Roux is a recipe management app made by Paul Bernius (“we,” “us,” or “Roux”). This policy describes what data Roux collects, how we use it, who we share it with, and the rights you have over your data.

We've tried to keep it specific and free of legalese — if anything is unclear, please email us at support@tryroux.app.

1. The short version

You sign in with your email address and a password.
The recipes you save are private to you. We don't sell them, share them with advertisers, or use them to train AI models.
When you paste a link or text for AI to turn into a recipe, that link/text is sent to a few third-party services (Anthropic, Supadata, Jina, Firecrawl, Voyage AI) to do the actual import and search. We name each one below and describe what they receive.
Roux Premium is an auto-renewing subscription sold through the Apple App Store. Apple handles the payment; we never see your card details. RevenueCat tells our backend which plan you're on.
You can delete your account at any time from inside the app, and that removes your recipes, profile, and any images we've stored for you. Deleting your account does not cancel an App Store subscription — cancel that in Settings → Apple Account → Subscriptions.
For anything else, email support@tryroux.app.

2. Who we are

Roux is an independent app developed and operated by Paul Bernius. For privacy questions or to exercise the rights described below, contact:

Email: support@tryroux.app
App: Roux: AI Recipe Assistant (iOS), bundle identifier com.paulbernius.roux

For users in the EU/UK: for the purposes of GDPR / UK GDPR, Paul Bernius is the data controller for your information.

3. Information we collect

3.1 Information you provide directly

What	When	Why
Email address	Sign-up and sign-in	To create your account, send sign-in / password-reset emails, and contact you about your account
Sign in with Apple identity token, and the email address Apple returns (which may be a private `@privaterelay.appleid.com` relay address if you chose to hide yours)	If you sign in with Apple	To create and authenticate your account
Password (stored only as a salted hash by our auth provider)	Sign-up and sign-in	To authenticate you
The “show nutrition” toggle	Profile screen	To render recipes the way you want
Recipe content — titles, descriptions, ingredients, instructions, tags, source URL, prep/cook times, servings, cuisine, difficulty	Whenever you save or edit a recipe	To provide the core recipe-management features
Recipe chats — the messages you send to the recipe assistant and its replies, each set of edits it makes (so you can undo it), the working draft of the recipe, and for long chats a summary of the earlier messages	Whenever you chat about a recipe	To show you the conversation, apply and undo edits, and give the assistant the context of the chat
Remembered preferences — short notes the recipe assistant saves when you tell it something lasting about how you cook: a diet, an allergy, your kitchen equipment, who you cook for, a food you dislike	When you tell the recipe assistant	So every chat, and the suggestions on your saved recipes, take them into account. You can see and delete each one in Settings → Chat Memory
Source links and pasted text — URLs to recipes (including links to TikTok, YouTube, Instagram, X/Twitter, or any cooking website) and any text you paste in to be turned into a recipe	Whenever you import a recipe	To turn the link or text into a structured recipe, and to show it in your import history
Content reports — which recipe you reported, the reason you picked, and when	When you report a recipe in Discover, tag browsing, or search	To hide that recipe for you, and to review it and remove it from Discover if it breaks our Terms. Reports are stored with your user ID, we are notified of each one through our error-reporting service (Sentry) with the recipe's ID and title, and your reports are deleted with your account.

3.2 Information collected automatically

Account identifiers — a unique user ID assigned by our auth provider, plus the timestamps of your sign-up and most recent sign-in.
Server logs — when our backend processes a recipe import, a recipe-assistant chat, or a search, we log information about that request: the input we received, the AI model used, response latency, token counts (so we can monitor cost), and the result. The app also records which search result you open. This is described in more detail in Section 5.
Recipe images we re-host — when you import a recipe and the source page exposes an image, we download that image (from the source's server) and re-host it on our storage, so the recipe still works if the source page later removes it. The image we host comes from the source URL you pasted; we do not generate or upload images on your behalf.
Crash and error reports — when the app crashes, freezes, or hits an unexpected error, it sends a diagnostic report to Sentry (Section 6): the technical error details and stack trace, your device model and OS version, the app version, your account user ID, and a short trail of the screens you visited and the requests the app made to our own backend just before the error. The app also sends timing measurements of app start-up and screen transitions so we can spot slowdowns. Reports never include your email address, your recipes, or your chat messages as content.

