Mom's Cookbook privacy policy

Last updated: October 26, 2026. Published: October 26, 2026.

Mom's Cookbook is made by David Plante, who is self-employed in Québec (Québec enterprise number 2281862567) and works under the name Calyro. This policy explains what we keep about you, why, who helps us, and what you can do about it. "We" and "us" mean David Plante, working as Calyro.

The short version

• We keep what you put in Mom's Cookbook, so it's there on any phone you sign in on.
• We don't sell your data, show you ads, or track you across other apps and websites.
• You choose who sees what: your partner shares your household, and family see what you share with them, and your table only if you turn it on.
• Our own usage analytics are switched off during private testing. When enabled, they note a few steps you take in the app, like adding a recipe, in our own database. No analytics company gets them.
• A few companies help us run the app. They may use your data only to do that, or when the law requires it. Expo, which updates the app, also uses technical details for its own needs.
• An AI made by OpenAI reads what you ask it to: recipe photos, PDFs, pages and text you import, and your questions to Maman.
• You can delete your account in the app. That deletes your recipes, photos, cookbooks, plans and lists, apart from the few things listed under "Deleting your account".

During private testing, AI features and our own usage analytics are switched off, and encrypted database copies at Cloudflare are not yet enabled. Amazon Web Services keeps encrypted backups of our live database in Montréal. The descriptions of those disabled features below apply when they are enabled.

What we keep, and why

Your account

Clerk, the company that runs our sign-in, keeps your email address, and your password if you use one. We never see your password. If you continue with Google, it shares your name, email address and profile picture with Clerk. If you continue with Apple, it shares your name and email address, or a private relay address instead of your real one.

Clerk emails you codes: to confirm a new account, when you sign in on a new device, and to reset your password. To protect your account, Clerk records the device, the IP address and the rough location of each sign-in.

We keep a copy of your name and email address, the web address of your profile picture (Clerk hosts the picture), and which plan you're on (Free, Plus or AI Pro). We get your name, email address and picture from Clerk when you make your account or change it, or the first time you use the app, and your plan from your purchases, or from us when we give you one. We use them to show your name, apply your plan, and find the cookbooks your family shared with your email. We also note when you finished or skipped the first steps after signing up, so the app doesn't show them again.

What you add

We keep your recipes, their photos and videos, your tags, cookbooks, meal plans, grocery lists and planner settings. That's how the app shows them on your phone, shares them the way you choose, plans your week and makes your grocery lists.

Phones save hidden details inside photos and videos, like where and when they were taken and which phone took them. Before we store a photo or video, our server removes those details from JPEG, PNG, WebP and HEIC photos and from MP4 and MOV videos, the kinds phones make. A file in another format, like a GIF, is stored as your phone sends it.

When you type an ingredient we haven't seen before, its name joins the list of ingredients we suggest to every cook. Other cooks can't see who added it.

The people you cook for

You can tell us who eats at your table, children included: a name and a short note for each person, what they won't eat or would rather not, and their allergies. We use them to plan the right portions, keep a recipe with someone's allergen out of their meals, and show on a recipe what to check. We don't ask for anyone's age or birth date. Add someone else only if they'd be happy with that.

Allergies are health information, so we keep them only if you agree. The app asks the first time you add one, and asks again if we change what we tell you about them. In a shared household, your partner agrees for the allergies they add. To stop, tap "Stop keeping allergies" on your Account screen: we delete the allergies you added and your agreement. Your partner's stay until they stop keeping theirs.

The people in your household see your table. Family see it only if you turn it on for them, one person at a time, or your partner does for theirs: they see the names, allergies and dislikes, never the notes. Either of you can turn it off for someone at any time, and that turns it off for both of you. When you invite your partner, whoever types the code sees who's at your table, with the notes, allergies and dislikes, and who can see it, so they know what joining changes. They see it before they accept. Maman doesn't see your table, only how many people eat.

Your family and your household

You invite family with a code that you send from your own phone, in the app you choose. We don't send anything, the app never reads your contacts, and we never learn who got the message. We keep the name and note you typed for the person, the name you signed with, and when the invite was used, cancelled or ran out, then delete it 30 days later.

Once they accept, you're family. Each of you keeps the name and note you give the other, and only you see yours. If you remove someone from your family, every share between you ends, both ways, and so does the view of your table you turned on for them. If your partner turned it on for them too, they can still see the table until one of you turns it off for them. We note when, so an older invite can't connect you again, and keep that note until one of you deletes your account.

