Privacy.

ooey is a pantry and recipe app built by Alien Tech Systems in Brooklyn, New York. We don’t run ads, we don’t sell your data, and we don’t track you across the web. This policy explains what data we collect, why, who we share it with, and how to get it back or make it disappear.

What we collect.

Email address. Provided when you create your account. Used for authentication (magic-link sign-in) and essential service emails. Linked to your account.

That you confirmed your age — not your date of birth. ooey is for adults only (see Children below), so when you create your account we ask you to confirm you meet the minimum age. We record that you confirmed and when. We do not store a date of birth.

Until September 2026 we asked for a birth date and kept it. We stopped because we never needed it: what we have to know is that you are old enough, and that is all we now keep. Birth dates already on file were replaced with the confirmation record and erased.

Older versions of the app still show a date picker, because the app on your phone updates separately from our servers. If you are using one, the date you enter is checked against the minimum age and then discarded — it is never written to your account. Updating the app replaces the picker with a single yes-or-no question.

Your handle. A short public name (for example @saffron) generated for your account when you sign up. Nothing in the app shows it to anyone else today; it exists so that a future community surface has a stable name to attach to.

Scan photos. When you scan a pantry item, your camera captures a photo that is sent to our AI ingredient-identification service (Google Gemini) for processing. ooey does not keep the photo itself. We do keep a record of the scan: a one-way fingerprint of the image (so the same photo is not processed twice), and the list of items the AI thought it saw, with its confidence in each. You are asked for explicit consent before the first scan.

Recipe photos. Photos you attach to a recipe are different from scan photos: these are stored, as image files, because the app has to show them back to you. They live in Cloudflare R2 object storage. A photo you remove from a recipe is deleted. A recipe you delete stays in Recently Deleted for 30 days so you can restore it; after that it and its photos are deleted. Deleting your account deletes them straight away.

Recipe imports. When you import a recipe from a photo or from pasted text, the photo or text is sent to Google Gemini so it can read the recipe. The recipe you save is kept; the photo or text you imported from is not.

Shopping lists. Items you add to your shopping list, whether you have ticked them off, and your list preferences (sort order, whether items auto-add when you run low).

AI recipe sessions. When you create a recipe with ooey’s AI, we store the draft and the conversation that produced it — the prompts you chose or typed, and each version the AI proposed. This is what lets you leave a draft and come back to it, and it is what we look at when you report a problem with an AI recipe.

To write the recipe, your request and the items in your Kitchen (their names, amounts, and which are close to their date) are sent to Google Gemini.

Cooking activity. Cook sessions you start (which recipe, when, how far you got, any scaling you applied), and a history of changes to your pantry items so quantities can be corrected.

Kitchen Today. A paid feature that is being turned on in stages, so it may not be on for your account yet. When it is, it keeps two things.

What happened to an item. When you mark an item used, tossed, or still good, we record which item, what you chose, and when, so the weekly recap can count them. The item’s name is erased from that record after 90 days; the count stays. Records you made are in your data export, and they are deleted with your household.

Estimated dates. Estimated best-by dates come from USDA food-storage guidance kept on our servers. When an item’s name does not match that guidance directly, the name alone is sent to Google Gemini to pick the closest food from a USDA list. Gemini receives nothing about you: no account, no email, no household. The answer is saved against the name and reused for anyone with an item of the same name, so it is not linked to you.

Reminders. Kitchen Today reminders are off until you turn them on. They are scheduled on your phone, not sent from our servers, and they never name an item, so nothing in your kitchen shows on a locked screen. Signing out clears them, and the next person to sign in on that phone starts with them off.

Your settings. Preferred language, measurement units, appearance, pantry and recipe sort orders, storage locations you rename, and category overrides you make.

Household. Your household record and its members. Everyone in a household shares its kitchen: the items in it, storage locations, the shopping list, and cooking sessions. Recipes stay with the person who wrote them. When you invite someone, we store the email address you entered with the invitation. An invitation expires after 7 days, and within an hour of that it is deleted with the email address in it, whether it was accepted, cancelled or ignored. The household’s history records that an invitation was sent, accepted or cancelled, but not the address.

Subscription status. Whether your account is on the free or paid tier, when a paid entitlement expires, and where it came from. ooey does not process payments itself and never receives your card details.

What we do not collect. ooey has no allergy or dietary settings, and we store no allergy, dietary, or other health information about you. Our support page says the same thing, and it is worth being blunt about: nothing in ooey is screening recipes against your allergies, because there is nothing to screen against. We also do not collect your name, phone number, address, contacts, precise location, or any advertising identifier.

Pantry items and recipes. Items identified from scans, items you add manually, recipes you save or import, and related metadata (quantities, expiration estimates, storage locations). This is your content, stored in your account so the app works.

