Privacy

Last updated 5 November 2026

The short version: we keep your name and email so you can sign in, and the recipes you convert, together with what you converted each one from: the words, the link or the photo of the page, and the photo of the finished dish if you added one. All of it is there so you can find them again, see where they came from, and send them again. Delete a recipe and all of that goes with it. Your Cookidoo® password never reaches our servers, because it never leaves your own browser, on a computer or on a phone.

Who we are

Chopr is a small project run by one person. Under European data protection law that person is the “controller” of your data: the one responsible for it, and the one to complain to:

Sofia Belfort
211 E 51st Street
New York, NY 10022
United States
support@trychopr.com

Email about anything on this page, including a request to see, correct or delete your data. There is no data protection officer, because Chopr is nowhere near big enough to need one.

Where Chopr runs

This page covers all three places Chopr exists, because they share one account:

• the website at trychopr.com
• the browser add-on, which does the sending on a computer
• the chopr app on your phone, which carries its own browser to send from

What we keep

When you sign in with Google, we receive and store:

• Your name, email address and profile picture link

That is all we ask Google for, and all we are given. We cannot see your Google password, your contacts, your files or anything else in your Google account.

We also keep a record of each conversion you run, which contains:

• when it happened, whether it worked, and how long it took
• how many characters you sent: the size, never the text
• which appliance model and units you chose
• how much work the AI did for it, counted in the units it charges by

This is what enforces the daily limits and tells us what things cost. It contains no part of your recipe. For a link, it also records which website the link pointed at: the site’s name, never the page.

When a conversion fails, we keep what failed. If the AI could not turn what you sent into a recipe, whether the text you pasted, the photo you took, or the page at a link, we keep that text, photo or page, together with what the AI answered and why we gave up, so that we can look at what went wrong and fix it. This is the one exception to “no part of your recipe”, and it applies only to conversions that did not work: one that worked leaves nothing behind but the recipe on your shelf. What we keep from a failure is tied to your account, is kept for as long as the account is, and is deleted with it.

And, so that you have somewhere to find your recipes again, we keep:

• The recipes you convert. The converted recipe, the one with the times, temperatures and speeds worked out, along with its name and the date. This is what fills the shelf on your home page and in the app.
• The photo of the finished dish, if you added one. Two copies: a thumbnail, a few tens of kilobytes, only big enough to draw the tile on your shelf; and the picture itself, full size, in a private folder only you can reach. The full-size one is what lets you send the same recipe again, next month or on a new phone, and have it arrive with its photo. Delete the recipe and both copies go with it.
• What you started from: the words you pasted, the link you gave us, or the photo you took of the page. This is what lets you open a recipe again later and see where it came from, fix a word the model misread, or send it to Cookidoo® a second time without paying to convert it again. A photographed page is kept as the photo itself, in a private folder that only you can reach.

If you would rather we did not keep any of that, delete the recipe, and that removes it, its pictures and whatever it was converted from, all together, and there is no copy anywhere else to restore any of it from.

These are yours and nobody else’s. There is no shared library, no public profile, and no way for one person to see another person’s recipes. Delete one and it is gone; there is no copy kept somewhere else to restore it from. Delete your account and they all go with it.

Why we are allowed to keep it

European law asks us to say not just what we hold but what entitles us to hold it. There are only two answers here, and neither is advertising:

• Because you asked for the service: your name and email, your recipes with the pictures you attached to them, and sending a recipe to the AI service to be converted. None of this is optional: without it there is no account, no shelf and no conversion. In the law’s words, it is necessary to perform our contract with you.
• Because we have a fair reason of our own: the record of each conversion, the scrambled IP address, the crash reports described above, the counts described below, and what a conversion that failed was given. These enforce the daily limits, stop a runaway script, tell us what Chopr costs to run, tell us when something is broken, tell us whether the thing we built is any use to anybody, and let us find out why a recipe would not convert. It is the minimum that answers those questions. Only the last of them holds any of your recipe, and only when the conversion failed. You can object to any of them (see below), and the counts have a switch of their own. In the law’s words, our legitimate interests.

Your camera and photo library are different again: those are only ever opened because you gave the phone permission, and you can take that permission back in your phone’s Settings whenever you like.

Nothing about you is decided automatically. The AI converts a recipe; it does not judge, score, profile or rank you, and no decision with any effect on you is made by a machine.

