Privacy Policy

Everything here is something you typed, tapped or photographed inside WifeFood. There is no hidden collection: we do not read your contacts, your calendar, your other apps or your device's location.

These are the most personal things WifeFood touches, so their storage rule is stated for each feature rather than hidden behind one general promise.

• Photos — a photo of your fridge, your pantry shelf, a finished dish, or a pan you want checked for doneness. The image is held in server memory for the length of that one request, screened for anything that should not be processed, sent to OpenAI to be read, and then dropped. These photos are not stored. What survives is only the text result — the dish name that lands in your cook log, or the ingredient names that land in your kitchen.
• Receipt photos are the exception. A linked staff helper can add one only after the household approved a request to buy an item. The server checks the real image bytes, rejects anything over 4 MB, turns the image into a smaller WebP, and removes EXIF metadata including GPS before saving it. The same helper and either linked household adult can view it through an authenticated request. It is deleted after 60 days. If the helper leaves or deletes the account, access ends but the household's temporary purchase record remains until expiry; if the household owner deletes the account, the receipt is deleted immediately. Receipt photos are stored on WifeFood's DigitalOcean server and are not backed up, so they should not be treated as a permanent copy.
• Voice notes— the recording goes straight to OpenAI's transcription model and comes back as text, which is used to answer you. The audio file is not saved, and neither is the transcript.
• Chats and typed asks— we do not keep a transcript of your conversations with WifeFood. There is one exception, and it is worth reading: when a question is general enough to be useful to anyone (it is never a baby-food question, and never a "show me something else" retry), the words of the question and the dishes we answered with are stored so the next cook who asks the same thing gets an instant answer. We only ever reuse a stored answer for 30 days; after that it is never served again, though the row itself stays in the database. That row has no account, name or device attached to it and cannot be traced back to you — which is also why deleting your account does not remove it, there being nothing in it that points at you. It is still your sentence, so please do not type anything private into the ask box.
• If an uploaded image is blocked by our image screening, we record that it happened — your account id, the time, and the category it was flagged under — so repeat abuse can be acted on. The image itself is not kept.
• Reports you file — when you report content, we keep what you reported, the reason you chose, anything you wrote, and a link to your account, so a moderator can act on it and come back to you. Your email address is not copied into the report itself; it is read through that link, which is why deleting your account takes the address with it. Reports are never shown to the person you reported.

WifeFood is built for the adult who cooks. It is not directed at children, we do not knowingly allow anyone under 13 to create an account, and a child never uses WifeFood on their own.

The only information about a child in WifeFood is what a parent or guardian chooses to type about their own child, so that the app can suggest food that is right for that stage:

• a name or nickname the parent picks — it does not have to be a real name;
• the relation "kid", and any diet note the parent writes;
• optionally, that child's diet — veg, non-veg, eggetarian, vegan or Jain — if the parent sets one. It is used for one thing: making sure the dish suggested for the whole family is one that child can eat. It is not required, and left blank the child simply follows the household diet.
• either an age band (6–8 months, 9–12 months, 1–2 years, 2–5 years) or a birth date. A birth date is used for one purpose only: working out which age band the child is in today, so the band moves up on its own as the baby grows and the parent never has to remember to edit it.

That information is used to shape recipes and safety rules — under one year old, for example, the app refuses to suggest honey, added salt or added sugar. It is sent to OpenAI only as cooking context in the shape of "child, 9–12 months". It is never used for advertising, never used to build a profile, and never shared with anyone else. A parent can edit or delete a household member at any time in the app, and deleting the member deletes that information.

Baby-food suggestions are general guidance for healthy, full-term babies, not medical advice. Every baby-food screen carries that warning, and your paediatrician always outranks the app.

Three outside services ever receive your data, and they are the three below. Separately, WifeFood sometimes offers you a link out to somewhere else — a video, a grocery app, WhatsApp. Those are not services we send your data to; they are doors you choose to walk through, and the last card in this section explains exactly what happens when you do.

