Privacy Policy

CulinaX is run by Youssef Hesham, an independent developer based in Egypt (“we”, “us”), who is responsible for your personal data. For anything about your privacy, email [email protected].

Only what you give us, or what using CulinaX produces:

• Your account: your name, email address and password. We store the password only as a salted scrypt hash, never as you typed it. If you pick a country (for finding coaches), we keep that too. If you continue with Google or Apple instead, they tell us your name, your email address (with Apple, possibly a private relay address) and an account number, and we never see your password there.
• Your kitchen: the food you add (names, amounts, shelves, use-by dates), barcodes you scan, your recipes and favourites, your week plan and shopping list.
• Food diary and targets: what you log, with calories and macros, and the targets you or your coach set. This can say something about your health.
• Your preferences: diets, allergies, dislikes, cuisines, household size, cooking skill and kitchen equipment. Diets and allergies can reveal health or religious information; you choose whether to give them.
• Coaching, if you use it. As a client: who your coach is, the answers you give to their starting questions (which may include injuries and health conditions), your weekly check-ins (energy, sleep, hunger and, if you add it, your weight), the diet plan and reminders they set, your messages and photos, and any review you write. As a coach: your listing (name, photo, headline, bio, specialties, city, country, price line and client limit), the notes, tags, plans, templates and reminders you write for clients, and your messages.
• Sage: your conversations with Sage, recipes it writes for you, nutrition it works out for a recipe, the recipe page links you import, and the meals it plans for you. Meal photos you send for a calorie estimate and receipt photos you scan are not stored; only the figures you choose to log, and the items you choose to add, are.
• What happens to your food: when you mark something as used up or thrown out, and when you finish cooking a recipe in cook mode, we keep a record of it (the item or recipe name and the date) to show your streak and how much food you saved.
• A shared kitchen, if you set one up: who you share it with. The people you share a kitchen with see its items, planner, shopping list and recipes, and add to them.
• Reports and blocks: if you report something, a copy of what you reported is kept for our moderators, with who reported it and why. If you block someone, we keep that so it keeps working.
• Support: the tickets and messages you send us.
• Subscriptions: whether you have CulinaX Plus or the Coach plan, which product, and until when. Payment itself is handled by Apple or Google in the apps, and by Paddle on the website; we never see your card details.
• Your device, in the app: a push notification token, if you turn notifications on, so we can reach that phone. The camera is used only while you scan or take a photo.

We do not collect your location, your contacts, or any advertising or analytics identifiers, and we do not track you across other apps or websites.

• To run CulinaX for you: your kitchen, recipes, planner, diary, Sage and coaching.
• To send the notifications you ask for, like use-by reminders, coach messages and coach reminders.
• To check which subscription you have, and unlock what it includes.
• To answer your support requests.
• To send account emails: confirming your address, and resetting your password when you ask.
• To keep CulinaX safe: preventing abuse, looking into what people report, moderating coach listings and reviews, and enforcing our rules.

Where data protection law applies, such as Egypt's Personal Data Protection Law or the UK or EU GDPR, we rely on these legal bases: providing the service you signed up for (contract); your explicit consent for health-related information you choose to enter and for sharing it with a coach you connect with, which you can withdraw at any time by removing it or ending the coaching; our legitimate interests in keeping the service secure and free of abuse; and legal obligations where they apply.

We never sell your personal data, and we do not share it for advertising. It goes only to:

