RecipExtract — Privacy Policy

Version 1.0

Effective Date: September 6, 2026

Last Updated: September 6, 2026

1. Introduction

RecipExtract ("we," "us," or "our") operates the AI-powered recipe extraction service at recipextract.com (the "Service"). This Privacy Policy explains how we collect, use, store, share, and protect your information when you use RecipExtract, whether with or without a registered account.

We know that the content you bring to RecipExtract can be deeply personal — a grandmother's handwritten recipe card, a family cookbook, photos from holiday meals. This policy is written to give you complete transparency about what we do with your data so you can use the Service with confidence.

By using RecipExtract, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

We collect different categories of information depending on how you use the Service.

2.1 Information You Provide Directly

| Data Type | When Collected | Who It Applies To |

|---|---|---|

| Email address | Account registration or sign-in | Registered users only |

| Display name | Account registration (if provided) | Registered users only |

| Uploaded images & documents | When you submit content for extraction | All users (guest and registered) |

| Edited recipe data | When you modify extracted recipes | All users during active sessions |

| Saved recipes | When you save extracted recipes to your library | Registered users only |

2.2 Information Collected Automatically

| Data Type | Purpose | Who It Applies To |

|---|---|---|

| Session identifiers | Track guest scan count (25-scan limit); maintain session state | All users |

| Usage analytics | Understand how the Service is used; improve features (pages visited, features used, extraction counts, error rates) | All users |

| Device and browser information | Compatibility, debugging, security (browser type, OS, screen resolution) | All users |

| IP address | Security, fraud prevention, abuse detection, approximate geolocation for analytics | All users |

| Cookies and similar technologies | Session management, preferences, analytics (see Section 9) | All users |

2.3 Information from Third-Party Authentication

If you sign in using Google OAuth ("Sign in with Google"), Google provides us with:

Your Google email address
Your Google display name
Your Google profile identifier

We do not receive or store your Google password. We use this information solely for account creation and authentication. Google's use of your data is governed by Google's Privacy Policy.

2.4 Information We Do NOT Collect

EXIF metadata from images: Our processing pipeline strips EXIF data (including GPS coordinates, camera model, and timestamps) from uploaded images upon receipt. EXIF data is not stored, logged, or processed.
Payment information: We do not currently process payments. If we introduce paid features in the future, payment data will be handled by a third-party payment processor (see Section 7 regarding future third parties), and this Privacy Policy will be updated accordingly.
Precise geolocation: We do not request or collect GPS-level location data from your device.

3. How We Use Your Information

We use the information we collect for the following purposes:

| Purpose | Legal Basis | Data Used |

|---|---|---|

| Provide the Service — process uploads, extract recipes, deliver results | Performance of our Terms of Service (contract) | Uploaded images, session data |

| Maintain your account — authentication, preferences, saved recipes | Contract performance | Email, display name, authentication data |

| Track guest scan limits — enforce the 25-scan free tier | Legitimate interest | Session identifiers |

| Improve the Service — analyze usage patterns, identify bugs, optimize performance | Legitimate interest | Usage analytics, device info, error logs |

| Communicate with you — respond to support requests, send service announcements | Contract performance / legitimate interest | Email address |

| Ensure security — detect and prevent fraud, abuse, and unauthorized access | Legitimate interest | IP address, session data, device info |

| Comply with law — respond to legal process, enforce our Terms | Legal obligation | As required by the specific legal process |

We do NOT use your information for:

Selling your personal information to third parties — ever.
Advertising or ad targeting.
Training or improving our AI/ML models using your uploaded images or extracted recipes without your explicit opt-in consent (see Section 4).

4. AI/ML Processing — What Happens to Your Uploads

This section provides detailed transparency about how our AI systems interact with your content.

4.1 The Processing Pipeline

When you upload an image, PDF, or URL to RecipExtract, the following occurs:

1. Secure Transmission: Your file is transmitted over TLS-encrypted connections to our processing servers.

2. EXIF Stripping: Any embedded metadata (GPS coordinates, camera information, timestamps) is immediately stripped and discarded. It is never stored or processed.

3. AI Classification: A machine learning model analyzes the image to determine content type (cookbook page, recipe card, handwritten note, food photo, etc.) and identify the number of recipes present.

4. OCR Extraction: Optical character recognition extracts all readable text from the image.

5. Recipe Parsing: A natural language processing model structures the extracted text into recipe components: title, ingredients, quantities, units, instructions, cook time, servings, and notes.