With a partner, you share one household: your meal plans, grocery lists, planner settings and table. You also see each other's recipes, but can't change them. If you leave, you take a copy of the table and the settings, and get back the plans you had before you joined. The household's plans and lists stay with your partner, and so do the allergies you added, as theirs. Your copy keeps the allergies only if you agreed to keep them.

Cookbooks shared by email, before family invites, keep working. We keep the email address that was typed, so the cookbook shows up when the person signs in with it. Then the two of you become family.

Recipes you import

When you import a link, our server opens the page or post, so the site sees our server, not you. If our server can't open a web page, your phone opens it and sends it to us, and then the site sees your phone.

We keep what was read, and any photos worth keeping, so you can check the recipe before you save it. We note each time the AI reads something, to count it toward your plan's monthly limit, if it has one.

The app looks at your clipboard only when you tap to paste.

Maman

Maman is the kitchen helper in the app. When you ask her something, we keep your question and her answer, so the chat is still there when you come back. We clear the words after 30 days. We keep the rest of the record, like when you asked, which recipe you asked about and what it cost us, to count it toward your plan. A recipe she writes for you stays like a recipe you import, until you delete your account.

You can give her the name you call her, like Mamie or Nonna, and choose how she looks: a drawing, her initial, her name in handwriting, or a photo you add. We keep her name, her look and the photo until you change them or delete your account. Her name goes to OpenAI with your questions, so she can answer as herself. Her look and her photo never do.

Only you see her photo in the app. Like your recipe photos, it has a long, random web address, and anyone who has that address can open it. If the photo shows someone else, like your grandmother, add it only if they'd be happy with that. When you remove the photo or choose a new one, we delete the old one. If our photo storage fails to delete it, our server tries again automatically until the photo is gone, and until then keeps only the file's name in our storage. The photo stays at its address until it's deleted.

Your plan and purchases

Plus and AI Pro are subscriptions you buy in the App Store or Google Play. Apple or Google takes the payment. We never see your card.

RevenueCat, a company that runs purchases for apps, checks your purchases with the store for us. The app sends RevenueCat your account's id, a code made from your sign-in id with a secret key that only we hold, never your name or email address. It does that when you open "Choose a plan", buy a plan, restore your purchases or manage your subscription, and after that each time you open the app. It also does it when you sign in on a phone where, since the app last started, it already did it for someone else.

RevenueCat keeps that id with your purchases and the store's receipts for them, when you last used the app, and details about your phone, such as its type and system. It also works out your country, from your purchase and from your IP address, and doesn't keep the IP address. Its dashboard shows us what it keeps about you, and charts made from what it keeps about everyone.

We keep your plan, a record of each subscription RevenueCat tells us about (the store, the plan, its dates, what the store will do next, and the store's and RevenueCat's ids for it), and each change RevenueCat reports, like a purchase, a renewal or a cancellation, with its price. We use them to unlock what you paid for, show your plan on your Account screen, warn you before you delete your account while a store can still charge you, and help with billing questions.

When something goes wrong

If the app or our server crashes, a crash report goes to Sentry, so we can fix the problem. Before it leaves, we take out what the app was sending, sign-in details, email addresses and the values that were being saved. The report says what broke and on which kind of phone, not who you are. The app also tells Sentry when it's opened and whether it crashed, with a random id for the app on your phone, not for you. That's how we know how often it crashes. Sentry keeps reports for up to 90 days.

Our server keeps a short log of errors. It can hold part of what was being saved when something failed, like a link that didn't import. After you delete your account, it also notes each step of deleting your record at RevenueCat, with account ids, the ids and types of RevenueCat's messages about them, and the order numbers and other ids of Google Play subscriptions. We keep it for 14 days, then Amazon Web Services deletes it, usually within 3 days. Our server doesn't write your IP address into its logs or our database.

How we improve the app

These notes are switched off during private testing. When enabled, our server notes some of the steps you take to learn which parts of the app help cooks and where they get stuck:

• when you join
• when you add a recipe, and whether you typed it, imported it, asked Maman for it or made a copy
• when you make a cookbook or share one, plan your week, or make a grocery list, and whether that list came from your plan or you wrote it
• when Maman answers you, and when you download your recipes
• when you reach a limit of your plan, and which one

It also notes each day you use the app while signed in.

Each note says what the step was, when, and which account took it. It never holds anything you typed, like a recipe, a name or a link. The notes stay in our own database, and no analytics company gets them. We use them to count things, like how many new cooks add a recipe in their first week. We delete each note after 13 months, and all of yours when you delete your account.

