Privacy policy
Who we are
Kubbord is made by Night Shift Studio, an independent developer in Indiana, USA. Contact: hello@kubbord.com.
What Kubbord stores, and where
| What | Where | Why |
|---|---|---|
| Your pantry, shopping list, saved recipes, settings, kitchen tools, diet and allergy choices, what you cooked and threw away, money-saved estimates, your recipe passport and its stamps, your cooking streak, the monthly challenge, and your cooking profile (how sure you feel in the kitchen, what you want to get better at, weeknight time, equipment, who you cook for, favourite cuisines) | On your phone only (the pantry, shopping list and week's plan too, unless you share your kitchen) | So the app works, including offline. Your cooking profile is never sent to us; only "I'm good at" is shown, on your cook card, and only if you set one up. |
| If you share your kitchen: what is in it (each item as the app keeps it: its name, amount, place, dates, note, barcode, and the price if it came off a receipt), the shopping list and who ticked each line, the week's planned meals, who made each change and when, who is in the kitchen with their cook names, and a join code that works for 24 hours | Our server | So everyone in the kitchen sees the same food, list and plan on their own phone. Only the people in that kitchen can read it; no other cook can. Your cook card, favourites, passport, settings and everything else stay your own. |
| An anonymous account ID (your Kubbord ID in Settings) | Our server (Supabase, Canada) | To keep your own recipes, ratings and scan allowance. It contains no name or contact details. |
| Recipes you write, their photos, ratings, reports and comments | Our server | Private recipes are visible only to you. Recipes you share are visible to everyone, with your nickname if you set one. |
| An optional cook name, and your "Feature my recipes" choice | Our server | Shown on recipes you share and on what you post in Community. It doesn't have to be your real name. The choice tells us whether we may feature your recipes. |
| Your cook card, if you set one up: a line about you, up to three things you're good at, your country (from the region you chose in the app, never your location), an optional photo, and a short code for sharing the card | Our server | Shown to other cooks in the app, who can find you by your cook name. The words are checked like posts. A photo is shown to others only after a person has reviewed it, and you can remove it at any time. |
| Photos of dishes you cooked, if you choose to share one: the photo and a small copy of it (made on your phone, with the location, camera and time details removed), which recipe it's of, the hearts it gets, the hearts you give, and reports you make about photos | Our server (Supabase storage) | Shown to everyone in the app on that recipe, with your cook name and the flag of your region, once it has passed the checks below. Other cooks can heart it or report it. You can delete it at any time, which removes it everywhere. Free accounts can share 3 a month. |
| The date you confirmed "I'm 18 or older" | Our server | Needed before you can post, ask or answer a question, or share a dish photo |
| Community questions and answers, the topic you pick for a question, and which answers you marked "Helpful" on your own questions | Our server | Visible to everyone in the app, with your cook name. Helpful marks put the best answers first and earn their writers a small badge on their cook card. Answered questions move to the Q&A library after two weeks and stay searchable. |
| Whether you want "Questions in my topics" letters | Our server | So we only send them if you want them (on unless you turn it off in Settings), at most one a day |
| Questions you ask under a recipe, the answers to them, the "Helpful" marks you give answers, and the best answer the recipe's cook pinned | Our server | Visible to everyone in the app, with your cook name, under that recipe. The recipe's cook gets a notice in their mailbox about a new question. |
| Private messages, requests to message and private questions sent before 12 October 2026, when Kubbord stopped having private messages | Our server | Kept hidden from everyone, other cooks included, and never published. They are deleted with your account. |
| When you last had Kubbord open (one time, replaced each time; no history) | Our server | So other cooks see a green dot on your face while you are in the app, and a sleeping face when you are not. They only ever see "in the kitchen now" or "asleep", never a time, and somebody you blocked (or who blocked you) sees nothing. |
| Cooks you follow or block, and reports you make (with the note you add to one, if any) | Our server | So following, blocking and moderation work. The person you block or report is not told; a report's note is read only by moderators. |
| Which recipes were marked "I cooked this", and on what day | Our server | To pick the Cook of the week. Nobody, including other cooks, can read these records. |
| Badges the server gives: founder, Cook of the week, helper badges for answers marked helpful, and the notices in your mailbox (replies and answers to you, @mentions of your cook name, your recipe as Today's Dish, a moderator's decision about something of yours) | Our server | So they show on your You tab, your cook card, the Community board and your mailbox |
