Privacy

This site

This page makes no request to anyone else: no audience measurement, no tracker, no remote font, no embedded video. It records your language choice in a cookie when you change it. Nothing else is kept, so there is nothing to consent to.

Household data

Griddle will hold what it needs in order to compute quantities and flag what each one avoids: the people of a household, recorded by first name alone, with the share each one eats, their allergies, intolerances, diets and dislikes, and, for whoever consents to it, their limits per meal (energy, protein, carbohydrate, fat, salt), typed by the person and never computed by Griddle. No surname, no contact details, no date of birth. The household is your family’s: each of its members sees and edits it. Each member of the family is in the household; that link serves the household alone and never leaves it. If you delete your account, your entry stays in the family’s household, linked to no account, until a member removes it.

What it is used for

The share each one eats computes ingredient quantities. Allergies, intolerances and diets are matched against recipes: they flag a dish in which what somebody avoids was found, or which could not be read for it, and leave a dish it was found in out of a suggested week and, when you ask, out of the recipes offered for a meal. What a person doesn’t like marks, on the recipe sheet and in the week’s recipe picker, the dishes Griddle found it in, and leaves them out of suggested weeks; it is a taste, never health information. Limits per meal choose recipes — narrowing and ordering the library, and preferring a dish in a suggested week while saying so — and propose each person the part of a dish that keeps within them; they are stored only with the person’s explicit consent, and withdrawing it erases them. If you allow it, it serves the same way for the proposals and warnings Griddle gives a connected assistant, without ever showing it to the assistant (see “A connected assistant”). This data does nothing else. It feeds no audience measurement, it is never sold nor shared outside your family — the members of your family see and edit it, because they share one household —, it trains no model, and it never leaves the service. Griddle calls no artificial-intelligence service: reading a photographed recipe happens in whichever tool you choose, and you alone send anything to it. Before a photo leaves your family, your device looks for a face in it, to remind you to ask the person’s consent; the photo is sent nowhere for this, and nothing of it is kept.

A shared recipe or carnet

A family on the paid plan can share a recipe, or a whole carnet, by a link or by an invitation. The page shows the whole recipe, however it came into your family: its title, description, times, difficulty and utensils, its ingredients for the number of servings it states, its method, its nutrition, the allergens found in its ingredients and the ones that could not be read — never that an allergen is absent —, and those of its photographs whose file Griddle keeps; a recipe imported from a page names that page. A carnet shows its title, description, cover and recipes, each one whole, in the carnet’s order; a recipe locked by the free plan does not appear. The page shows neither your household nor your allergy alerts, nor your labels, comments or star ratings, and a page opened by link does not say who shared it.

A link opens for anyone who holds it, with no account. It is shown once, to the member who creates it, and Griddle publishes it nowhere; the page asks search engines not to index it and carries no audience measurement and no tracker. Your family sees how many times each link was opened: a number, never by whom. An invitation is read only by signing in to Griddle with the invited address, once that address is confirmed; the invitation message says who invites, by the name that member gave themselves or, failing that, by their e-mail address. Whoever receives a share can only read it: Griddle offers them no way to add it to their own Griddle, to export it or to print it as a booklet; their browser can print the page they are reading or save it as a PDF.

Any member of the family can revoke a link or withdraw an invitation, and the invited person can decline it. A revoked link stops opening at once, and no cache keeps the page. Deleting the recipe or the carnet ends all of its sharing, and a recipe taken out of a carnet leaves that carnet’s pages at once; if the family’s plan ends, the sharing is suspended and resumes with the plan. A link that no longer opens says only “This link is no longer active.”, whatever the reason.

The address of an invitation

The e-mail address you invite is used for that invitation and nothing else: sending it the message saying who invites it and to which recipe or carnet, recognising the account that confirms it, and limiting the invitations it receives to three a day. It is added to no list and receives no reminder and no advertising. Your family sees it among the recipe’s or the carnet’s invitations; it is erased when the invitation is withdrawn or declined, or when the recipe, the carnet, or the account of the member who sent it, is deleted.

Your subscription

For each subscription, Griddle keeps the plan (Essentiel or Premium), its period, whether it holds a founder price, a change of plan that is scheduled and its dates, with, for a subscription taken out on the site, the two references Stripe gives it — the subscription and the customer — and never anything of your card. This is used to know what your family may use and to honour the founder price; your data export contains it, without the Stripe references.

