DishBinder Privacy Policy

Effective date: 2026-10-08

DishBinder (“we”, “our”, “the app”) is a recipe, meal-planning and food-log app made by Duskfield Studios LLC. This policy explains what we collect, why, who else receives it, how long we keep it, and your rights.

1. Information we collect

Account: your email address, your name (optional), a password hash (bcrypt — we never store your password itself), and, if you sign in with Google or Apple, the account identifier that provider gives us. If you choose a profile photo, we store it.

Date of birth check: at sign-up we ask for the month and year you were born, only to confirm you are old enough to use DishBinder. We check it and discard it — it is not stored.

Onboarding and preferences: your goals, diet styles, allergies, household size, favourite cuisines, dietary restrictions, disliked ingredients, cooking skill level, timezone, and unit system.

Nutrition targets: calorie, protein, carbohydrate, fat, fibre and water targets, and — if you use the targets calculator — the age, sex, weight, height, activity level and goal weight you enter.

Your recipe library: recipes (titles, descriptions, ingredients, instructions, source URLs, notes, tags, ratings, photos), collections, grocery lists and purchase history, meal plans and templates, pantry items, and leftovers.

Food log: what you eat and drink, when, its nutrition, and any meal photo you add.

Health data you connect: on iPhone/iPad (Apple Health) or Android (Health Connect), if you grant permission — see section 4.

Dining out: if you use restaurant suggestions, the ZIP code, search radius and restaurant chains you choose.

Household: if you create or join a household, the household membership and the email addresses of people you invite.

AI usage: a per-day count of AI requests per feature, for usage limits. We do not keep the text of your Chef-chat conversations on our servers; the app holds the conversation only while you are using it.

Subscription: which store handled your payment (Stripe, Apple or Google), your plan, status, billing period, and the store’s customer, transaction or purchase identifiers. We never see card numbers or store passwords.

Device and technical data: a push-notification token if you enable notifications; on the mobile app, a one-way hash of a device identifier (Android’s device ID or an install ID on iPhone), used only so each person gets one free trial; IP addresses, which our servers use for rate limiting and which appear in server logs; and crash and error reports (section 3, Sentry).

2. How we use your data

• To run the recipe library, collections, grocery list, meal planner, pantry and food log
• To import recipes from links and videos you give us, and to look up nutrition and products
• To power the AI features (Chef chat, recipe generation, meal plans, photo reading, nutrition estimates)
• To send email you need or ask for: sign-up verification, password reset, your welcome email, your data export, and recipe, cookbook and household invitations you send
• To send push notifications you allow (reminders, trial ending)
• To take payments through Stripe, Apple and Google and keep your access in sync across devices
• To give each person one free trial, and to protect the service from abuse
• To find and fix errors

We do not use your data for advertising, and we do not sell it.

3. Who else receives your data

These companies process data for us, each only for the purpose shown.

• Google Gemini (Google LLC) — our main AI provider. Receives the text you send to Chef chat and the recipe, meal-plan and nutrition features, the preferences used to personalise them (dietary restrictions, allergies, dislikes, skill level, calorie target, pantry items), any photo you ask us to read (a recipe card, cookbook page, receipt, pantry shelf or meal), receipts you paste, and videos you import a recipe from. Your email and name are not sent. Google’s privacy policy.
• Groq and DeepInfra — backup AI providers, used only when Gemini is unavailable; they receive the same kind of request. Groq · DeepInfra.
• Nutrition and product databases — USDA FoodData Central, Open Food Facts and FatSecret receive the food names and barcodes being looked up (never your identity).
• Google Places — receives the ZIP code and radius when you ask for restaurant suggestions.
• Pexels — receives a recipe title when we look for a stock photo for a recipe without one.
• YouTube and X (Twitter) — when you import a recipe from a video or post, we fetch it from that service.
• Recipe websites — when you import a recipe by link, we fetch the page from the site you gave us, and recipe photos from other sites may load directly from those sites.
• Stripe (web payments), Apple (App Store) and Google (Google Play) — handle subscriptions and send us the identifiers above. Stripe’s privacy policy.
• Sign in with Google / Apple — if you use them, they confirm your identity and email to us. Their sign-in scripts load on our sign-in pages.
• Resend — sends our emails (section 2), including your data export, which contains your account data. Resend’s privacy policy.
• Expo (650 Industries) — delivers push notifications to Apple Push Notification service and Google Firebase Cloud Messaging, and delivers app updates. Push messages contain the reminder text (for example, items expiring in your pantry).
• Railway — hosts our servers, database and cache.
• Cloudflare — serves our website, stores the photos you upload (R2), and counts page views on the website with Cloudflare Web Analytics (no cookies, no cross-site tracking).
• Sentry — receives crash and error reports from the app, website and server. We configure it not to send your recipes, food log, chat text, request contents or page query strings.

