Privacy Policy

1. Who we are

Cookkd is a free beta service run by an individual, who is responsible for your personal data (the “controller” under the EU General Data Protection Regulation, GDPR, and the UK's version of it). To reach us about your data, use Help in the app.

2. What we collect

• Account: your university email, first name, building, room number (if you give one), and when you confirmed you live there.
• Profile photo, if you add one. Your phone cuts it to a small square before it's sent, which also removes its location and other details.
• Food allergies: the allergens you tick and anything you write in your own words, or that you have none. This is health information, so we only keep and use it with your explicit consent. If you choose “I'd rather not say”, we keep nothing.
• Getting paid: your Revolut Revtag and whether you accept cash, if you give them.
• What you do on Cookkd: plates and requests you post (dish, description, ingredients, allergens, times, pickup place, price), reservations and orders, ratings and comments, and your answer to the membership question.
• Notifications and following: if you turn notifications on, the address your browser's push service gives that device and what kind of device it is (like “iPhone”), and which cooks you follow.
• Support: messages you send us, screenshots you add, and details sent with them: the page you were on, your browser and device type, screen size, time zone and app version.
• Technical: sign-in cookies, your IP address (used by our hosting and sign-in providers, and to limit sign-in abuse), and basic server logs. Your password is kept by our sign-in provider only as a one-way hash; nobody, us included, can read it.

3. Why we use it, and on what legal basis

• To run Cookkd for you: signing you in, showing your posts to your neighbours, reservations, orders and ratings. Legal basis: our agreement with you (GDPR Article 6(1)(b)).
• To check plates against your allergies and flag them on the feed. Legal basis: your explicit consent (Article 9(2)(a)). You can withdraw it at any time by choosing “I'd rather not say” under Food allergies on the Me page, which deletes your allergy information straight away. Without it we can't check plates for you.
• To keep Cookkd safe: checking you're a student in the building, preventing abuse, and handling reports. Legal basis: our legitimate interest in a safe service (Article 6(1)(f)).
• To answer you and improve Cookkd: support conversations, fixing bugs and deciding what to build next. Legal basis: legitimate interest.
• To follow the law when it requires us to keep or share something. Legal basis: legal obligation (Article 6(1)(c)).

AI features help you and us (price suggestions, allergy flags, sorting support messages), but no decision with legal or similarly significant effects is made about you automatically.

4. Who can see your data

• Neighbours in your building see your first name, profile photo, room number, rating and what you post. Nobody outside your building can see your photo. When you reserve a plate or cook for someone, the other student sees your name and room. Buyers see a cook's Revtag and whether they accept cash. The “can't eat” list you choose to put on a request is visible to your building.
• Ratings you give (the stars, your comment, the dish and the month) are shown to your building on the cook's page, without your name. The cook can see which rating is yours, on the order.
• Following: a cook sees how many neighbours follow them, not who.
• Not shown to other students: your email, your allergy profile, your support messages and your membership answer.
• The person who runs Cookkd, to operate it and answer support messages.
• Service providers who process data for us, under data processing terms:
  • Supabase: database, sign-in and file storage, in Frankfurt, Germany.
  • Vercel: hosting, in Frankfurt, Germany.
  • OpenAI, in the United States: price estimates (dish, description, ingredients); the allergy check (dish, ingredients, declared allergens and your allergies); the recipe check when someone cooks a request (the request, the cook's ingredients and the request's can't-eat list); and sorting support messages and drafting replies (the conversation). OpenAI's API terms say this data isn't used to train its models; it may be kept for up to 30 days to detect abuse.
  • Resend, our email delivery provider: your sign-in codes, and emails and reminders about your orders (the dish, the other person's name and room, when and where to pick up). You can turn order emails and reminders off on the Me page.
  • Your browser's push service (Google, Apple, Mozilla or Microsoft), if you turn notifications on: it delivers them to your device. What they say is encrypted, so the push service can't read it. You can turn them off on the Me page or in your browser.
• Revolut, if you open a cook's Revolut link. Revolut handles that under its own privacy policy.
• Authorities, if the law requires it.

We don't sell your data, and there are no ads or advertising trackers.

5. Transfers outside the EU and the UK

Most of your data stays in the EU, which the UK recognises as protecting it to the same standard. OpenAI processes the data sent to it in the United States. Those transfers are covered by safeguards recognised under the EU and UK GDPR, such as the EU-US Data Privacy Framework and its UK extension, or standard contractual clauses.

6. How long we keep it

• Your account: while it's open. When you ask us to delete it, we delete or anonymise your data within 30 days. Orders and ratings you were part of stay for the other student's records, without your name.
• Allergies: until you change them, withdraw your consent, or delete your account.
• Profile photo: until you change or remove it on the Me page, or delete your account. A photo you replace is deleted straight away.
• Support conversations and screenshots: up to 12 months after the conversation is closed.
• Logs: kept by our providers for a short time, usually days to weeks.

7. Security

Connections are encrypted, screenshots are kept in private storage, and access to the database is limited to the app's server. No system is perfectly secure; if a breach puts your data at risk, we'll tell you as the law requires.

8. Your rights

You can ask to access, correct or delete your data, to restrict or object to how we use it, to get a copy to take elsewhere, and to withdraw your consent. You can change your name, room, Revtag and allergies yourself on the Me page. For anything else, ask through Help; we'll reply within one month. You can also complain to the data protection authority where you live: in the UK, the Information Commissioner's Office (ICO).

9. Cookies and local storage

We only use cookies that keep you signed in, and your browser's local storage for small preferences, like whether you've opened the invite. No analytics, advertising or tracking cookies, so there's no cookie banner.

10. Age

Cookkd is for people aged 18 and over. If we learn an account belongs to someone younger, we'll close it.

11. Changes

We may update this policy. The date at the top shows the latest version, and we'll tell you in the app about important changes. See also our Terms of use.