Updated
Privacy policy
What Reduce collects when you convert and save recipes, who processes it, how long it is kept, and how to get it deleted.
1. Who we are
Reduce is operated by Atlas Row LLC, a United States limited liability company, which is the data controller for the personal information described on this page. Write to reducerecipes@gmail.com about anything on this page.
2. What this policy covers
This policy covers the Reduce website and app: the recipe converter, your cookbook, share links, and the Pro subscription. It does not cover the recipe sites you paste links from. Those are other people's websites with privacy policies of their own, and opening one is between you and them. Some of them are reached by your browser without you opening anything, which the section on what your browser loads from other services explains.
3. Information you give us
- Your account. If you sign up with an email address and a password, we store the email address. The password is handled by Supabase, which hosts our database and our authentication, and is stored as a hash that we cannot read.
- Google sign in. If you continue with Google, we ask Google for nothing beyond your basic profile and email, and we never receive your Google password. Three of those fields are the ones Reduce itself shows you: your email address, your name as Google has it, and the web address of your Google profile picture. The sign-in record Supabase keeps for the connection holds more than the app displays. It stores the account identifier Google issues for you, the profile details Google returns alongside it, and the times that connection was created, last updated and last used. That record is what lets you sign in with Google again, and it is deleted with your account.
- Sign in with Apple. If you continue with Apple, we ask Apple for nothing beyond what signs you in, and we never receive your Apple password. What reaches us is your email address, carried in the identity token Apple issues, so it arrives again on every sign-in. We do not receive your name. Apple offers a name only at the moment you first approve an app, in a separate one-time message that the sign-in route we use does not pass on to us, so Reduce holds no name from Apple and your account is shown by your email address instead. The sign-in record Supabase keeps for the connection holds the account identifier Apple issues for you, which is particular to Reduce and identifies you to nobody else, along with the details Apple returns beside it and the times that connection was created, last updated and last used. That record is what lets you sign in with Apple again, and it is deleted with your account. Apple also issues Reduce a credential for your account, called a refresh token, and we keep it for one purpose only: so that deleting your account can tell Apple to end Reduce's access to your Apple ID. It is never shown to anyone and never used to sign you in. It reaches the app on your device first, inside the sign-in session the app keeps there, and the app passes it straight on to our server, where no request made from the app or the site can read it back. We replace it each time you sign in with Apple and delete it with your account.
- Hiding your email from us. Apple offers you a choice at sign-in to hide your real address. If you take it, Apple gives us a relay address instead, ending either @privaterelay.appleid.com or @private.icloud.com. That relay address is the one we store on your account and the one we send mail to, and Apple forwards it on to you. We never receive your real address, we cannot work it out from the relay one, and the account mail described below reaches you through Apple rather than directly. You can stop that forwarding at any time in your Apple account settings, under the list of apps you have used Sign in with Apple for. Doing so does not delete your Reduce account, but we would have no working address for you.
- Your settings. Whether you read amounts in metric or US units, whether the app is light or dark, whether voice control is on in Cook Mode, and whether Reduce offers to convert a recipe link it finds on your clipboard. These sit on your account so the app behaves the same way on your next device.
- How you found Reduce. Once you have an account we may ask, one time, how you found Reduce. You can pick one of six answers, or type something in its optional text box instead. Answering is optional: if you decline we store only that you chose not to answer, so that we do not ask again. We use it to count how many people arrived each way, and the counts are aggregate, with no report tying an answer back to a person. What you tell us is stored on your account and is deleted with your account.
- Your answer about sending recipes. Before your first conversion we ask whether we may send a recipe to the companies that help us read it. What we keep is the date and time when you agreed we could send recipes, so that we do not have to ask again. The answer is all we keep: agreeing does not put a copy of any recipe on your account, and the answer itself is deleted with your account. If you answer before you sign in, it is held against the device you answered on and copied onto your account the first time you sign in there.
- Your cookbook. Recipes you save, notes you write on them, ratings, favorites, collection names, and how many times you have marked a recipe cooked are stored against your account.
