Your data is safe with us
The whole policy, in plain words.
Never sold
Not to advertisers, not to data brokers, not to anyone.
Only ever your kitchen
Your items, dishes and messages are there to answer your household. The requests board is the one thing you post in public, on purpose.
Export or erase, any time
One tap takes a copy of everything; one erases it. Both are in Settings → Your data.
The AI is given only what answers you
Your message and the stock rows and diet rules it needs — never your name, your email or your household's.
One exception, stated up front: deleted data can sit in an encrypted backup for up to about six months before the last copy holding it is pruned.
The promises
What we do and don't do, in full.
What we do and don't do, in full.
Nine of them, including the two exceptions to “delete means delete”.
We never sell your data
Not to advertisers, not to data brokers, not to anyone. It isn't a product we have.
We don't use it for anything but your kitchen
Your items, dishes and messages are there to answer your household — nothing else. No other family can see any of it. The one exception is the requests board, which is a screen you post to on purpose: what you write there is meant to be read, and it is the only place in Rasoi where anything of yours is.
You can see everything we keep
Settings → Your data → My data lists every record stored for your household, counted and named in plain English.
You can take a copy any time
One tap exports the lot as a single file — members, diet rules, groceries, the meal log, chat and your dishes.
And you can bring it back
That file loads into any account, including a new one. It only adds what's missing, and it shows you what that is first.
The requests board is public, and only that
A request, a vote or a reply on the requests board is readable by everybody signed in to Rasoi: it carries your first name and the words you wrote, and never your email address. Deleting your data takes your votes away and takes your name off what you posted — the words stay, because other people's votes and replies hang off them.
You can delete it, and it's gone
Erase your data whenever you like. If you're the only account in the household, that erases the household with it. Two things stay: the record of sign-in attempts to this app — a security log, kept where Rasoi itself cannot reach it — and what you posted to the requests board, with your name taken off it.
We count screens, on our own machine
Which screens get opened, and whether setup was finished — recorded by software on the same server as Rasoi, not by Google and not by anyone who sells advertising. It sets no cookies, it stores no IP address, and the numbers never leave that machine. It carries no account number either, so a screen it counts is one somebody opened rather than one you opened. Never a dish, never an item, never a diet rule, never your name or email.
We keep a note of which parts you use
When you cook a dish, add an item or send an invitation, Rasoi records that it happened — the kind of thing, your account number and your household's, and nothing else. Never a dish name, never an item, never a diet rule. It's how we know which parts of the app are worth keeping. It stays on our own server for 180 days and then deletes itself. Unlike the screen counting above, this one does carry your account number: it is part of running the service rather than analytics, which is why we state it separately.
What leaves your kitchen
Seven services make Rasoi work.
Seven services make Rasoi work.
Each one, by name, and everything it is given.
Google, when you sign in
Your name, email and profile picture — so the app knows whose kitchen this is. No password ever reaches us, because you never make one. The picture is never copied here: it is shown straight from the address Google gave us, so your browser fetches it from Google on each screen that shows your face, carrying no cookies of ours.
Anthropic's Claude, for every answer
The model behind the chat, the dish suggestions and the sentence-to-stock reading is Claude Haiku, run through Anthropic's API. It is sent your message and the stock rows and diet rules needed to answer it — never your email, your name or your household's. Anthropic does not train its models on what comes through the API, and we have no arrangement that would let anyone else read it.
OpenAI, for the pictures
The photograph at the head of a dish and the little icon on a grocery are drawn by OpenAI's image model, sent the dish's or item's name and our house style — toor dal, atta — and nothing else: no stock, no diets, no messages, and nothing that says which kitchen asked. When OpenAI can't draw one — a missing key, a spent quota — the same name goes to Google's Gemini instead.
YouTube, when a dish wants a video
A dish with no recipe video gets one search on YouTube: the dish's name, once ever, and the answer is shared so the next kitchen holding that dish never asks. Saved links are also looked up, so a dead video never sits inside a recipe. All of that carries only the dish's name — YouTube first learns anything about you when you press play, and the player loads in its no-cookie mode.
Telegram, only if you link a group
Messages in the group you link are handled the same way as messages in the app. Link nothing and Telegram sees nothing.
Our mail server, twice at most
Once when you finish setting up your kitchen — a welcome, sent to the address you signed in with, saying what Rasoi does and what to try first. And once for each person you invite: the address you typed, the family's name and your own, so an invitation can be delivered. Both are sent from our own mailbox, never handed to a marketing service. There is no newsletter, no digest and no list, so that is the whole of what lands in your inbox.
Google Fonts, for the lettering
The two typefaces Rasoi is set in are fetched from Google Fonts by your browser, which tells Google the address that asked and nothing more — no cookies, and nothing about your kitchen. It is the one request every page makes, signed in or not.
How it's kept
Where it sits, and for how long.
Where it sits, and for how long.
The specifics, rather than a promise to be careful.
One server, one database
Rasoi runs on a single rented server and stores everything in one database on that same machine. Every record — items, dishes, meals, chat — carries the id of the kitchen it belongs to, and every query is filtered by it, so one household's data cannot be returned to another.
In transit, and who can reach it
Everything between your browser and the server travels over HTTPS. Signing in leaves a signed session cookie that expires after 30 days. The database isn't reachable from the internet, and the only people who can reach the machine are the ones who run it.
Your kitchen is kept until you delete it
There's no expiry and no quiet clear-out: what you put in stays until you take it out. Delete it and it's gone from the live database immediately.
Backups are the one exception
The database is backed up every hour so a broken server doesn't cost you your kitchen. Those backups are kept on a 120-hourly, 7-daily, 4-weekly, 6-monthly rotation, and every one of them is also copied off the machine, encrypted — which means a household deleted today can still sit inside a backup for up to about six months before the last copy holding it is pruned. Nothing reads them except a restore.
The screen counter is ours too
The analytics is Umami, self-hosted on the same server — the script, the endpoint that receives the hit and the database it lands in are all ours, so no third party is involved. It sets no cookies, stores no IP addresses and carries no account number, so a screen it counts is one somebody opened rather than one you opened. It never sees an item, a dish or your email.
We time how long the page takes to draw
When you close a tab, your browser sends four numbers to our machine: how long the page took to appear, how long it took to respond when you tapped, how much it moved while loading, and when Rasoi first drew a screen. They're added to a running count and then thrown away. There's no cookie, no account number, no address and nothing kept about your visit — only four totals that tell us the app got slower, never who it was slow for.
We keep a note of which parts you use
When you cook a dish, add an item or send an invitation, Rasoi records that it happened — the kind of thing, your account number and your household's, and nothing else. Never a dish name, never an item, never a diet rule. It's how we know which parts of the app are worth keeping. It stays on our own server for 180 days and then deletes itself. Unlike the screen counting above, this one does carry your account number: it is part of running the service rather than analytics, which is why we state it separately.
Sign-in attempts are kept, and survive a delete
Every attempt to sign in — successful or refused — is recorded with the address that was used, in a place Rasoi itself has no credentials to read back or erase. That's what makes it a security log rather than a convenience. It's the one thing deleting your data does not remove.
Talk to a person
Something here unclear, or something you'd like removed? Write to us — a person reads it.
contact@rasoi.io