Privacy Policy

1. Who We Are

Sagely is operated by Marc Grigoruk, a sole trader based in Victoria, Australia. For the purposes of privacy law, Marc is the data controller for the personal information described in this policy. You can reach us at hello@sagely.kitchen.

2. Information We Collect

Account information: When you sign up, we collect your email address and display name through our authentication provider (Google, Apple, or email/password via Supabase Auth).

Sign-in security checks: When you sign up or sign in with email, Cloudflare Turnstile (with hCaptcha as a fallback) checks that the request comes from a person. That check may process your IP address and browser details under the provider's own privacy policy.

Recipe data: Recipes you import, create, or save, including ingredients, instructions, photos, ratings, and notes. This data is stored in your personal account.

Dietary and allergen information: If you choose to tell us about allergies, intolerances, or dietary needs, we store them so Sagely can flag recipes that conflict with them. You can record these for yourself and, if you set up household eater profiles, for the people you cook for, including children. Some countries treat allergy and intolerance information as health data, so we want to be plain about how it is handled:

• It is used to warn you and to shape recipe suggestions. It is never sold, never used for advertising, and never used to build a profile of you for any purpose other than running Sagely.
• It is sent to our AI providers (Anthropic and OpenAI, both in the United States) as part of the request whenever you use an AI feature, so the assistant knows what to avoid. This is deliberate: an assistant that cannot see an allergy cannot cook around it.
• It is applied even if you turn personalisation off. That switch controls taste preferences, not safety. Allergen handling stays on so a setting can never quietly remove a warning.
• If you connect Sagely to your own AI assistant, that assistant can read your dietary profile, because you asked it to.
• It is deleted with your account, along with everything else we hold about you. You can also remove it yourself at any time in Settings.

Sagely is a tool to help you avoid allergens, not a guarantee, and it can miss them. You decide what goes in your food, so always check the ingredients and packaging yourself.

Usage data: We collect anonymous analytics (page views, feature usage) through Vercel Analytics to improve the app. Vercel Analytics is not linked to your identity. We also keep a record of which features you use (for example, that you saved a recipe or planned a week), linked to your account, so we can understand how Sagely is used and improve it. That record is never used for advertising.

Error and diagnostic data: When something goes wrong, we send error reports to Sentry so we can fix it. Unlike the anonymous analytics above, these reports are linked to your account: they include your user ID and email address, plus technical detail about what failed. For roughly one in ten sessions, and for any session in which an error occurs, Sentry also records a replay of how the page behaved (taps, scrolling, and the page structure) so we can reproduce a fault. Text you type and text on the page are masked in those replays. We use all of this to diagnose faults, not to build a profile of you.

AI interactions: When you use AI features (chat, recipe creation, imports, voice), your prompts and the recipe or profile data needed to answer them are sent to third-party AI providers (Anthropic, OpenAI, Google) to generate responses. Voice conversations with Ask the Chef are streamed to OpenAI while you speak. Cook Mode's free voice commands (“next”, “back”, “repeat”, “start timer”) are different: they are off until you switch them on, and they use your browser's own speech recognition, so your browser sends what you say to its maker's speech service (for example Google for Chrome, Apple for Safari) under that company's privacy terms. Sagely never receives that audio or the words. Your chat and assistant conversations are saved to your account so you can revisit them, and are deleted when you delete the conversation or your account.

Payment information: When you subscribe to Premium on the web, your payment is processed by Stripe. Your card details are collected and stored by Stripe, not by Sagely. We never see or store your full card number. On iOS you can subscribe through the App Store instead: Apple processes the payment under its own terms, and RevenueCat, our subscription service, tells Sagely whether your subscription is active. Neither we nor RevenueCat receive your card details. In both cases we retain a limited record of your subscription status and billing history (for example, plan, start date, and renewal state) to provide and manage your subscription.

3. How and Why We Use Your Information

• To provide and maintain the Sagely service
• To save and organize your personal recipe collection
• To generate AI-powered recipe suggestions and assistance
• To flag recipes that conflict with the allergies, intolerances, and dietary needs you have told us about
• To enable household sharing features you opt into
• To send transactional emails (password reset, account verification, billing notices)
• To improve the app through analytics and diagnostics

Where privacy law asks us to say why we are allowed to do these things: we process your account and recipe data because it is the service you signed up for; your allergy, intolerance and dietary information because you choose to give it to us, and you can remove it at any time; diagnostics, security checks and the feature-usage record in our legitimate interest in keeping Sagely working, safe and improving; and billing records because the law requires us to keep them. We do not send marketing email without asking you first.