Account identifiers. An internal user ID generated when you sign up. Used to associate your data with your account.

Passkeys. If you set up a passkey for faster sign-in, a WebAuthn public-key credential is stored server-side. Biometric data (Face ID, Touch ID, fingerprint) never leaves your device — it is verified locally by your device’s secure enclave and is never transmitted to ooey.

Anonymous usage events. Counts of in-app actions — for example: the app was opened for the first time, an account was created, a pantry item was added, a recipe was generated — together with a random per-install identifier. These carry no name, email, or content from your pantry or recipes, and are not linked to your account identity. PostHog also works out an approximate location for each event from the internet address it arrived from — country, region, city, postal code, and rough coordinates — and then discards the internet address itself, so it is never stored. They are processed by PostHog in the European Union, are on by default, and you can switch them off any time in Settings → Privacy & Voice → Share anonymous usage data.

Crash reports. When the app crashes, it sends the technical details of the failure: the error, where in the code it happened, the app version, and your device model and operating-system version. No screenshots, no record of what you tapped, and nothing from your pantry, recipes, or photos. Values that could identify you — email address, account identifier, sign-in tokens — are replaced with a short one-way hash on your device before the report is transmitted, so the data is pseudonymous rather than anonymous: we can tell that two crashes came from the same installation, but not whose it is. Crash reports are processed by Sentry in the European Union, are used solely to diagnose and fix faults, are never used for tracking or advertising, and are not linked to your account. They are on by default and you can switch them off any time in Settings → Privacy & Voice → Send crash reports.

How we use your data.

Every piece of data listed above exists for one reason: to make the app work. We use your email to sign you in. We use your photos to identify ingredients. We use your pantry and recipe data to show you what’s in your kitchen and what you can cook. We do not use your data for advertising, profiling, or training AI models.

Third parties.

Google Gemini (Google LLC, US). Receives:

The app asks for your consent before your first scan. It does not yet ask before recipe imports, AI recipes, or Kitchen Today send data to Gemini.

Google may retain submitted data for up to approximately 55 days for abuse prevention and safety monitoring, after which it is deleted. Google does not use data submitted via the Gemini API to train its models.

Resend (Resend Inc., US). Delivers transactional emails (magic-link sign-in, service notices). Receives your email address for delivery purposes only.

Sentry (Functional Software, Inc.; EU data region). Receives crash reports when the app fails, if you have left crash reporting on. Receives the error and stack trace, app version, and device model and operating-system version, with identifying values hashed on your device beforehand. Used only to diagnose and fix faults; never for tracking, advertising, or profiling.

Cloudflare (Cloudflare Inc., US). Provides hosting, content delivery, DDoS protection, and cookieless, aggregate web analytics for ooeyapp.com. Cloudflare processes requests to serve the app; it does not receive or store your account data.

PostHog (PostHog, EU region). Processes the anonymous in-app product-analytics events described under Anonymous usage events above, so we can see which features help and where people get stuck. Hosted in the European Union. Receives no name, email, pantry, or recipe content, and no advertising or cross-app identifiers. You can switch it off in Settings → Privacy & Voice.

We do not sell, rent, or trade your personal data to anyone. The third parties listed above receive only the minimum data required to provide their specific service.

Cookies and tracking.

We do not use cookies. We do not track you across other apps or websites, and we do not use advertising identifiers. Our website analytics (Cloudflare Web Analytics) are aggregate and cookieless — they cannot identify individual visitors. Inside the app we use PostHog (EU) for anonymous product analytics that you can switch off in Settings — see Anonymous usage events and Third parties above.

Sticker QR codes. We put stickers up around Brooklyn, and each one carries a QR code with its own short link. When you scan one we record that a scan happened, which design it was, whether the phone was an iPhone or an Android, and the country the request came from — then we send you to the App Store, Google Play, or this website. We do not store your IP address, we do not store the full details of your phone or browser, we do not set a cookie, and each scan is recorded with a fresh random identifier, so two scans cannot be connected to each other or to you. It tells us which poster worked. It cannot tell us who you are.

Data retention.

Your account data (email, pantry items, recipes, passkeys) is retained for as long as your account is active. Photos sent for ingredient scanning are not stored by Ooey after processing, and neither are the photos or text you import a recipe from; Google may retain them for up to approximately 55 days for abuse prevention. Abandoned scan data (scans that are started but never confirmed) is automatically purged after 72 hours. Kitchen Today erases item names from its record of used and tossed items after 90 days; the counts remain.

Account deletion.

