data Privacy Policy provides further details about information that may reveal health or dietary needs.

We do not sell personal information or use it for third-party advertising at launch. We do not use your content to train AI models. Recipes are private by default; sharing requires your action. The sections below explain the processing needed to run these features, including processing by service providers.

Information you provide

• Account information: your email address, sign-in method and identifiers, and account settings. We record the age confirmation and legal notices associated with account or purchase actions. We do not use an account password for our email sign-in method.
• Saved content: recipes, source links, photographs or scans, notes, collections, meal plans, shopping lists and preferences you choose to save. Content may itself contain personal information, including names, dietary restrictions or allergies.
• Import requests: links, page content, photographs, screenshots or text you ask us to process, together with the resulting recipe and processing outcome.
• Optional dietary information: preferences and goals you choose to supply. These may reveal sensitive information depending on their content and context. You can use features that do not depend on those details without providing them.
• Support and reports: your messages, contact details and any screenshots or content you send us. A report from the app carries what you enter or, for a failed import, what its Report button names (the photos, pasted text or page link), with basic technical information. Please do not send passwords, sign-in codes or full payment-card details.
• Email choices: your address, the updates you request, confirmation and unsubscribe records, and delivery status.

Some processing can happen before account creation. For example, a purchase creates a subscription-provider identifier, and Apple and our subscription provider keep a record of the purchase, before you register. Selecting information during onboarding does not by itself create an account. When you sign out, the app switches to a new anonymous subscription-provider identifier, so the device stops using your account's identifier. A purchase made before you sign in is linked to the account you sign in to next.

Information received from others or collected automatically

Apple or Google supplies the sign-in identifiers and profile information you authorise when using their sign-in services. Apple's Hide My Email may give us a relay address instead of your personal address. We do not receive your Apple or Google password.

Apple and RevenueCat supply purchase and subscription information, including product and transaction identifiers, purchase and renewal status, trial or introductory eligibility and relevant storefront information. Apple processes your payment details; we do not receive your full payment-card number.

Source websites and transcription services supply content when we process an import. A user may provide a share link that you choose to open or save. We receive technical information needed to operate and secure the service, such as network addresses, device and app information, request times, error reports and authentication or abuse-prevention signals. Source sites may also receive your network information when your device visits them or loads their images.

Photos that come with a recipe imported from a website or social post are not stored on our servers. The app downloads each photo directly from the publisher or the service that hosts its images, which receives your network address and basic device information, as with any image request. These requests do not identify your Prep and Chef account. The main app sends no cookies with them; a download made while importing through the share sheet may include cookies the source site set during that import. In the iOS app, each device keeps its own copy so the photo appears offline. The web app also loads these photos directly from the publisher, without sending the address of the page you are viewing; whether your browser sends the publisher's own cookies depends on your browser's settings. Some social image links expire, so our servers may fetch the post again to obtain a current image link, which we store with your recipe.

The launch app does not use Google Analytics or keep optional behavioural histories of onboarding, feature use or promotions. We retain the service records needed for features, purchases, support, security and reliability, subject to their purposes and retention limits. These records may remain linked to your account.

To troubleshoot imports and improve reliability, we keep narrow success-and-failure diagnostics for up to 30 days from the original event, including time queued on your device. These cover the import method and processing path, outcome and stage, broad technical failure category, app and OS version, connection category, bounded retry and timing information, cache use and the source. For a public web page, the source is its address without query or sharing codes (a page number may remain); for a public social-media post, it is the post's own address, rebuilt from its ID. For file-sharing and document services we keep only the service's name, for shortened links only that a short link was used, and for an address that appears to contain an email address, an account or access code or similar personal detail, only the website's domain. When an import starts from a shortened TikTok or Pinterest link, the app follows it on your device to find the post, and diagnostics keep only that post's address, never the short link. Imports from the in-app browser, photos and pasted text use general categories. Diagnostic reporting excludes recipe content, photographs, pasted text, nutrition information, email addresses, Premium status and persistent customer identifiers. It stays in our restricted operational systems and is not sent to Google Analytics or used for marketing segmentation or long-term customer histories. Separate restricted records associate diagnostics with an account only for reliable delivery and privacy handling; these records are not anonymous. Applicable privacy choices and restrictions still apply. Diagnostic delivery problems do not prevent you from importing recipes. Reports you send to support follow their separate rules below.

Why we use information

We use information to create and secure accounts; import, save, sync and share content at your request; provide nutrition estimates; manage subscription access; communicate about the service; respond to support, privacy and content requests; prevent abuse; understand and improve reliability and use; and comply with legal obligations.