4. Third-Party Services

Sagely uses the following third-party services. Where a service processes data outside Australia, the location is noted.

• Supabase: database, authentication, and file storage, hosted in Sydney, Australia (AWS ap-southeast-2)
• Vercel: hosting, served from Sydney, and anonymous analytics (processed in the United States)
• Anthropic (Claude): AI recipe assistance and chat (United States)
• OpenAI: voice features, text-to-speech, and recipe image generation (United States)
• Google (Gemini): AI assistance for some imports (United States)
• ScraperAPI: helps fetch some of the recipe pages, reels and photos you import. It receives the web address, not your name or email (United States)
• Tavily, with DuckDuckGo as a fallback: web search when Ask the Chef or recipe research looks something up. They receive the search words, not your name or email (United States)
• Resend: transactional email delivery (United States)
• Stripe: subscription billing and payment processing on the web (United States; card data is handled by Stripe, not stored by Sagely)
• Apple and RevenueCat: App Store subscriptions on iOS. Apple processes the payment; RevenueCat (United States) manages whether your subscription is active
• Sentry: error monitoring, diagnostics, and session replay (United States)
• Cloudflare Turnstile, with hCaptcha as a fallback: sign-in security checks
• Upstash: rate limiting and abuse protection. It holds short-lived counters keyed by your account id or, when you are signed out, your IP address

Each service has its own privacy policy. We only share the minimum data necessary for each service to function.

5. Where Your Data Lives, Security, and International Transfers

Your account, recipes, and photos are stored in Supabase in Sydney, Australia, with row-level security policies ensuring only you (and household members you invite) can access your data. All data is transmitted over HTTPS. Recipe photos are stored in Supabase Storage with access controls tied to your account.

Some of the services listed above process the data we send them in the United States: the AI providers, ScraperAPI, Tavily and DuckDuckGo, Resend, Stripe, RevenueCat, Sentry, and Vercel Analytics. We send each service only what it needs for its job, under its standard data-processing terms, which include contractual safeguards for international transfers where the law requires them. If you are in the United Kingdom, Canada, or New Zealand, this means some of your data leaves your country to be processed.

6. Data Sharing

We do not sell your personal information. We share data only:

• With third-party services listed above, to provide the service
• With household members you explicitly invite
• When you share a recipe via a public link, or publish it to Discover, where it is visible to anyone along with your author name
• If required by law or legal process

7. Your Rights

You can at any time:

• Export your data: use the exports in Settings. JSON export of your recipes is available on every plan; CSV and Paprika exports are a Premium feature. These cover your recipes and shopping lists. If you want a copy of anything else we hold (for example your chat history, taste profile, or meal plans), email us and we will send it to you.
• Delete your account: in Settings, under Account at the top of the page, tap Delete account. That permanently erases your account and the data linked to you straight away. Section 8 explains the few records that survive in anonymised form.
• Update or correct your information: edit your profile, dietary information, and household eater profiles in Settings, or email us for anything you cannot change yourself.
• Turn personalisation off in Settings. Allergen handling stays on, for the reason given in section 2.
• Complain: if you are not happy with how we handle a request, you can complain to your privacy regulator. In Australia that is the Office of the Australian Information Commissioner (OAIC); in the United Kingdom the Information Commissioner's Office (ICO); in Canada the Office of the Privacy Commissioner of Canada; in New Zealand the Office of the Privacy Commissioner; in the United States your state attorney general.

8. How Long We Keep Data

• Account and recipe data: for as long as your account exists. Deleted when you delete the account.
• Chat and voice conversations: saved to your account until you delete the conversation or the account.
• AI usage records: we keep a ledger of AI usage and its cost for accounting. When you delete your account the link between those records and you is removed; the anonymised totals remain.
• Error reports and session replays: held by Sentry for a limited time (currently up to 90 days), then they expire. Reports sent before you delete your account expire on the same schedule.
• Database backups: kept for a short period for disaster recovery and rolled off automatically. Deleted data disappears from backups on that schedule.
• Billing records: for as long as tax and accounting law requires.

9. Cookies & Local Storage

Sagely uses essential cookies for authentication and session management. We use local storage to cache preferences and recent activity. We do not use advertising or tracking cookies.

10. Children's Privacy

Sagely is not directed to children under 13. We do not knowingly collect personal information from children under 13. Adults may add eater profiles for children in their household; we treat that information as the adult's data and handle it as described in section 2.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by posting a notice in the app. Continued use after changes constitutes acceptance.

12. Contact

For privacy questions or data requests, email us at hello@sagely.kitchen or visit our support page.

If you use the Save to Sagely browser extension, its own privacy policy is at Browser Extension Privacy Policy.