- Your meal plan. If you plan a week of meals, we store which recipes you picked, the servings you set for each one, which recipe you put on which day, and which lines of the shopping list you have ticked off. You have one plan at a time, so planning another week replaces it rather than adding to it.
- Recipes you share. Publishing a share link copies that recipe to a page anyone with the link can read, and it stays readable for as long as the link exists. Reduce has no in-app control for taking a single share link down yet. Write to us and we will remove one for you, and deleting your account removes every link you have published.
- What you submit for conversion. The recipe address you paste, or the recipe text you paste, is sent to our server so it can be read. See how conversion works, below.
4. Information we collect automatically
- A device identifier. The first time you convert a recipe, your browser stores a random identifier. It exists to count free conversions against this browser as well as against your account, so that signing out is not a way to start the month again. It is a random value and it says nothing about you. It is also recorded on our server against each conversion it counts, which is what makes the allowance hold when you are signed out. Clearing your browser storage for this site removes the copy on your device; it does not remove the conversion records already stored against it.
- Your network address, when you convert without signing in. A conversion started while you are signed out is checked against a limit on how many conversions one network may run in an hour, which is what stops an automated caller spending our budget by pretending to be a new guest on every request. To count it we read the network address our host observed for the request and store the network it belongs to, together with the time. For an IPv4 address that network is the address itself. For an IPv6 address we keep only the first half, which identifies your connection and not your device. When no address can be read, the attempt is counted in a single shared bucket instead. We do not store it against your account, we do not use it to identify you, and conversions you run while signed in are not counted this way at all.
- Analytics. We use Google Analytics 4, measurement ID G-YW5N714EH1, to count how the product is used: which screens are opened, conversions started, finished and failed, saves, ratings, share links created and opened, Cook Mode sessions, and checkouts started and completed. Google Analytics sets cookies in your browser and gives your browser an analytics identifier, which it stores in a cookie named _ga.
- What Google Analytics collects on its own. Beyond the events we ask it to count, a standard Google Analytics installation collects information about your browser and device, such as the browser and its version, the operating system and its version, the device type, the screen size and the language you browse in. It also works out an approximate location from the network address the request arrives on. That location is coarse, no finer than a city, and Google derives it rather than passing us the address. We do not ask for it, we cannot turn it off from inside the page, and it is not tied to your account.
- Share link views. When someone opens one of your share links, we record the time, the address of the page they came from, and their browser's user agent string, so we can show you how many times the link has been opened. The address is the whole one the browser reports, including any path, not only the site it belongs to, and it is stored against the link rather than against the person who opened it. To keep that count honest, and to stop an automated caller writing view records without limit, we also read the network address our host observed for the request. The network it belongs to is kept with the time for one hour, in the same form and for the same reason as the signed-out conversion limit below, and a salted digest of that network and the user agent string is stored with the view so that the same person reopening the link within half an hour is counted once. The address itself is not stored with the view, and the digest cannot be turned back into it.
- What our servers write down about every request. Supabase runs our database, our accounts and our server functions, and Cloudflare serves the site in front of them. Both keep a log of the requests they handle, and we have not switched that off. A log line holds your network address, the kind of browser you are using, the page address your browser said it came from, the country and roughly the city the request arrived from, which page or function was asked for, whether it worked, and how long it took. When you are signed in it also holds the account it was for, including the email address on it. This is not something we ask for a screen at a time. It is how a request gets served and how we tell a problem from an attack, and it is written whether or not you have an account. How long it is kept is set by the plan our database is on rather than by us, and the retention list further down says what that means.
What we do not send to Google Analytics: recipe titles, recipe addresses, text you pasted, email addresses, account identifiers, or the query string of any page you visit. Reduce replaces the page address, page title and referrer that Google Analytics would otherwise collect by itself with the bare route you are on, such as /recipe, and with the referring site's host without its path.
Reduce has no in-app switch for analytics, and refusing cookies is not one either. Blocking the _ga cookie removes the identifier that ties your visits to each other, but Google Analytics can still report a visit without a cookie, so the measurement does not stop. What stops it is preventing the Google Analytics script from loading or running, which is what Google's Analytics opt-out browser add-on and script-blocking browser extensions do. Reduce works exactly the same either way.
