Privacy Policy

Effective October 7, 2026

Recipe Box (at app.bakfan.com) is a small app for recipes, meal plans and grocery lists, made by one person as a hobby. This page explains, in plain language, what it keeps, where that goes and how to delete it.

Your recipes, plans and lists are yours. They aren't sold, shared for advertising or used to train AI.
Without an account, everything stays on your phone, unless you turn on sync.
You can delete your account, and its data, from the app at any time.

What's on your phone

The app keeps your recipes, meal plans, grocery lists, pantry, prices, ratings and settings in your browser's storage on your device. Recipe photos stay on that device only and are never uploaded.

If you sign in or sync

Signing in is optional. If you sign in, Google's Firebase Authentication handles it, and the app receives your name, email address and an account ID from it. Your password, if you use one, goes to Firebase and is never seen by Recipe Box.

When you sign in or turn on sync, your recipe box (recipes, plans, lists, pantry, prices and settings) is stored on Cloudflare's servers, so it can appear on your other devices and for the people you share the box with. To let you undo mistakes, one copy of the box is kept from each day, for 30 days.

People in a shared box can see everything in it, including the names of the other members. Invites you create expire on their own, and you can cancel them sooner.

Features that send something out

Adding a recipe from a link: the app fetches that page, through its own server at api.bakfan.com, and sometimes through a public page-fetching service. Recipes read from a link are kept on the server for a week, so the same link loads faster next time.
Reading a recipe or a Nutrition Facts label from a photo, or a page with AI: the image or page text goes to an AI model run by Cloudflare Workers AI. Recipe Box does not keep these images.
Move my data (from the app's old address): your data is encrypted on your phone before it's uploaded, can't be read by the server, and is deleted once it's picked up or expires.
Nutrition and prices: ingredient names (not your recipes) are looked up with the USDA FoodData Central service, and average prices come from the U.S. Bureau of Labor Statistics.

Crash reports and usage stats

To find bugs and learn which features help, the app sends anonymous crash reports (to Sentry) and a short list of usage events (to PostHog), such as "a recipe was added" or "a grocery list was made", with counts. These use a random ID, not your name or email, and never include your recipes, lists, notes or anything you type. You can turn this off in Settings, under Privacy.

What isn't done

No ads, and no advertising or tracking cookies.
Your data is never sold or rented.
Your recipes and lists are not used to train AI models.

Deleting your data

Delete your account: Settings, Account, Delete account. This removes your account and your private recipe box from the server. In a box you share, your membership ends and the box stays with the other people in it. The daily copies of a deleted box expire within 30 days.
Sign out and clear this phone: Settings, Account, Sign out, then Sign out and clear this phone.
Without an account: clearing the site's data in your browser removes everything.

You can also export a backup of your recipes from Settings at any time.

Children

Recipe Box isn't meant for children under 13, and it doesn't knowingly collect information from them.

Changes

If this policy changes, the new version will be posted here with a new date. Big changes will also be mentioned in the app's What's new.

Questions

Write to gerstengineering@gmail.com.