3.3 What we do not collect

Other than the crash and error reporting described above, we do not run any analytics, tracking, or advertising SDKs inside the app. There is no Google Analytics, no Firebase Analytics, no PostHog, no Mixpanel, no Amplitude, no advertising SDK. We do not track you across other apps or websites. We do not collect your location, contacts, calendar, photos, microphone, or HealthKit data. We do not store payment information. Roux Premium is sold as an auto-renewing subscription through the Apple App Store: Apple processes the payment and we never receive your card number, billing address, or Apple ID password. We receive only the subscription status described in Section 6 (which product you bought, whether it is active, and when it renews or expires).

4. How we use your information

We use the data above to:

Provide the core features of the app — sign-in, saving recipes, importing recipes from links or text, searching your collection, chatting with the recipe assistant to modify a recipe, and remembering the cooking preferences you tell the assistant about.
Cache import results — when you paste a publicly-accessible URL, we keep the imported recipe in a server-side cache keyed by that URL so future imports of the same link are faster and cheaper. This cache contains recipe data derived from the public web page and is not tied to your account once cached.
Operate the service — debug failed imports, investigate quality regressions, monitor costs, improve the prompts and models we use, and check that search finds the right recipes (using your searches and the results you open).
Communicate with you — respond to support emails and send transactional emails (sign-in, password reset, account-related notices).
Comply with our legal obligations.

Content you import or chat about is sent to Anthropic. When you paste a link or text to import, and when you send a message in recipe chat, that content (plus the recipe being edited and, for chat and for the suggestions shown on your saved recipes, your remembered preferences) is transmitted to Anthropic's API so Claude can import or edit the recipe. The app asks for your explicit permission before the first time this happens. We do not use your recipes, your chat messages, or your account information to train AI models, and neither does Anthropic — API inputs and outputs are excluded from model training under their commercial terms. The third-party AI providers we work with (Anthropic, Voyage AI) likewise do not use API inputs to train their models — see Section 6.

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act / CPRA.

5. Server-side logs

To operate and improve the service, our backend keeps internal records when you import a recipe, chat with the recipe assistant, or run a search:

AI call log — one record per call our backend makes to an AI model (for an import, a chat, a search, or background work on a recipe): the input we sent to the model, the model's output, the model used, token counts and cost, latency, and whether the call succeeded. The input and output are deleted automatically after 30 days; the rest of the record is kept.
Search logs — for each search: the query you typed, how you started it (typed, a suggestion, a recent search), what Roux understood the query to mean (for example the ingredients or diet it picked out) and how confident it was, the IDs of the recipes that matched, and timing/cost information.
Search taps — each search result you open: which result, whether it came from your recipes or Discover, and its position in the list. Together with the search logs, these tell us whether search is finding the right recipes.
Background-job records — one record per background task (importing a recipe, adding timers or suggestions, updating search data): its status, attempts, and any error. Deleted automatically 30 days after the task finishes.
Older import and chat logs — earlier versions of our backend wrote separate import logs (the URL or text you submitted, the content sent to the AI model, and its response) and chat logs (your messages, the assistant's replies, and its edits). We no longer add to them, except a short receipt for each import made from an older version of the app.

Internally these live in the ai_calls, search_logs, search_taps, and job_runs tables, and the older extraction_logs and chat_logs tables. They are not visible inside the app and are not shared.

These records are tied to your user ID (background-job records point to the import or recipe they worked on). They are accessible only to us (the app can add its own search logs and search taps, but cannot read, change, or delete any of these records) and to our hosting provider (Supabase) acting on our behalf. Retention and deletion are described in Section 8.

6. Third parties we share data with

We only share data with the providers below, and only as needed to deliver the features you use. Each provider is bound by their own contract with us and provides protections for your data that are at least equivalent to those in this policy. All of these providers are based in the United States.

