Privacy Policy

PromptBite (“PromptBite,” “we,” “us”) makes the PromptBite iOS app — an AI cooking assistant that suggests recipes, builds a grocery cart, and guides you through cooking. This policy applies to the app and to promptbite.app.

1. Information we collect

Account information

PromptBite uses Sign in with Apple. There is no separate email signup or password. When you sign in, we receive an identifier from Apple and the email address you choose to share — which may be Apple’s private relay address rather than your personal email. We use this to create and secure your account. Apple may also issue us a token for your account when you sign in. We keep it on our servers, use it only to ask Apple to disconnect PromptBite from your Apple ID when you delete your account, and delete it along with your account.

Information you provide to use the app

• Recipe requests — the text prompts you type (e.g. “quick pasta dinner for 2”).
• Photos you take to Scan ingredients or a grocery receipt — when you use CookVision™, the photo is sent for ingredient recognition so the agent can suggest recipes or, for a receipt, list the groceries for you to add to your pantry. Photos are processed to detect ingredients and are not used to build an advertising profile.
• Cooking preferences — your allergies, dietary tags, dislikes, prep-level preference, and kitchen equipment. Allergies are used as a safety constraint on every recipe.
• People you cook for (optional) — if you add the people you cook for, such as a partner or your children, you give each one a name of your choosing and their allergies, diet and dislikes. These details are saved on your iPhone. Their needs are sent to our AI provider as cooking needs, the same way your own preferences are (see §3): for a new recipe, or a change you ask for in a chat, those of the people eating; when you change a recipe from its page or ask a question while cooking, everyone’s allergies; and when a recipe is rewritten from its page, everyone’s diets and dislikes too. These needs never carry their names. §5 explains the records we keep of them.
• Pantry and saved recipes — the items you add to your pantry and the recipes you save.
• Your shopping list — what is on your basket, and — when you ask the basket to change something — the list that goes with your instruction.
• Your ZIP code (optional) — if you enter one in the app, while setting up or later in Profile → Preferences → Delivery ZIP, it is saved on your iPhone only. It is not sent to us, and it is never sent to an AI provider. You can change or remove it there at any time. A ZIP code from a connected Amazon account is different — see Connected services below.
• Voice input — if you use voice features, speech is transcribed to text, on your iPhone where it supports that and otherwise by Apple’s speech recognition, so the agent can act on it.

Receipt forwarding has been retired. Version 1.0 of the app has a receipt-forwarding screen in Profile → Connected accounts. It no longer gives out addresses, and the next version of the app removes it. PromptBite never used email sent to a forwarding address: none of it reached an AI provider or your pantry. Any such email that was delivered is kept in a mailbox we operate on Microsoft 365 (see §4) until we delete it; to have yours deleted sooner, email hello@promptbite.app. To add a receipt to your pantry, take a photo of it with the CookVision™ camera.

Purchases

If you subscribe to PromptBite+, the purchase is processed by Apple through the App Store. We do not receive or store your card number. We use a subscription provider (RevenueCat) to confirm your subscription status so we can unlock PromptBite+ features.

Connected services

If you connect Amazon (Login with Amazon, in Profile → Connected accounts), you approve the connection on Amazon’s own page, and your Amazon password never reaches PromptBite. Amazon then sends us your Amazon account ID, your name, your email address and the ZIP code on your Amazon account. We keep the account ID and the ZIP code, in its five-digit form, with your PromptBite account until you delete your account; we do not keep the name or the email address. That ZIP code is never sent to an AI provider. Disconnecting Amazon removes the link and its ZIP code from your iPhone; the account ID and ZIP code we keep are deleted when you delete your PromptBite account.

Connecting Amazon is optional: checkout works the same without it. When you check out, your basket is handed to Amazon through a link that opens in your own Amazon account. We never see your prices, payment details, or final order total — those live entirely within Amazon.

Information collected automatically

To keep the app working and diagnose problems, we and our infrastructure providers process basic technical data such as a device identifier, app version, and error/diagnostic logs. Some diagnostic logs also include needs sent with a request. When a change to a recipe has to be redone, or can’t be made, because of an allergy, or a named dish can’t be made because of one, the log includes the allergies sent with it. When a recipe is redone because it missed a diet you asked for, the log names that diet. And for a named dish, the log includes the web search used, which can name the version you asked for (for example “dairy-free tiramisu”). We do not sell this data, and PromptBite does not use third-party advertising trackers.

