Privacy Policy

#01

Who this policy covers

CraveTwist is operated by Hajar Labs, LLC. This policy covers the CraveTwist iOS app, TestFlight builds, cravetwist.com, recipe-share pages, support, and related services. Privacy questions and rights requests can be sent to keith@cravetwist.com or made by phone at +1 512-367-2884.

#02

Data we handle

Depending on the features you choose, CraveTwist may process account identifiers and Sign in with Apple details; optional allergies, intolerances, health-related cooking targets, religious or ethical food rules, preferences and kitchen equipment; recipe text, links, files, photos, voice or typed requests; generated recipes, nutrition estimates, images, cooking progress, notes, feedback and memory; share settings and reports; purchase evidence; support messages; and limited device, security, crash and operational records.

• CraveTwist creates a private anonymous account at first use and stores recipes and preferences against that account in its service systems. Opened content may also be cached on your device for offline use.
• Linking with Apple preserves the same CraveTwist account and enables recovery on another device; it is optional for free use and required before purchase or restore.
• Account-linked constraints remain protected inside CraveTwist and are not sold or used for advertising.
• Private recipes and media remain private unless you deliberately publish a share.
• Apple handles payment-card details; CraveTwist does not receive or store them.

#03

Why we use data

We use data to provide and secure the service, create and refine recipes, apply confirmed constraints, estimate nutrition, support Cook Mode, save eligible preferences, publish or revoke chosen shares, reconcile Apple purchases, answer support requests, prevent abuse, and evaluate product quality.

• For European and UK users, contract or requested pre-contract steps support core app functions; legitimate interests support proportionate security and service operations; legal obligation supports required records; and consent supports optional sensitive preferences where required.
• You may withdraw an optional sensitive preference and its acknowledgement in the app.
• CraveTwist does not sell personal information, use it for cross-app tracking, or use private content for advertising.

#04

AI and service providers

CraveTwist uses disclosed providers for hosting, authentication, bounded privacy inspection, recipe reasoning, visual understanding, illustrative image generation, transactional email, and owner-chosen speech transcription. These include Apple, Google Cloud and Firebase, Neon, Cloudflare, Resend, Google Gemini, OpenRouter, DeepSeek, DeepInfra, Xiaomi MiMo, Ideogram, OpenAI, AssemblyAI, and Parallel.

• Registered recipe models receive purpose-limited cooking requests. Before a request leaves CraveTwist, account and persistent profile identifiers and internal provenance are removed, saved constraints are converted to cooking rules, and a one-use nonce replaces workflow identity. The request you provide is preserved after privacy filtering, so an allergy, health requirement, or other sensitive meaning you voluntarily include may remain. Gemini, DeepSeek, or MiMo may process this input through the configured registered route.
• Resend receives your email address and the content needed to deliver a requested transactional message. Clarification and account-export messages use an opaque link without the recipe, question, choices, or profile. If you request a recipe-ready notification, the message includes the recipe name, an authenticated app link, and, when available, the generated recipe cover as an email attachment. This does not create a public recipe share. These messages do not include your profile, original recipe input, or full recipe directions, and CraveTwist does not enroll your address in a marketing audience.
• CraveTwist may receive public food-composition records and fully de-identified, verified product-label facts from Aretic, DMLS's related nutrition service. No Aretic account, meal, media, OCR, message, or evidence identifier is shared. Product facts are usable only after exact barcode or complete strict package-identity matching.
• OpenAI may create retrieval embeddings from public food-record descriptions. Embeddings retrieve evidence candidates; they do not establish ingredient, allergen, dietary, product, or safety identity.
• Google Cloud Sensitive Data Protection may transiently inspect and deidentify a bounded recipe description or post-Cook feedback field before it is sent to a recipe model. CraveTwist does not persist the DLP request content or findings.
• MiMo may also receive authorized food imagery through the separately governed multimodal route. Ideogram receives bounded AI-authored visual direction without account or profile identity to generate illustrative recipe imagery.
• For a specifically granted owner-only development feature, AssemblyAI universal-2 transcribes a voice note only after the owner taps Record. CraveTwist requests deletion of the provider transcript after processing and provides no fallback speech provider.
• Cooking-science research may send short, de-identified questions to Parallel Search. It does not send your account identity, original recipe link, photo, or raw request. Curated science is stored separately in PostgreSQL and retrieved through Cloudflare Vectorize and Workers AI; retrieved guidance remains evidence for the recipe model, not an allergen or safety guarantee.
• Gemini may run through OpenRouter using CraveTwist’s dedicated Google Cloud credentials. The configured global endpoint does not imply that inference stays in a particular country.
• CraveTwist does not store a model's private chain-of-thought. A model result cannot override deterministic allergen, food-safety, permissions, publication, or deletion controls.