| If you ask a moderator to look again at a decision (a post taken down, or not being able to post): which decision, the note you add (if any), and what was decided | Our server | Read only by moderators, so the decision can be looked at again. You are told the outcome in your mailbox. |
| Corrections to Kubbord's food list, if "Help improve Kubbord's food knowledge" is on (it is unless you turn it off in Privacy & your data): which food or barcode, whether you changed where it lives, its aisle or its name, the new answer, your region's country and the day. Never amounts or what is in your kitchen. | Our server | When many cooks in a region make the same correction, it becomes everyone's default there. Your account ID is used only so each account counts once; nobody can read the votes, and new names are checked by a person first. |
| What a receipt line was, under the same setting: when you pick or confirm what a line on a receipt or order screenshot is, the shop chain's name (for example Walmart), the words of that line and the product or food you chose (or "not food"). Never prices, totals, card digits, dates, addresses or your name; a line that looks like payment, card, loyalty or contact details is never sent. | Our server | When 3 or more cooks agree on what a line at a shop is, the next receipt from that shop is matched for everyone. Your account ID is used only so each account counts once; nobody can read these. |
| Changes you suggest to a recipe ("Suggest an edit"): the recipe as you proposed it (its words, amounts, time and servings), an optional note about what you changed, when you sent it, and whether it was taken, turned down or later undone. Every version of a recipe is kept, with who made each change. | Our server | So the change can be checked and, once taken, shown on the recipe. Your cook name appears in "Improved by" and in the recipe's history, and the number of your changes on your cook card. A cook's own recipe: its writer sees your suggestion and your cook name to decide on it. A change that is turned down is kept, so repeated vandalism can be limited. |
| A recipe of your own that you share as a link ("Send a link"): a copy of its name, ingredients, amounts, steps, time and servings, and when you shared or stopped sharing it | Our server | So anyone you send the link to can open the recipe at kubbord.com, with your cook name (or "Kubbord cook"). Only people with the link can open it: it is not in the recipe library, search or Community. The words are checked first (see Automatic moderation). Changing the recipe updates the copy; "Stop sharing this link" removes it. |
| If you choose kitchen notes by email: your email address, the language and a key your phone made for sending, whether you confirmed the address, and which days a note was sent. Never the notes themselves. | Our server | To send the notes you asked for, and only those. The address is used for nothing else and shared with no one except the email service that delivers it. |
| Foods you add to your shopping list from a kitchen-notes email on a computer | Our server, until your phone collects them | Your shopping list lives on your phone, so they wait here until Kubbord next opens, then are deleted (after 14 days at the most). |
| How many scans and AI requests you have used | Our server | Free allowances and abuse limits, and to show you a note in the app about Kubbord Plus when a free allowance runs out. Your phone decides when to show these notes from what it already knows (for example this month's savings on Your food money); our server only counts how often each kind of note was shown or tapped, with no account attached. |
| A device code: a one-way scrambled form (hash) of the ID Android gives Kubbord on your phone, never the ID itself, sent with each AI request, with the days it was first and last seen and the accounts that used it | Our server | So free allowances count per phone as well as per account, and reinstalling does not reset them. It cannot be linked to other apps (Android gives every app its own ID) and is never used for ads. Forgotten after 13 months unused; deleting your account removes its link to the device. |
| Your Kubbord Plus subscription status | Our server | To unlock paid features. Payment is handled entirely by Google Play; we never see your card. |
Photos and AI
When you photograph a shelf, fridge, receipt or online order, the photo goes over an encrypted connection to our server and from there to Google's Gemini AI service, which reads it and returns a list of items. We do not keep your photos; they are discarded once read. The same service translates recipes, checks shared recipes for spam or unsafe content, and matches food names. We use Gemini under Google's paid terms, under which Google does not use your content to train its models. Receipts may show the last digits of a card; Kubbord does not store them. Since October 2026 most receipts are read on your phone first (Google's ML Kit, through Google Play services), and only the words go to our server; the photo is sent only when the phone cannot read it.
