What we store
- Your identity. The stable user id Google gives us for you, and your email address. No password: we never see one, because Google does the signing in.
- Your recipes and staples. Everything you generate and save, including ratings and notes.
- Your OpenRouter API key, encrypted. See below.
- Sessions. One row per signed-in device, holding a hash of the session token — not the token — with the browser string it reported and the times it was created and last used.
- Monthly usage totals. How many recipes you generated and how many tokens they cost, so you can see your own spend.
Server logs record the method, path, status and account id of API requests. They do not record request bodies, so what you typed is not in them, and they never contain credentials.
What we deliberately do not store
Your Cookidoo login. When you connect Cookidoo, the session value you paste is put
in a cookie in your own browser, marked HttpOnly and Secure, and
scoped so the browser only ever sends it to the one endpoint that performs a push. It is
not written to our database, it is not in our backups, and there is no table of Cookidoo
sessions here to steal.
Being straight about the limit: a push has to be made from our server, because a browser will not let a page on our domain call Cookidoo directly. So during a push, your credential passes through our server in memory. That is minutes of traffic rather than a stored credential, and it is the reason the credential expires and has to be re-pasted rather than living here permanently.
How your API key is protected
Your OpenRouter key has to work when you are not sitting there, so it is stored — but encrypted with XChaCha20-Poly1305 under a key that belongs only to your account, which is itself encrypted with a master key held in the deployment's secret store and never written to the database.
The key is write-only over the API: once saved, it is never returned, not to you and not to anything else. Settings shows only that it is set and its last four characters. It is never written to a log.
Deleting your account destroys your account's encryption key. After that, the stored ciphertext cannot be decrypted by anyone — including us, and including from a backup taken before you deleted it.
Where it lives
On a server hosted by OVH in the EU. Backups are replicated to OVH object storage, also in the EU.
Who else is involved
- Google — identity only. They tell us your stable user id and your email address; we ask for nothing else.
- OpenRouter — recipe generation, under your own API key and your own account with them. Their terms and privacy policy apply to what you send through it.
- OVH — hosting and backup storage.
There is no email provider, no analytics, no advertising network and no authentication vendor. There is nothing to unsubscribe from, because we cannot send you email.
Your data, on demand
Export. Settings → Your data → Download my data returns every recipe and staple you have saved, as JSON. It is available at any time and does not require asking anyone.
Deletion. Settings → Your data → Delete my account removes your account, your recipes, your staples, your sessions, your usage totals and your encryption key, immediately. Backups age out on their own retention schedule, and what they hold of your encrypted key is unreadable from the moment the key is destroyed.
Cookies
tm6_session— keeps you signed in. Necessary; there is no site without it.tm6_oauth— lives for ten minutes during sign-in to stop the sign-in itself being forged.cookidoo_session— your Cookidoo credential, set only if you connect it, and sent only to the push endpoint.
All three are strictly necessary for a feature you asked for. There are no tracking cookies.