What we do not keep

• Any photo you did not attach to a recipe. Your camera and your photo library are opened for the one picture you pick or take, and nothing else in them is read, uploaded or looked at. The one you do attach is kept, as listed above, and so is a photo we tried to read and could not, so that we can find out why; that one is listed above too.
• Your Cookidoo® password or login. These never reach our servers at all. See below.
• Your IP address. When we turn a request away, whether signed out, not yet invited, or over a limit, we store a one-way scrambled version of the address it came from, which changes every day, to spot a script that keeps trying. It cannot be turned back into an address, and the same connection cannot be recognised across two days. Requests we answer store none.
• Anything for advertising. There are no advertising cookies and no tracking cookies, on the site or in the app. We do not follow you anywhere else: nothing we use can see what you do in other companies’ apps or on their websites, and nothing about you is ever sold, shared with advertisers or given to a data broker. Nothing records your screen, what you type, or where you move the mouse.
• What is in your recipes. Two things do report back, and neither carries a word of what you wrote: one when something breaks, and one counting what people do. The next two sections are entirely about them, and both have an off switch. A third thing, the notification that a recipe is ready, carries that recipe’s name and nothing else from it; it has a section of its own after those two.

When something breaks

When the app or the website hits an error, such as a screen that will not open or a crash that closes the app, a report is sent automatically so that we find out. Without it, an app that shuts itself down in somebody’s kitchen is something we would only ever hear about if they wrote in, and almost nobody writes in.

A report says where the code broke, and as little else as we could manage:

• the kind of error and the exact line of our own code it happened on
• which screen or page you were on, and which button or request came just before
• the version of Chopr, and of your phone’s or browser’s software

What a report never contains is your recipe. Error messages can have pieces of whatever was being worked on inside them, so Chopr strips the message out before the report leaves your device and keeps only the line number. There is no screenshot, no recording of the screen, and nothing that says which account it was: no name, no email, no IP address. The reports cannot be connected to you, and we could not connect them to you if we tried.

These reports are handled by Sentry (Functional Software, Inc.), an American company whose whole business is this one job. They are kept there for a limited period and then deleted automatically, and we do not copy them anywhere else.

Why we are allowed to do it: the same fair reason of our own as the conversion records below: software that breaks silently stays broken. It contains nothing that identifies you, and you can object to it (see Your rights).

What we count

Chopr counts what people do with it. Not what they cook: what they do. How many people sign in, how many convert a recipe, how many of those come from a photo or a link rather than from pasted words, how many send one to Cookidoo®, how many of those sends fail, how many subscribe, where in the welcome screens people stop, and which of Chopr’s screens get opened. About forty such moments, and the complete list is written down in our own notes.

Each one is a single line: the name of the moment, a few words from a fixed list that we wrote ourselves, perhaps a number or two, which app it happened in, and the time. The numbers are things like how many seconds a conversion took, how many steps and settings a recipe has, and how many of them you changed before sending it. They say how many you changed, never what you changed them to. For a link, the line can say that it came from one of a few dozen well-known recipe sites, such as BBC Good Food; any other site is simply “another site”, and the link itself is never part of it.

A few facts about your account sit beside the counts, so that they can be compared: which Thermomix® model and which units you chose, your Cookidoo® country, whether you subscribe, whether you joined through an invitation, and how many recipes you have converted and sent. Each is again a word from our list or a number.

Some of the counts come from our server rather than from your phone or browser: what each conversion cost us to run, and when a subscription renews, is cancelled or ends. They follow the same off switch. Your app tells our server whether you count, and when it says no, the server counts nothing for you either.

None of it can contain your recipe, and that is built rather than promised. Every one of those words comes from a list fixed in the code, so there is no field anywhere that free text could be put into: a line can say that a conversion came from a photo and failed because the text was not a recipe, and it has nowhere to put the photo, the text or the reason in anybody else’s words. There is no recipe, no title, no ingredient, no step, no name, no email address, no link you pasted and no Cookidoo® address.

It is tied to your account, by the same anonymous account number our own database uses, so that twenty conversions by one person are not read as twenty people. That number says nothing about you by itself and is never accompanied by your name or your email. This is the one way the counting differs from the crash reports above, which carry nothing about who they came from at all.

Your IP address is not part of it. The company that holds the counts is told, in the request itself, not to look up where it came from, so there is no country, no city and no address attached to any of it.

These counts are handled by Mixpanel (Mixpanel, Inc.), an American company, and they are kept on servers in the European Union. We do not copy them anywhere else.

How to turn it off. In the app: the You tab, under About, Help improve chopr. On the website: the switch below. It is also off already, without your doing anything, if your browser sends Global Privacy Control or Do Not Track, which this site honours. Turning it off stops it at once and for good, and nothing else about chopr behaves differently.

Why we are allowed to do it: the same fair reason of our own as the conversion records above. Chopr is made by one person, and without this there is no way to tell whether any part of it works for anybody, or where people give up. It contains nothing you wrote, it is not used to make any decision about you, and you can object to it or simply switch it off (see Your rights).

Notifications

The app can tell you when a recipe has finished converting while you were somewhere else, or when one could not be read. That is all it sends. When you sign in on an iPhone, chopr turns on the quiet kind of notification, which an iPhone allows without asking: they go into your list of notifications with no sound and no banner. The app asks you before making them any louder. Each kind has its own switch on the You tab, under Notifications, and your phone’s own Settings can turn all of them off.