Dish photos are different: they are kept, because you are sharing them. After "I cooked this", or with "Add your photo" on a recipe, you can share a photo of what you made. It needs a cook name and your confirmation that you're 18 or older. Your phone makes it smaller and removes its hidden details (where and when it was taken, and the camera) before it is sent. Before anyone else can see it, the photo is sent to OpenAI's Moderation API, which checks it for harmful content, and to Google's Gemini, which checks that it shows food; a photo that fails either check is deleted and never shown. If the checks can't run, the photo waits on your phone until they can. Nothing is shown unchecked. A photo reported by three different people is hidden until a moderator looks at it.
Community
In Community you ask and answer questions on the boards and under each recipe, for everyone to learn from. There are no private messages (since 12 October 2026). Posting needs a cook name and your confirmation that you're 18 or older. Posts are text only: links, email addresses and phone numbers are refused. Your mailbox shows notices about you: replies, answers, @mentions, rewards and moderator decisions.
Questions under a recipe. You can ask a recipe's cook a question right under the recipe, or "Ask" them from their cook card. Everyone can see questions and answers, and anyone can answer. The cook is told about a new question in their mailbox and can pin the best answer; anyone can mark an answer "Helpful". Questions asked privately before 12 October 2026 were never published and stay hidden.
Cook cards and finding cooks. Other cooks can find you by your cook name once you have one, and open your card from anything you post. Someone you block, or who blocks you, never finds you and can't see your card.
Automatic moderation. Before a post, a cook name or the words on a cook card are shown to anyone, the text is sent to OpenAI's Moderation API, which checks it for harmful content. Only the text is sent, not your name or account. If the check can't run, the post waits on your phone until it can. Nothing is posted unchecked. OpenAI says it doesn't use data sent through its API to train its models.
Reports and blocks. You can report a cook or a post, a question or an answer (offensive, spam, unsafe, or under 18) and block any cook; a block hides their posts from you. A post reported by three different people is hidden until a moderator looks at it. A block works both ways and the blocked person is not told. If a moderator takes down your post or stops you posting, your mailbox says so, and you can ask for another look once.
"For you", search and topics. The board picks a few questions for you by comparing them, on your phone, with what's in your kitchen, what you cooked, the cooks you follow and your language. Your kitchen and what you cooked are never sent for this. When you search the board, your search words are sent to our server to find matching questions and answers; they are not saved. While you write a question, its words are sent the same way to show "Did someone already ask this?"; they are not saved unless you post the question. If you're good at a topic (from your cook card, or from answers people marked helpful), a new question in that topic may arrive in your mailbox as "A baking question you might know", at most one a day, never from someone either of you has blocked. You can turn these off in Settings.
Sharing a recipe with a link
Share on any recipe sends a link to kubbord.com through your phone's own share menu, to whoever you choose. A recipe from the library links to its public page. A recipe of your own becomes an unlisted copy that only people with the link can open: it isn't added to the library, search or Community. Before the copy is made, and again whenever you change the recipe, its words are sent to OpenAI's Moderation API (only the words, not your name or account); a recipe that fails the check isn't shared, and you're told why. The page shows your cook name, or "Kubbord cook" if you have none, and a photo of the dish only if one has already been approved for everyone. "Stop sharing this link" removes the copy, and the page then says the recipe is no longer shared. Deleting the recipe or your account removes it too. When someone opens the link, kubbord.com shows the recipe in their browser's language; we don't keep a list of who opened it.
Recipes on the board, and favourites on your cook card
Pinning a recipe. "Pin it to the board" puts a recipe on the Community board with your cook name and, if you write one, a line about how it went. The line is checked by OpenAI's Moderation API like any post (only the words). Everyone on Kubbord can see your pins, on the board and on the Pinned shelf of your cook card, until you unpin them. Pins of the same recipe are shown together as one note with how many cooks pinned it; anyone can see who pinned it, except cooks either of you has blocked. A recipe of your own that isn't in the library goes on the board through its share link (above): anyone on Kubbord can then open it, and "Stop sharing this link" takes it off the board too.
Showing your favourites. Your favourites stay on your phone unless you turn on "Show my favourites on my card" (off unless you turn it on). Then the library recipes you have hearted are sent to our server and shown on your card, with what you cooked lately from the library (from the "I cooked it" record the server already keeps). Your own private recipes are never shown. Cooks who follow you may see "added to favourites" and "cooked" in their Following tab, only for things after you turned it on. Turning it off deletes the list from our server at once and hides both shelves; nobody you have blocked, or who has blocked you, sees them.
