Privacy Policy

Effective date: March 4, 2026 | Last updated: March 4, 2026

TOO KitchenPlus.kz ("KitchenPlus", "we", "us", or "our") operates the KitchenPlus mobile application (the "App"). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the App.

By using KitchenPlus, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Information You Provide

Account data: email address, first and last name, profile photo, language preference (Russian, English, or Kazakh).
Authentication data: password (stored in hashed form only), or third-party sign-in tokens (Apple ID, Google).
Family data: family name, family photo, family member names, member types (child, woman, man), and portion coefficients.
Recipe data: recipes you create including title, description, ingredients, preparation steps, photos, and videos.
Kitchen inventory: item names, quantities, measurement units, categories, and expiry dates.
Meal plans: calendar entries, meal types, and portion assignments per family member.
Shopping lists: ingredient names, quantities, and purchase status.
Social interactions: recipe ratings, comments, favorites, collections, and reports.
Ingredient requests: names and descriptions of ingredients you suggest adding to our catalog.
Receipt images: photos of grocery receipts you upload for AI-powered item recognition.

1.2 Information Collected Automatically

Platform: whether you use iOS or Android (for subscription routing).
Server logs: HTTP request method, URL path, response status code, and response time. These logs do not contain personal identifiers.

1.3 Information We Do NOT Collect

Device identifiers (IDFA, Android Advertising ID)
Precise or approximate location
Contacts, calendar, or other phone data
Browsing history
Third-party analytics or tracking (no Firebase Analytics, Amplitude, etc.)

2. How We Use Your Information

Purpose	Data used	Legal basis (GDPR)
Account creation and authentication	Email, name, password hash, OAuth tokens	Contract performance
Providing core App functionality (meal planning, recipes, shopping lists, kitchen inventory)	Family data, recipes, meal plans, shopping lists, kitchen items	Contract performance
AI-powered features (receipt scanning, recipe tag suggestions, menu recommendations, recipe translation, kitchen assistant)	Receipt images, recipe text, family context, kitchen inventory	Contract performance / Consent
Subscription management and payment processing	User ID, purchase receipts, platform	Contract performance
Email communication (verification codes, password reset)	Email address	Contract performance
Content moderation (recipe reports)	Report reason, description	Legitimate interest
Service improvement and bug fixing	Server logs (anonymized)	Legitimate interest

3. Third-Party Services

We share data with the following service providers, solely to operate the App:

Service	Purpose	Data shared	Location
Neon (PostgreSQL)	Database storage	All account and content data	US/EU
Upstash (Redis)	Caching and rate limiting	Session tokens	US/EU
Cloudflare R2	Photo/image storage	Uploaded images	Global CDN
Cloudflare Stream	Video processing and streaming	Uploaded videos	Global CDN
Google Gemini API	AI features (receipt parsing, recommendations, translations)	Receipt images, recipe text, family context (no personal identifiers)	US
RevenueCat	Subscription management	User ID, purchase receipts, subscription status	US
Resend	Transactional email delivery	Email address, email content	US
Apple App Store / Google Play	Payment processing	Purchase receipts, transaction IDs	US
Railway	Application hosting	Application logs	US

We do not sell your personal data to any third party. Data shared with service providers is used solely for the purposes described above.

4. AI Data Processing

When you use AI-powered features (receipt scanning, recipe suggestions, menu planning, kitchen assistant), relevant data is sent to Google Gemini API for processing. This includes recipe text, receipt images, family context (member count, portion sizes), and kitchen inventory — but never your email, name, or other personal identifiers.

AI requests are processed in real time and are not stored by us after the response is returned. Google's data processing policies apply to data sent to their API.

5. Data Storage and Security

Passwords are stored using one-way cryptographic hashing (bcrypt). We never store plaintext passwords.
Authentication tokens (JWT) are stored in your device's secure storage (Keychain on iOS, EncryptedSharedPreferences on Android).
Media uploads use time-limited presigned URLs (expiring within 1 hour).
All API communication is encrypted via HTTPS/TLS.
Server access is protected by rate limiting and input validation.

6. Data Retention

Account data: retained as long as your account exists.
Content you create (recipes, meal plans, shopping lists): retained as long as your account exists.
Verification codes: ephemeral, expire within minutes.
Authentication tokens: invalidated on logout.
Server logs: retained for up to 30 days for debugging, then deleted.
Receipt images sent to AI: not stored after processing.

When you delete your account, all associated data is permanently removed from our systems, including family data, recipes, ratings, comments, and media files.

7. Your Rights

Depending on your location, you may have the following rights under applicable data protection laws (including GDPR):

Access: request a copy of the personal data we hold about you.
Rectification: correct inaccurate or incomplete data.
Erasure: request deletion of your account and all associated data.
Portability: receive your data in a structured, machine-readable format.
Restriction: request that we limit processing of your data.
Objection: object to processing based on legitimate interest.
Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at admin@kitchenplus.kz. We will respond within 30 days.

8. Children's Privacy

KitchenPlus is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

Family member profiles (including children) are created and managed by the adult account holder. No separate accounts are created for children.

9. International Data Transfers

Your data may be processed in countries outside your country of residence (including the United States and EU). We ensure appropriate safeguards are in place, including the use of service providers that comply with applicable data protection standards.

10. Cookies and Tracking

The KitchenPlus App does not use cookies, web beacons, pixel tags, or any tracking technologies. We do not engage in cross-app or cross-site tracking.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App or by email. The "Last updated" date at the top indicates the most recent revision.

12. Contact Us

If you have questions about this Privacy Policy or your personal data:

Company: TOO KitchenPlus.kz
Email: admin@kitchenplus.kz