CookFast
Sign in

Privacy Policy

Last updated: 21 October 2026

CookFast helps you turn cooking videos into recipes you can actually cook from. This policy explains what personal data we collect, why, and what your rights are. We have tried to keep it short and honest.

Who we are

CookFast is a personal project operated from the Netherlands (the "developer", "we"). For anything in this policy, contact support@cookfast.fit. We are the data controller for the personal data described below under the EU General Data Protection Regulation (GDPR).

What we collect

  • Account data. When you sign in with Google we receive your name, email address and profile picture. When you sign in with Apple we receive your name (the first time only) and an email address, which is a private Apple relay address if you choose "Hide My Email". We never see your Google or Apple password. If you delete your account, we also ask Apple to revoke CookFast's access to your Apple ID.
  • Your content. The YouTube links you paste, the recipes extracted from them, your edits, tags, cook log and food preferences.
  • Suggestion history. The five weeknight preferences you set (diet, goal, weeknight time, cuisines, foods to avoid), which video we suggest you each day, and which suggestions you skip (and why, if you tell us). Used only to pick better suggestions for you.
  • Recipe reports. If you report a community recipe, we store which recipe, the reason you picked and any note you add, linked to your account so the same person cannot report one recipe twice. Reports are never shown publicly and are used only to review that recipe.
  • App usage (mobile app only). Which screens you open and which steps you take (for example finishing the five questions or tapping "Cook this"), with your app version, phone model, operating system and language. Described under Analytics below, including how to switch it off.
  • Technical logs. Standard server logs (IP address, browser or app version, timestamps) kept briefly for security and debugging.

We do not run ads, do not process payments and do not sell personal data. We do use analytics, described below.

The dinner decider (no account)

The dinner decider works without an account. Your three answers (diet, time, cuisine) are sent to our server only to pick a video and are not stored against you. Your IP address is used briefly in memory to stop automated over-use, and is not stored. If you tap "Get the written recipe", your answers and the chosen video are kept in your own browser until you finish signing in. After sign-in, if you have no saved preferences yet, those answers become your preferences, as if you had answered them in the app. Umami counts how many visitors use the decider, but never what they answered.

The recipe converter (no account)

The YouTube and TikTok to recipe converters work without an account. The link you paste is used to fetch that public video and write out its recipe, which then appears in the public community pool with the creator credited and no link to you. Your IP address is used briefly in memory to allow one free conversion a day and to stop automated over-use, and is not stored. If you sign in from the converter, the link you pasted is kept in your own browser until you are back. Umami counts how many visitors use the converter, but never which links they paste.

How we use your data, and on what legal basis

  • Providing the service (your account, recipe library, suggestions, community features): performance of a contract, Article 6(1)(b) GDPR.
  • Security, abuse prevention and debugging (server logs, rate limiting): legitimate interest, Article 6(1)(f) GDPR.
  • Analytics via Google Tag Manager and Analytics: your consent, Article 6(1)(a) GDPR, given or withdrawn through the cookie banner or the cookie settings control described below.
  • Mobile app analytics via PostHog: legitimate interest, Article 6(1)(f) GDPR, in learning which parts of the app work and where people get stuck. You can object at any time by switching off "Share usage analytics" in the app.
  • Anything else new that needs consent will ask for it first.

Analytics and cookies

We use three analytics tools, which work differently:

  • Umami counts page visits without cookies and without identifying you. It runs for everyone, with no prompt, because there is nothing to consent to.
  • Google Tag Manager, running Google Analytics (GA4), sets cookies and sends usage data to Google, including outside the EEA. It only runs after you accept the cookie banner shown on your first visit. If you decline, or do nothing, it never loads.
  • PostHog runs in the mobile app only. It records which screens you open and which steps you take, so we can see where people get stuck. The app keeps a random ID on your phone for this. After you sign in, events are linked to our internal account number, never to your name or email address. PostHog stores the data on its EU servers (Frankfurt, Germany), does not store your IP address, and we do not use it for location, advertising IDs or ads. Events are kept for one year. To switch it off, open Profile in the app and turn off Share usage analytics; the app then sends nothing more and forgets its random ID.

For Google Analytics, you can change your mind at any time using , whether or not you are signed in.

How YouTube and TikTok links are processed

When you paste a YouTube or TikTok link, our server fetches information about that video, including what is said in it, to build a structured recipe (title, ingredients, steps). We store the extracted recipe and the video's channel name and link so the creator is credited. We do not store or serve the video itself. YouTube and TikTok are separate services with their own terms and privacy policies.

The community pool

Recipes can appear in the public community section. Community recipes are always anonymous: they never show your name, email or any account detail. Only the recipe itself and the original video creator's credit are public.

Who we share data with

Only the processors needed to run the service: our hosting provider (Render, with servers in the EU and US), Google (sign-in, the YouTube Data API, and, if you consent to analytics, Google Analytics), Apple (Sign in with Apple, if you use it), PostHog (mobile app analytics, EU servers, unless you switch it off), a transcript service (CaptAPI) and an AI model service (OpenRouter), which receive the public video link or its transcript to write the recipe, never your account details. Where data leaves the EEA, it is protected by the EU-US Data Privacy Framework or Standard Contractual Clauses. We do not use your data for advertising.

How long we keep it

For as long as your account exists. Server logs are kept for a short rolling window. When your account is deleted, your account data, personal recipe library and suggestion history are deleted immediately and irreversibly; there is no archived copy and no hidden deactivated account. Anonymous community-pool recipes (which contain no personal data) may remain. Mobile app analytics events are kept for one year; after your account is deleted they are linked only to an internal number that no longer matches any account. Email us if you want them deleted sooner.

Deleted data can survive for a short while in routine encrypted database backups. Those backups are not queried or used for anything except disaster recovery, and if one ever has to be restored, the deletion is applied again to the restored data.

Deleting your account and data

You can delete your account yourself, at any time, from inside CookFast. On the web, open Preferences and use Delete account. In the mobile app, open Profile and use Delete account. You will be asked to type the word DELETE to confirm.

Deletion happens straight away and cannot be undone. It removes your account, your name and email address, your recipe library and tags, your preference answers, the record of what you cooked or skipped, and any recipe reports you sent. Recipes of yours already in the anonymous community pool stay there with the link to you removed, as described in the terms of service; those copies contain no personal data.

If you would rather not do it yourself, or you cannot sign in, email support@cookfast.fit from the address you signed in with and we will delete your account and associated personal data within 30 days.

Your rights

Under the GDPR you can ask for access to, correction of, deletion of, or a portable copy of your personal data, restrict or object to processing, and withdraw consent. Contact support@cookfast.fit. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Children

CookFast is not directed at children and is intended for users aged 16 and over.

Changes

If this policy changes materially, we will update this page and the date above. Continued use after a change means the new version applies.