• We do not sell, rent or trade your data. Not to advertisers, not to data brokers, not to anyone.
• There is no advertising network, no analytics SDK, no tracking pixel and no third-party tracker anywhere in WifeFood — not on the website, not in the app. No embedded video player, no social buttons, no outside fonts, no outside scripts. While you are on a WifeFood screen, your device is talking to us and to nobody else.
• We do not hand anyone a way to follow you. When you tap a link out to YouTube, a grocery app or WhatsApp, we do not attach an identifier, a referral tag or anything about you to it — and we get nothing back about what you did there. What that other company then does is theirs, which is why we name them in Who else sees your data rather than leaving you to find out.
• We do not track your location. WifeFood never asks your device for it.
• We do not read your contacts, photo library, calendar, messages or microphone in the background. A photo or a voice note reaches us only when you deliberately take or record one.
• We do not use your data to build advertising profiles, and we do not share it across companies for that purpose.

If you are a cook using WifeFood, the website sets exactly one cookie, wf_session. It holds a signed session token, it is HTTP-only (JavaScript on the page cannot read it), and it lasts up to 30 days — 7 days for admin sessions. The mobile app keeps the same kind of token in your phone's own secure storage instead.

For completeness, there is a second cookie that never touches a cook's browser: wf_admin_backup. It is set only on a WifeFood admin's own browser, only while they are viewing the console as a user in order to fix something, and it holds nothing but that admin's own session so they can get back to being themselves. It is never set on your device.

That is the whole list. There are no advertising cookies, no tracking cookies and no third-party cookies. Changing your password revokes every session on every device.

• Your kitchen data — preferences, household, cook log, pantry, lists, saved dishes — is kept for as long as your account is open, because the whole point is that WifeFood remembers. It goes when the account goes.
• Fridge, pan and meal photos, and voice recordings — not stored. Gone at the end of the request that used them. Approved-purchase receipt photos are stripped of metadata and deleted after 60 days (or immediately when the household owner deletes the account).
• Your video searches — kept for as long as your account is open, and deleted with it. We do not want a permanent record of what you looked up, so we are adding an automatic clear-out that removes search rows older than 90 days; until that is switched on they stay for the life of the account, and this page will say so plainly when it changes. Deleting your account removes them either way, immediately, and does not wait for any clear-out.
• Anonymous cached questions — reused for up to 30 days, then never served again. The row itself is kept; it carries no account, name or device, so there is nothing in it to tie back to a person.
• Push tokens — kept while the device is registered. A token is removed when you delete your account, when Apple tells us the token is dead (the app was deleted, the phone was wiped), and when we clear out tokens that have not checked in for a long time. To be exact: signing out does not remove the token— set the daily reminder to Off, or turn notifications off for WifeFood in your phone's settings, if you want the reminders to stop.
• AI usage and error logs — kept while we need them for cost control and debugging. While your account is open these rows carry your account id, never your name or email. When you delete the account, that id is stripped out of every one of them — see Deleting your account.
• Content reports — kept after they are dealt with, not only while they are open, so a moderator sees a repeat pattern instead of starting from zero each time. Deleting your account leaves the report standing but unlinks it from you.
• Blocked-upload records — the most recent 100 uploads refused by image screening, each holding the account id and the category it was flagged under. These keep the account id even after the account is deleted; otherwise deleting and signing up again would wipe the pattern.
• Records of admin actions — if someone on the WifeFood team acts on an account (a support fix, a suspension, a deletion), that action is written to an internal audit log that is never deleted. It records what was done, the id of the admin who did it, and the account id it was done to — never your recipes, photos or notes. This exists so account changes can always be traced.

Tap Download my data — in Profile in the app, in Settings on the website — and you get a plain, readable report: your account details, your preferences, your dishes, your full cook log, your pantry and every dish you passed on. It is free for everyone, on any plan: a copy of your own data is not something we charge for.

That file is not everything we hold. It is the part of your kitchen you are most likely to want back, and it leaves out your household members, your meal plan, your shopping list, your partner and companion links, your push tokens and your video searches. If you want a copy of all of it, email wifefood.com@gmail.com from the address on your account and say so — we will put the rest together by hand and send it, free, within 30 days.

In the WifeFood app, you do it yourself: Profile → Delete my account. You type your account password to confirm — a tap alone must never be able to do this — and the account is deleted immediately. No waiting period, no email to click, no reason to give, and nobody to ask. It cannot be undone, so the password screen is the last point at which you can change your mind.