2. How we use your information

• To generate recipes that respect your preferences, allergies, and pantry.
• To recognize ingredients, or the groceries on a receipt, from the photos you Scan.
• To build and refine your grocery cart and hand it off to Amazon.
• To guide you through cooking, including timers and read-aloud steps (the text read aloud is synthesized by ElevenLabs).
• To find or generate a photo for a recipe.
• To publish recipes you generate to other PromptBite cooks in Discover after a safety check, and to create a public page for a recipe when you choose to share it — in both cases without your name, account, prompt or preferences.
• To manage your account, your subscription, and the free-tier monthly limits.
• To send notifications you’ve enabled (such as cooking-timer alerts).
• To maintain, secure, debug, and improve the app.
• To respond when you contact support.

3. AI processing

We ask first. Before PromptBite sends anything of yours to an AI provider, the app shows you what will be sent and who it goes to, and asks you to agree. Until you do, the app refuses those requests — the check sits in the code that would make the network call, not just on the screen that asks. You can re-read that disclosure, or withdraw your agreement, at any time in Profile → Legal & privacy → AI & your data; withdrawing stops further sending.

PromptBite is built on AI, and we use more than one provider. Anthropic — the company that makes the Claude models — is the main one: your recipe prompts and follow-up questions, the photos you scan or choose from your photo library, the relevant parts of your cooking preferences and pantry, and the shopping list you send with a basket instruction are sent there to generate recipes, answer cooking questions and recognize ingredients. Anthropic processes this content to return a result and, under our business terms, does not use it to train its models on your data.

Three other AI services support specific features, and they receive recipe output rather than your prompts, photos or profile:

• ElevenLabs — when you cook hands-free, the recipe step or answer text being read aloud is sent there so the narration voice can be synthesized.
• Google (Gemini) — when a recipe has no photo, its title, category and ingredient list are sent there to render one.
• Tavily — when you ask for a specific named dish, that dish name is searched on the web so the recipe can cite real sources.

AI can make mistakes. As noted in the app, always read a recipe’s ingredients yourself if you have an allergy — PromptBite is not designed or marketed as medically safe for severe allergies.

4. How your information is shared

We do not sell your personal information. We share your information only with the companies listed below, and only as needed to provide the app. Which of them work for us as service providers, and on what terms, is set out after the list:

• Apple — Sign in with Apple, App Store subscription billing, push notifications, and speech recognition when your iPhone can’t transcribe on device.
• Supabase — our backend and database host, which stores your account data, preferences, pantry, saved recipes, and a record of each AI request (see §5).
• Anthropic — AI processing of recipe prompts, cooking questions, scanned and picked photos, preferences, pantry, and shopping list (see §3).
• ElevenLabs — text-to-speech for recipe steps and assistant answers read aloud during hands-free cooking.
• Google (Gemini) — generating a photo for a recipe from its title, category and ingredient list.
• Tavily — web search used to ground a recipe for a specific named dish; receives the dish search query.
• Pexels — stock photo search used to find a photo for a recipe; receives the dish name only.
• Microsoft (Microsoft 365) — hosts our email, including hello@promptbite.app and any message sent to a retired receipt-forwarding address.
• RevenueCat — subscription status management.
• Vercel — hosts promptbite.app and the public pages for recipes you share.
• Amazon (product catalog) — we send ingredient names, pantry item names and scanned barcodes to Amazon’s product catalog to find product photos and matching cart items. This happens whether or not you connect an Amazon account.
• Amazon (checkout) — when you check out, your basket’s products and quantities are handed to Amazon through an Amazon Associates link that opens in your own Amazon account. No connected account is needed.
• Amazon (Login with Amazon) — only if you connect it. We send Amazon nothing about you; Amazon sends us the details described under Connected services in §1.
• Mercato — only if you choose to shop a local store through it; your session with Mercato is yours and stays on your device.

The terms they work under. Supabase, Anthropic, ElevenLabs, Google (Gemini), Microsoft, RevenueCat and Vercel work for us as service providers, under written terms that limit them to processing your information to provide their service to us, require them to keep it secure, and do not let them sell it. Some of those terms let a provider use data in aggregated or de-identified form, or to maintain and improve its own service. Anthropic’s terms do not allow it to train models on what we send. Tavily and Pexels are search services: they receive only a dish name or search phrase, never your name or account, and handle it under their own terms, which let them use searches to improve their services. Amazon and Mercato are not our service providers. When you use Amazon features, or shop through Mercato, they handle your information under their own terms and privacy notices. Apple is not our service provider either — it operates Sign in with Apple and App Store billing under its own privacy policy.

