Privacy policy

Your account

When you sign up we receive your email address and, if you sign in with Google, the name and profile picture on your Google account. Sign-in is run by Clerk. Your real name is never shown publicly: what you publish shows your display name instead, and your profile picture if your account has one. You can change the name, or remove the picture, in Account.

Your kitchen

The food you add and its use-by dates, your shopping list, saved recipes, meal plans and cooking preferences (diets, allergies, dislikes, equipment and measurement units). This is the product: we use it to suggest what to cook, what to use first and what to buy. Without an account it stays in your browser, on your device. With an account it is stored in our database, so it follows you between devices.

What you publish

Recipes you choose to make public, and your comments, can be seen by everyone. If you report someone, or someone else's content, the report is kept with your account so we can act on it. The people you block, and when you agreed to the community rules, are kept with your account at Clerk, our sign-in provider.

Health and body details (optional)

The Pro meal planner uses your sex, age, height, weight, body fat, target weight, activity level, goal and pace to set calorie and protein targets, and you can tick health conditions it should cook around (diabetes, IBS, high blood pressure, PCOS or celiac disease). We use these only to plan your meals.

• They are stored on your device and, if you are signed in, in your account.
• We work out your targets on our own server. The AI that writes the plan receives the targets, never your weight, height, age or sex. If you tick a condition, it receives that condition and the cooking rule that goes with it, such as "low sodium".
• They are kept out of our analytics and advertising tools, never shared with anyone else and never sold.
• The planner is not medical advice. If you have a medical condition, follow your doctor or dietitian.
• You can clear any of them at any time, and deleting your account deletes them.

Photos you scan

When you photograph your fridge or your shopping, the photo goes from your device through our server to Google's Gemini, which lists the food it can see. We do not store the photo. We keep only the foods you confirm.

Voice

Voice Chef uses your browser's own speech recognition (in Chrome, a Google service), so we receive your words, not a recording. We send your words to Gemini for an answer, and the answer to Gemini's voice service to speak it.

Expiry reminders

If you turn on notifications, we store the address your browser gives us for them, your time zone and your browser type, so we can tell you when food is about to go off. Your browser maker's push service (Google's or Apple's, for example) delivers them. Turning reminders off, or deleting your account, removes this.

Emails

We email you about your account and purchases (a welcome note or a payment confirmation, for example) through Resend. A newsletter goes only to people who switch it on in Account, and each one has an unsubscribe link. We keep a record of the emails we send, so none goes out twice.

Payments

Chef's Pass is sold by Paddle, our merchant of record, which collects your payment details under its own privacy policy. We never see your card number. We receive your plan's status and a record of each purchase.

Shopping on Instacart

When you choose to shop for a recipe, we send Instacart the recipe (its title, picture, ingredients and steps) or the items you are missing, to create the page you shop from. We do not send your name, email or account. On Instacart, Instacart's privacy policy applies.

Riff in ChatGPT

If you use the Riff Kitchen app in ChatGPT, it can search and show Riff's public recipes without an account. If you link your Riff account, ChatGPT can also read and change your kitchen, your shopping list and your saved recipes when you ask it to. Linking goes through our sign-in (Clerk) and asks your permission first. ChatGPT receives a key to your Riff account, never your password, and you can disconnect it in ChatGPT at any time.

• What goes to ChatGPT is only what you ask for: the foods in your kitchen with their amounts and use-by dates, your shopping list, and the recipes you search, open or save. Never your email, your health or body details, your allergies, your plan or your payments.
• What comes from ChatGPT: the foods, list items and recipes it saves for you, and the time zone, country and language ChatGPT shares, which we use to count use-by dates in your own calendar and to show US or metric amounts. We do not keep those. The words of a recipe search or a recipe check, including foods to leave out, are used for that one request and not kept.
• Each time a Riff tool is used we record which tool, whether it worked, how many things it returned and whether you were signed in (in PostHog, linked to your Riff account), never what you asked or what came back. Without a linked account, ChatGPT sends an anonymous id, which we scramble and use to limit how often the tools can be used.
• Your conversation itself is between you and OpenAI, under OpenAI's privacy policy. Deleting your Riff account deletes everything ChatGPT saved to it.

How you use Riff

The pages you visit, the buttons you press, the site that sent you, your device and browser, and your approximate location (country or city, worked out from your IP address). We use this to see what works and fix what does not.

• PostHog, our product analytics, loaded through our own domain. When you are signed in it is linked to your account and email address, so we can help when you ask for support.
• Google Analytics and the Google Ads tag, to count visits and whether our ads lead to sign-ups.
• Microsoft Clarity, which records how pages are used (clicks, scrolling and replays of page visits), so we can see where people get stuck.
• Vercel, our host, which keeps short server logs (IP address, browser and the page asked for) and checks signals from your browser to tell people from automated scripts when the free tools are used without an account.
• Your IP address is also used to limit how often the free tools can be used.
• What you search for in the help centre is kept without your name, so we know what to write next.

In the Riff Kitchen app from Google Play, only PostHog runs: the Google tag and Clarity are not loaded there.

Cookies and storage on your device

Sign-in cookies (Clerk), a cookie that counts free uses without an account, analytics cookies (Google Analytics and Clarity), and browser storage for PostHog, your preferences and, without an account, your kitchen.