Before launch: the controller entity, its registered address and its EU/UK representative still need to be filled in. Everything marked [to confirm] is a placeholder, not a finished commitment.
1. The short version
- There is no account. No name, no email address, no password, no profile.
- Your pantry, cookbook, meal plans and taste profile are stored on your iPhone and/or iCloud (opt-in). We keep no copy.
- Nothing about your food is sent anywhere until you agree to it, and you can withdraw that agreement in Settings › Privacy.
- When you ask Ratatouille to plan a day, read a receipt or size up a meal, the text of that one request goes to our server and from there to an AI provider. It carries no name, no email address and no location.
- We do not store your requests or the answers to them. What we store is a counting ledger — which install asked, which endpoint, how many tokens, what it cost — and raw rows are deleted after 30 days.
- There is no advertising, no analytics SDK and no tracking of any kind. We sell nothing to anybody.
2. Who is responsible
We act as the controller for the personal data described here under the UK and EU General Data Protection Regulation.
- Privacy questions and requests: [email protected]
- Everything else: [email protected]
3. What stays on your iPhone
The app is local-first. The following is held in the app's own container on your device and is never sent to us:
- your pantry, its levels and its log, leftovers and the shopping list;
- receipt photographs (but see §4 for the one case where a photo is sent);
- saved recipes, your cookbook, and what you told the app you cooked;
- your taste profile, your dietary answers and what the app has learned;
- meal plans, timers, reminders and widget snapshots.
If you turn on iCloud sync, this is mirrored into your own private iCloud database, encrypted, under your Apple Account. That is Apple's storage and yours — we have no access to it and cannot read, export or delete it.
If you connect Apple Health, the app writes what you cooked into Health on your device. Health data is never sent to our server or to an AI provider.
Speech is turned into text by your iPhone's own on-device dictation. Your voice is never transmitted.
Deleting it: Settings › Privacy › Delete everything on this device erases the lot. It cannot reach your own iCloud copy, your Apple Health samples or your Reminders — those are yours to remove in Apple's own settings — and the screen says so.
4. What Ratatouille sends, and when
Nothing leaves your iPhone until you tap something that needs a model, and not even then until you have agreed on the "Where your answers go" screen.
| When you | What is sent | To |
|---|---|---|
| Scan or share in a receipt | The text recognised on your device. If recognition is off or finds too little to work from, the photo itself (JPEG) | Our server, then an AI provider |
| Type what you bought | The words you typed | Our server, then an AI provider |
| Plan a day, refine a meal, ask about leftovers | The relevant pantry items, your dietary answers and preferences as food terms, what you cooked recently, and the request you tapped | Our server, then an AI provider |
| Ask for a nutrition estimate | The dish and its ingredients | Our server, then an AI provider |
| Share in a recipe from a web page or a social post | The link. Our server fetches the page — your phone does not, so the site sees us and not you | Our server, then an AI provider |
| Scan a barcode | The digits under the barcode, and nothing else. Asked only after a separate permission screen | Open Food Facts (directly from your phone), or our own copy of their public database |
| Open a saved recipe that came from a web page | A request for that site's icon, from your phone, so the site can see your IP address. Nothing is stored | The recipe's own website |
It is food text. It carries no name, no email address, no contact list, no location and no advertising identifier — the app never collects any of them.
Receipt photographs sent under the first row are held in memory, forwarded to the model and dropped. They are never written to disk on our server and never written to a log.
5. The identifiers we use instead of an account
| Identifier | What it is | Why |
|---|---|---|
| Device identifier | A random value created when the app first proves, through Apple's App Attest, that it is a genuine copy of Ratatouille on a genuine iPhone. It carries nothing about you, and reinstalling produces a new one | To apply fair-use limits and block abuse |
| Session token | Issued for 24 hours, stored by us only as a hash | To authenticate requests |
| Subscription hash | A keyed one-way hash (HMAC-SHA256, truncated) of the transaction identifier in the purchase receipt Apple signed for your subscription. We check Apple's signature, hash what is inside, and never store the identifier itself | To apply fair-use limits and block abuse |
| Client version | For example ios/0.55.1 | To understand the performance of our builds and adoption rate. |
The subscription hash is stable — it is the same after a reinstall and the same on your other devices. It tells us no name, no email address and no Apple Account; Apple does not give us those and we do not ask. It is used for fair-use limits and abuse, and for nothing else.
None of the data we collect identify you by name, it is pseudonymous.
6. What our server stores — and what it never stores
It never stores your prompts or the answers.
What is stored is one ledger row per request and the records that make the service work:
| What | Kept for |
|---|---|
| Ledger rows: timestamp, device identifier, subscription hash, endpoint, model, token counts, cost, latency, success or failure | 30 days, then deleted |
| Daily totals per device and per subscription (counts and cost only) | Retained as aggregates |
| Device record and hashed session tokens | While the install is active; tokens expire after 24 hours and are swept |
| Subscription record (the hash, its status and when Apple's signature was last checked) | While the subscription is live, then 180 days. |
| Repeat-request cache, so a button tapped twice is not billed twice | 24 hours |
| Attestation challenges | 60 seconds |
| Web-server access logs: IP address, path, status, timestamp — never a request body | 360 days |
7. Legal bases
| What | Basis |
|---|---|
| Sending your food text to our server and on to an AI provider | Consent, Art. 6(1)(a) — given on the "Where your answers go" screen, withdrawable at any time in Settings › Privacy |
| Sending a barcode to Open Food Facts | Consent, Art. 6(1)(a) — a separate screen on your first scan |
| Running the app you paid for: verifying your subscription, issuing sessions, returning the answer you asked for | Contract, Art. 6(1)(b) |
| Fair-use limits, abuse prevention, security logs, cost control | Legitimate interests, Art. 6(1)(f) — server security. |
| The waitlist email address on our website | Consent, Art. 6(1)(a) |
Withdrawing consent stops the AI features; the pantry, shopping list, timers and saved recipes keep working. Withdrawal does not undo what was lawfully done before it.
