RecipeLedger ("RecipeLedger", "we", "us") is a household recipe, meal-planning, and shopping-list app at recipeledger.pro. This policy explains what we collect, why, who it's shared with, and the choices you have. The short version: we collect only what the app needs to work, we don't sell your data, and the only advertising is affiliate links to Amazon (see section 4), and you can ask us to delete it at any time.
From Google when you sign in: your name, email address, profile picture, and Google account ID. Sign-in asks only for these basic profile permissions.
From Kroger, only if you connect your store account: a sign-in token that lets RecipeLedger add items to your cart. You sign in on Kroger's own page, so we never see your Kroger password, and the permission can't read your orders, payment details, or cart, or place an order.
What you and your household add:
Activity log: the app records actions taken in your household (for example "recipe version added" or "store selected"), with who did it and when, so the household has a history of changes.
Technical data: like any website, our hosting provider receives your IP address and basic request information when you use the app, and may keep server logs for a short time for security and troubleshooting.
We do not collect payment information, precise location, or contacts, and we don't use analytics or advertising trackers.
We don't sell or rent your personal information, use it for advertising, or share it with data brokers.
RecipeLedger relies on these service providers. Each receives only what's needed for the feature you're using:
| Service | What it receives | When |
|---|---|---|
| Google (Sign-In, Drive) | Your sign-in request; recipe photos and documents you upload | When you sign in; when you add a photo or document with Drive connected |
| Anthropic (Claude AI) | The photo or PDF being scanned; assistant messages and the recipe, meal-plan, and cookbook details the assistant looks up to answer | When you scan a recipe or use the assistant |
| Kroger (Developer API) | Ingredient search terms (e.g. "olive oil") and your chosen store's ID — no name, email, or account details. If you connect your store account: the product codes and quantities you choose to add to your cart, sent with your Kroger sign-in token | When your household has a store selected and you open a shopping list; when you tap "Add to my cart" |
| Instacart (Developer Platform) | The recipe's title, ingredients, instructions, servings, and photo link | Only when you tap "Shop this recipe" or "Shop This Meal" |
| Amazon (Associates program) | Nothing from RecipeLedger. Amazon links ("Buy on Amazon", kitchen tools on recipes, "Add to Amazon cart") go directly to Amazon; what Amazon collects when you open one is covered by Amazon's privacy notice | Only when you open an Amazon link |
| Railway (hosting) | Hosts the app and its database, so it stores the data described in section 1 | Always |
| Google Fonts | Your IP address and browser details when fonts load | When pages load (the app's typefaces are served by Google Fonts) |
Amazon Associates. RecipeLedger is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn fees by linking to Amazon.com and affiliated sites. As an Amazon Associate, RecipeLedger earns from qualifying purchases. Amazon links go directly to Amazon. When you open one, Amazon and other third parties may place cookies or similar technologies in your browser and collect information about your visit under Amazon's own privacy notice. RecipeLedger does not send Amazon any of your information. If you link an item on a shopping list to an exact Amazon product, we store only that product's ID (its ASIN) with your household's list settings.
We may also disclose information if required by law, to protect the safety of users or others, or as part of a transfer of the service to a new operator (in which case this policy would continue to apply to your data).
Sign-in uses Google's basic profile permissions (OpenID, email, profile) only to identify you and show your name and picture.
Google Drive is optional. If you connect it, RecipeLedger requests the drive.file permission, which lets it create files in a "RecipeLedger" folder in your Drive and access only the files it created — it cannot see, read, or change any other files in your Drive. Photos are stored there so they stay under your control. You can disconnect Drive in Settings at any time; files already uploaded stay in your Drive, and you can also revoke access from your Google Account's security settings.
RecipeLedger's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not allow humans to read it except with your permission, for security purposes, or to comply with law.
RecipeLedger uses only what's needed to keep you signed in:
| Name | Purpose | Lasts |
|---|---|---|
app_session (cookie) | Keeps you signed in | 30 days, or until you sign out |
pending_google (cookie) | Holds your verified Google sign-in while you finish creating or joining a household | 10 minutes |
rl-hide-staples (browser storage) | Remembers the "Hide common staples" checkbox on shopping lists | Until you clear it |
RecipeLedger itself sets no advertising, analytics, or third-party tracking cookies. Amazon links go directly to Amazon, and any cookies involved are set by Amazon and other third parties on Amazon's site (see Amazon Associates above). Because RecipeLedger's own cookies are strictly necessary for signing in, there's no cookie banner.
We keep your account and household data for as long as your account exists, because recipes and their history are meant to last. Store product lookups are cached for about a day.
To delete your data, go to Settings → Delete my account. It takes effect immediately: your sign-in and personal content (blog posts, ratings, reviews, reactions, follows, assistant chats, and any store-account connection) are deleted, and you're signed out everywhere. If other people share your household, its recipes, plans, and pantry stay with them (with you removed as their creator); if you're the household owner, you choose who takes over. If you're the only member, the whole household and everything in it is deleted. You can also contact the app's administrator from the address you sign in with, and we'll do it within 30 days and confirm when it's done. Content you published that others already forked remains in their copies. Photos in your Google Drive are yours and stay there until you delete them. Deleted data may remain in our hosting provider's backups for a limited time before being overwritten.
The app is served over HTTPS, sign-in cookies can't be read by page scripts, every request is checked against your household so one household can't see another's data, and text from other users is displayed safely. No system is perfectly secure, so we can't guarantee absolute security; if we learn of a breach affecting your data, we'll notify affected users as required by law.
RecipeLedger isn't directed to children under 13, and we don't knowingly collect personal information from them. A household owner may let older family members join their household. If you believe a child under 13 has provided us information, contact us and we'll delete it.
If we change this policy, we'll update the effective date above, and for significant changes we'll let users know in the app or by email before they take effect.
Questions or requests about your data: contact the app's administrator.