Who we are
Plaited is run by Codi Burley. We’re responsible for your personal data in Plaited (under the GDPR, the “controller”). You can reach us about anything in this policy at [email protected].
What we collect
Your account
Your email address, username, and anything you add to your profile, like a display name or photo. Passwords are handled by our sign-in provider; we never see them. If you sign in with Apple or Google, we receive the account identifier and email address they share with us.
What you make in Plaited
- Recipes and their versions, including notes on what you changed
- Cooks you log: photos, titles, notes and who can see them
- Likes, friends, friend requests and people you’ve hidden
- Grocery lists and the stores you set up
- Drafts and instructions you give the AI features while creating or editing a recipe
Technical data
Our servers keep standard logs (things like IP address, device and app version, and the time of a request) to keep Plaited secure and fix problems. We don’t use third-party analytics or advertising trackers in the app.
The waitlist
If you join the waitlist on plaited.club, we keep your email address only to tell you when Plaited is available. We don’t add it to any other list. We delete it after we send the launch email, or sooner if you ask.
This website
plaited.club doesn’t use cookies, analytics or advertising trackers, and it loads nothing from other companies’ servers. Our web host keeps standard request logs, like any website.
How we use it, and why
Data protection law asks us to name the legal reason (the “lawful basis”) for each thing we do with your data:
- Running Plaited for you: storing your recipe book, showing cooks to the people you choose, building grocery lists, and the AI features you use. The basis is our contract with you: we can’t provide the app without it.
- Waitlist emails: telling you when Plaited launches. Basis: your consent, which you can withdraw any time by emailing us.
- Account emails, like confirming your address or resetting your sign-in. Basis: our contract with you.
- Keeping Plaited secure and fixing bugs, using server logs. Basis: our legitimate interest in a working, safe service, which we keep small by deleting logs after 30 days.
- Meeting legal obligations, like answering a valid legal request. Basis: legal obligation.
We don’t sell your personal information, share it for advertising, or use it to build profiles about you for anyone else. We don’t make decisions about you by automated means that have legal or similarly significant effects.
AI features
Some features use an AI model: drafting a recipe from a description, applying the change you describe after a cook, and combining and sorting grocery lists. To do that, we send the relevant recipe text and your instructions to OpenAI, which returns the result to us. Your photos are not sent.
OpenAI processes this data on our behalf and doesn’t use it to train its models. It may keep it for up to 30 days to monitor for abuse, then deletes it.
Who can see your stuff
- Your profile is public by default. Make it private and only friends and family can see your cooks.
- Each cook is either shared or just for you. Shared cooks from public profiles can appear in Discover for people you aren’t connected to.
- Your recipes are visible to people you share them with, and to people who can see a cook you shared of that recipe.
- Share links let anyone with the link view that one cook, without opening the recipe. Grocery list links expire after 48 hours.
- Your email address is shown only to you and to friends and family.
Connected AI apps
If you connect an AI assistant such as Claude to Plaited, that app can read and act on your recipe book with the permissions you approve. What that app does with the data is covered by its own privacy policy. You can see and disconnect every connected app in Settings › Connected apps.
Service providers
We use a small number of companies to run Plaited. Each one processes data only on our instructions, under a data processing agreement with us.
- Supabase: sign-in and our database
- Amazon Web Services: hosting, photo storage, server logs and account email
- Cloudflare: hosting this website and delivering email sent to [email protected]
- OpenAI: the AI features described above
- Apple and Google: only if you choose to sign in with them
We may also disclose information if required by law, or to protect the safety of our users or the service.
Where your data is stored
Plaited’s database, photos and servers are in the United States. If you use Plaited from the EU, the UK or Switzerland, your data is transferred to the US. To protect it, we rely on the European Commission’s Standard Contractual Clauses, and the EU-US Data Privacy Framework (with its UK and Swiss extensions) where a provider is certified. Email us for a copy of the safeguards we use.
Keeping and deleting data
- While you have an account, we keep your data so the app works.
- When you delete a cook, recipe or list, it’s removed from Plaited right away, and any share link to it stops working.
- To delete your account, email [email protected] from the address on your account. We erase your account and everything in it within 30 days of your request, and email you when it’s done. Recipes a friend saved are their own copies; we remove your name from them.
- Backups are kept for 7 days and can’t be edited one person at a time. Deleted data stays in them until they roll off, and we never restore it.
- Server logs are deleted after 30 days.
Your rights
Wherever you live, you can ask us to:
- See your data and get a copy of it, in a common format you can take elsewhere
- Correct it, if something’s wrong (most of it you can edit in the app)
- Delete it, as described above
- Restrict or object to how we use it, including our use of server logs
Email [email protected]. We may ask you to confirm the request from the email address on your account, so we know it’s you. We’ll reply within one month. If a request is unusually complex we may need up to two more months, and we’ll tell you within the first month if so. We won’t treat you differently for asking.
If you’re in the EU or UK and unhappy with how we’ve handled your data, you can complain to your local data protection authority (in the UK, the Information Commissioner’s Office). We’d appreciate the chance to fix it first.
Children
Plaited isn’t meant for children under 13, and we don’t knowingly collect their information. If you think a child has signed up, let us know and we’ll delete the account.
Changes and contact
If we change this policy in a meaningful way, we’ll tell you in the app before it takes effect. Questions about privacy? Email [email protected].