Privacy Policy

Last updated November 1, 2026.

Without an account

Your kitchen list and saved recipes are stored only in your browser (localStorage). Nothing is sent to Crave.

With an account

We store your email, display name, a salted password hash (never the password itself), your kitchen list, saved recipes, and any posts, comments and photos you share. We use this only to run Crave. We don't sell data or show third-party ads.

AI kitchen scan (photo, video, voice)

If you use the AI scan, the photos, video frames and audio you capture are sent through our server to Google's Gemini API to identify food. Crave does not store or log them; you only get back a list of ingredients, and nothing is added to your kitchen until you review it and confirm. Crave uses Gemini's free tier, under which Google may use submitted content to improve its products (see Google's Gemini API terms). Please avoid capturing people or personal documents. Results can be wrong or incomplete, so check and edit them. To limit use, we keep a daily scan counter keyed to a hashed IP address or account, and a site-wide monthly total.

Barcode scanning and live transcript

The camera feed is processed on your device to read the barcode. Only the barcode number goes to Open Food Facts to look up the product. Live voice transcripts use your browser's built-in speech recognition where available, which may send audio to your browser maker (e.g. Google for Chrome) under its own policy.

Purchases

Payments are handled by Stripe; we receive your email and order details, not your card number. Download emails are sent via Resend.

Grocery links

When you tap a Shop button, the missing ingredient names are sent to our server to build the link, and then to Instacart or Walmart when you open it.

Email list

If you sign up in the "free recipe printables and occasional updates" box, we store your email address, the page you signed up on and the date (Netlify Blobs). We send one welcome email right away (via Resend), then about one email a month at most. Every email has a one-click unsubscribe link; after you unsubscribe we keep only a record that you opted out. We never sell or share your email.

Visit counts

We count page views and button clicks as daily totals only, with no cookies, IP addresses or personal data, and nothing is counted if your browser sends Do Not Track or Global Privacy Control.

Security and abuse prevention

We keep short-lived rate-limit counters keyed to a hashed IP address or account.

Your choices

To delete your account and posts, or for any privacy question, contact us via this contact form and mention Crave.