We use contact details for optional marketing only when you have chosen to receive it. Agreement to the Terms or acknowledgement of this policy does not enrol you in marketing. Where a particular use requires permission, we ask before that use. Withholding optional information may make the relevant optional feature unavailable, but does not require you to give up unrelated features.

AI and transcription processing

We use Google's Gemini API for recipe extraction and Anthropic's Claude API for photo parsing and nutrition processing. Supadata assists with transcripts for supported video and social-source imports. The provider used depends on the feature and import route.

Processing may send the submitted image, text, relevant recipe fields, source link or retrieved source content to those providers. If you report a failed import, our team may re-run it with what the report carries, using the same providers, to find and fix the problem. We do not deliberately attach your account email or account identifier to an AI content request, but content you submit may itself identify you or someone else. Review it before sending and avoid unrelated private information.

We use provider arrangements that do not permit training models on your submitted content. Providers may still process or retain requests for service delivery, safety, abuse prevention and legal compliance. We do not promise zero retention. Anthropic's standard commercial API retention is generally up to 30 days, with exceptions such as legal requirements, safety investigations or different agreed arrangements. Google's paid Gemini API terms permit limited safety and compliance logging without specifying a universal deletion period. Supadata may cache results from public sources. Contact us about a deletion request affecting provider-held information so we can assess and action it with the relevant provider.

We explain applicable AI processing and obtain permission before sharing personal information with third-party AI where required. An import or nutrition result is not reviewed by a human as a matter of course.

Who receives information

• Google/Firebase: authentication, cloud storage and databases, server processing, security and operational services; Gemini for the processing described above.
• Anthropic: image/text recipe and nutrition processing described above.
• Supadata: submitted public-source links and transcript processing for relevant imports.
• Apple and RevenueCat: App Store purchasing, subscription status, access and restoration. Apple also handles sign-in if you choose it.
• Postmark: transactional and opted-in email delivery, including addresses, message content and delivery/suppression information.
• Cloudflare: website and sharing-link delivery, security and network processing.
• Fastmail: our support mailbox, including email addresses, correspondence, attachments and related email information needed to receive and respond to your support, privacy and copyright requests. Authorised personnel have access only where needed to handle those requests and operate the service.
• Other users and external sharing services: the content you choose to share, as explained below.

We may disclose information where law requires it, to respond to valid legal process, or where reasonably necessary to protect legal rights or people from serious harm. We assess the request and limit disclosure to what is appropriate. We do not give advertising networks your private recipe library.

Sharing and the public-source cache

Creating and sending a recipe link lets others with that link see a public title-and-branding preview. Links can be forwarded. A recipient needs an account to receive a recipe. A source recipe may be re-imported for the recipient or eligible fields may be delivered as a copy. Private notes are excluded.

You can revoke a link. Revocation and account deletion stop future use of your active links but do not recall recipes already saved by recipients. Messaging services and other third parties may retain previews under their own policies.

We temporarily reuse eligible processed public-source recipe results to speed up repeat imports. This cache is separate from your saved private library. It excludes private uploads, scans, personal edits and in-app-browser captures, and does not include account identifiers or personal URL parameters. Entries cannot be reused more than 30 days after they were first created from freshly fetched and processed material; reuse does not restart that clock. Expired entries are removed automatically and may be removed earlier. We do not describe the cache as anonymous merely because account identifiers are excluded. Contact us about affected content.

Website and email choices

The public website and sharing pages process technical request information for delivery and security. The web app at prepandchef.com/app lets you sign in and view your library. Your browser keeps your sign-in until you sign out. The web app holds your library in memory while it is open and does not save it to your browser's storage, although your browser may keep ordinary cached copies of pages and images under its own settings. The web app also stores navigation state in your browser, including library search text and your account identifier, so Back and reload can restore your view. These history entries can remain after you sign out. Following a link to an external source brings that source's own privacy practices into play.

The launch website has no waitlist or email signup form. Optional marketing requires a separate choice; account creation or purchase does not subscribe you. Unsubscribe through the link in an email or contact us. Necessary account, security, purchase and legal communications are separate from optional marketing.

We do not add advertising pixels or cross-app tracking merely because we advertise Prep and Chef. Any future change to data use must follow the relevant notice and permission requirements.

Retention and deletion

We keep information for the purposes described here, then delete it or remove identifying details when those purposes no longer require it. Retention depends on the record, not one period for everything.

