Privacy

Privacy

RecipeDraft stores recipes, notes, cook history including optional detailed and custom review responses, plans, grocery lists, pantry data, bounded recipe-revision photos, and bounded Cook Session completion photos locally. A selected photo or PDF is read locally to create an import draft; when a person saves that review, the selected photo can be retained as a locally normalized recipe-revision image. Completion photos are stored only with their selected Cook Session and never silently modify a recipe version. It has no HomiSoft backend, account, login, advertising, analytics, tracking SDK, or automatic cloud synchronization.

First-run completion is stored as a local iOS AppStorage value or Android DataStore preference. It records only whether the introductory pages were finished; it does not contain recipe content, does not leave the device, and is not included in .recipedraft backups.

The main iOS app, Share extension, and Widget each bundle an audited privacy manifest with tracking disabled, no declared collected data types, and only the UserDefaults required-reason entries used for local/app-group state. See PRIVACY_MANIFEST.md; a release archive must still generate and review its aggregate privacy report.

An explicitly selected URL is requested directly from that source site; imported content and images are not relayed through HomiSoft. OCR and PDF interpretation run on-device. Purchases use Apple/Google frameworks. Calendar, Reminders, Camera, and Photos permission are requested only at the contextual action. Notification permission is requested only when a person starts a timer or explicitly enables a per-item Pantry expiry reminder; expiry dates alone do not schedule alerts. Crash reporting must never include recipe content, private notes, or photo paths.

When a person explicitly exports a meal plan, the app writes that plan's meal title, servings, and plan note directly to the device's selected writable system Calendar. The platform Calendar event identifier stays only in the local archive so a later export can update the same event; it is excluded from .recipedraft backups and is never sent to HomiSoft.

On iOS, when a person explicitly exports a grocery list to Reminders, the app writes only the item title, quantity, aisle, grocery-list title, and available source recipe titles to the device's default writable Reminders list. It never writes private recipe notes, Cook Session data, or review data. A local EventKit identifier lets a later export update, complete, or reopen the same RecipeDraft-created reminder; the identifier is excluded from .recipedraft backups. Removing a grocery row or list only stops RecipeDraft from tracking that reminder and does not silently delete a person’s system reminder. Android does not expose an equivalent generic writable reminder store, so the user can explicitly hand a text list to an installed task or reminder app through the system share sheet.

The app caches only a local Lifetime Pro entitlement flag after a store-verified purchase so access can survive a short offline period. It does not upload a purchase token or combine purchase data with recipe content.

The iOS WidgetKit extension and Android home-screen widget receive only a local count-only snapshot: active Cook Sessions, active timers, unchecked grocery rows, and meals planned for today. That snapshot deliberately excludes recipe and revision identifiers, titles, timer labels, notes, photos, source links, and all Cook Session review content. Tapping the widget opens the local Kitchen tab; it does not expose a specific recipe or cook record.

Recipe PDF, selected-current-revision text-first cookbook PDF, PNG image-card, plain-text, Markdown, JSON, and CSV exports are created locally and sent only through the system share action the person chooses. They include the selected revision's public fields and source link; PDF and image card can include its valid locally stored recipe photo, while private notes, Cook Session reviews, including who-liked-it text, and full Cook Session history are excluded. Manual .recipedraft backups include the bounded recipe-revision and Cook Session completion photo payloads; no full-resolution photo-library identifier is stored.

Lifetime Pro can make an optional encrypted .recipedraft file locally using an entered passphrase, PBKDF2-HMAC-SHA256, and AES-256-GCM. The passphrase is used only in memory for that file operation; RecipeDraft does not retain it in the app, backup metadata, analytics, or a HomiSoft service. An encrypted file can still be opened and restored by a Free installation that knows its passphrase, so export protection never turns data access into a purchase gate.

Grocery-list text sharing is also created locally. It includes aisle grouping, quantity, checked state, and contributing recipe title only; it does not include private recipe notes or Cook Session notes.

On iOS, a user-selected link, text, image, or PDF shared to RecipeDraft is briefly placed in the local App Group inbox so the main app can open an import-review screen; it is not uploaded or sent to another app. Android keeps link/text shares in app memory until review, and copies a shared image or PDF into its app-owned local shared-imports directory before on-device extraction. Both media paths reject files over 50 MB and remove the staged file after extraction, so review does not depend on another app's temporary file permission.

If a private local archive is unreadable, RecipeDraft blocks changes rather than replacing it with an empty library. A person may explicitly save the raw recovery bytes using the system file picker. That file can contain every local field, including private recipes, notes, and photos, may not be importable, and is neither uploaded nor sent anywhere by RecipeDraft. The person chooses its location and remains responsible for keeping it private.

This is an engineering data-flow statement. A hosted public policy is required before store submission.