To reach your phone, a notification goes through a company that delivers them:

• our server gives it your anonymous account number and the words to show
• the words are the recipe’s name, cut short to fit a locked screen, and a sentence we wrote ourselves; nothing else from the recipe
• your phone gives it the address Apple issues your phone for notifications, so that it knows where to deliver them

Its kit inside the app also notes the ordinary things such kits record: the phone’s model and software version, the language and time zone it is set to, the country it is connecting from, when the app was opened and for how long, whether a notification was opened, and, if you subscribe, which plan you bought. It sees the internet address your phone connects from, as any service your phone talks to directly does. It is given no name, no email and no other part of any recipe. Signing out of chopr, or deleting your account, disconnects your phone from your account there, so whoever signs in next on that phone is not told about your recipes.

This is handled by OneSignal (OneSignal, Inc.), an American company.

Why we are allowed to do it: the same as your recipes: it is part of the service you asked for, telling you about a recipe you have just asked us to convert. Every switch for it is yours.

What stays on your phone

Some things the app needs live only on the phone itself. None of these are sent to us, and all of them go when you delete the app:

• Your Cookidoo® session. It lives in the cookie jar of the app’s own browser window and nowhere else. The app cannot read it; it can only ask that browser to do something on the page you are signed in to. It is also wiped when you sign out of chopr or delete your account, so whoever signs in next on that phone does not find your Cookidoo® account waiting for them.
• Your chopr sign-in, kept in the phone’s own secure store, the same protected place a password manager uses.
• Your two settings: which Thermomix® you have, and whether you like grams or ounces.
• A recipe you were half-way through typing, so that a phone call does not empty the box. It sits in the app’s own private folder, and is cleared when you finish or start again.
• A mark saying you have seen the welcome screens, so they do not run twice.
• When we last asked about notifications, and what you said, so that the app does not keep asking.

Camera and photos

The app asks to use your camera when you take a photo, and opens your photo library only through the phone’s own picker. Either way it receives just the one picture you pick or take, and cannot browse the rest of your photos.

• A photo of a recipe page is made smaller on your phone, then sent to the AI service to be read. We keep it with the recipe it became, in a private folder only you can reach, so you can look back at it, until you delete that recipe or your account.
• A photo of the finished dish goes to Cookidoo® when you send the recipe, as described below. We keep a copy of it too, the small one for the tile and the picture itself in that same private folder, so the recipe can be sent again later with its photo, and for no other reason.

Nothing else from your camera or your library is sent anywhere or kept.

How your recipe reaches Cookidoo®

This is the part people most want to understand, so plainly: the sending is done from inside a browser that you are signed in to, using the Cookidoo® login already there. On a computer that is the add-on, inside your own browser. On a phone it is the browser window the app carries for exactly this job. Either way, your password and session are never transmitted to us and we could not read them if we wanted to.

If you attach a photo to a recipe, it is uploaded through Cookidoo®’s own image upload process, the same route as adding a photo in Cookidoo® directly. The copy that reaches Cookidoo® goes from your device to their image host and does not pass through us. We hold our own copy separately, in your private folder, so that the same recipe can be sent again later with the same picture.

Who else handles your data

• Anthropic: the company whose AI actually reads your recipe and works out the times, temperatures and speeds. It receives the words you paste, the page you photograph, or the page behind the link you give us. Based in the United States. It keeps what it receives for up to 30 days, so that it can check its systems are not being misused, and then deletes it. None of it is used to train their models.
• Supabase (Supabase Pte. Ltd., Singapore, with Supabase, Inc. in the United States): stores your account and your recipes. The servers holding them are in Oregon; the company we contract with is registered in Singapore.
• Google: signs you in, and tells us your name and email.
• YouTube (Google): when you give us a YouTube link, our server asks YouTube for that video’s description, so we can read the recipe written there. YouTube is told which video, and nothing about you.
• Instagram (Meta): in the phone app, when you share or paste an Instagram link, your phone opens that post itself to read the recipe in its caption, just as your browser would. Instagram sees that your phone asked for that post, as it would if you opened it yourself. None of this passes through us, and the caption only goes into your box for you to check.
• Vercel: hosts the website, and counts visits to it: how many people opened which page, which website sent them, and their country, browser and kind of device. It uses no cookies and keeps no identifier for longer than a day, so a visit cannot be connected to you or to your account. It counts nothing inside the phone app.
• Sentry (Functional Software, Inc.): receives a report when something in Chopr breaks, as described above. Based in the United States. It receives no recipe, no name, no email and no IP address.
• Mixpanel (Mixpanel, Inc.): receives the counts described above, on servers in the European Union. Based in the United States. It receives no recipe, no name, no email and no IP address, and only ever a word from a list we wrote.
• RevenueCat (RevenueCat, Inc.): keeps track of whether your subscription is live, so that Chopr knows what you have paid for. Based in the United States. It receives your anonymous account number, which plan you chose, when it renews, and whether you have turned counting off, so that our server knows not to count your renewals. It never sees your card, because Apple takes the payment and tells us only that it happened. No recipe, no name and no email reach it.
• OneSignal (OneSignal, Inc.): delivers the notifications described above. Based in the United States. It receives your anonymous account number, your phone’s notification address, and the name of a recipe when it tells you that recipe is ready. No name and no email reach it.
• Apple: distributes the phone app and, during testing, TestFlight. Apple can see that you installed it; Apple does not see your recipes. Apple also takes the payment if you subscribe, and is the seller of record, so your card details belong to your Apple Account and never reach us.