A subscription taken out in the App Store or on Google Play

A subscription taken out in the app is sold by the App Store or by Google Play: the store is its seller and handles its payment. Griddle receives the store’s verification of the purchase — its reference, the plan, its dates and its state — and keeps of it what it keeps of any subscription, with that reference, and never anything of your card. To recognise your account in your purchases, the app passes the store an account reference Griddle created, which designates nothing outside Griddle. Your data export contains the subscription, without the store’s reference. Deleting your Griddle account does not stop a subscription taken out in a store: stop it in the App Store or on Google Play.

What you write on the shopping list

A note or an amount written on a line of the shopping list belongs to your family, as the list itself does: every member sees and edits it, and an assistant you allowed to read the list reads it with the list. It goes with the line it is on, when the list is emptied or the dish is taken off, and it is in every member’s export.

A connected assistant

With Premium, you can connect an assistant — Claude, ChatGPT or another — to Griddle. It receives only what the permissions ticked on the page where you allow it open to it, and only when it asks. Reading your recipes gives it your recipes and your carnets: ingredients, method, nutrition values, estimated cost, and the allergens found in the ingredients or that could not be read — never the absence of an allergen. Reading your week gives it the meals planned; reading your shopping list, its lines, with the notes and amounts your family wrote on them. Reading what you have cooked gives it the days a recipe was cooked, your stars and your family’s notes on the recipe, each with the first name of whoever wrote it; never a photo. A writing permission lets it add or change what it names, and nothing else; a cooking logged by an assistant is shown to nobody outside your family. What it receives, the assistant reads to answer you, at the provider you chose and under that provider’s terms; Griddle itself calls no artificial-intelligence service.

To cook and shop in the right measure, an assistant that does not say for how many people receives the number of portions of your table, the one Griddle applies on screen, even without taking your household into account. It is a number, and nothing else: no first names, and not the share each one eats.

“Take your household into account” is a permission of its own, which Griddle never ticks for you, even when the assistant asks for it: it is given only if you tick its box yourself. With it, Griddle matches dishes against your household on its own side, as it does on screen — allergies, intolerances, diets, dislikes, equipment and limits per meal —, and tells the assistant only the result: the weeks it proposes leave out the dishes that do not suit, and when the assistant plans a dish, Griddle answers only that somebody at the table reacts to it, or that the dish could not be read for your household. Never who, never to what: no first name, allergy, intolerance, diet, dislike, limit or equipment is passed on. Even reduced to that, it is information drawn from health data, passed to your assistant’s provider: it is passed only with your explicit consent (GDPR, Art. 9(2)(a)). You can withdraw that consent at any time: remove the permission from your account — the assistant keeps the others — or disconnect the assistant; the withdrawal holds from its next call.

When the family's Premium stops

For each member carrying on separately, Griddle keeps which family they belonged to and since when, so as to bring them back when Premium resumes; that link goes when they leave the family for good, join another, or delete their account. Each recipe keeps the member who created it — forgotten with their account — and, for a copy, the recipe it came from and a fingerprint of its content, used only so that a recipe is not doubled on the way back. The household and its allergies stay with the family and are never copied; only the entry of a member who leaves goes with them. Griddle sends an e-mail when Premium is about to stop or to become Essentiel, when the family has parted, and to a member removed from the family: nothing else.

Signing in with Apple or Google

If you sign in with Apple or Google, that service sends Griddle an identifier of its own and the e-mail address it has verified — with Apple, possibly a relay address, which forwards messages to your mailbox. That address is your account’s, and the identifier lets Griddle recognise you even if your address with that service changes. Your first name is read only at the sign-in that creates your account; Griddle reads neither your surname nor your photo. With Apple, Griddle also keeps a token Apple issued, used for one thing only: telling Apple, when you delete your account, that Griddle no longer signs you in. Your data export names the services you sign in with, without their identifiers or that token.

Notifications on your phone

If you turn them on in the app — each kind separately, none is on by default —, Griddle tells you when another member of your family changes the week or comments on a recipe, and about activity on the Feed that concerns you. A notification says who did what, on which week, recipe or publication; it never carries the words of a comment, nor anything of your household (allergies, intolerances, diets, dislikes, portions, limits). To deliver it, Griddle keeps your phone’s notification identifier and its system (iOS or Android), tied to your session: they are deleted when you sign out, change your password or delete your account, or when the session expires. Notifications go through Expo’s service (650 Industries, in the United States, Griddle’s processor, under standard contractual clauses), then through Apple (APNs) or Google (Firebase Cloud Messaging), depending on your phone. You can turn them off at any time in the app or in your phone’s settings. Your data export contains your notification choices, not your phones’ identifiers.