6. Confidence Scoring: The system assigns a confidence score reflecting extraction certainty.

7. Result Delivery: Structured recipe data is returned to your browser/session for review.

4.2 What the AI Model Sees

Our AI models process the visual content (pixels) and detected text of your uploaded file. The models:

DO see the image content, including any visible text, handwriting, illustrations, and photographs within the uploaded file.
DO NOT see your email address, account information, personal identity, file name, device information, or any data outside the specific file being processed.
DO NOT retain your image in model memory after processing. Each extraction is a stateless, independent operation.

4.3 No Model Training on Your Data Without Consent

Your uploaded images and extracted recipes are NOT used to train, fine-tune, retrain, or otherwise improve our AI/ML models unless you have provided explicit, informed, opt-in consent through a clearly disclosed and separate consent mechanism.

Our AI models are trained on licensed datasets and publicly available recipe content. Your personal uploads — including family recipe cards, cookbook pages, and food photos — remain yours and are not incorporated into our models.

4.4 Image Retention Schedule

|---|---|---|---|

4.5 Early Deletion

You may request deletion of your uploaded images before the 30-day retention period expires by contacting [email protected]. We will process deletion requests within 5 business days.

5. Data Retention Schedule

| Data Category | Retention Period | Trigger for Deletion |

|---|---|---|

| Uploaded images and documents | 30 days from upload | Automated; or earlier on user request |

| Extracted recipe data (saved) | Until user deletes it or deletes account | User action |

| Account information (email, display name) | Until account deletion | User request |

| Authentication tokens | Duration of active session | Session expiry or logout |

| Session data (guest users) | Duration of session | Session expiry |

| Usage analytics (aggregated) | 24 months | Automated rotation |

| Usage analytics (identifiable) | 12 months, then aggregated | Automated anonymization + rotation |

| Processing/error logs | 90 days | Automated rotation |

| Support correspondence | 3 years from resolution | Automated deletion |

Upon account deletion, all personal data associated with your account is permanently deleted within 30 days, except where retention is required by law.

6. No-Account (Guest) Sessions

If you use RecipExtract without creating an account:

Ephemeral by design. Your session data — including uploaded images, extracted recipes, and interaction history — exists only for the duration of your active session.
No persistent personal data. We do not store your name, email, or any personal identifier beyond session-level cookies and IP address logs (retained per the schedule above).
Session identifiers are used solely to track your scan count toward the 25-scan limit and maintain session functionality. They are not linked to any personal identity.
When your session ends, all uploaded images and extracted recipe data from that session are permanently deleted.

7. Third-Party Services and Data Sharing

We share your information with third parties only in the following limited circumstances:

7.1 Current Third-Party Services

| Third Party | Data Shared | Purpose |

|---|---|---|

| Google OAuth | Email, display name, profile ID (received from Google upon your sign-in) | Authentication — "Sign in with Google" |

| Keycloak (grayrecipes realm) | Account credentials, authentication tokens | Shared authentication across RecipExtract and GrayRecipes |

| GrayRecipes | Extracted recipe data (when you explicitly save a recipe to GrayRecipes) | Recipe storage and group sharing — initiated by you |

| Cloud infrastructure providers | All data in transit and at rest (encrypted) | Hosting, storage, processing infrastructure |

7.2 Future Third-Party Services

We may integrate additional third-party services in the future, including:

Stripe (or equivalent payment processor) — for billing if paid tiers are introduced. Payment data would be handled directly by the payment processor and not stored on RecipExtract servers.
Analytics providers — for aggregated, anonymized usage analytics.

This Privacy Policy will be updated before any new third-party data sharing is implemented. Material changes will be communicated per Section 12.

7.3 When We May Disclose Your Information

We may disclose your information if we believe in good faith that disclosure is necessary to:

Comply with applicable law, regulation, legal process, or enforceable governmental request;
Enforce our Terms of Service, including investigation of potential violations;
Detect, prevent, or address fraud, security issues, or technical problems;
Protect against harm to the rights, property, or safety of RecipExtract, our users, or the public, as required or permitted by law.

7.4 No Sale of Personal Information

We do not sell, rent, or lease your personal information to third parties. We do not share your personal information with third parties for their direct marketing purposes.

8. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect your information, including:

Encryption in transit: All data transmitted between your device and our servers uses TLS (Transport Layer Security) encryption.
Encryption at rest: Uploaded images and stored data are encrypted at rest using industry-standard encryption.
Access controls: Employee and system access to user data is restricted on a need-to-know basis and logged.
Automated deletion: Image retention limits are enforced by automated systems, not manual processes.
EXIF stripping: Metadata that could reveal your location or device information is removed from uploads before processing.
Regular security reviews: We conduct periodic security assessments of our infrastructure and practices.

No system is perfectly secure. While we strive to protect your information, we cannot guarantee absolute security. You use the Service at your own risk, and you are responsible for maintaining the security of your account credentials.

9. Cookies and Similar Technologies

RecipExtract uses cookies and similar technologies for the following purposes:

| Cookie Type | Purpose | Duration |

|---|---|---|

| Essential/Session | Authentication, session management, scan counter, CSRF protection | Session duration |

| Preferences | Remember your settings (e.g., display preferences, last-used features) | Up to 12 months |

| Analytics | Aggregated usage statistics to improve the Service | Up to 12 months |

We do not use advertising cookies, tracking pixels for ad networks, or cross-site tracking technologies.

You may configure your browser to reject cookies, but doing so may impair the functionality of the Service, particularly session management and the guest scan counter.

10. Your Rights and Choices

10.1 All Users

Regardless of where you are located, we provide the following rights to all RecipExtract users:

Access: You may request a copy of the personal data we hold about you.
Deletion: You may request deletion of your personal data, including uploaded images (even before the 30-day retention window expires) and extracted recipes.
Export: Registered users may export their extracted recipes at any time via the Service's built-in export features (PDF, print cards, digital cookbook).
Correction: You may edit your extracted recipes directly in the Service. You may update your account information by contacting support.
Account Deletion: Registered users may request full account deletion by contacting [email protected]. Account deletion is processed within 30 days.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving your request.

10.2 California Residents — CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights:

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
Right to Correct: You have the right to request correction of inaccurate personal information.
Right to Opt Out of Sale/Sharing: We do not sell or share (as defined by the CCPA/CPRA) your personal information, so there is no sale or sharing to opt out of.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of Personal Information Collected (per CCPA categories):

| CCPA Category | Examples | Collected? |

|---|---|---|

| Identifiers | Email address, display name, IP address, session IDs | Yes (registered users: email, name; all users: IP, session IDs) |

| Internet/electronic network activity | Usage analytics, browser info, pages visited | Yes |

| Geolocation data | Approximate location from IP address (city/region level) | Yes (approximate only) |

| Sensory data | Uploaded images of cookbook pages, recipe cards | Yes (temporarily — deleted within 30 days) |

| Inferences | AI extraction results, confidence scores | Yes |

| Professional/employment information | None | No |

| Financial information | None | No |

| Biometric information | None | No |

| Protected classification characteristics | None | No |

How to Submit a CCPA Request:

Contact us at [email protected] with the subject line "CCPA Request." We will verify your identity before processing your request and respond within 45 days (extendable by an additional 45 days with notice if reasonably necessary).

You may also designate an authorized agent to submit requests on your behalf. Authorized agents must provide written proof of authorization.

11. Children's Privacy — COPPA Notice

RecipExtract is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13.

If you are under 13 years of age, do not use the Service and do not provide any personal information to us.

If we learn that we have inadvertently collected personal information from a child under 13, we will take prompt steps to delete that information. If you believe that a child under 13 has provided personal information to RecipExtract, please contact us immediately at [email protected].

Parents or guardians of children aged 13–17 should review these terms with their children before allowing use of the Service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

Material changes (changes to what data we collect, how we use it, or who we share it with) will be communicated to registered users via email and/or a prominent notice on the Service at least 15 days before taking effect.
Non-material changes (clarifications, formatting, typographical corrections) may be made without prior notice.
The "Last Updated" date at the top of this policy will always reflect the most recent revision.

Your continued use of the Service after the effective date of any revised Privacy Policy constitutes your acceptance of the revised policy. If you do not agree with the changes, you must stop using the Service and request account deletion.

13. Data Transfers

RecipExtract is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer. We apply the same data protection practices to all user data regardless of the user's location.

14. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals. Because there is no universally accepted standard for how to respond to DNT signals, RecipExtract does not currently respond to DNT signals. We do not engage in cross-site tracking regardless of DNT settings.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

RecipExtract

Email: [email protected]

Website: recipextract.com

For privacy-specific inquiries, please use the subject line "Privacy Inquiry" to help us route your request promptly.

This Privacy Policy is effective as of September 6, 2026.

Version 1.0