Sharing your kitchen
You can share one kitchen with the people you live with (You, Settings, Kitchen members). It is off until you share or join one. You choose who is in it: the person who shares it shows a code (and a QR code) on their phone, good for 24 hours, and only someone who types or scans that code can join. Before joining, the app shows whose kitchen it is, and you choose whether to move your food into it or start fresh; your own kitchen is then kept on your phone so you can bring it back if you leave. While you are in a kitchen, its fridge, pantry, freezer, shopping list and planned meals are kept on our server and sent to every phone in it, with who changed what and when (the history is kept for 90 days). Nobody outside the kitchen can read them. The person who shared it can take someone out, and anyone can leave; leaving keeps a copy of everything on your phone and stops your changes reaching the others. When the last person leaves, the kitchen and everything in it is deleted from our server. Deleting your account takes you out of the kitchen. If you get kitchen notes, they may say what the others added ("Anna added milk"), in the way you chose to get them.
Barcodes and product information
When you scan a barcode, Kubbord looks it up in Open Food Facts, a free public product database. Only the barcode or product name is sent, never anything about you. Product details may be kept on our server so the next scan of the same product is faster. That is product information, not yours.
Kitchen notes, notifications and Today's Dish
Kitchen notes (what to use soon, what is running low, what to buy again) and the Today's Dish note (at 4 PM unless you change it) are worked out and scheduled on your phone, from your own kitchen. As notifications, nothing about them is sent to us. Today's Dish is picked by our server and is the same recipe for everyone that day. It isn't chosen from anything about you.
By email, only if you ask. In Settings, Kitchen notes, you can have the notes emailed daily or weekly. We first send a link to check the address is yours, and nothing else is sent until you press it. At the time you chose, your phone sends us only that day's note (the names of the foods in it, how many days each has left, and whether it is running low), and we pass it to our email service to deliver. We don't keep the note; we keep only the date one was sent. Your pantry stays on your phone. Every email has a one-click unsubscribe link, and you can stop the emails in the app at any time, which deletes your address. The emails carry no tracking pixels and no adverts. The "Add to my shopping list" links in them work once, for 7 days.
The launch waitlist on this website
Before Kubbord is on Google Play, you can leave your email address on kubbord.com to hear when it launches. This is separate from the app and needs no account.
- What we keep: your email address, the language of the page you used, which page or link brought you (for example a Pinterest pin), and the date you joined and confirmed.
- Why: to send you one email when Kubbord launches, and before that one email asking you to confirm the address is yours. Nothing else: no newsletter, no adverts, and we never share or sell the list.
- Where: in our database at Supabase (Canada). The emails are delivered by Resend (USA).
- How long: an address that is never confirmed is deleted after 30 days. A confirmed address is deleted 30 days after the launch email, or as soon as you leave the list, whichever comes first.
- How to leave: every email has a link that deletes your address at once. Or email hello@kubbord.com and we'll delete it by hand.
- Keeping out robots: to stop automated sign-ups we count tries from the same internet address for an hour, keeping only a scrambled form of it, never the address itself, for one day. If the form shows a "Verify you are human" box, that is Cloudflare Turnstile, which checks your browser and is covered by Cloudflare's privacy policy.
- The iPhone list: "Tell me when" on kubbord.com/get on an iPhone is the same list, marked as the iPhone one. It gets one email when Kubbord is on the iPhone (and the confirmation), never the Google Play one, and is kept and deleted the same way.
Kubbord codes on products and kubbord.app/get
A Kubbord QR code on a product (kubbord.app/p/...) or the link kubbord.app/get only counts what happens: how many times a code was scanned, opened the app, led to an install, was added to a kitchen or opened a recipe, and for the link which kind of device (Android, iPhone, computer) and which tag (?from=) it came with. Each is just a number per day. No account, email, internet address, cookie or device identifier is kept with it. Adding the product happens on your phone, like any food you add.
Links to shops
Kubbord may suggest cookware or grocery delivery with links to shops. Kubbord may earn a commission from these links, at no extra cost to you. When you tap one you leave Kubbord and that shop's privacy policy applies.