What we don't do

We don't show ads, track you, sell your data or work with data brokers. We don't use an analytics company, and the notes under "How we improve the app" stay with us. RevenueCat, which runs purchases, shows us charts in its dashboard (see "Your plan and purchases").

Your data goes only to the companies listed below, to the people you choose to share with (your partner, and the family you share with or show your table to), or to an authority when the law requires it. If Mom's Cookbook, or the business that makes it, is ever sold, your data would go to the new owner under this policy, and we'd tell you first.

The app doesn't ask for your location, your contacts or your microphone, and doesn't send notifications. It asks for your camera or your photos only when you add a picture.

OpenAI, the AI that reads your recipes and questions

Some features use an AI made by OpenAI.

• Imports. We send OpenAI the photos, PDFs, social media posts, pasted text and pages without recipe data that you import, so its AI can read the recipe. Recipe pages that list their ingredients and steps in the standard web format don't need the AI.
• Maman. With each question, we send OpenAI your question and what she needs to answer it: your first name, the name you gave her, the names of your cookbooks, the titles of your recipes, this week's meals, your planner settings, the recipe you have open, and your last few questions and her answers.
• We don't send your email address or your account id with these requests. Each question to Maman carries a random id for that one request, which only our own records link to you.
• OpenAI doesn't use what we send to train or improve its AI, unless we choose to share it, and we don't.
• We ask OpenAI not to store what we send or its answers. It still keeps logs to check for abuse, for up to 30 days, or longer if the law requires it or if that's reasonably needed to protect its services or others from harm.
• It may also keep encrypted data from a request on the machines that run its AI, for up to 24 hours.
• OpenAI checks every photo and file for child sexual abuse material. If it detects possible abuse material, it keeps the image for a person to review.
• We don't ask OpenAI to keep or read what we send in a particular country, so it may store and process it in other countries.

The AI can get things wrong. You check every recipe before you save it, and the terms explain what Maman's answers are and aren't.

Sharing with family

You can share a cookbook, a recipe or a tag's recipes with someone in your family. With Can view, they see the recipes, their photos and your name, and your email address on a cookbook. With Can edit, they can also change the words of those recipes, not the photos, and add their own recipes to your cookbook. A recipe they add stays theirs, and leaves your cookbook when you stop sharing it with them. If you stop sharing, what you shared disappears for them. If they have a partner, their partner may see those recipes when planning their household's meals.

When family change your recipe, everyone who can see it sees who changed it last and when. We keep the last 10 versions from before family changes, so you can put one back. Changes you make to someone else's recipe stay with their recipe. If you delete your account, they stay, without your name.

They can save their own copy of a recipe they can see. Their copy is theirs, photos included, and it stays if you stop sharing, delete the recipe or delete your account.

Your photos have long, random web addresses that are hard to guess. Anyone who has the address of a photo can open it until the photo is deleted, and for up to a day after that from Cloudflare's copies. Removing a photo from your recipe deletes it, unless another recipe still has it, like a copy that you or a family member made. Then the photo stays, at the same address, until no recipe has it. If our photo storage fails to delete a removed photo, our server tries again automatically until the photo is gone, and until then keeps only the file's name in our storage. The photo stays at its address until it's deleted. Deleting a whole recipe keeps its photos (see "How long we keep things").

Who helps us

These companies work for us. They may use your data only to provide their service to us, or when the law requires it. Expo also uses the technical details the app sends it, under its own privacy policy, for example to improve its services.

Apple and Google run Sign in with Apple, Google sign-in, the App Store and Google Play. When you use them, they follow their own privacy policies. They send us download and sales numbers, and crash reports from people who chose to share them with app makers. If you join our beta, they share your email address and your feedback with us.

How long we keep things

If we ever have to restore our database from a backup, everything changed after the backup's moment is undone, up to about 7 weeks before the problem; account deletions are always applied again. If we lose our whole database, RevenueCat may keep the purchase records of accounts deleted shortly before.

Deleting your account

To delete your account in the app, go to Home, tap the circle with your initial at the top right, then tap "Delete my account" at the bottom. You can also write to us from the email address you sign in with. Our support page has the steps.

This deletes your account and everything in it: your recipes and photos, tags, cookbooks and the shares you made, meal plans, grocery lists, imports, Maman chats, planner settings, your table with the allergies and dislikes, your kitchen helper and her photo, your family list, your invites, the shares between you and your family both ways, who can see your table, the notes of the steps you took, and your plan's records.

If you share a household, what's in it stays with your partner: the meal plans and grocery lists, the planner settings, the table, and the allergies you added there, which become theirs. Meals already planned keep the names of their recipes, yours and those family shared with you. Your place at the table stays, with your name.

