Privacy Policy

About this policy

My Royal Chef is a pantry-aware cooking assistant and recipe service provided by Aporia Systems. This policy covers the website (myroyalchef.com) and the Android app. If you have questions about this policy or about your data, use the contact form and we will respond as soon as we can.

Account information

If you create an account, we store your username, email address, and a secure hash of your password (never the password itself). If you sign in with Google, we receive your name and email from Google to create or match your account. Your account may also record your plan status (Free or Premium) and how it was granted.

Chef chat & saved recipes

The chef runs on your device. On the website it is Royal Chef, a small cooking model that runs in your browser after a one-time download; in the Android app the same model is bundled with the app. Your prompts and the chef’s replies are answered on your device and are not sent to any AI service, and our server calls no AI service. Guest chats are kept only in your browser or app storage. If you are signed in, your conversations and saved recipes are stored on our server so you can return to them across sessions; the Android app also keeps a local copy of your chat. On the website, voice dictation is handled by browser or operating-system speech recognition; we do not receive the audio.

Pantry & recipe tools

Your pantry list and saved ingredients are stored on your device only. Fridge Rescue and Cook Tonight are answered by the on-device chef, so the ingredient names, quantities and expiry dates you enter are not sent to any AI service. Your pantry is not stored on our server.

Messages you send us

If you use the contact form or sign up for the cookbook, we store the name, email, and message you provided so we can respond.

Subscription & payments

Premium is sold through Gumroad on the website. Gumroad processes your payment — we never see your card details. We receive only your purchase email and sale status, which we use solely to attach Premium to your account. The Android app downloaded from this website opens the same Gumroad checkout and recognizes your Premium entitlement after login.

If you subscribe to Premium in the Android app installed from Google Play, Google processes the payment and Google's privacy policy applies to it. Our server receives a purchase token from Google so it can confirm and renew your subscription and apply cancellations or refunds. We store only a SHA-256 hash of that token, the product, the subscription status and its expiry date, linked to your account; these are removed when you delete your account, and renewals stop only when you cancel in Google Play.

AI content reports

When you report an AI-generated answer or recipe from the app, we store the report category, the feature it came from, a short content identifier (for example a recipe title) or a SHA-256 hash of the content, an optional note you write, and — only if you are signed in — an internal user id. Reports do not contain your password, images, advertising identifiers or full chat history, and they are used only to review and improve AI output. If you later delete your account, the reporter link on your reports is anonymized (your user id is removed) while the moderation record itself may remain.

Security logs

We keep minimal technical records (login attempts, rate-limit counters) purely to protect accounts from abuse. These are not used for marketing or profiling.

Cookies

A session cookie keeps you logged in, and a security token protects forms against forgery. Both are strictly necessary. The website also uses Google Analytics 4 to measure aggregate traffic, which sets two optional cookies (_ga and _ga_R9KYVH815S); you can block them in your browser or with Google’s opt-out add-on. There are no marketing cookies.

Google Mobile Ads (AdMob)

The Android app includes Google's Mobile Ads SDK so signed-in free users can watch a rewarded ad to earn a free 24-hour Premium day (at most once every 7 days). Google may process device and advertising identifiers (for example the advertising ID), ad interactions, and diagnostics, measurement and fraud-prevention data to serve and measure ads, in line with Google's policies — that processing is done by Google under its own terms, and we receive only a small completion claim from the app, not Google's ad data. We do not intentionally collect or store the device advertising ID in our own backend. When an eligible signed-in user completes a rewarded ad, the Android app sends a reward-completion claim to our server so the Premium day can be granted: we process and store limited reward records (a generated reward identifier, the reward type, the date, and a subject key linked to the signed-in account). These records are used only to grant the Premium day, enforce the once-every-7-days limit, prevent duplicate claims and prevent abuse. Because they are linked to a signed-in account, they are not anonymous. Guests cannot claim the rewarded-ad Premium day.

The app uses Google's User Messaging Platform to determine where consent or privacy messages are required and to show Google-managed consent or privacy messages to the users who need them. Where Google requires a privacy-options entry point, the Android app's Settings shows a "Privacy choices" option to review or change those choices.

On-device storage and server processing

The Android app runs the chef, its recipe tools and your pantry on your device, with the chef model bundled in the app. Chef prompts and replies are not sent to any AI service. The app also contacts our server to sign you in, check your plan and download the latest recipe data. Your chat transcript, saved recipes, pantry and cached results are stored on your device in the app’s private storage; guest chats stay on the device. Google sign-in on Android uses Google's native, system-level account picker — the app never sees your Google password. Your session is stored securely on the device and is cleared when you log out, delete your account, or clear the app's data.

Voice input

The chat mic button uses Android speech recognition to convert your voice into text in the input box. Speech recognition may be handled by the device's configured recognition service or provider (for example Google's speech services), rather than entirely on the device — audio may therefore be processed by that service according to its own policies. We do not receive or store your audio. The mic only listens while you activate it, and only with the RECORD_AUDIO permission you grant.

• Hugging Face — hosts the chef’s model files for the website. When you start the chat in your browser, the browser downloads them directly from huggingface.co, with this site’s own server as the fallback mirror. That request carries no conversation content.
• Google (Sign-In, Mobile Ads, speech services, Analytics) — authentication, advertising, device-level speech recognition as described above, and Google Analytics 4 on the website for aggregate traffic measurement.
• Gumroad — website payments only; never used inside the Android app.

Data is transmitted over HTTPS where applicable, and we apply reasonable technical and organizational measures to protect the data we hold. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Deleting your account

You can delete your account at any time — in the Android app under Settings → Account → Delete account, or signed in on the delete account page. Deletion is permanent: in one transaction we remove your account, saved recipes, chats, usage records and any pending premium grant linked to your account's email, and your app session is cleared. Purchase receipts are anonymized (personal identifiers removed) and kept for tax and accounting compliance; rate-limit and security counters are kept without personal content; and any AI content reports you submitted keep their moderation record with your user id removed. See the delete account page for the full detail. If you prefer, you can also ask us through the contact form, and we process deletion requests within 30 days.

Retention

Account data is kept while your account is active. Rate-limit counters are pruned automatically (typically within 24 hours) and technical logs are kept for a limited period; none of these are used for profiling.