Flowstate Labs LLC ("Flowstate Labs," "we," "us," or "our") operates Cookflow, a recipe, meal-planning, and grocery-list mobile application (the "App"), and the cookflowai.com website (together, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights available to you. By using the Service, you agree to the practices described here.
Cookflow is built to be local-first: your recipes, menus, and grocery lists are stored on your own device by default. We do not require you to create an account with an email or password. We do not sell your personal information, and we do not run advertising or third-party tracking/analytics SDKs in the App. If you choose to use optional features — cloud sync, recipe import from a photo or URL, or connecting a grocery retailer — those features involve sending specific data to the third-party services described below, solely to perform the feature you asked for.
Recipes you write, import from a URL, or import from a photo, along with your menus, grocery lists, tags, notes, and serving-size preferences ("User Content"). This is stored locally on your device (via on-device storage) and, only if you have cloud sync enabled, synced to our cloud database as described in Section 3.
When you import a recipe by pasting/opening a link, the destination webpage's publicly visible content is fetched and parsed. When you import a recipe from a photo, the image is processed to extract the recipe text. Both text and, where needed, the image itself may be sent to our recipe-parsing infrastructure and the third-party AI providers listed in Section 3 solely to structure the recipe into ingredients and steps. We do not use these images or URLs to identify you personally, and we do not use them to build advertising profiles.
Cookflow reads your device clipboard only at the moment you tap the "import from link" icon, to check whether you've copied a recipe URL so we can offer to import it. We never read the clipboard passively, in the background, or at any other time.
To support cloud sync and rate-limit abuse of our recipe-parsing service, the App generates an anonymous device identifier and/or an anonymous authentication session. This identifier is not linked to your name, email address, or any other directly-identifying information — we do not ask for or collect those.
If you choose to connect a grocery retailer (e.g. Kroger) to build a cart directly, you are redirected to that retailer's own sign-in page; we never see or store your retailer account password. We receive and store only the access token the retailer issues, which we use solely to add items to your cart at your request, until you disconnect the retailer or the token expires. For retailers using a "hand-off" model (e.g. Walmart), Cookflow does not receive any account credentials or tokens at all — you complete the order entirely within that retailer's own app or website.
Cookflow can schedule on-device cooking-timer notifications. These are generated and delivered locally by your device's operating system — no notification content is sent to, or generated by, our servers.
To provide specific features, the following sub-processors may receive limited data strictly necessary to perform that feature. Each is bound by its own privacy policy, linked below.
| Service | Purpose | What it may receive |
|---|---|---|
| Supabase | Optional cloud database for syncing recipes/menus/grocery lists across your devices, and for hosting our recipe-parsing functions. | User Content (if cloud sync is on), anonymous device/session identifier. See Supabase's Privacy Policy. |
| Anthropic (Claude) & DeepInfra (Llama) | Parse imported recipe text/photos into structured ingredients and steps. | Recipe text and/or a submitted recipe photo, transmitted for the single purpose of that parsing request. See Anthropic's Privacy Policy and DeepInfra's Privacy Policy. |
| Kroger | Optional: build a shopping cart in your Kroger account when you connect it. | Handled entirely on Kroger's own sign-in page; we receive only an access token. See Kroger's Privacy Policy. |
| Walmart | Optional: hand off your grocery list to Walmart's own app/site to complete an order. | No Cookflow-held account data — you interact directly with Walmart. See Walmart's Privacy Policy. |
| Apple (App Store, TestFlight, iCloud device services) | App distribution and standard OS-level services. | Governed by Apple's Privacy Policy. |
| Netlify | Hosts the cookflowai.com website (not the App itself). | Standard web request data (e.g. IP address) per Netlify's Privacy Policy. |
We may also link out to grocery retailers or brands through affiliate/referral programs — see Section 12.
We do not use your User Content, recipe photos, or grocery data to train third-party foundation models beyond the single request needed to parse that specific recipe, and we do not use this information for advertising targeting.
We share information only: (a) with the service providers listed in Section 3, strictly to operate the features you use; (b) with a grocery retailer you explicitly connect or hand off to; (c) if required by law, subpoena, or valid legal process; (d) to protect the rights, property, or safety of Flowstate Labs, our users, or the public; or (e) in connection with a merger, acquisition, or sale of assets, in which case we will require the successor to honor this Policy for previously collected data. We do not sell your personal information.
User Content stored only on your device is deleted the moment you delete that item in the App, clear the App's local storage, or uninstall the App. If you've enabled cloud sync, deleting a recipe or list in the App also deletes it from our cloud database. To request deletion of any residual data associated with your anonymous device identifier, email us at mike@flowstatelabs.dev and we will delete it within 30 days, except where retention is required to comply with law, resolve disputes, or enforce our agreements.
We use industry-standard measures to protect information, including encryption in transit (TLS/HTTPS) for any data sent to our cloud infrastructure, and the security protections built into iOS for data stored on your device. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Our service providers may process data in the United States and other countries where they operate. Where required by applicable law, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.
Cookflow is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
If you are located in the EEA, UK, or Switzerland, you have the right to: access the personal data we hold about you; request correction or deletion; restrict or object to processing; and request data portability. Because Cookflow is designed to store most content locally on your own device, you can exercise most of these rights directly within the App (view, edit, export, or delete your content). For anything else, contact us at the email in Section 14. Our legal bases for processing are: performance of the service you requested (contract), your consent (e.g. enabling cloud sync or connecting a retailer), and our legitimate interest in operating and securing the Service (e.g. abuse prevention).
California residents have the right to know what personal information we collect, request deletion, request correction, and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. You may submit a verifiable request by emailing us at the address in Section 14; we will not discriminate against you for exercising these rights.
Cookflow may, where enabled, link out to third-party grocery retailers or brands through affiliate or referral programs (e.g. Impact.com-powered partnerships). If you follow one of those links and make a purchase, Flowstate Labs may earn a referral commission at no additional cost to you. This never affects which items, recipes, or retailers are shown or how they're ranked, and any purchase you make through such a link is governed by that retailer's own terms and privacy policy, not ours.
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice within the App. Continued use of the Service after a change becomes effective constitutes acceptance of the revised policy.
Flowstate Labs LLC
Email: mike@flowstatelabs.dev