5. What your browser loads from other services
Some of what a Reduce page is made of is fetched by your browser from somewhere other than Reduce. That happens as the page draws, without you clicking anything, and the service on the other end necessarily sees your network address and the ordinary details any browser sends with a request, such as the kind of browser you are using.
- Typefaces. The site is set in typefaces we serve ourselves, from the same place the rest of Reduce is served from. Your browser fetches them the way it fetches any other part of the page, and no other company sees a request for them.
- Recipe photographs. A recipe saved from a website keeps pointing at the picture on that website, so opening a recipe, your cookbook, or a share link can make your browser fetch that picture from the site it came from, or from whatever network delivers pictures for them. That request goes to them rather than through us, and it happens because the picture is on the page, not because you followed a link to their site.
6. How converting a recipe works
We ask first. Before your first conversion we show you a screen naming every company that helps us read a recipe, saying what each one receives, and we do not send anything until you agree. The four are Firecrawl, ScrapeCreators, Groq and Anthropic, and the rest of this section is what each of them does. A recipe reaches only the companies that link needs, so text you paste goes to one of them rather than to all four, and none of them is sent your account, your name or your email address. We record the date and time you agreed and nothing else about the answer, and we do not ask again. You can read the question again at any time from your account screen. If you answer before you have an account, the answer is kept against the device you answered on and copied to your account when you sign in.
When you convert a recipe from a link, our server fetches that page. It first tries to read the recipe out of the structured data the page publishes about itself, which costs nothing and involves nobody else. When a page cannot be read that way, the fetch falls back to Firecrawl, a third party scraping service, which fetches the page on our behalf and therefore receives the address you submitted.
Two kinds of link reach that text a different way. An Instagram link is sent to ScrapeCreators, a third party that reads the caption of a post, so it receives the address you submitted. When a link is a video, its audio is turned into text by Groq: depending on the link, Groq is either given the address and fetches the audio itself, or is sent the audio our server took from the video. What comes back in both cases is text, which then goes on to Anthropic like any other.
The page text, or the text you pasted, is then sent to Anthropic's API, which returns the recipe as structured data. Anthropic states that data submitted through its API is not used to train its models by default. Not training on it is not the same as not holding it. Under Anthropic's standard commercial API terms the inputs and outputs of a call are deleted within 30 days, and may be held longer where enforcing its usage policy or the law requires. Treat that as the longest we can promise on Anthropic's behalf: what Reduce controls is that we do not store the text ourselves, and anything shorter would depend on terms between Anthropic and us rather than on this page. Please do not paste anything into the converter that you would not want processed this way.
We keep a record of each conversion: the address you submitted, the title of the recipe it produced, and which of the methods above read the page. That record is also the ledger for your free monthly allowance, which is 10 conversions per calendar month for accounts without a Pro subscription. The allowance is counted against your account identifier and against the device identifier described above, whichever is present, so one browser and one account cannot each claim a separate allowance.
Separately from that record, a recipe you convert from a link is also kept on its own, as a recipe. That copy holds the recipe, the address of the page it was read from, and the few labels we tag it with, such as its cuisine and its main ingredient. It carries no account identifier, no device identifier and nothing derived from either. What we do count is how many times that same recipe has been converted by anyone, and how many times it has been cooked by anyone, which is how we tell a recipe many people cook from one almost nobody does when we suggest something similar to read next. Those same counts fill Discover, a public feed of the recipes converted this week, which anyone can browse in its own right rather than only meeting a recipe beside another one. Neither count and nothing on that feed records who converted or cooked anything. Every suggestion and every row of that feed names the site the recipe came from and links to it.