You can delete your account at any time from Settings → Account → Delete Account in the app. Deletion is a hard delete — all your data is permanently and irreversibly removed within seconds: your account and settings, pantry items and their history, scan records, recipes with their ingredients and steps, recipe photo image files, AI recipe drafts including the full turn-by-turn conversation, shopping list, cook sessions, household, and passkeys. There is no grace period and no recovery. Active sessions are immediately invalidated.

If other people share your household, the household is not deleted with you. It passes to the member who has been in it longest, and the shared kitchen — its items, shopping list, and cooking sessions — stays with them. Your account, your recipes, your AI drafts, your settings, and your passkeys are still removed.

One honest caveat about the image files. They live in object storage rather than the database, so they are deleted in a second step immediately after your account row is destroyed. That step is deliberately not allowed to block your deletion — if it failed, we would rather your account be gone than hold it hostage to a storage hiccup. In that rare case an orphaned image file could survive, unreferenced by any account. If you want written confirmation that nothing of yours remains, email privacy@ooeyapp.com and we will check and tell you.

If you have already uninstalled the app, or you cannot sign in, see how to request account deletion.

Community publishing.

ooey is private by default. Your pantry, your saved recipes, your shopping lists, your scan history — none of it is visible to anyone but you. The community surface is opt-in: a recipe becomes public only when you flip it from private to public, and only after you read and accept the community rulebook. This section explains what changes when you publish.

What becomes public. The recipe itself: ingredients, method, yield, the headnote you wrote, any photo you attached, the publish date, and your @handle (the public name you chose; not your email, not your real name unless you put it in your handle). If your recipe is a fork of another cook’s recipe, the lineage chain is also public; attribution is permanent and cannot be stripped.

What stays private. Your email address, your account ID, the recipes you haven’t published, and the four small appreciation signals attached to public recipes (cooked this, saved, on my list, and a fork) — these are private to the author of the recipe at aggregate level only. There are no public counts, no follower graphs, no leaderboards. There never will be.

Pre-publication scan. Before a recipe goes public, ooey runs a pre-publication scan on the headnote and any fork-note for things you almost certainly did not mean to publish — phone numbers, email addresses, street addresses, and similar personal identifiers. The scan surfaces findings to you; you either remove them or acknowledge them before the recipe goes live. The scan runs server-side and the results are not retained beyond the publish transaction.

The public modlog. Moderation actions on public recipes (hide, restore, account suspension, takedown) are recorded in a public modlog at ooeyapp.com/community/modlog (published when the community surface ships). The modlog publishes the action, not the content: a row contains a timestamp, the action taken, the recipe ID, the violation code, the steward’s handle, and a brief reason. The original report is not public.

If you delete your account. Public recipes you originated remain published because other cooks may have forked them, and attribution is part of the contract those forks depend on. Your @handle on those recipes is replaced with “a deleted cook” and your appreciation events on others’ recipes are deleted. Your account, email, passkeys, private recipes, and pantry data are hard-deleted on the same terms as the Account deletion section above.

What this section does not commit. The community surface is reserved on the roadmap (CM1 unlock) and is not yet live. This section discloses the privacy posture you can expect when CM1 ships; if any of it changes before then, this page is updated and the change is announced via the email on your account.

Data export.

You can export your data at any time, as a single machine-readable JSON file. Use the export option in the app, or email privacy@ooeyapp.com.

The export contains your account record and settings, your household and its membership, your pantry items and the history of changes to them, your scan records, your recipes with their ingredients and steps, your AI recipe drafts, your shopping list and its preferences, your category overrides, your cook sessions, and the metadata for any passkeys you have registered.

Two things are not in the export today, and we would rather name them than let you find out by looking:

Both are deleted when you delete your account, so neither outlives your use of ooey — the gap is in taking them with you, not in getting rid of them. If you want either one, email the address above and we will send it to you.

Security.

All data in transit is encrypted via HTTPS/TLS. Passwords are never used — ooey authenticates exclusively through magic links and passkeys, eliminating credential-stuffing and password-reuse risks. If you discover a security issue, please email security@ooeyapp.com.

Children and minors.

ooey is not directed at anyone under 18. Creating an account requires confirming you are 18 or over, and anyone who is not is declined before any account data is stored — including the email address they typed. The floor is 18 because ooey's recipe features rely on a third-party AI service whose terms require it.

Separately, and as required by the US Children's Online Privacy Protection Act, we do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact privacy@ooeyapp.com and we will delete it promptly.

Changes to this policy.

If we make material changes, we’ll update this page and revise the date below. For significant changes, we’ll also notify you via the email address associated with your account.

Contact.

For privacy questions, data requests, or concerns: privacy@ooeyapp.com.

Alien Tech Systems
Brooklyn, New York

Updated 2026-10-12.