Privacy policy

Last updated: 12 October 2026.

Scullery is a recipe organizer and kitchen decision app, currently in beta. This policy describes how we handle your information today. Because we are still in beta, some of the practices below are handled by hand rather than by self-serve tools, and we say so where that is the case.

Scullery is an early-stage project run by its founder from the Netherlands ("Scullery", "we", "us"). It is not yet operated through a registered company; when a legal entity is registered, we will name it here. If you have any question about your data or this policy, write to us at [email protected].

What we collect and why

We collect what we need to run your account, your household cookbook, and the features you use. In plain terms, this falls into a few groups.

Account and identity. When you create an account we store your name, email address, whether your email is verified, an optional avatar image, and account timestamps. If you sign in with a password we store a secured hash of that password, never the password itself. If you sign in with Google we store the tokens Google returns so we can keep you signed in (more on Google below). We use this to identify you, sign you in, and verify your email.

Sessions and security. To keep you logged in and to protect accounts, we record session tokens and their expiry, a shortened form of the IP address (we zero the last part rather than store the full address), and the browser (user agent) used for a session. We keep short-lived tokens for email verification and password resets.

Household and collaboration. A household has a name, an optional logo, and a unit-system preference, plus a record of which people are members and their role. When you invite someone, we store the invitee email, who invited them, and the invitation status so we can send and track the invite. If you asked for early access before public signup opened, we still hold the email you submitted (and a normalised version of it), where the request came from, and any note you left, until the retention periods below remove it.

Your recipes and cooking content. This is the heart of Scullery and it is private to your household. It includes recipes you save (title, description, ingredients, images, servings and timing, tags, and, for imported recipes, the source link and source details), your private kitchen notes and your household's private copy of cooking instructions, favourite and disliked flags, star ratings, cook history (what you cooked and when), shopping lists and items, recipes saved to try and Ideas (including notes, source links, captured snippets from a source, and stored media), and your household taste profile and recipe reactions. When you use Cook Mode we also record the cooking session itself (when it started, how far through the steps you got, and when it was last active) so we can ask you later whether a cook you did not confirm actually happened, and we stamp cook activity with a coarse country code derived from your network connection (the country only, never a precise location; it is stored for aggregate insight and not shown anywhere). We use this to run your cookbook and to personalize discovery for your household.

Ratings. Your household's star ratings stay in your household, with one exception: rating a recipe from Other kitchens counts towards that recipe's average. Other households see only the average and how many households rated it, and only once at least three have. No one sees which household or person gave a rating.

Imports from the web and social. When you choose to import a recipe or save an idea, we fetch the page or post you point us at (including recipe websites and TikTok, Instagram, or YouTube content) and store the source URL, the recipe text or structured data we find, captions, author or creator names, and source images. For personal imports, we only fetch links you submit, and our fetcher is restricted to public web addresses over standard web protocols.

The Scullery browser extension. If you install our Chrome extension, it does nothing until you click its button. When you click it on a page, it reads that page's address and content and hands them to Scullery in a new tab, where we import the recipe into your household as above. When you click it, the extension also checks with Scullery which account you are signed in to, so it can tell you; it keeps nothing. It does not read other tabs or pages you visit, keeps no browsing history, holds no sign-in details of its own, and sends nothing anywhere but Scullery.

Other kitchens contains references to recipes on public websites. When assessing a link for Other kitchens, we may inspect cooking instructions long enough to confirm that the page contains a usable recipe, but we do not keep the source description or instruction text in Other kitchens or its review records. If you choose a link in Other kitchens, we try to retrieve the current instructions directly from its source for your private draft. Instructions you then save are private content in your household.

Operational, security, and compliance records. To run the service safely we keep operational event logs (such as actions, outcomes, and request identifiers), records of paid third-party API usage for our cost controls (where the recipient is stored as a hash, not a readable address), admin audit records (which can include an admin's email, the action taken, and the request IP and browser), moderation records, and any copyright, abuse, or privacy notices people send us (including the reporter's name, email, and the action requested).

How we use your information

We use the data above to provide and operate Scullery: to run your account and household, save and organize your recipes, power import and the AI features described below, send the transactional emails you need, keep the service secure, control costs, handle abuse and takedown notices, and meet our legal obligations. We do not sell your personal data, and we do not use it to show you third-party advertising.

AI features and how your content is used

Several Scullery features use Google Gemini, an AI service from Google. When you use them, we send the relevant content to Google to process. This can include recipe text, ingredients and instructions, captions or snippets from a source you imported, and image bytes (such as recipe photos, idea media, or a screenshot you upload). We use this for safety screening of images, analyzing and tidying recipe content, summarizing sources, classifying tags, polishing instructions, mapping ingredients to steps, and generating recipe images.

We send this content to Google Gemini to provide these AI features, such as tidying recipe instructions, classifying tags, and generating recipe images. Google processes it under the Google APIs Terms of Service and Google's Privacy Policy.