Provider	What we send	When	What they do with it
Supabase (database, authentication, file storage, edge-function hosting)	All your account data, recipes, images, and server logs	Continuously, as you use the app	Hosts our backend on AWS in the United States (us-east region). Supabase acts as our data processor.
Anthropic (the maker of Claude)	The cleaned recipe text or transcript we pulled from your URL/pasted content; for chat, the recipe you're editing, your chat messages, and your remembered preferences	Whenever you import a recipe or chat with the recipe assistant	Runs the AI import and chat (Anthropic's Claude models). Per Anthropic's commercial API terms, inputs and outputs are not used to train models; Anthropic retains API logs for a short period for trust-and-safety purposes.
Voyage AI	Your search query text	When you run a search	Generates a numerical embedding of the query so we can do semantic search. Voyage's API terms state that API inputs are not used to train models.
Supadata	The video URL you pasted (TikTok, YouTube, Instagram, X/Twitter)	When you import a recipe from a social-media link	Returns a transcript and metadata (title, description) for the video so we can import a recipe from it.
Jina AI (“Jina Reader”)	The web URL you pasted	When you import a recipe from a website that doesn't expose structured recipe data	Returns a clean Markdown version of that public web page.
Firecrawl	The web URL you pasted	Fallback when Jina cannot render the page (e.g., heavy JavaScript)	Returns rendered page content.
RevenueCat (subscription management)	Your Supabase user ID (used as the RevenueCat app user ID), the App Store transaction/receipt data Apple provides, and the product you purchased	When you open a paywall, purchase, restore, or when your subscription renews or lapses	Validates the App Store receipt and tells our backend which plan you are on, so premium features unlock. RevenueCat acts as our data processor.
Apple (App Store, Sign in with Apple)	For purchases: the transaction itself, handled entirely by Apple. For Sign in with Apple: an identity token and the email address (real or private relay) you chose to share	When you subscribe, or when you sign in with Apple	Processes the payment and, for Sign in with Apple, verifies your identity. We never receive your payment card details.
Sentry (crash and error reporting)	The crash and error reports described in Section 3.2: error details, device and app version, your user ID, and recent screens and backend requests	When the app crashes or hits an unexpected error, and for start-up and navigation timing	Groups reports so we can find and fix bugs. Sentry acts as our data processor, stores reports in the United States, and deletes them automatically after 90 days.

In addition, when we re-host a recipe image, the image's original server (the website you imported from) sees a single download request from our backend.

We do not share your information with any other third parties. We do not run advertising SDKs, marketing pixels, or product-analytics SDKs.

If we ever need to share information for legal reasons — e.g., to comply with a valid subpoena, a court order, or to protect the safety of our users — we'll do so only to the minimum extent required and we'll tell affected users where the law allows.

If Roux is ever acquired or merges with another company, we will notify you before your information is transferred and becomes subject to a different privacy policy.

7. International data transfers

Roux's backend runs in the United States. If you use the app from outside the United States — including from the European Economic Area, the United Kingdom, Switzerland, or California — your information will be transferred to and processed in the United States. We rely on the Standard Contractual Clauses (SCCs) and our providers' equivalent transfer mechanisms to protect data transferred out of the EEA / UK.

8. Data retention and deletion

Account data, profile, recipes, and recipe images — kept for as long as your account exists.
Recipe chats — a chat on a saved recipe is kept until you delete that recipe or your account. A chat on an imported recipe you haven't saved, in which no edits were made, is deleted after 30 days without activity; any other chat is kept until your account is deleted.
Remembered preferences — kept until you delete them in Settings → Chat Memory, or delete your account.
Import history — kept until your account is deleted. Dismissing an import in the app only hides it.
AI call log — the inputs and outputs of each AI model call are deleted after 30 days; the rest of the record (model, token counts, cost, timing, status) is kept until your account is deleted.
Search logs and search taps — kept until your account is deleted.
Background-job records — deleted 30 days after the job finishes.
Older import and chat logs — kept as history, with your user ID removed when your account is deleted.
Cached import results — kept indefinitely; these are derived from publicly-accessible URLs and are not tied to your account.
Anthropic API logs — retained by Anthropic according to their commercial terms (typically a short window, currently a matter of days, for trust-and-safety review).
Subscription records — RevenueCat keeps your purchase history for as long as your subscription record exists; our own subscriptions row is deleted with your account. Apple retains transaction records under its own policy.
Crash and error reports — retained by Sentry for 90 days, then deleted automatically. They are keyed by your user ID, so after you delete your account any remaining reports expire on their own within that window; email us if you'd like them removed sooner.