It is worth being exact about what that does and does not hide, because the easy version of this sentence would be the flattering one. The kept copy on its own says nothing about who converted it. But the conversion record described just above is still ours, and it names a page address beside your account or your device. So we are not telling you the recipe becomes untraceable to you while your account exists, and we are not claiming the copy is beyond our reach either. Ask us and we will go and look, and the answer is exact. It is exact because we record it rather than work it out afterwards: every kept copy stores the conversion it was made from, so finding the copies your conversions produced is a matter of reading what was written down. This used to be a search on a page address, and an address was never a reliable way to do it, because the address you give us and the address we actually read are two different ones for a shortened or a social link. We stopped matching and started recording. One limit is left, and it is about what exists rather than about what we can find: a recipe already in the collection is not stored a second time when somebody else converts it, so a conversion of a dish we already hold adds to the count and makes no copy of its own. There is then no copy of yours to hand back, because none was made, and the copy that is there records the conversion that first produced it. We hold no list of everyone who has converted the same dish since. What is true is narrower and it is about FILING rather than about reach: the copy is not stored under your name, so it does not move when the records that are stored under your name move, and an automatic account deletion passes it by.
This applies only to recipes converted from a link, because those were already published on a page anyone can read. A recipe you paste in as text is not kept this way at all: it was published nowhere, so there is no site to credit and no reason to hold it.
7. Ingredient swaps and Cook Mode tips
Two features ask Anthropic about a recipe you already have, and both work only while you are signed in. Asking for an alternative to an ingredient sends that ingredient, the name of the recipe it belongs to, and the recipe's one line description where it has one. Opening Cook Mode sends the recipe title and its steps, which means each step's text, the timing shown on it where there is one, and any tip already saved against it. Neither one sends your email address or your name.
We count these requests so that no single account can spend the budget for everyone. Each request records your account identifier, which of the two features asked, and the time. That count is the whole of what Reduce stores: none of the recipe text that was sent is stored with it. Reduce not storing it is not the same as it being gone. These requests go to the same Anthropic API under the same terms as a conversion, so the retention described above applies to them too. The limit is 30 requests per feature per account per day, measured against UTC, and the count is deleted with your account.
8. Payments
Pro subscriptions are billed by Stripe. Card details are entered on Stripe's own checkout page and never reach Reduce. We do not see them, we do not store them, and we could not produce them if asked. What the app shows against your account is your Stripe customer identifier, whether the subscription is active, and the date the current billing period ends. The usual route for changing or cancelling a subscription is Stripe's customer portal, which you reach from inside the app; if it does not open, or does not offer what you need, write to us and we will make the billing change for you, cancelling included. The terms of service describe how that works.
Reduce keeps more of the billing record than that summary shows. Stripe notifies our server when something happens, and we store three kinds of notice: the completed checkout that starts a subscription, and the two that follow when a subscription changes or ends. Three kinds is not three records. We keep one record for every notice of those kinds that Stripe sends, so a subscription that changes many times leaves one stored notice behind per change, and the number we hold is not fixed. Each is stored whole, as Stripe sends it, carrying the checkout, customer and subscription details for the event it describes. Anything else Stripe sends is acknowledged and not stored. The completed checkout is the one that carries your account identifier, because it is the notice that tells us whose subscription this is; the other two are matched by the Stripe customer and subscription identifiers instead. We also keep a running record of the subscription and of the customer behind it: those identifiers, the tier, the status, the end of the current period, and when each was last changed. None of it contains a card number.
9. Email we send you
Account email, such as a password reset or a confirmation of an address change, is delivered through Resend and sent from noreply@reducerecipes.com. We do not send marketing email and there is no mailing list to be added to.
10. Why we use this information
- To run the product: converting recipes, keeping your cookbook, serving your share links.
- To count the free monthly allowance and to keep the converter from being abused.
- To take payment for Pro and to know whether a subscription is active.
- To answer you when you write to us.
- To understand, in aggregate, which parts of the product are used and which are not.
- To keep the service secure and to meet our legal obligations.
11. Who else processes it
These companies process personal information on our behalf, each for the one job named:
- Supabase: database, accounts and authentication, and the server functions.
- Cloudflare: hosting and delivery of the site.
- Google Analytics: usage analytics.
- Anthropic: reading a recipe out of page text, and answering the ingredient swap and Cook Mode tip requests described above.
- Firecrawl: fetching a page when it cannot be read directly.
- ScrapeCreators: reading the caption of an Instagram post.
- Groq: turning the audio of a video into text.
- Stripe: payments and subscription management.
- Resend: delivery of account email.
