Skip to main content
← Back to home

Privacy Policy

Last updated: 2 November 2026

This Privacy Policy explains how Lion Eye Digital Ltd (“we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use Cookko (“the service”). Lion Eye Digital Ltd is registered in England and Wales (Company No. 16752034), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We are the data controller for personal data processed through the Cookko service. This policy is written in plain English in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data We Collect

We collect the following categories of personal data:

Account Information

  • Email address
  • Display name
  • Password, if you sign up with email (stored as a secure one-way hash — we never have access to your raw password)
  • Account creation date and last login

Signing in with Google

If you choose to sign in with Google, Google shares your name, email address and profile picture with us, through our authentication provider Supabase. We use your email address to create your account and sign you in, and your name and profile picture to personalise your account. We do not ask for access to your Gmail, contacts, calendar, Drive or any other Google data, and we never post to your Google account.

We store this information with the rest of your account data (see Section 4), never sell it, and share it only with the processors listed in Section 5 so we can run the service. You can ask us to delete it at any time (see Section 8), and you can remove Cookko's access from your Google Account settings. Cookko's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Recipe and Content Data

  • Recipes you create, save, or extract, including titles, ingredients, instructions, and images
  • Tags, collections, and organisational preferences you apply
  • Source URLs for recipes saved from external websites

Voice Recordings

If you use the voice input feature, your audio recording is transmitted to Deepgram for transcription. Audio is processed in real time and is not stored by us after transcription is complete. Please see Section 5 (Third-Party Processors) for details.

Payment Information

If you subscribe to a paid plan, your payment is processed directly by Stripe. We do not see, store, or have access to your full card number, CVV, or bank details. We do receive from Stripe limited billing information such as the last four digits of your card, card brand, billing postcode, and subscription status for the purpose of managing your account.

Usage and Technical Data

  • Pages visited and features used within the app
  • Browser type, operating system, and device type
  • IP address and approximate location (country/region level)
  • Error logs and performance data

2. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contract performance: Processing necessary to provide the Cookko service you have signed up for, including account management, recipe storage, and billing.
  • Legitimate interests: Processing necessary for our legitimate business interests, such as improving the service, preventing fraud, and ensuring security, where these interests are not overridden by your rights.
  • Legal obligation: Processing required to comply with applicable law, such as financial record-keeping obligations.
  • Consent: Where we rely on your consent (for example, for certain analytics or marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

3. How We Use Your Data

We use your personal data to:

  • Create and manage your account
  • Provide, operate, and maintain the Cookko service
  • Process AI recipe extraction and voice transcription on your behalf
  • Process payments and manage your subscription
  • Send transactional emails (account confirmations, password resets, billing receipts)
  • Send service update notifications where required
  • Monitor and improve service performance and security
  • Comply with legal obligations

We do not use your recipes, voice recordings, or personal data to train AI models. We do not sell your personal data to third parties.

4. Data Storage and Security

Your data is stored in Supabase, which is hosted on Amazon Web Services (AWS) within the European Economic Area (EEA). We apply the following security measures:

  • Encryption in transit using TLS for all data communications
  • Encryption at rest for database storage
  • Row-level security (RLS) policies that ensure you can only access your own data
  • Access controls limiting which team members can access production systems

No method of transmission or storage over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

5. Third-Party Processors

We use the following third-party data processors to operate the service. Each processor acts under our instructions and is contractually obligated to handle your data securely and only for the purposes we specify.

Supabase

Purpose: Database storage, user authentication, and file storage. Data processed: Account information, recipe data, usage data. Location: AWS (EEA). Supabase Privacy Policy

Stripe

Purpose: Payment processing and subscription management. Data processed: Billing information, payment method details, transaction history. Location: United States (covered by Standard Contractual Clauses). Stripe Privacy Policy

OpenAI

Purpose: AI-powered recipe extraction from text, images, and video content. Data processed: Recipe content submitted for extraction. OpenAI does not use API-submitted data to train its models by default. Location: United States (covered by Standard Contractual Clauses). OpenAI Privacy Policy

Deepgram

Purpose: Voice transcription for the voice recipe input feature. Data processed: Audio recordings submitted via the voice input feature. Audio is processed in real time and is not retained after transcription is complete. Location: United States (covered by Standard Contractual Clauses). Deepgram Privacy Policy

Sanity

Purpose: Content management for editorial and public content (such as blog posts and help articles). Data processed: Published editorial content only. User personal data is not stored in Sanity. Location: United States (covered by Standard Contractual Clauses). Sanity Privacy Policy

Vercel

Purpose: Hosting and deployment of the Cookko web application. Data processed: Web request logs including IP addresses, browser information, and page URLs. Location: Global CDN with EEA nodes. Vercel Privacy Policy

6. Data Retention

We retain your personal data for the following periods:

  • Account data: For as long as your account is active, plus up to 30 days following account deletion to allow for recovery if deletion was accidental.
  • Recipe data: Deleted immediately when you delete a recipe or close your account.
  • Billing records: Retained for 7 years to comply with UK financial record-keeping requirements.
  • Voice recordings: Not retained — processed and discarded in real time.
  • Usage logs: Retained for up to 90 days for security and debugging purposes.

7. International Transfers

Some of our third-party processors (including Stripe, OpenAI, and Deepgram) are based in the United States. Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) or the European Commission.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access: You may request a copy of the personal data we hold about you.
  • Right to rectification: You may ask us to correct inaccurate or incomplete data.
  • Right to erasure: You may request deletion of your account and all associated personal data, subject to our legal retention obligations.
  • Right to data portability: You may export your recipes and account data in a machine-readable format via your account settings.
  • Right to restrict processing: You may ask us to limit how we use your data in certain circumstances.
  • Right to object: You may object to processing based on legitimate interests.
  • Rights related to automated decision-making: We do not make solely automated decisions that produce legal or similarly significant effects on you.

To exercise any of these rights, contact us at support@cookko.app. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use cookies and similar technologies on the Cookko website and application. For full details, including how to manage your cookie preferences, please read our Cookie Policy.

10. Children's Privacy

Cookko is not intended for children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact us at support@cookko.app and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through an in-app notice before the changes take effect. The date of the most recent update is shown at the top of this page. The current version is always available at cookko.app/privacy.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

  • Email: support@cookko.app
  • Post: Lion Eye Digital Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