Privacy

This page says what Tuckabox does with what you put into it. It describes how the app works today, not what it might do one day.

What stays on your device

Your recipe box, your pantry, your shopping list, what you have ticked off while cooking and your settings are stored by your browser, on the device you are using. If you never sign in, none of it leaves that device and Tuckabox cannot see any of it. Clearing this site's data in your browser deletes it, and nobody can get it back for you — which is why Settings can export your recipes to a file.

You do not need an account for any of that. The recipe box, the pantry, the shopping list, cook mode and importing a recipe from a link all work signed out.

What goes to our server when you sign in

Signing in keeps a copy of your recipes, your pantry and your shopping list on our server, so your other devices can read them. That copy is held against your account. No other cook can reach it.

We use that copy for one more thing. Now and then we read how pantry items are worded — never recipes, and never your shopping list — to check that Tuckabox understands the way people write down food. "Half an onion" has to match recipes that need onion. What comes out of that check is counts and words we did not recognise, never anyone's list.

The server is in Virginia, in the United States. So is the database.

What we send to Anthropic

Six things in Tuckabox use Anthropic's AI: reading a recipe out of text or photographs, inventing a dinner from your pantry, suggesting starter recipes, suggesting a substitution, filling your pantry from photographs of your kitchen or from what you say is in it, and writing the plant-based version of a recipe. All six need an account. Making a recipe plant-based also uses a second company first, which is described below.

Writing a plant-based recipe is the newest of the six, and it costs none of your AI actions. It happens at the second press, after you have read the list of swaps, and at no other time. On a recipe in your recipe box that press is "Save plant-based copy". On a recipe you are still adding it is "Rewrite this recipe". Either way we send Anthropic the recipe's title, its ingredient lines, its method and the swaps you accepted. We also send its description and tags, unless they are very long. The answer comes straight back. From a recipe in your recipe box, Tuckabox makes a new recipe and leaves the one you started from as it was. On a recipe you are still adding, it puts the answer into the form in front of you, and nothing is added to your recipe box until you press Save.

When you use one, we send what that action needs to Anthropic, a company in the United States, and the answer comes straight back. Depending on the action, that is the text you pasted, the photographs you chose, the recipe you are looking at, or what is in your pantry. Tuckabox keeps no copy of the photographs — of a recipe or of your kitchen — they are sent, read, and never stored here. What Anthropic keeps, and for how long, is Anthropic's to say.

Anthropic's commercial terms for the service we use say that “Anthropic may not train models on Customer Content from Services”. That is Anthropic's promise rather than ours. You can read it at anthropic.com/legal/commercial-terms.

What we send to TypeSafe

Making a recipe plant-based takes two presses, and the first uses a different company. It needs an account too, and it costs nothing and spends none of your AI actions. When you press "Make it plant-based", we send the recipe to TypeSafe, in the United States, whose small model picks swaps from a list Tuckabox keeps. That is the recipe's title, its ingredient lines and its method, and the answer comes straight back as the list of swaps you read. The second press sends the recipe to Anthropic, as described above. Tuckabox stores a short history of the conversion as part of the recipe: the swaps you accepted, the lines it found and left, and, for a copy, which recipe it was copied from. Our server also keeps counts of how many plant-based recipes were written for your account each day and how many times it asked, listed below with the other things we record, and nothing else about the conversion.

TypeSafe's privacy policy says it will “not train or fine tune any artificial intelligence or machine learning models on your prompts or other Input”, and that it keeps data “for as long as reasonably necessary to provide you with the Services, or otherwise in support of our business or commercial purposes”. It names no period, so we cannot tell you one. That is TypeSafe's policy rather than our promise. You can read it at typesafe.ai/privacy.

Your account and your payment

Clerk holds your account: your email address, how you sign in, and your plan. Clerk is outside Australia. If you buy the plan, you pay inside Clerk's own checkout — your card details never reach Tuckabox's code at all.

You can sign in with a code we email you, or with your Google account. If you choose Google, a company in the United States, Google tells Clerk your email address, your name and your profile picture, and Clerk keeps them with your account. We ask Google for nothing else — not your contacts, your mail or your files — and your Google password never reaches Tuckabox or Clerk. Google knows you signed in to Tuckabox. What Google keeps about that is Google's to say.

Signing in with Google under the same email address as your existing account opens that account, with your recipes in it. You never need a Google account: the emailed code always works.