That is the complete list. We do not sell your data and we do not share it with advertisers. The only cookie we set is the one that keeps you signed in.

If Chopr were ever sold or handed to somebody else to run, your account and your recipes would go with it, and whoever took it on would be bound by this page. We would tell you before it happened, so that you could take your recipes out and close your account first if you would rather not.

Your data goes to the United States

Chopr is run from New York, and the database that holds your account and your recipes is in Oregon. Nearly all of the companies above are American, and two are not quite: the company that runs our database for us is registered in Singapore even though your recipes sit in Oregon, and the counts described above are held on servers in the European Union. So if you are in Europe or the UK, your data leaves it; there is no version of Chopr where it does not, and we would rather say so here than leave you to work it out.

That transfer is covered by the European Commission’s standard contractual clauses: the standard agreement written for exactly this, which binds each company to European standards of protection wherever the data physically sits. Google, Apple and Vercel are additionally certified under the EU-US Data Privacy Framework. You can ask us for a copy of what is in place at support@trychopr.com.

It is worth being straight about the limits of that: United States law gives its authorities powers that European law does not, and no contract fully cancels that out. What we can tell you is that what is there to be reached is small: your name, your email, and the recipes you chose to save.

How long we keep it, and how to get rid of it

Your account and your recipes are kept for as long as your account exists. They are not kept on a timer, and nothing is deleted behind your back.

• One recipe: delete it on the website or in the app and it is gone immediately, along with its pictures and whatever it was converted from.
• Everything: in the app, tap Delete account at the bottom of the You tab; on the website, open your name at the top of the page and choose Delete account. Either one removes your account and everything in it straight away, with nothing to email and nobody to wait for. If you would rather write, email support@trychopr.com and we do it within 30 days and tell you when it is done.
• Take back a permission: you can turn off the camera, photo or notification permission in your phone’s own Settings at any time, and you can disconnect Chopr from your Google account in Google’s security settings. Either one stops that part working; neither deletes your recipes.

When an account is deleted, your name, email, profile, every recipe, and anything we kept from a conversion that failed are removed. The record that a conversion happened is kept but stripped of any link to you, because it is our own record of what things cost. It contains nothing that identifies you and nothing from your recipe.

Your rights

If you are in the European Union or the United Kingdom, the GDPR gives you all of the following. Email support@trychopr.com and we will do it within one month, free of charge. We will not ask you why.

• See it: a copy of everything we hold about you.
• Correct it: if anything is wrong.
• Delete it: your account and every recipe in it. You do not have to ask: the Delete account button in the app and on the website does it on the spot.
• Take it with you: your recipes in a normal, machine-readable file you can load somewhere else. You do not have to be leaving to ask.
• Object to it: in particular to the conversion records, the scrambled IP, the crash reports, the counts and what a failed conversion was given, the five things we keep for our own reasons rather than yours. The counts you can simply switch off yourself, in the app or in your browser: see What we count.
• Pause it: ask us to stop using your data while we sort out a disagreement about it, rather than deleting it outright.
• Take a permission back: camera, photo access and notifications, in your phone’s Settings, at any time.
• Complain: to your national data protection authority, in your own country and your own language. You do not need to come to us first, though we would rather you did, because it is one person reading and most things are quicker to fix than to report.

Everyone else has the first three by asking, whatever country you are in. We are not going to run a different standard for different people.

If something goes wrong

If your data were ever exposed, whether a break-in, a mistake of ours or a failure at one of the companies above, we will tell you what happened, what of yours was in it and what to do about it. Where the law sets a deadline for telling the authorities, which in Europe is 72 hours, we will meet it. We will not sit on it while we work out how it looks.

Children

Chopr is for people aged 16 or over, or the lower age your country sets for agreeing to this yourself; the terms say how. We do not knowingly create accounts for anybody younger, and we delete one if we find out.

Changes

If this policy changes in a way that affects you, we will say so on this page and update the date at the top. Chopr is in early testing, so things may still move.