Last updated: June 15, 2026
ChefUp ("we", "our", "us") is operated by Headwater Labs, the data controller for the personal data described below. This Privacy Policy explains how we collect, use, and protect your personal information when you use the ChefUp mobile application. It is provided in accordance with the UK GDPR and the EU GDPR.
When you create an account, we collect your email address, username, and password (securely managed by AWS Cognito). If you sign in via Google or Apple, we receive your name and email from those providers.
You may optionally provide dietary requirements, allergies, and family member profiles. Profile photos are stored as encrypted data associated with your account.
Special category data. Allergy and dietary information can reveal details about health. Under Article 9 of the UK/EU GDPR this is "special category" data, and we process it only with your explicit consent, given when you choose to enter it, and solely to tailor recipe suggestions. You can remove this information at any time, and where you create profiles for family members you confirm you have the authority to provide their information.
We store the ingredients you add to your pantry, expiry dates, and recipes you generate or save. This data is used to provide the core functionality of the app.
We collect analytics via Firebase Analytics, including screen views, feature usage, and app performance data. This helps us improve the app experience. Analytics and crash reporting are optional: if you are in the UK or EU we ask for your consent before enabling them, and everyone can turn them on or off at any time in Settings → Analytics & Crash Reports.
We use Sentry to collect crash reports and error logs. These may include device type, OS version, app state at the time of the error, and a pseudonymous user identifier so we can correlate a crash with the affected account. We strip directly identifying fields such as your email address and IP address before reports are sent, and on-screen text and images are masked in any captured session replay. We do not deliberately include your name, pantry contents, or message content in crash reports.
With your permission, the app accesses your camera for ingredient scanning (OCR and barcode) and your microphone for voice input.
Photos of ingredients you take in the app are uploaded to our servers for ingredient identification. The image is processed and the recognised ingredients are returned to your device; the image itself is not retained after processing.
Voice input is converted to text on your device using your operating system's speech recognition. The resulting transcript (and the structured ingredient operations parsed from it) is sent to our servers so we can update your pantry. The transcript may be stored briefly for service quality and debugging, and is associated with your account.
Barcodes you scan are sent as numeric codes to our servers and to Open Food Facts for product lookup.
Under the UK/EU GDPR we rely on the following legal bases for processing your personal data:
We do not sell your personal data. We share data with the following service providers ("processors"), who act on our instructions:
Your account and pantry data are stored in the UK/EU (AWS eu-west-2). Some of our processors — including OpenAI, Replicate, Firebase, RevenueCat, and Sentry — are based in, or process data in, the United States or other countries outside the UK/EEA. Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards as required by the UK/EU GDPR, in particular the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, or transfers to countries the UK/EU has deemed to provide adequate protection. You can request a copy of the relevant safeguards by contacting us at the address below.
Your data is stored on AWS servers in the EU (eu-west-2 region). We use industry-standard encryption for data in transit (TLS/HTTPS) and secure authentication via AWS Cognito. Passwords are never stored in plain text.
We retain your account data for as long as your account is active. When you delete your account it is deactivated immediately and your personal data is permanently erased after a 30-day grace period (which lets you change your mind and protects against accidental deletion). Specific retention periods:
For full details of what is deleted and when, see our Account Deletion page.
Under UK and EU data protection law, you have the right to:
You can exercise the access, export and deletion rights directly in the app (Settings → Export My Data / Delete Account), or contact us at hello@chefup.io for any of these rights. We respond to requests within one month.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO), ico.org.uk; in the EU it is your local data protection authority. We'd appreciate the chance to address your concerns first, so please do contact us.
We use AI to generate recipe suggestions based on your ingredients and preferences. This personalisation does not produce legal or similarly significant effects, and we do not carry out automated decision-making within the meaning of Article 22 of the GDPR.
ChefUp is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us.
With your permission, we send push notifications for expiry reminders, cooking timers, and occasional engagement prompts. You can disable these at any time in your device settings or within the app.
The app may contain links to external websites. We are not responsible for the privacy practices of third-party sites.
We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or email. Continued use of ChefUp after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or your data, contact us at:
Email: hello@chefup.io
Website: https://legal.chefup.io