We do not sell personal information, and we do not share it for cross context behavioral advertising. We may disclose information if the law requires it, or to protect the service and its users from abuse.
12. How long we keep it
- Saved recipes and notes: until you delete them in the app, or until your account is deleted.
- Your meal plan: until you replace it by planning another week, or until your account is deleted. There is only ever one, so the week before it is not kept.
- Your account: until it is deleted. You can delete your account in your account settings, or ask us to, and both routes are under Your choices below.
- The Apple refresh token, if you sign in with Apple: until your account is deleted. Each Apple sign-in replaces it, so we hold one at most. Deleting your account uses it first to ask Apple to end Reduce's access, and then deletes it with the account. The copy inside the sign-in session on your device goes when you sign out.
- Share links: until your account is deleted, or until you ask us to take one down. A published link keeps resolving until then, because there is no in-app control for removing a single link yet.
- Conversion records: kept as your allowance ledger. A conversion you made while signed in belongs to your account and is deleted with it. A conversion you made while signed out is attached to the device identifier and to no account, so there is no account deletion for it to follow, and we keep it until you ask us to remove it. Neither kind is on an automatic deletion schedule today.
- The copy of a converted recipe described above: kept for as long as we run the service. It carries no account identifier and no device identifier, so it is not filed as yours and an account deletion does not reach it on its own. Nothing sweeps them and they are on no deletion schedule. That is about how the copy is stored, not about what we can find: each copy records the conversion it was made from, so while your conversion records still exist we can find the copies your conversions produced, and you can ask us to tell you what they are, send them to you, or remove them. That is a reading of what was recorded rather than a search on a page address. The one thing it cannot return is a copy that was never made, for the reason set out above.
- Share view records: kept until the share link they belong to is deleted. After ninety days a view record is folded into a daily count for its link and the record itself, with the page address, the user agent string and the digest, is deleted; the daily counts stay until the link is deleted.
- Server request logs: days rather than months, and we keep no copy of our own. The exact period is the log retention that comes with the plan our database platform is on, which is a setting on that plan rather than something we tune per request. Nothing in Reduce reads a log back into the product. Cloudflare separately keeps its own record of the requests it serves, on its own schedule, which we do not set.
- Signed-out conversion attempt records and share link view attempt records, meaning the network and the time described above: one hour. Each limit only ever counts the last hour, so anything older is deleted the next time the check runs. This is the one thing on this list that does delete itself without waiting for anything else.
- Analytics records: held by Google for the retention period configured on our Google Analytics property.
- The device identifier: in your browser until you clear this site's storage, and on our server for as long as the conversion records that carry it.
- Assistant request counts, meaning the record that an ingredient swap or a Cook Mode tip was asked for: kept as the ledger for the daily limit and deleted with your account. The recipe text those requests carried is not stored by Reduce at all, though Anthropic holds it under the API retention described above.
- Billing records, meaning every stored notice of the kinds described above and the subscription and customer state we keep from them: kept as our record of what was billed, including after a subscription ends, which is what a payment record is for. They sit in their own tables, which are keyed by Stripe identifiers and carry no foreign key to your account row, so deleting your account cascades nothing into them, and nothing sweeps them, so they are on no deletion schedule and deleting your account does not reach them. That is a fact about the schema and not a claim that the records are anonymous: the stored checkout notice still contains the account identifier it was sent with, which keeps it traceable to you.