• Account and saved content: kept while needed to provide your account. Once we accept your deletion request, your account closes immediately and cannot be reopened. There is no recovery window or cancellation of an accepted deletion. We then process deletion of your account data in the background; closure is not confirmation that all deletion work has finished. Read Delete Account for the process, subscriptions, offline copies and retained-record exceptions. Requests requiring a different legal response are handled through our privacy contact.
• Deleted files: after a file is removed from active Cloud Storage, our configured seven-day recovery retention applies before permanent removal. These recovery copies are unavailable in normal app use and do not provide a way to restore a closed account.
• Temporary processing data: account-specific photo-processing results have a seven-day reuse limit. Temporary nutrition results are private to your account and can be reused for up to 90 days. They are removed through scheduled cleanup after expiry, after deletion of the related recipe, or as part of permanent account deletion. Shared public-source recipe results have a fixed maximum reuse period of 30 days. Logical expiry stops reuse even if physical cleanup is still pending. Your saved recipes and saved nutrition insights are governed by your library's lifecycle, not those cache periods.
• Routine import diagnostics: routine import measurements, including recorded source addresses, have a 30-day use limit from the event. Pending diagnostic uploads are kept privately on your device and removed after delivery is acknowledged, or on the next use once expired. The server measurements and private records needed to handle their delivery and privacy requests are removed through scheduled cleanup after expiry, or as part of permanent account deletion. Retrying delivery does not restart the period.
• Temporary support-report uploads: when you send a report (by tapping Report on a failed import, or Submit in Report Problem), its content and photos are held in a private device queue for up to 24 hours to retry delivery. Retries do not restart this period. Expired upload copies are removed when the app can next access the queue; an inactive or locked device may delay physical removal. Incomplete server reports expire 24 hours after first receipt and are removed through scheduled cleanup. Retrying does not extend that period. The deleted-file recovery period above also applies to uploaded photos. Successfully submitted reports follow the separate period below.
• Support-delivery records: ordinary delivery and retry records on your device, including the report reference, account association, dates, status and attempt counts, have a 30-day limit from sending the report, shortened by a confirmed earlier server-report expiry. Retries do not restart the period. Expired records are removed when the app can next access its queue. This bookkeeping is separate from report content and the minimal support history below.
• Submitted support reports: the content of an in-app support report, including any recipe text, photos and source link it carries, is available to our support team for up to 30 days from when we first receive the report. Completing submission, retries or staff review do not restart this period. Access ends at expiry and scheduled cleanup removes the report and its attachments. Re-runs of a reported import use a staff test account, are not added to your library, and are deleted once we're done, within the report's 30 days. You can request earlier deletion. This does not delete the original content saved in your recipe library. The deleted-file recovery period above also applies to report photos.
• Minimal support history: we keep the report reference, account association, relevant dates and necessary delivery or resolution status for up to three years from first successful submission, to identify earlier reports and support follow-up. This history does not contain your report message, recipe text, photos or source links. Later contact, status updates and access do not restart the period. You can request earlier deletion of this history; it is also included in permanent account deletion. Expired history is removed through scheduled cleanup.
• Privacy-request records: we keep a minimal record while handling an access, correction, deletion or objection request and for up to three years after the case closes. It records the request reference, type and how it was received, relevant dates, verification outcome, actions taken and response or denial reason. We use it to handle requests, demonstrate compliance and improve our privacy-request procedures. This allowance does not cover identity-document copies, exported account data or recipe content. Reading the record, administrative updates and unrelated later requests do not restart the period. The minimal record may remain after account deletion where needed and legally permitted to demonstrate compliance. Specific legal requirements or unresolved matters may require limited longer retention.
• Account data on your device: when you sign out, switch accounts or close your account on a device, or the device finds that your sign-in has ended, the app removes that account's recipes, photos, lists, account settings and unsent changes from that device. The next person to sign in cannot see them. The app warns you before a sign-out or switch discards unsent changes, or tells you when it cannot check. A plain sign-out keeps pending import diagnostics and support reports, within the limits above, and small markers the app uses when you return; closing your account on the device removes these too. Closing your account does not remotely erase your other devices. Another device removes the account's data only when it processes the end of its sign-in, so an offline device keeps its copy until then, and it may treat that ending as a plain sign-out, keeping the records a plain sign-out keeps. The app also keeps the minimal records it needs to recognise a closed account, keep subscription identities separate or finish a pending privacy request. Removal means the app can no longer read or restore that data; it does not securely erase the device's storage. A device backup made before the removal, such as an iCloud backup, still contains what was on the device then. If that backup is restored and a different account signs in, the app removes the earlier account's recipes, photos, lists, account settings and unsent changes before showing the other account's; the kept records described above remain.
• Optional marketing records: if you choose ongoing marketing, your subscription continues until you unsubscribe. Limited consent records may remain where needed to prove your choice. Email restrictions follow the separate rule below.
• Support correspondence: we keep ordinary support-email conversations while handling the issue and, while needed for customer-service continuity, for up to three years after it closes. This helps us understand earlier concerns, positive feedback and how issues were handled when you contact us again. Reading a conversation, ordinary account activity or an unrelated new issue does not restart its retention period. Recipe text and photos supplied for diagnosis have a separate 30-day limit from first receipt, including copies quoted or attached in support emails. You can request earlier deletion. We handle account-deletion requests across linked support correspondence, retaining only information still needed for a specific unresolved matter or legal obligation.
• Email-delivery records: we keep minimal records of automated service emails for up to one year after sending and automatic retries finish, to investigate delivery problems and support enquiries. These include the email type, dates, delivery outcome, necessary message and recipient references, and limited failure details. Viewing a record or receiving a later status update does not restart the period. This allowance does not cover full email bodies, sign-in codes or authentication links. Records needed to prevent unwanted email and support correspondence follow their separate retention rules.
• Email restrictions: we keep a minimal record for as long as needed to honour an unsubscribe, spam complaint or unresolved delivery block, including after account deletion. It contains only the recipient reference, applicable restriction, reason and necessary dates. It does not contain email bodies or preserve your account or private library. Marketing opt-outs and service-email restrictions are handled separately. Expiry of routine delivery records does not lift an active restriction. We update or remove restrictions when justified and permitted; records no longer needed for this purpose are removed.
• Logs and provider records: ordinary application logs use a 30-day retention setting; Google's required audit-log bucket uses 400 days. Security records are kept only as needed for security, a dispute or a legal requirement. Provider-held copies have separate retention arrangements and do not all expire with an account record.