These AI calls only run for signed-in users and are bounded by usage limits we set to control cost and abuse. If a limit is reached, the feature is either skipped quietly (your recipe still saves) or asks you to try again later.

Who we share data with

We do not sell your data. We share it only with the service providers we rely on to run Scullery, and only to the extent each needs to do its job.

Google Gemini receives the recipe content and images described in the AI section above, to process AI features.

Brave Search provides the web results in recipe search. When you search for a dish while signed in, our servers send Brave the words you typed and the names of any favourite recipe sites you saved. Brave does not receive your account details or your IP address.

Resend is our transactional email provider. It receives a recipient email address and the message content for emails such as email verification, password resets, and household invitations.

Google receives your sign-in details only if you choose Sign in with Google. In that case Google handles the sign-in, and we receive and store the account identifier and tokens, along with the profile email, name, and avatar Google provides.

Cloudflare provides our DNS and proxy layer, so inbound traffic to Scullery passes through Cloudflare, which processes visitor IP addresses, request details, and the secure (TLS) connection. Cloudflare also stores the recipe images Scullery saves and serves, on our behalf, through its R2 object storage.

Hetzner is our hosting provider. The servers and the database that hold the data described in this policy run on Hetzner infrastructure located in Germany, inside the European Union.

When you import a link, the recipe site or social platform you chose receives a request from us for that URL. These are content sources you point us at, not partners we share your account data with.

Analytics

On our public pages (the home page, FAQ, articles, method and the Mealime import), and on the account pages (sign-up, sign-in, and the page that confirms a new account), we use Umami, a privacy-first analytics tool we host on our own servers, to understand general traffic and which calls to action people use. Umami is cookieless, keeps the data on our own infrastructure, and does not track you across sites, and we do not send it personal details. We do not run Umami on your cookbook, shopping list, plan, or cook pages. When you follow a link to a recipe's original source, we count that click anonymously. We record the destination site and which recipe, never who clicked. We do not use Google Analytics, advertising pixels, or session-recording tools.

How long we keep data

Sessions and verification or reset tokens expire automatically. When you remove content such as a recipe, an idea, or a shopping item, we usually archive it rather than erase it immediately. When an account or a household is deleted, the data tied to it is removed, while some audit and compliance records are kept with the personal actor reference cleared.

A scheduled job also enforces fixed retention periods. Expired sign-in sessions and expired verification or reset tokens are deleted within two days of expiring. Household invitation records are deleted 30 days after the invitation expires. Early-access requests we decline are deleted after 6 months, and requests that stay unanswered are deleted after 12 months of no activity. Operational logs are kept for up to 12 months, administrative audit records for up to 24 months, and records of our usage of paid providers for 7 days.

Being honest about beta: stored images are not yet on an automated cleanup schedule of their own; they are removed when the content they belong to is removed. If you want your data removed sooner, contact us (see "Your choices and rights").

How we protect your data

We take reasonable measures to protect your information. Passwords are stored only as secured hashes, traffic is served over encrypted connections, and our link-fetching is restricted to block requests to private network addresses. No service can promise perfect security, and we will not claim guarantees or certifications we cannot stand behind today.

Your choices and rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain uses. We want to honour these requests.

Inside the app you can delete individual recipes, ideas, shopping items, and invitations, and you can remove a member from a household. From the Settings page you can also request a copy of your data. An administrator reviews the request, and once approved we email a machine-readable JSON file to your account address. It includes your account details, households, recipes, meal plans, taste profile, shopping lists, and cooking history. You can also delete your account from Settings.

Deleting your account is a two-step process designed to protect you from accidents. When you confirm the request, you are signed out everywhere and your account is deactivated right away; we email you the deletion date. For the next 30 days you can change your mind by signing back in and choosing Restore. After the 30 days, once any active data export request has been resolved, the deletion is permanent: your sign-in details and verification tokens are removed, and households where you are the only member are deleted with everything in them, including recipes, meal plans, shopping lists, and stored images. Households you share with other people stay with them: the shared cookbook remains, your personal attribution on it is cleared, and if you were the only admin, the longest-standing member takes over that role. As described under "How long we keep data", some audit and compliance records are kept with the personal actor reference cleared. If you want your data removed sooner than the 30-day window, or anything does not work, email [email protected] and we will action your request by hand.

Copyright, privacy, and abuse notices

If you believe content on Scullery infringes your rights or should be removed, you can send us a notice and we will review it. Please include enough detail for us to act, such as the link in question and what you are asking for. Send notices to [email protected].

Children

Scullery is not intended for children. The service is for adults managing a household kitchen, and you should not create an account or use Scullery if you are under the age required to do so in your country. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will remove it.

Changes to this policy

As Scullery grows out of beta, this policy will change. When we make a meaningful change we will update this page. We encourage you to check back before relying on any specific point.

Contact us

For any question about your data or this policy, email us at [email protected]. For general enquiries, use our contact page.

This policy is governed by the laws of the Netherlands, where Scullery is operated.