Food recalls and saved receipts
Food recall alerts. Kubbord downloads the public recall notices of the US Food and Drug Administration and the US Department of Agriculture to your phone. Matching them against your kitchen happens on your phone: your kitchen is never sent anywhere for this. All the server learns is a count of how many matches were shown and what was done about them (thrown out, returned, "not this lot"), with no account and no food attached. You can turn the alerts off in More settings. If you choose your state there, it stays on the phone.
Saved receipts (Kubbord Plus). With Plus, a photo of each receipt you scan is kept with its shop, date and lines, so you can show it at the store for a refund. Receipts stay on your phone, are never shared or uploaded, and are not included in Android's cloud backup. You can delete any of them at any time; they are removed automatically after the time you choose (12 months unless you change it), and 60 days after Plus ends.
Price history (Kubbord Plus). What you paid for each thing, at which store and when, comes from the receipts you scan and any price you type in. It is kept and worked out on your phone (which store is usually cheaper, your spending by month) and is never sent to us. In a shared kitchen, members see the prices on the items they share, as before.
Which country you are in
The AI services Kubbord uses (Google's Gemini and OpenAI's moderation check) are not offered in some countries, such as Russia and Belarus, and Google Play cannot take payments in some. So when the app talks to our server, the server works out which country the request comes from, from its internet address, using DB-IP's free country table (kept on our own server; nothing is sent to DB-IP). Only when there is no address does it use the region you chose in the app. It is never more precise than the country, and your internet address itself is not stored.
- If you are in one of those countries, Kubbord's AI helpers (reading receipts and shelf photos, importing and writing recipes, translating, checking dish photos) and posting in Community are switched off for you, the app says so, and the whole week's meal plan and kitchen sharing are free instead.
- For accounts used from those countries only, we keep the country code (for example "RU") and when the account was last seen there, to keep server costs in check. Accounts used anywhere else have nothing about their country kept. The code is deleted with your account, or after 13 months of not being seen there.
What we don't do
- No advertising and no advertising IDs.
- No selling or renting of data to anyone.
- No tracking across other apps or websites, and no location tracking: never GPS, never anything finer than the country (see above).
- No access to your contacts, messages or files beyond the pictures you pick.
Who processes data for us
- Supabase: database and server functions, hosted in Canada.
- Google: Gemini AI (including checking that a shared dish photo shows food) and Google Play (installs, payments).
- OpenAI: the Moderation API, which checks the text of Community posts (questions and answers), cook names and cook cards, suggested recipe changes, and shared dish photos.
- Open Food Facts: product lookups by barcode or name.
- Resend: delivers kitchen-notes emails, only if you turn them on, and the launch waitlist emails (USA).
- Cloudflare: runs this website, and, if it is switched on, the Turnstile check on the waitlist form.
Data may be processed in Canada, the United States and other countries where these providers operate.
How long we keep it
Account data stays while you use Kubbord. Shared recipes stay public until you unshare or delete them, or a moderator hides them. Dish photos you share stay until you delete them, a moderator removes them, or your account is deleted. Community posts, your cook card and its photo, follows, blocks, reports and appeals stay until you change them or your account is deleted, which deletes them all. Your kitchen-notes email address stays until you stop the emails or delete your account; the record of which days a note was sent is kept for 90 days. A waitlist address is kept as described above. Subscription records are kept as long as needed for the subscription and for tax and accounting. Server logs are kept briefly for security and fixing problems. Backups clear within about 30 days.
Your choices and rights
- Unshare or delete your recipes in the app at any time.
- Uninstalling Kubbord, or clearing its data, removes everything stored on your phone.
- To delete your server data, see Delete my account. To get a copy of it, email us with your Kubbord ID. We respond within 30 days. Depending on where you live (for example the EU, UK, California or Canada) you may have further rights, and we honour them.
Children
Kubbord is meant for adults and isn't directed at children. Community posts are for people who confirm they are 18 or older. We don't knowingly collect data from children. If you believe a child has shared something, report it in the app or contact us and we'll remove it.
Security
Connections are encrypted, every table on our server is protected so each account reaches only what it should, and AI keys never leave our server. No system is perfect, so we keep as little as we can.
Changes
If this policy changes we'll update the date above, and tell you in the app about important changes.