Legal holds do not justify retaining an entire private library indefinitely. Backups and provider systems may take additional time to clear. We restrict their use during that period and honour applicable deletion deadlines. For covered consumer health data, the specific rights and deadlines in our health-data policy apply.

International processing and security

We operate from New Zealand and use providers in other countries, including the United States. Our current Firebase databases are hosted in the United States. Provider support, infrastructure and subprocessors may involve additional countries. Data-protection laws may differ from those where you live.

We remain responsible for our handling of your information. We assess overseas processing and use appropriate contractual and other safeguards where required; we do not treat your acknowledgement of this policy as a waiver of those protections.

We use access controls, authenticated account access and encryption in transit and provider-managed storage protections. No online system is completely secure. Contact us promptly about a suspected privacy or security issue. We assess incidents and notify affected people and authorities when the law requires.

Your choices, requests and complaints

You can edit information through available app controls, manage email preferences, revoke sharing links, cancel a subscription through Apple, or request account deletion. You may also email support@prepandchef.com to request access, correction or deletion or ask about other applicable privacy rights.

Consent withdrawal and objections: where we rely on your consent, you can withdraw it at any time by emailing support@prepandchef.com. You can also email us to exercise any applicable right to object to processing. We will stop the processing covered by your withdrawal and assess objections under applicable law. A privacy request does not itself cancel your account or subscription. We will explain any effect of withdrawing consent on a feature that needs the information. Processing needed to provide the features you request, administer purchases, protect security or comply with law may continue on an independent lawful basis. A withdrawal does not by itself request deletion of previously collected information; you can request deletion in the same email.

We may need proportionate information to verify your identity or an authorised representative's authority. We will explain any lawful reason we cannot fulfil a request. We do not require your password or sign-in code. Withdrawing permission does not undo lawful processing that has already occurred.

Under New Zealand's Privacy Act, we decide access and correction requests as soon as reasonably practicable and ordinarily within 20 working days. If a lawful extension is necessary, we tell you. Information we agree to provide is supplied without undue delay. You can complain to the New Zealand Privacy Commissioner.

Australian users may have access, correction and complaint rights under applicable Australian privacy law. You can contact the Office of the Australian Information Commissioner where it has jurisdiction. Our commitment to handling requests also applies when a particular statutory regime does not cover a small business.

US state laws may provide rights to access, correct, delete or obtain a copy of data, to use an authorised agent, and to appeal a refusal, depending on the law and its applicability. Send the request or appeal to our privacy contact; you may also contact your state attorney general or other relevant regulator. We do not retaliate for exercising applicable rights. See the separate health-data policy for covered health information.

Children and changes to this policy

Accounts and subscriptions are for adults aged 18 or older. We do not knowingly collect children's information for those services. If you believe a child has provided it, contact us so we can investigate and take appropriate action. This policy does not make the public website age-restricted.

We update this policy when our practices or requirements change and show the effective date above. We give appropriate notice of material changes and obtain permission where required before a new use. Updating a policy does not itself authorise a new purpose or remove an existing right.