The short version. We keep only what the app needs to plan your family’s food. We never sell it or use it for ads, the AI Chef sees only what he needs to help you, and you can delete everything in Profile at any time.
What we store. Your account — your name and email — and everything you make in the app: menus, recipes and their photos, shopping lists, food preferences, the health goals you add and what you ask the Chef to remember. We also keep a few plain numbers so we can see the app is working and how people find it: when you joined, how you found Pink Menu (the site or link that brought you, such as a search, a post, an ad or a friend’s link), when you last opened it, and how many times you have asked the Chef or imported a recipe. If you send us feedback, we keep your message with your email. If the app hits an error on your phone it sends us the error message, which browser you were using and whether you opened the app from your home screen, which tab you were on, whether you were online, your screen size and your account email, so we can fix it; we get an email when a new one appears, and error reports are deleted after 90 days. We count visits to our public pages by day and the site that sent them, and which tabs get opened, as plain totals: no cookies, no IP addresses, nothing that says who. It all lives in our own database. There are no ads, no trackers and no analytics companies.
The Chef. The Chef is Google’s Gemini AI, and he can only help with what he is told. So when you ask him something, we send your question along with the kitchen he needs to answer about: your first name if you gave one, your week’s menu, your shopping list, the names of your saved recipes — and a full recipe when the job needs one: a recipe you mention, or the ingredients of your planned dishes when he writes your shopping list — your food preferences (your diet, what to avoid, including allergies, the foods and cuisines you love, your kitchen equipment, your cooking style and any health goals you add), what you asked the Chef to remember (you can see and delete it in Profile), and who you cook for: how many adults and children, and the children’s ages. The names on your family list are never sent. Your last few messages go too, so he can follow a conversation, and so does any photo you give him, like a handwritten recipe, your fridge or a restaurant menu. Your email, your password and the photos on your saved recipes are never sent. The Chef runs on Google’s paid service, so Google does not use any of this to train or improve its products, and keeps it only for a limited time to catch misuse.
Passwords. We never store your password itself, only a scrambled Argon2 fingerprint of it that can’t be turned back into the password. When you choose one, we check it isn’t on a list of leaked passwords by sending the first five characters of a scrambled copy of it, never the password, to Have I Been Pwned. If you sign in with Google, we never see a password at all.
Cookies, and what stays on your phone. One cookie, and it only keeps you signed in — your browser holds it so you do not have to type your password on every visit, and clearing it simply signs you out. The app also keeps a few things on your own device: which tab you were last on, and words you have typed into your shopping list before, so it can finish them for you. Our public pages also remember which site or link brought you, only in that browser tab and only until you close it, so that if you sign up we know how you found us. And if a save cannot reach us — a dead zone in the shop — your menus, recipes and list are held on your phone until it can. That is what stops a week’s planning disappearing when the signal does. None of it follows you anywhere else: there are no advertising cookies, no tracking pixels and no analytics companies here. Two things load from Google: our fonts, which Google serves without cookies but, like any server, sees your IP address to send them; and on the sign-in screen, Google’s sign-in script, so its button works. Google sees that visit, and sets its own cookies if you sign in with it, under its own privacy policy.
Sharing. If you share your shopping list or a recipe, anyone with the link can see it — and change the list, if you let them — until you stop sharing it.
Children. Pink Menu is for grown-ups planning meals for their household, so accounts are for adults. The kids’ menu and your family list, with your children’s names and ages, are things you add as the parent. The Chef gets the ages, never the names on that list. We don’t knowingly collect personal information from children under 13, and if we learn a child has made an account, we delete it.
The services that run the app. Railway hosts our server and database; like any host it sees your IP address when your phone connects, and we don’t keep IP addresses in our database. Resend sends our emails: your welcome email, password resets, and our own error alerts and weekly backups. Google runs the Chef. Railway, Resend and the Chef’s Google service handle your data only to do that job for us, under terms that protect it at least as well as this page does; Google sign-in and Google’s fonts work under Google’s own privacy policy. When you paste a recipe link, our own server opens that page to read the recipe. When you talk to the app, your phone or browser turns your voice into words with its own speech service (on most phones, Apple’s or Google’s), and we only receive the words.
Your data is yours. We never sell it, never use it for advertising, and never give it to anyone but the services above that run the app. You can delete your account any time in Profile, or email hello@pinkmenu.app and we will, and everything you made is erased from the app straight away, with your shared links, feedback and error reports. Until then we keep it for as long as you have the account. Want to see everything we hold about you? Email hello@pinkmenu.app and we’ll send you a copy within 30 days. Once a week an encrypted copy of the database is emailed to us in case something breaks, so a copy of your account can remain in an older backup until that backup is deleted.
Changes. If this page changes in a way that matters, the date below changes with it, and we’ll tell you by email.
Updated 18 October 2026.