• Your coach, if you connect with one. They can see your food diary, kitchen, planner, starting answers, check-ins and messages, and change your plan, targets and planned meals. Ending the coaching stops this.
• The people you share a kitchen with, if you share one: they see and change its items, planner, shopping list and recipes. Your food diary, targets, Sage chats and coaching stay yours.
• Anyone with a recipe link you share. The public page shows the recipe only, never who shared it.
• Other CulinaX users, for coaches. A coach's listing, and the first name, rating and text of reviews written about them, are shown to people browsing the coach directory.
• Service providers who run parts of CulinaX for us, under contract and only to provide their service:
  • Railway, which hosts our servers and database.
  • Google and Apple, if you choose “Continue with Google” or “Continue with Apple”: they confirm who you are to us. We only receive what is listed under “Your account”.
  • Google (the Gemini API), which powers Sage. See section 5.
  • Resend, which sends our account emails (confirming your address, resetting a password). It receives your email address and the link in the message.
  • RevenueCat, Apple and Google, which handle subscriptions. RevenueCat knows your purchases by your CulinaX account ID.
  • Paddle, which sells subscriptions on the website as our reseller (the merchant of record). When you buy there, Paddle receives your email address and payment details, and handles tax and receipts.
  • Expo, Apple and Google, which deliver push notifications. They receive your push token and the notification text.
• Open Food Facts, a public food database: when you scan a barcode we look up the barcode number there. Nothing else about you is sent.
• Recipe websites, when you import a recipe from a link: our server fetches that one page, the way a browser would. Nothing about you is sent with it.
• Authorities, if the law requires it, or to protect someone's safety.

Some of these providers are in the United States, so your data may be processed outside your country. Where the law requires it, these transfers are covered by safeguards such as standard contractual clauses.

Sage is an AI assistant. When you use it, we send Google's Gemini API what Sage needs to answer: your message and the recent conversation, the food in your kitchen, your preferences, and any photo, receipt or recipe page you give it. Sage only does this once you have allowed it, and you can withdraw that in Settings at any time, which stops every Sage feature. When a coach asks Sage to summarise a client's week or draft a plan, the client's diary, check-ins, starting answers and plan are sent the same way. Google processes this to produce the reply, under its terms for the Gemini API.

Sage can be wrong. Its recipes, calorie estimates and summaries are suggestions, are marked as such, and are not medical or nutritional advice. Talk to a doctor or dietitian about any medical condition, allergy or diet.

• Your data stays for as long as you have an account, so CulinaX keeps working for you.
• Sign-in sessions last 30 days, or until you sign out.
• Meal photos for calorie estimates and receipt photos are never stored.
• Password reset links last an hour, and email confirmation links three days.
• Reports are kept while a moderator looks at them, and afterwards as a record of how our rules were enforced.
• When you delete your account, everything above is deleted straight away: your account, kitchen, recipes, diary, preferences, Sage history, coaching data on both sides, messages, photos, reviews, support tickets and push tokens. The only exception: if a moderator ever acted on your account or content, a short record of that action, including your email address, is kept to show how our rules were enforced.

You can delete your account and its data at any time:

• In the app: open the You tab, go to Delete account, and confirm with your password.
• On the website: open Settings, go to Delete account, and confirm with your password.
• Without the app: email [email protected] from the address you signed up with, asking us to delete your CulinaX account. We will confirm and delete it within 30 days, usually much sooner.

Deleting your account does not cancel a subscription. Cancel CulinaX Plus or the Coach plan in your Apple or Google account settings, or from Manage subscription on the website if you bought it there, or it will keep renewing.

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service; and you can withdraw consent you have given at any time. Most of this you can do yourself in CulinaX; for the rest, email [email protected]. We will answer within a month.

If you are unhappy with how we handle your data, you can complain to your data protection authority: in Egypt, the Personal Data Protection Center; in the UK, the Information Commissioner's Office; in the EU, the authority in your country. We would appreciate the chance to put it right first.

We do not sell or “share” personal information as California law defines those words, and we do not use sensitive information to infer things about you.

The website uses one cookie, which keeps you signed in for up to 30 days. It is essential, so we do not ask for consent for it. The site also notes in your browser that you have seen the opening animation, so it does not replay. The apps keep your sign-in token in your phone's secure storage (the iOS Keychain or the Android Keystore). There are no advertising or analytics cookies.

Everything travels over encrypted connections. Passwords and sign-in tokens are stored only as hashes, and every request for your data is checked against your account on the server, including what a coach can see. No system is perfectly secure, but if we learn of a breach that affects you, we will tell you and the authorities as the law requires.

CulinaX is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, email [email protected] and we will delete it.

If we change this policy we will update the date at the top, and for anything significant we will tell you in CulinaX before it takes effect. Questions about your privacy: [email protected].