#05

Allergies and sensitive preferences

New profiles begin with No known food allergies as the visible default so recipe creation is not blocked by a confirmation step. This default means no allergy has been added to the profile; it is not a medical finding or a promise that a person has no allergy. CraveTwist stores optional account-linked selections only when you add them so it can apply them to recipes. A versioned acknowledgement is required when the first allergy, health-related target, or religious food rule is saved and again only if the notice materially changes.

• Saved profile constraints are sent as operative cooking rules, such as excluding a canonical allergen, with the original profile wording and persistent profile identifiers removed. Privacy filtering removes identifiers from unrestricted request text; it does not guarantee removal of every health-related or sensitive meaning you choose to include in that request.
• CraveTwist blocks cooking and publication when a confirmed excluded allergen matches an ingredient or derivative, or when ingredient or product-label evidence remains unresolved.
• Cross-contact remains a user-verifiable risk. CraveTwist cannot inspect or clear a kitchen, preparation surface, packaged-product facility, or substitution.

#06

Preferences and memory

Confirmed allergies and other hard constraints are profile data, not inferred memory. Eligible cooking preferences may activate automatically at the narrowest useful scope. You can inspect them, remove them, view removed items, restore eligible items, or erase them through account deletion.

• Removed memory is excluded from retrieval immediately and protected against silent recreation.
• CraveTwist does not infer a diagnosis, health condition, or religious belief from recipe behavior.

#07

Public and unlisted sharing

Recipes are private by default. Publishing creates a version-pinned snapshot behind an opaque link. An unlisted link can be opened by anyone who receives it; a public link may be discoverable. Revoking a link stops access and triggers cache and object cleanup.

• Public and unlisted pages include the same governed allergen, AI, and nutrition notices as the app.
• Your original cook photo and creator name are included only when the share controls explicitly say so.

#08

Retention, export, and deletion

Core account content is kept while your account is active unless you delete it earlier. Export files expire after seven days. Operational records are retained only for documented security, legal, transaction, deletion, and recovery purposes, with content-free provider telemetry.

• When clarification email is enabled, the current verified address is encrypted by CraveTwist before storage. Turning the preference off removes the encrypted address. Answer links are stored only as one-way hashes and expire after seven days.
• Owner-only app-edit screenshots, annotations, notes, transcripts, and recordings are private development evidence. They are included in account export and deletion; media is purged 90 days after resolution while a content-free resolution record remains until account deletion.
• Account deletion can be started inside the app and removes the account and associated recipes, notes, memory, shares, photos, generated media, vectors, and provider artifacts unless a narrow record must be retained by law.
• A fully de-identified verified product fact received from Aretic may remain as independently useful product data. It contains no member, account, meal, media, OCR, message, or source-evidence link.
• Deletion reconciliation includes Sign in with Apple revocation where linked, share-cache purge, exact storage deletion, and protection against restoration of erased data.
• Email is an assistance channel, not a substitute for the in-app deletion control.

#09

Your choices and rights

The app provides controls to view or change profile data, remove or restore memory, keep or revoke shares, export account data, withdraw optional consent, and delete the account. Depending on where you live, you may also have rights to access, correct, erase, restrict, object, receive a portable copy, withdraw consent, and complain to a regulator.

• Send a request to keith@cravetwist.com. Identity verification is limited to what is necessary to protect the account.
• Withdrawing consent does not make earlier lawful processing unlawful; it stops future processing based on that consent.

#10

Security and incidents

CraveTwist uses owner-scoped authorization, private object storage, short-lived access, least-privilege identities, secret management, rate limits, redacted logs, audit records, and deletion workflows. No service can promise absolute security.

• CraveTwist assesses notification duties under applicable privacy and data-breach laws, including consumer-health privacy laws where they apply.
• Do not send passwords, authentication tokens, or unnecessary medical details by email.

#11

Age and international use

CraveTwist is intended for people age 13 and older. Where local law requires it, a parent or guardian must authorize use by a person who has not reached the applicable age of digital consent. CraveTwist is not directed to children under 13. Country availability may be limited where required legal, language, provider, safety, or consumer-protection support is not yet available. Apple’s questionnaire determines the App Store age rating.

#12

Generated guidance and health claims

This recipe was developed with AI and reviewed by CraveTwist’s automated checks. It may contain errors. Use your judgment and follow appropriate food-safety guidance. Nutrition values are estimates and are provided for general informational purposes, not medical advice.

• Check every current product label, substitution, ingredient identity, preparation surface, cross-contact risk, safe temperature, storage method, equipment instruction, and personal suitability before cooking or eating.
• CraveTwist is not your only allergy safeguard and does not guarantee that a recipe or product is free from an allergen or cross-contact.
• Follow your established care plan and consult a qualified healthcare professional when you need medical or dietary guidance.

#13

Changes and contact

Material changes receive a new version and effective date and, where required, notice and renewed acknowledgement before a new use begins. Contact Hajar Labs, LLC at keith@cravetwist.com or +1 512-367-2884. The current mailing contact is Keith Parker, 2916 Grand Mission Way, Pflugerville, TX 78660, United States.