What we record about using the app

Nine things, and no more than these:

• Which days your account opened the app. Not what you did on them.
• For each recipe imported from a link, the site it came from — say bbcgoodfood.com — and whether the import worked. Never the full address, and never the recipe.
• How many AI actions your account has used and what each one cost us to run, and how many you paid for and have not used yet. This is the billing record.
• How many plant-based recipes were written for your account on each day, how many times it asked for the list of swaps, and how many times it asked for one to be written. A few numbers per day, never which recipes, so that nobody can run that feature without limit. They are deleted when you close your account.
• How many times on each day your account asked for something that spends an AI action — the five features the billing record above counts, and not making a recipe plant-based, which has numbers of its own. The number is taken off again when an answer reaches you, so what is kept is roughly the count of attempts that gave you nothing. One number per day, never which feature and never what you asked. It is there so that nobody can run those features without limit, and it is deleted when you close your account.
• When you fill your pantry from a photograph or a spoken list, which of those two you used, and three numbers: how many things came back, how many you kept, and how many we could see but could not name. Plus whether you replaced your pantry or added to it. Never the photograph, never what you said, and never any of the names. We are measuring how well that feature reads a real kitchen, and we will stop recording it once we know.
• If Tuckabox breaks in your browser and you press Send report, what broke: the browser's own name for the error, where it happened in the code Tuckabox runs — ours, and the shared libraries we build it from — and which version of your saved recipes was being opened. Never the error's message, because that is the part that can quote your own recipe back at us. Nothing is sent unless you press the button.
• With that report, the line your browser sends every website to identify itself. It names the browser and its version, and usually the operating system and the kind of device you are on. We keep it because most faults of this kind only happen on one browser or one version.
• If you are signed in when you press Send report, the report can carry your account with it. It does not always: we keep one record per distinct fault, so a report that matches one somebody already sent is counted against theirs. When a report cannot get through at the time, your browser keeps it and tries again later, and that later try never carries your account — though the first try may already have reached us with it. If you are signed out, nothing about who you are is sent at all, on either try.

None of those records what you were cooking. There is no record anywhere of which recipes you open.

We delete a crash report once it is 90 days old. The clearing out happens whenever the next report arrives, so if nobody sends one for a while, the last few sit there until somebody does.

Visitor numbers

We use Vercel Web Analytics to count visits. It is told which screen was opened — /recipe, /shopping — along with the things any web server sees anyway: where you came from, your country, your browser and whether you are on a phone. Everything after the screen's name is cut off before it leaves your browser, so which recipe you opened is never sent.

It sets no cookies and it cannot follow you to another site. Vercel says it recognises a visitor by a hash of the request and discards that after 24 hours. Nothing ties a visit to your account.

Cookies

Clerk sets cookies to keep you signed in. Tuckabox sets none of its own, and nothing here advertises to you or follows you around.

When you close your account

Close your account from the account panel in Settings. Clerk tells us it has closed, and your recipes, pantry and shopping list are deleted from our server, along with the daily counts of plant-based conversions and the notes on how you filled your pantry from a photograph or a spoken list. That happens when the message arrives, normally within moments. If the deletion fails, the message is sent again until it works. The copy on your own device stays there until you clear it.

Three things stay behind:

• The record of the AI actions your account used, and of any you paid for and did not use, because that is what you were billed for.
• The note of which days the app was opened, and which sites links came from. That is how we understand whether Tuckabox is worth running.
• Any crash report you sent. What broke is about our code, not about you, and it may still need fixing, so we keep the fault itself. We take your account off those reports when you close your account. A report sent in the few minutes around that moment can keep your account on it. If that matters to you, email us before you close your account, and we will clear it once the account has closed. The whole report goes at 90 days, in the way described higher up the page: the clearing out happens when the next report arrives, so the last few can sit a while longer.

None of the three holds a recipe. The first two have no date on which they are deleted. If you want either of them gone sooner, or your account taken off a crash report, email us, and do it before you close your account. Once your account has closed, your email address no longer leads us to your records. We can remove the note of your days and links, and take your account off a crash report, while you keep using Tuckabox. The billing record goes only once your account has closed, because it also holds any AI actions you paid for and have not used. If we are waiting for your account to close and it is still open 30 days after you write, we will tell you, and you will need to write again before you close.

Getting in touch

Questions about any of this, or about what we hold on you: hello@tuckabox.app.

Tuckabox is run by Roan Bradley in Australia. Last updated 16 October 2026 — when this page changes, that date changes with it.