Updated 16 October 2026 · Controls described below apply to Sous 1.12 and later. Earlier releases have different controls, as noted below.
AI processing is optional. Before your first AI request, Sous explains the data sharing and asks for explicit permission. Decline to keep using saved recipes, manual editing and timers. Withdraw permission in Settings → Privacy; this stops future requests, but cannot recall content already sent.
Usage analytics are enabled by default. On first opening this release, an in-app notice explains analytics and offers a toggle before you continue. Turn off Share Usage Analytics in Settings → Privacy to stop future analytics and discard queued events on that device. AI permission and analytics controls are separate.
Sous stores your recipe collection and recipe conversations on your device. When iCloud is available, recipes and conversations synchronize to your private Apple CloudKit database; selected preferences also synchronize using iCloud. This is not local-only storage. Apple processes iCloud data under its privacy policy. Local-only storage may be used if iCloud is unavailable.
Pending text and URL imports and parsed recipe reviews are stored on your device until completed or dismissed, so you can recover after interruption. Selected photos for an unfinished import are not retained in that recovery queue. Personal recipe notes and attached photos sync with your private recipe collection. Selected camera or photo-library images are used for the import you request. Sous does not upload your whole photo library. Delete recipes and associated conversations in the app. Deletions synchronize when iCloud is available. You can manage iCloud app storage and backups in Apple Settings; backups follow Apple's retention controls.
The separate AI permission, analytics welcome notice and 30-day recipe-sharing retention described here are introduced in version 1.12. Earlier versions may send content when you invoke an AI feature without this new permission screen. Earlier analytics may include search terms, recipe titles, source URLs, share identifiers and error descriptions. Update to 1.12 when available to use the new controls and reduced analytics collection. Older recipe shares may remain available as described below.
After you grant permission, Sous sends the information needed for the selected AI feature over HTTPS through our Cloudflare Worker to Google Gemini. Imports send pasted text, fetched website content or selected photos. Cooking help sends your question, conversation and relevant recipe context. Recipe adjustments and grocery grouping send recipe or ingredient information. Recipe discovery sends your query and uses Google Search grounding. Its two-stage search sends search evidence to Gemini again to format the results. Website imports and recipe links also connect to the original publisher, which receives ordinary connection information.
Do not provide sensitive or confidential personal information. AI output can be inaccurate; check ingredients, quantities, allergens and cooking guidance. Our proxy does not intentionally log or persist request bodies, photos or generated content. Cloudflare processes network and operational information to host and protect the service under its privacy policy.
Google's Gemini API terms and privacy policy govern its processing. Google may retain content for abuse prevention and service operation, including up to 55 days for abuse monitoring and 30 days for Google Search grounding. Data use also depends on the service tier: paid-service prompts and responses are not used to improve Google products; unpaid-service content may be used for product improvement and reviewed by people. We do not promise zero retention or that withdrawing permission deletes a provider's existing security records.
Creating a share link is optional and requires a separate confirmation. The recipe title, ingredients, instructions, servings, times and source URL, or shopping items, quantities, checked states, recipe names and shopping tip, are sent to Cloudflare and are readable by anyone with the link. Do not publish private information. Personal recipe notes, photos and chats are excluded from new shares. New links expire after 30 days; recipients may retain copies.
Earlier versions also copied recipe shares, including photos when present, to Apple's public CloudKit database and created Cloudflare recipe links without expiration. Those historical copies are not automatically removed by updating or deleting your local recipe. Contact us with the share link to request removal of hosted copies.
Apple App Attest helps verify genuine app installations. Our backend stores a public verification key, request counter, last-used time and usage allowances. It processes an IP address to apply abuse limits and stores a hash rather than the raw address for that counter. Keys expire after 90 days without use; expired quota and challenge records are cleaned up. These records contain no recipe or photo content. A cryptographic request digest is used to verify each request and is not retained as recipe content.
Mixpanel receives an installation identifier, basic app/device information, feature interactions, counts and performance timings to help improve Sous. We do not send recipe content, photos, chat messages, search text or full recipe URLs as analytics properties. Automatic event collection and IP-derived location enrichment are disabled in this release. Network providers necessarily process connection metadata. See Mixpanel's privacy policy.
We do not sell this data or use it for cross-app advertising tracking. Turning analytics off stops future events and clears queued SDK data on your device; it does not automatically delete historical server records. Contact us to request access or deletion. Analytics are retained under the project's configured retention controls until expiration or an approved deletion request. Earlier app and website versions sent more detailed URL and location information; these changes do not retroactively erase those records.
Apple handles subscriptions, payment details and purchase verification. Sous reads verified StoreKit entitlements to unlock features; we do not receive payment-card details. Camera, selected-photo, notification and Siri permissions support the features you choose and can be changed in Apple Settings. Sous does not require an app account.
The website may use Mixpanel for page and feature-use analytics with an opt-out control. Campaign links redirect to Apple with a campaign label; this release removes the separate redirect event that transmitted IP and location fields. Hosting providers may retain operational/security records. You can clear local website storage and use its analytics control.
To request access, correction or deletion, contact snagra045@gmail.com. Include your analytics identifier from Settings if your request concerns app analytics; do not email passwords, payment details or confidential recipes. We will explain any information needed to locate records and any legally required retention. Requests to Apple or Google may also be subject to their own identity and retention processes.
Sous is not directed to children under 13. Service providers may process data in countries where they operate. We use providers' contractual safeguards and publish their privacy information above. Material changes to AI sharing require a new in-app permission decision; the policy date will also be updated.