Our website loads no advertising or social-media trackers, and our fonts are served from our own domain.

4. Health data, and the consent we ask for

Some of what DishBinder stores is health data under Washington’s My Health My Data Act, Nevada SB 370, and (in the EU/UK) Article 9 of the GDPR: the food you log and its nutrition, your weight and body measurements, activity and energy synced from Apple Health or Health Connect, your calorie and macro goals, and the allergies and dietary restrictions you enter. Some of it is sent to our AI providers (section 3) to generate recipes, plans and estimates.

We ask for your explicit consent to process it — a separate, unticked checkbox at sign-up, not bundled into the Terms. That consent is our lawful basis under GDPR Art. 9(2)(a). We record when you gave it and which version of the notice you saw, and if we change the notice materially we ask again.

You can withdraw it at any time in Settings → Your data. DishBinder cannot work without this data, so withdrawing pauses the app until you agree again or delete your account.

Apple Health and Health Connect are optional and only connect after you allow them in the system prompt. We write the nutrition and water you log, and we read your weight, body fat, energy burned, exercise minutes and steps. Only a daily summary reaches our servers, and only while connected. You can disconnect in Settings or in your device’s Health settings. We never use health data for advertising and never sell it.

5. Sharing recipes publicly

Sharing a recipe or cookbook (a Premium feature) makes it public: anyone can find it, including through search engines, and we list shared recipes on our website and notify search engines about them. A shared page shows the title, description, ingredients, instructions, photo, and your name as the person who shared it — not your notes, tags or ratings. Sharing a cookbook shares each recipe in it. You can only share recipes you added. Stop sharing at any time from the recipe or cookbook; search engines may take a little while to drop the page.

In a household, recipes you add are visible to the other household members.

6. Security

• Passwords are hashed with bcrypt
• All traffic uses HTTPS / TLS
• Sign-in tokens are kept in the iOS Keychain / Android Keystore on mobile, and in your browser’s local storage on the web
• Rate limiting and account lockout against password guessing
• Security headers on the website and API
• Daily database backups by our host

7. Data sharing

We do not sell or rent your data and do not share it for advertising. We share it only with the processors in section 3, with people you choose (household members, people you send recipes or invitations to, and anyone who opens a recipe you shared publicly), and with authorities when the law requires it.

8. How long we keep data

• Your account data: while your account is open.
• When you delete your account: you are signed out at once, a web subscription stops renewing, and after a 7-day window (in which you can change your mind by signing back in) your account and everything in it — recipes, photos, food log, health data, subscription records — is permanently deleted.
• To keep the one-free-trial-per-person rule, we keep the normalised email address and the hashed device identifier from your sign-up after deletion. They are not linked to anything else.
• Server logs (which include IP addresses): up to 30 days.
• Database backups: deleted data can remain in our host’s backups until those backups expire.
• Payment records: Stripe, Apple and Google keep their own records under their policies.

9. Your rights

Wherever you live, you can:

• Access / export your data — Settings → Your data → Export my data emails you a file of your account data
• Correct it — edit it in the app, or ask us
• Delete it — Settings → Danger zone → Delete account, or email us
• Withdraw consent for health data — Settings → Your data
• Unsubscribe from emails — every invitation or share email has an unsubscribe link
• Not be treated differently for using these rights

California, Washington, Nevada, EU and UK residents have these rights under their laws; EU/UK residents can also complain to their data protection authority. Email support@duskfieldstudios.com; we respond within 30 days (45 where the law allows).

10. Children

DishBinder is not for children under 13, and sign-up checks this. We do not knowingly collect data from children under 13. If you are a parent or guardian and believe your child under 13 has an account, email support@duskfieldstudios.com with the account’s email address; we will confirm the request with that address and delete the account and its data. Users aged 13 to 17 need a parent’s or guardian’s permission.

11. Recipe content disclaimer

Recipes in DishBinder are written by users, imported from other sites, or generated by AI. They are not nutritional, dietary or medical advice, and we do not check them for allergens or food safety. If you have allergies or dietary needs, check every ingredient yourself.

12. Changes

We will tell you about material changes in the app or by email at least 14 days before they take effect, and update the effective date above.

13. Contact

Duskfield Studios LLC, 2108 N St Ste N, Sacramento, CA 95816 · support@duskfieldstudios.com