Whisk - Privacy Policy

This Privacy Policy describes the collection, use, disclosure, retention, and protection of personal information by the operator of Whisk ("Whisk," "we," "us," or "our") in connection with the Whisk mobile application, the website at trywhisk.app, and related support services (collectively, the "Services"). Whisk is responsible for the processing described in this Policy, subject to the independent responsibilities of third-party providers identified below.

This Policy is a notice of our information practices. It does not, by itself, constitute consent to processing for which separate consent is required. Questions and requests concerning this Policy may be directed to support@trywhisk.app.

We receive personal information directly from you, through your use of the Services, and from authentication, subscription, infrastructure, and analytics providers supporting the Services. The categories relevant to your use include:

Information needed to establish an account or perform a requested function is necessary for that function. Optional preferences and customization instructions are provided at your discretion; withholding them may limit personalization or the requested customization. Do not include information about another person unless you are authorized to provide it.

We process the information described above for the following purposes:

Recipe recommendations are automated suggestions intended to assist with cooking choices. They do not constitute medical assessments or decisions determining eligibility for employment, credit, insurance, or comparable benefits.

The principal recipe collection is a pre-generated catalog. When you request customization, Whisk sends OpenAI your instructions, the source recipe, and relevant preferences to generate, moderate, validate, and repair recipe content. Repair attempts may resend instructions, preferences, recipe content, and validation findings. Dietary or allergy information included in these materials is therefore disclosed to OpenAI. The customization payload does not separately assign your account name or email address, but personal information you enter in a prompt may be included.

Customized recipes are private to your account and are not added to the shared catalog merely because you generate or save them. "Private" describes visibility to other users; it does not exclude processing by Whisk or its service providers to operate, secure, or support the Services.

Each successful customization is stored as a private draft, including when you do not save it. Drafts do not appear in your cookbook. Saving changes the recipe’s status to saved and adds it to the cookbook. Unsaving removes the cookbook reference but does not delete the customized recipe or change its status back to draft. Drafts have no automatic expiration or cleanup period and remain stored indefinitely unless removed through account deletion as described in Section 8. Cookbook visibility must not be understood as a complete account of stored information.

Avoid submitting unnecessary sensitive information. A customization request is not anonymous merely because a name or email field is omitted. Provider-side retention, training or data-sharing settings, and processing locations are not established by the App’s interface. Separate disclosure and permission required for AI data sharing must not be inferred from acceptance of these Terms or this Policy.

Providers supporting the Services include:

We disclose information to providers as necessary for their assigned functions, subject to applicable contractual and legal requirements. We may also disclose information when required by law or valid legal process; to establish or defend legal claims; to investigate fraud or security incidents; or to protect persons, rights, or property, where permitted by law.

Information may be disclosed in connection with a proposed or completed reorganization, financing, merger, acquisition, or transfer of the Services, subject to applicable confidentiality obligations, notice requirements, and restrictions on materially different uses. We may make other disclosures at your direction or with legally sufficient consent.

The website uses Vercel Web Analytics to measure page visits and understand website usage. Our integration supplies the page pathname when visitors navigate between pages; it does not supply app account identifiers, recipe preferences, or customization prompts. This website measurement is separate from the App analytics described below.

Whisk initializes PostHog analytics when analytics is configured and records interaction and preference events during onboarding, including before email-signup acceptance of the Terms. Identified events may be associated with your user ID. The information described in Section 5 is used to evaluate onboarding, purchase flows, feature usage, and product improvements. Local storage, cached images, and authentication information also support operation of the Services.

The current App provides preference editing and notification permission controls, but does not provide a dedicated analytics opt-out, a sensitive-preference consent or withdrawal control, or a separate OpenAI data-sharing permission step. Editing a preference or disabling notifications does not, by itself, withdraw analytics data already transmitted or erase provider records. Email-signup acceptance of the Terms is recorded separately and must not be treated as specific consent to these other processing activities. Contact support@trywhisk.app concerning your information or a privacy request.

Development analytics logs include event payloads. Recipe-generation error handling can also record generated content, and retained generation code logs dietary or allergy counts. Health-related information must therefore not be assumed to be excluded from diagnostic records.

Third-party sites opened from the Services are governed by their own information practices. This Policy does not extend to independently operated sites.

Dietary preferences, allergies, health-related goals, and statements in customization prompts may reveal sensitive personal information or consumer health data. The provision of a recipe or nutrition feature does not make Whisk a health-care provider. Such information should be submitted only as necessary for the feature you request.