You cannot switch off the device identifier and the subscription check in §5 — it is integral for the functioning of the app.
Special Categories of Data. We do not intend to process special-category data under Art. 9 and will try our best to redact it before it reaches our servers. If you type something into a free-text field that reveals it anyway, our basis is your explicit consent under Art. 9(2)(a), given on the same screen.
8. Who else receives it
| Who | What they get | Role |
|---|---|---|
| Apple, (Apple Inc. USA) | Your payment, your Apple Account and your App Store purchase. We never see your card, your billing address or your Apple Account — only whether a subscription is active, and a signed transaction we hash. Apple also runs App Attest, and tells our server when a subscription is refunded or cancelled. Separately, if you have turned on Share With App Developers in iOS Settings › Privacy & Security › Analytics & Improvements, Apple gives us aggregated usage statistics and crash reports; they do not identify you, and we cannot turn them on for you | Independent controller for the purchase; Apple's own privacy policy applies |
| RevenueCat (RevenueCat, Inc., USA) | Runs our subscriptions and draws the paywall. It receives the transaction Apple signed for your purchase, an anonymous identifier its own SDK generates for the install ($RCAnonymousID:… — nothing logs you in), and ordinary app and device metadata such as app version, platform and country. No name, no email address, no card, and nothing about your food. Apple's subscription notifications now reach our server through RevenueCat, unaltered. We keep its anonymous identifier beside the install record so that a support request can be matched to a purchase; nothing about access, limits or blocking is decided from it | Processor |
| OpenRouter (OpenRouter, Inc., USA) | The food text of a single request, and the answer. No device identifier, no subscription hash, no account — the request reaches them from our server, not from your phone. OpenRouter states that it does not train on inputs, and that each model provider behind it has its own data policy; we use providers that offer zero data retention wherever possible. | Processor for the content of the request, under the data processing terms incorporated into its terms of service |
| Hostinger (Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus) | Runs the virtual server holding everything in §6, and hosts this website. Under Hostinger's data processing addendum, with its own sub-processors listed there. Server region: UK | Processor |
| Cloudflare (Cloudflare, Inc., USA) | Answers DNS for getratatouille.dev and protects the server from attack. Requests to the website and to our API pass through it, so it sees connection metadata — IP address, timestamp, the address requested — and uses it to filter abusive traffic, under Cloudflare's own data processing addendum. No Cloudflare analytics script runs on the site and no Cloudflare cookie is set; the only figures we are shown are counts of DNS queries, which are about domain names and not about people | Processor |
| Open Food Facts (21 rue des Îles, 94100 Saint-Maur-des-Fossés) | The digits under a barcode, asked directly by your phone, so your IP address reaches them. Only after you agree on the barcode screen. Their own privacy policy governs what they do with it, and it says technical logs including IP addresses may be kept for up to three years | Independent controller |
| Email delivery for the waitlist | [TO CONFIRM — provider] | Processor |
Model providers may cache the fixed opening part of our prompt — our own instructions, the same bytes for every user of the app — to make a request cheaper. The part of the request that is about you is deliberately left outside that cached section.
We do not sell personal data, we do not share it for advertising.
9. Your rights
If you are in the UK, the EU or a place with equivalent law, you have the right to access, rectify, erase, restrict, port and object, to withdraw consent at any time, and to complain to your supervisory authority (in the UK, the ICO; in the EU, the authority where you live).
Two honest notes about how that works here:
- Most of it, you already hold. Your pantry, recipes, plans and profile are on your iPhone, editable and deletable without asking us — Settings › Privacy › Delete everything on this device.
- We usually cannot identify you (Art. 11). A device identifier and a one-way subscription hash are all we have, and neither can be turned back into a person. To act on a request about our server records we need something that lets us find the rows: a request made from the app itself, or the original transaction identifier of your subscription, which you can obtain from Apple and which we can hash to locate — and only to locate — your rows.
We answer within one month and charge nothing.
10. AI, and automated decision-making
Ratatouille uses AI models to write meal plans, read receipts and estimate nutrition. You are interacting with an AI system, the app says so where the suggestions appear, and the recipes it shows you are machine-written: check anything that matters, particularly if you are avoiding an ingredient.
These are suggestions about food. There is no profiling that produces legal or similarly significant effects, and no automated decision within the meaning of Art. 22 GDPR.
11. The website and the waitlist
getratatouille.dev sets no advertising or analytics cookies and carries no tracking pixels. It stores two things in your own browser, both needed for the page to do its job: a note that you already joined the waitlist, and a short-lived token that stops bots submitting the form.
12. Changes
We reserve the right to change this policy at our discretion. Your continuous use of the app constitutes you continuous consent with the current version of this policy. The previous version is available on request.