Privacy Policy

Account information. When you sign up, we collect your email address. We use passwordless "magic link" authentication, so we never collect or store a password.

Recipe and pantry data. Recipes you save (manually entered or imported), pantry/fridge item lists, your shopping list, and any text or URLs (including YouTube video links) you submit for recipe extraction.

Photos you upload for AI import. If you use the photo-import feature, the photo is sent directly to our AI provider (Anthropic) for processing and is never stored by us — it is held in memory only long enough to extract the recipe or pantry data, then discarded. We do not retain a copy.

Payment information. If you subscribe, payment is handled entirely by our payment processor, Stripe. We do not collect or store your card number — we retain only subscription status metadata (e.g., plan, active/canceled status) needed to run the Service.

Contact form submissions. If you contact us via our contact form, we collect what you submit (your message and reply-to email) in order to respond.

Technical data. We may log IP addresses and basic request metadata for security purposes (e.g., rate-limiting sign-up requests to prevent abuse). We do not use this data for tracking or advertising.

Error/crash diagnostics. If something goes wrong while you use the Service, technical details about the error (the error message, stack trace, affected page, and your IP address) are automatically sent to our error-monitoring provider, Sentry, so we can identify and fix the problem. We don't use this for tracking or advertising, and we don't record your screen or session — see Section 3.

We do not use analytics or advertising trackers, and we do not sell your information.

• To provide the Service: storing your recipes and pantry data, matching what you can cook, and running AI-powered imports.
• To authenticate you via magic-link emails.
• To process subscription payments and manage billing.
• To respond to support requests.
• To prevent abuse (e.g., rate-limiting sign-up and import requests).

We share information only with the service providers ("subprocessors") that are necessary to operate Left 2 Cook:

We do not sell, rent, or share your data with third parties for advertising or marketing purposes.

We may disclose information if required by law, or to protect the rights, property, or safety of Left 2 Cook, our users, or others.

We retain your account, recipe, and pantry data for as long as your account is active. Uploaded photos for AI import are never retained — see Section 1.

Deleting your account. You can permanently delete your account at any time from your Account page. Deletion is immediate: as soon as you confirm, we delete your account, recipes, pantry items, and any active login sessions from our database — there is no waiting period. If you have an active subscription, it is canceled immediately as part of deleting your account, even if there is unused time remaining in your current billing period.

This immediate deletion covers the data we hold directly. It does not extend to records our service providers retain under their own policies — for example, Stripe retains billing and invoice history for financial record-keeping (often a legal requirement), and Resend and Vercel retain their own transactional-email and server logs for a limited period that we don't control.

Left 2 Cook is based in Australia, but our service providers — Anthropic, Stripe, Resend, Vercel, Cloudflare, and Sentry (see Section 3) — are based in and process data in the United States. This means your personal information is disclosed and transferred overseas whenever you use the Service.

We take reasonable steps to ensure these providers handle your data consistently with the Australian Privacy Principles (APPs). Each of these providers has confirmed data-transfer safeguards for our EU/UK users in their published Data Processing Agreements, incorporating the EU Standard Contractual Clauses (and the UK Addendum for UK transfers); Resend, Stripe, and Vercel are also self-certified under the EU-U.S./UK Data Privacy Framework. By using the Service, you consent to this overseas disclosure, which is necessary for us to provide the Service to you (e.g., we cannot run AI-powered import without sending your submission to Anthropic in the US).

Australian users. As a sole trader, Left 2 Cook's annual turnover is currently below the AUD $3 million threshold at which the Privacy Act 1988 (Cth) generally applies to a business, meaning we may fall under the "small business" exemption. Regardless, we've written this policy to reflect the Australian Privacy Principles (APPs) as best practice. You can ask us to access, correct, or delete the personal information we hold about you at any time via our Contact page. If you're not satisfied with our response, Australian users can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Other jurisdictions. Left 2 Cook has users outside Australia, and where mandatory local law grants you further rights, those rights apply in addition to the above:

• California residents: Under the CCPA/CPRA, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.
• EU/UK/EEA residents: We process your data on the basis of contract necessity (to provide the Service you signed up for) and legitimate interest (fraud/abuse prevention). You have the rights described above (access, correction, deletion, portability, objection) under the GDPR/UK GDPR, and can lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us via our Contact page. We aim to respond within the timeframe required by applicable law (e.g., within 30 days).

Left 2 Cook is not directed at, and is not intended for use by, children under 13 (or under 16 in jurisdictions where that is the relevant age). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

We use only strictly necessary cookies required to keep you signed in (session/authentication cookies). We do not use analytics, tracking, or advertising cookies, so no cookie consent banner is required.

We take reasonable technical and organisational measures to protect your data, including passwordless authentication, server-side session management, and the ability to revoke sessions from your Account page. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (e.g., by email or a notice on the Service). Continued use of the Service after changes take effect constitutes acceptance.

Questions about this Privacy Policy or your data? Reach us via our Contact page.