Where European Economic Area or United Kingdom data protection law applies, each processing purpose requires an applicable lawful basis. Providing requested account and App functions may involve performance of a service contract; proportionate security and troubleshooting may involve legitimate interests; and legally required processing may involve a legal obligation. These bases do not automatically authorize optional health-related analytics or remove any separate condition required for sensitive information. Acceptance of general Terms alone does not establish explicit consent.

Where processing relies on consent, applicable law may entitle you to withdraw it without affecting the lawfulness of prior processing. The current App does not include the dedicated sensitive-preference or analytics withdrawal controls described in Section 6. Contact support@trywhisk.app to submit a request; this notice does not represent that automated withdrawal or provider deletion is already available.

Unsaved customizations are retained as private drafts for an indefinite period, until account deletion; no expiration period or automatic cleanup is implemented. Saving or unsaving a customization does not determine its deletion from storage. The current implementation does not establish retention periods for provider records, analytics history, purchase records, support correspondence, logs, or backups. Retention rules for those categories remain to be established; this Policy does not represent that they are subject to a defined deletion schedule.

Account deletion removes the Supabase authentication account and associated Supabase database records, including customized recipes linked to that account, through database deletion cascades. This depends on the relevant migrations and foreign-key relationships being correctly deployed. The account-deletion flow does not request deletion from PostHog, RevenueCat, OpenAI, Apple, support-email systems, or other external providers. Resetting the local PostHog identity or logging out of RevenueCat does not delete records retained by those providers.

Supabase backups, Edge Function logs, OpenAI processing records, analytics history, and purchase records are not erased by this account-deletion flow. Such records may remain, including transaction records subject to legal retention obligations. No immediate or comprehensive erasure of all personal information is promised. These limitations describe current implementation and do not authorize retention beyond what applicable law permits.

You may request account deletion through the App or direct a broader personal-information request to support@trywhisk.app. Additional handling is necessary to address provider-held records and applicable legal obligations. Any permitted retention for security, transaction recordkeeping, or legal claims remains subject to applicable limits. Information held independently by Apple may require a separate request to Apple. These implementation limitations do not diminish rights provided by applicable law.

Deleting an account or uninstalling Whisk does not itself cancel an Apple subscription. Manage the subscription separately through your Apple account.

We maintain reasonable technical and organizational safeguards appropriate to the information and the Services. No method of transmission or storage is entirely secure. You should protect your credentials and notify support@trywhisk.app if you suspect unauthorized access.

Whisk and its providers may process information outside your state or country, including in the United States, where protections may differ. Where applicable law restricts an international transfer, the transfer must rely on a permitted mechanism and required safeguards. Contact us for information about the locations and safeguards applicable to your information.

Depending on your location and the law applicable to Whisk, you may have rights to obtain access to personal information and information about its use; correct inaccuracies; request deletion; obtain a portable copy; restrict processing; withdraw consent; or object to processing based on legitimate interests. You may also have rights concerning sale, sharing for cross-context behavioral advertising, targeted advertising, sensitive information, or qualifying automated decisions where such processing occurs and the applicable law provides those rights.

Submit requests to support@trywhisk.app with sufficient information to identify your account and the requested action. Do not send passwords or unnecessary identity documents. We may reasonably verify identity and, where applicable, an authorized agent’s authority. We will respond within the time required by applicable law and explain any applicable limitation or refusal.

Where a right of appeal applies, reply to our decision requesting a privacy appeal. You may also complain to the competent data protection authority or state regulator. Individuals in the United Kingdom may contact the Information Commissioner’s Office; individuals in the EEA may contact the supervisory authority in their place of residence, work, or alleged infringement. Exercising a protected privacy right will not result in unlawful discrimination.

The Services are not directed to children under 13, or below a higher age where applicable law requires it. We do not knowingly collect personal information from children below the applicable minimum age. If you believe such information has been provided, contact support@trywhisk.app so that we can investigate and take appropriate action. An App Store age rating does not replace these eligibility conditions or applicable parental-consent requirements.

We may revise this Policy to reflect changes in the Services, information practices, or legal requirements. A revised version will identify its effective date. We will provide additional notice or obtain consent where required before applying material changes. Continued use of the Services does not waive statutory rights or replace consent required by law.

Privacy inquiries, rights requests, and complaints may be sent to support@trywhisk.app.