Deleting your account removes your profile, your saved recipes, your notes, your meal plan, your share links, the view records attached to them, the conversion records made while you were signed in, and your assistant request counts. It is a deletion, not a flag. If you signed in with Apple, it also removes the Apple refresh token, and before anything is removed it uses that token to ask Apple to end Reduce's access. If Apple does not confirm, nothing is removed and you can try again. Three things are not part of that removal. Conversions you made before you had an account, or while signed out, are attached to a device identifier rather than to the account, so there is no account deletion for them to follow. Write to us and we will delete those too. Billing records sit in their own tables, which carry no foreign key to your account row and which nothing sweeps, so the deletion does not reach them, and the stored checkout notice still contains the account identifier it was sent with, which keeps it traceable to you. A record of what was billed is one we keep, so write to us and we will remove whatever we are not required to keep. And the copy of a converted recipe described above is not part of it either, for the opposite reason: that copy holds no account identifier, no device identifier and nothing derived from either, so a deletion keyed to your account has nothing in it to match. We would rather be exact than reassuring about what that does and does not mean. It does not mean we are unable to find those copies. While your conversion records exist we can find the copies that came from your conversions, so if you ask us what we hold we will tell you what those records name, and if you ask us to send those copies to you or to remove them we can do that too. Ask and we will. That answer is exact rather than a best guess, because each copy records the conversion it was made from instead of being matched to one by page address. It will not hand you a copy that was never made, which is the dedupe described earlier and not a limit on the looking. What is true is narrower than an inability: the copy is not filed under you, so a deletion keyed to your account does not reach it on its own, in the way it reaches a recipe you saved. What the deletion does do is remove the records on our side that point at those recipe copies, and there is more than one kind. The conversion records name the pages you converted. A recipe you saved sits in your cookbook under your account and carries the same page address. A link you published carries its own copy of the recipe. Each of those is filed under you, so each of them goes when your account goes. Once they are gone the copies in the recipe collection are still there and we can no longer pick out which ones were yours. If you want them removed as well, ask us before or at the same time, not after.
13. Your choices
Most of what we hold is already in front of you: your cookbook, your notes and your ratings are all editable and deletable in the app. Share links are the exception. Once you publish one it keeps resolving for anyone who has it, and there is no in-app control for taking it down yet. Write to reducerecipes@gmail.com to have a share link removed, and deleting your account removes every link you have published.
You can delete your account and all associated data at any time. Delete your account in your account settings, where the control asks you to confirm first and then removes everything below. If you would rather we did it, email reducerecipes@gmail.com from the address on the account and we will confirm with you before anything is removed.
For a copy of everything we hold about you, or a correction, write to the same address from the address on the account and we will send the copy or make the correction within 30 days. The support page says what to expect.
14. California privacy rights
If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights below. Reduce works the same whether or not you use them, and we will never charge you a different price or give you a worse service for asking.
- To know what personal information we collect, why, and who we share it with. That is this page.
- To get a copy of the personal information we hold about you.
- To have inaccurate personal information corrected.
- To have your personal information deleted.
- To limit the use of sensitive personal information. The credentials that sign you in, meaning your account login together with your password, are sensitive personal information as the CPRA defines that term. They are the only sensitive personal information we hold. We use them to authenticate you and to keep your account secure, and for nothing else: we do not use them to infer anything about you, and we do not disclose them. That is already the limit this right lets you ask for, so there is nothing further to restrict.
- Not to be discriminated against for exercising any of these rights.
In the categories that Act uses, we collect identifiers (your email address, your account identifier, the device identifier, the analytics identifier Google Analytics stores in your browser, the network an unsigned-in conversion came from, and the network a share link view came from), commercial information (whether you hold a subscription, the purchase history Stripe keeps for it, and the billing records we keep from Stripe's notices), internet activity (which screens you open in Reduce, which recipes you convert, the ingredient swap and Cook Mode tip requests you make, together with the browser and device information Google Analytics collects by default and the requests your browser makes to the sites recipe pictures come from), geolocation data in the coarse form described above (the approximate location, no finer than a city, that Google Analytics derives from a network address), sensitive personal information in the single form described above, the credentials that sign you in, and the answer you give if you tell us how you found Reduce, together with anything you type in its optional text box and, if you decline, the fact that you chose not to answer. We draw no inferences and build no profiles.
We do not sell personal information and we do not share it for cross context behavioral advertising, so there is no Do Not Sell Or Share link for us to offer you. To make a request, write to reducerecipes@gmail.com from the address on your account and we will answer within 45 days. You may use an authorized agent, in which case we will ask for proof that you authorized them.
15. Children
Reduce is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, write to reducerecipes@gmail.com and we will delete it.
16. Changes to this policy
When the product changes what it collects, this page changes with it, and the date at the top is when the current wording took effect. If a change materially affects how we use information you have already given us, we will say so here rather than quietly reword the paragraph.