If you signed in with Apple and delete your account in the app, we also ask Apple to stop Mom's Cookbook using your Apple sign-in. If we can't confirm that it worked, the app shows you how to remove Mom's Cookbook in your Apple account settings. If we delete your account for you because you wrote to us, we send you those steps instead.

We also ask RevenueCat to delete its record of your purchases, if it has one. Just before, we try to stop each Google Play subscription that could still charge you. Apple doesn't let us stop an App Store subscription. We check RevenueCat again 1 hour, 1 day, 7 days and 30 days later, and after each date your store could still charge you, and we delete anything that has come back under your account's id. Every 6 hours or so, for as long as we run the app, we also look through RevenueCat's records and delete anything under that id.

A few things stay:

• a note of your sign-in id, your account's id and when you deleted the account, so it can't come back by mistake, and so we can find anything RevenueCat still has under that id
• what we need to check RevenueCat again: your account's id, the dates of the checks, how the last ones went and, while a step keeps failing, its last error. We keep it for at least 30 days, and longer while a store could still charge you: about 14 months for a yearly plan that just renewed.
• ingredient names you added to the shared list, with nothing that links them to you
• copies of your recipes that family members saved for themselves, with their photos
• in a shared household, what's in it, with your partner (see above)
• changes you made to family's recipes, and the versions you saved, without your name
• photo and video files our storage hasn't managed to delete yet. Our server keeps only each file's name in our storage and tries again automatically until the file is gone. If our database is down at the same moment, which can happen when you change or remove your kitchen helper's photo, the file's name goes only to our server logs and the file can stay.
• crash reports and server logs, until they expire
• our backups, until they're deleted: we ask for that within 8 weeks, and the company that stores them then finishes it
• what Apple and Google keep about your purchases
• your record at RevenueCat, until it's deleted there. We ask RevenueCat to delete it right after you delete your account, or later if RevenueCat or our server has a problem, or after about 3 days if stopping a Google Play subscription keeps failing. RevenueCat then deletes it within a reasonable time.
• what RevenueCat keeps as needed to meet its legal duties, resolve disputes or enforce its agreements

Deleting your account doesn't cancel an App Store subscription: Apple doesn't let us. It tries to stop a Google Play subscription, but it may not. So cancel your subscription in the App Store or Google Play first.

Your rights

You can ask us to:

• show you what we have about you
• fix something that's wrong. You can fix most things yourself in the app. To change your name or email address, write to us.
• delete it
• send you a copy. Tap "Download my recipes" on your Account screen: you get one file with your recipes, their photos and videos, your cookbooks, plans, lists, planner settings, your household and table, your family list, invites and shares, and the Maman chats we still keep. For a copy of anything else we keep about you, write to us.

Write from the email address you sign in with, so we know it's you. We answer within 30 days.

If you're not happy with our answer, you can complain to the privacy regulator where you live.

Where your data is kept

Our server and our database are in Canada (Montréal). Sentry and Expo are in the United States. Clerk hosts your sign-in details in the United States, but may also store or process them wherever it or its providers have data centers. We ask Cloudflare to store your photos in eastern North America. Cloudflare tries to, but doesn't promise it. It also keeps copies for up to a day in its data centers closer to the people who view them, which can be in other countries. OpenAI may store and process what we send it in other countries. Google keeps the emails you send us, and may keep and process them in any country where it or the companies it uses have facilities. So your data may be kept or read outside your country or province.

RevenueCat, which runs purchases in the app, keeps what it gets about your purchases in the United States.

Children

Mom's Cookbook is for people 18 and older. If you think someone younger has made an account, write to us. We'll check, and delete the account if they're under 18.

You can add children to your table (see "The people you cook for"). We keep only what you type about them, never an age or a birth date.

Keeping your data safe

• The app talks to our server, Clerk, RevenueCat and our photo storage over encrypted connections (HTTPS).
• Our database accepts no connections from the internet.
• At Calyro, only the founder can open the systems that hold your data, with two-step sign-in, and only to help you or keep the app running.

No system is perfect. If a breach puts you at risk, we'll tell you and the privacy regulator, as the law requires.

Changes to this policy

When we change this policy, we update the date at the top. For important changes, we'll tell you in the app before they take effect.

Contact

Questions and requests: privacy@calyro.io

The person in charge of protecting your personal information at Calyro: the founder, at privacy@calyro.io

David Plante, working as Calyro, 9310 Avenue Patrimoine-Mondial, Quebec Quebec G2B 5M8, Canada