Recipes you share. When you tap Share on a recipe, we create a public web page for it so the link you send can be opened by anyone who has it. The page carries the recipe only — not your name, your account, your prompt, or your preferences. Recipes generated in the app may also, after a safety check, be published to other PromptBite cooks in Discover, again without anything that identifies you.

We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a business transfer such as a merger or acquisition.

5. Data retention

We keep your account data for as long as your account exists. A ZIP code you enter in the app stays on your iPhone until you change or remove it, sign out, or delete the app; the ZIP code from a connected Amazon account is kept with your account until you delete your account. The names of the people you cook for, and the details you save about them, are kept on your iPhone until you remove them, sign out, delete your account or delete the app, and are included in your iPhone’s backups if you use them. Removing someone stops their needs being used from then on, but their name can stay in chats you’ve already had until you delete those chats. Scan photos are retained only as long as needed to return ingredient results and support the feature, and are not used to build an advertising profile. When you delete your account, we delete or de-identify the personal data associated with it, except where we must retain certain records to meet legal, tax, or security obligations.

Records of your requests. When you ask for a recipe, we keep a record of the request with your account: what you asked for, your pantry, and the allergies, diets and dislikes sent with it. When people you cook for are included, their needs are part of that record, without their names. Usually they’re merged with yours into one list. When you ask for a dish for one person, the record holds the allergies of everyone eating plus that person’s diets and dislikes. When a recipe is rewritten from its page, the record includes everyone you’ve added. We use these records to count usage and cost, and to check and improve the recipes the app makes. We keep them for as long as your account exists, and removing someone from your table or signing out doesn’t change records already made. When you delete your account, we erase from these records what you asked for and the allergies, diets, dislikes and pantry sent with it. We keep only what we need to count usage and cost: the type of request, when it was made, its cost, and which recipes it produced.

6. Your choices and rights

• Edit your data — update your allergies, diet, dislikes, the people you cook for, your pantry, and saved recipes any time in the app.
• Your ZIP code — change or remove the ZIP code on your iPhone in Profile → Preferences → Delivery ZIP. The ZIP code we keep from a connected Amazon account is deleted when you delete your account.
• Notifications — turn notifications on or off in iOS Settings → Notifications → PromptBite.
• Camera and microphone — Scan and voice features ask for permission; you can revoke access in iOS Settings at any time.
• Subscriptions — manage or cancel PromptBite+ in iOS Settings → your name → Subscriptions.
• Delete your account — you can delete your PromptBite account and its data from inside the app at any time: Profile → Legal & privacy → Delete my account. This removes your profile — including any Amazon account ID and ZIP code kept with it — your preferences, pantry, and saved recipes, and it can't be undone. If we hold a Sign in with Apple token for your account, we also ask Apple to revoke it, which disconnects PromptBite from your Apple ID. You don't need to contact us to do it.
• AI processing — PromptBite asks for your permission before sending anything to our AI provider, and you can review or withdraw that permission at Profile → Legal & privacy → AI & your data (see §3).
• Access your data — email us at hello@promptbite.app to request a copy of your personal data.

Depending on where you live (for example, the EEA/UK or California), you may have additional rights to access, correct, delete, or port your data, and to object to certain processing. Contact us to exercise them — we won’t discriminate against you for doing so.

If you live in Washington State, or your health data is collected there, our Consumer Health Data Privacy Policy explains how we handle consumer health data and how to use your rights under Washington’s My Health My Data Act.

7. Children

PromptBite is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we’ll delete it. If you add a child as someone you cook for, you are telling the app about their needs as their parent or carer; those details are handled as described under “People you cook for” in §1.

8. Security

We use industry-standard measures — including encryption in transit and access controls on our backend — to protect your information. No method of transmission or storage is completely secure, but we work to protect your data and to limit who can access it.

9. International users

PromptBite is operated from the United States, and our service providers may process data in the United States and other countries. By using the app, you understand your information may be transferred to and processed in countries with different data-protection laws than your own.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we’ll update the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of PromptBite after an update means you accept the revised policy.

11. Contact us

Questions about this policy or your data? Email hello@promptbite.app and we’ll get back to you within one business day.