You can delete your account at any time from the Settings screen in the app. Deleting your account does not cancel an auto-renewing App Store subscription — only Apple can do that, in Settings → Apple Account → Subscriptions. Deleting your account immediately removes your auth record, your profile row, all of your recipes, all images we've stored for you, your recipe chats, your remembered preferences, your import history, your AI call log records, your search logs and search taps, and your content reports. Your user ID is unset on the older import-log and chat-log rows.

If you have trouble deleting your account from inside the app, email us at support@tryroux.app and we'll do it manually within 30 days.

9. Your rights

Depending on where you live, you have some or all of the following rights over your personal information. Roux honors these rights for everyone, regardless of jurisdiction.

Access — ask us for a copy of the personal information we hold about you.
Rectification / correction — ask us to correct inaccurate information. Most fields (your email address, recipe content) you can correct yourself in the app.
Erasure / deletion — ask us to delete your information. Account deletion is available in-app; for partial deletion requests, email us.
Restriction of processing — ask us to pause processing while we sort out a dispute about your data.
Portability — ask us for an export of your account data and recipes in a portable format.
Objection — object to our processing of your information based on our legitimate interests.
Withdraw consent — where we rely on consent, you can withdraw it at any time. Withdrawing consent doesn't affect processing that already happened.
No automated decision-making — Roux does not make any decisions about you that have legal or similarly significant effects using only automated processing.

To exercise any of these rights, email support@tryroux.app. We may need to verify that you're the account holder before acting on requests. We'll respond within 30 days (or 45 days under the CCPA, which we'll use only when reasonably necessary).

If you're in the EEA / UK / Switzerland, you also have the right to lodge a complaint with your local data-protection authority. We'd appreciate the chance to address your concern first.

California-specific rights (CCPA / CPRA)

In the past 12 months we have collected the following CCPA-defined categories of personal information:

Identifiers — email address, account user ID.
Commercial information — the Roux Premium subscription you purchased and its status.
Internet or other electronic network activity information — server logs of recipe imports, chats, and searches you initiate, and the search results you open; crash and error reports, including device model, OS version, and the screens visited before an error.
User content — the recipes you save, the messages you send to the recipe assistant, and the preferences you ask it to remember.

We collect these categories from you directly (when you provide them) and from third-party sources you choose to import from (when you paste a URL, the source web page provides text and an image). We use them for the purposes described in Sections 3, 4, and 5. We disclose them only to the service providers listed in Section 6, and we do not sell or share personal information for cross-context behavioral advertising.

California residents have the right to know, the right to delete, the right to correct, the right to opt out of the sale or sharing of personal information (we don't do either), the right to limit use of sensitive personal information (we don't collect sensitive PI), and the right not to be discriminated against for exercising any of these rights.

10. Security

We rely on commonly-accepted security practices to protect your data:

TLS in transit between the app and our servers, and between our servers and the third-party providers in Section 6.
Passwords stored only as salted hashes by our authentication provider — we never see your password in plaintext.
Postgres row-level-security policies that prevent any user from reading or modifying another user's data.
Privileged backend operations are gated behind service-role JWTs that are never exposed to the app.

No service can guarantee perfect security. If we ever detect a breach affecting your data, we'll notify you and the appropriate regulators within the timeframes the law requires.

11. Children

Roux is not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child has signed up for Roux, please email support@tryroux.app and we'll delete the account.

12. Changes to this policy

We may update this policy from time to time. When we do, we'll change the “Last updated” date at the top, and — for material changes — we'll notify you in the app or by email before the new version takes effect. The current version is always available at the URL where you found this policy, and the change history is in the public Git repository that this document is published from.

13. Contact

For any privacy question, request, or complaint:

Email: support@tryroux.app