On the website there is no such button yet. We are being straight about that rather than pointing you at a screen that does not exist: if you use WifeFood in a browser, email wifefood.com@gmail.com from the address you signed up with, and we delete the account within 7 days and confirm by email. The same applies if you are locked out of the app. The button is coming to the website, and this page will change the day it does.

Deleting the account removes, permanently and together: your profile and password, your preferences and life mode, every household member you added (including any child age band, birth date or per-person diet), your entire cook log with its notes and ratings, your saved dishes and personal notes, your pantry, your shopping list, your meal plan, every dish you passed on and every dish you planned anyway, the record of suggestions we made you, every video search you ever made, every push token, your companion and partner invite links, your link to any partner account, every partner request sent to or from you, and every receipt photo owned by your household. None of it is recoverable afterwards.

A few things outlive the account, and you should know exactly which:

• Recipes you published into the shared WifeFood library stay in the library, unlinked from you — your account is no longer named as their author. If you want them taken down as well, email wifefood.com@gmail.com before you delete: once the account is gone nothing connects those recipes to you, so we can no longer tell which ones were yours.
• The internal AI-usage and error rows stay, because our cost and crash figures are built from them — but your account id is stripped out of each one as part of the deletion, so they are no longer attached to a person.
• If someone on the WifeFood team ever acted on your account, the admin audit row for that action is never deleted and keeps the account id it acted on. It holds none of your content, and it is what makes an account change traceable afterwards.
• A content report you filed stays in the moderation queue, because the content you reported still has to be reviewed — but it is unlinked from you: your account id is removed from it, and your email was never stored on it in the first place.
• A record that an upload of yours was blocked by image screening does keep the account id, so a repeat pattern survives someone deleting and signing up again. The image itself was never stored.
• Anonymous cached asks are untouched, because there is nothing in them pointing at you to remove — see Photos, voice notes and what you type.

WifeFood can create a read-only companion link so your family can see this week's menu and the grocery list without an account. That link is public by design — it is meant to be pasted into a family group chat, and anyone who has it can open it. Treat it the way you would treat anything you post in that group. You can turn it off in the app at any time, and the old link stops working immediately.

A partner invite is different and deliberately separate: redeeming it creates a lasting link to your kitchen. Removing a partner rotates the invite, so a removed partner cannot walk back in with the old code.

• Passwords are stored only as bcrypt hashes. Nobody — including us — can read your password.
• All traffic between the app, the website and the server is encrypted with HTTPS.
• Session tokens are signed and revocable; changing your password signs out every other device.
• Access to the server and database is limited to the people who run WifeFood.

No system is perfect. If we ever discover a breach that affects your data, we will tell affected cooks by email and say plainly what happened.

The WifeFood server and database run on DigitalOcean infrastructure. OpenAI processes requests on its own infrastructure, primarily in the United States. So if you are cooking in India, the words you type and the photos you take are read on servers outside India before the answer comes back to you.

• Change or clear any preference, at any time, in Profile — Settings on the website.
• Remove a household member, and the information about them goes with the row.
• Set the daily reminder to Offin the WifeFood app, or turn off notifications for WifeFood in your phone's settings. Reminders only ever go to a phone, so if you use WifeFood in a browser there is nothing being sent to switch off — and the website has no reminder screen for that reason.
• Delete individual cook-log entries and dishes you passed on.
• Turn off the companion link, or remove a partner, and the access ends immediately.
• Simply not use the camera or the microphone — every other part of WifeFood works without them.
• Simply not search for a video. Nothing is written down about a search you did not make, and every other part of WifeFood works without it.
• Delete the whole account yourself in the app, from Profile → Delete my account — password, then gone. From the website, email wifefood.com@gmail.com and we do it for you.
• Ask for a copy of your data at wifefood.com@gmail.com.

If what we collect or who we share it with changes, this page changes in the same release and the "last updated" date at the top moves. For a change that meaningfully affects you, we will also tell you in the app or by email rather than quietly editing the page.

Questions about anything here, or a request about your own data, goes to one place: wifefood.com@gmail.com. A person reads it. See also our Terms of Use and the Support page.

WifeFood is operated by Jodi Studio, the data controller for everything described on this page.