Privacy

Spuno is a weekly meal-planning app made by PCF Digital LLC. In this policy, "we", "us" and "our" mean PCF Digital LLC. This page describes what data it collects, how that data is used, and how you can control it.

Account

Spuno signs you in anonymously by default — no email, name, or password is required. Firebase assigns the account a random identifier so Spuno can keep its data separate from other accounts.

You may optionally link your account to Google or Apple sign-in. Linking lets you reach your data from another device, and makes recovery reliable if your phone is reset, erased, or replaced. When you link an account, the sign-in provider may give Firebase your email address, display name, provider identifier, and profile photo, depending on the provider and the choices you make there.

If you never link an account, your data is still saved on our servers — but the only thing identifying it as yours is a credential stored on your device. Erasing or resetting the device can therefore leave an unlinked account unreachable. See Your controls below for what this does and does not mean.

What data we store

The following is stored in Google Cloud Firestore under your Firebase account identifier:

• Recipes you add — name, ingredients, instructions, source, and any photos you attach (up to five per recipe, so a printed recipe spanning several pages can be captured whole).
• Weekly plans you generate or edit.
• Preferences — household size, dietary rules, and similar settings.
• Grocery list state — which items you've crossed off, the amount each was crossed off against, any grocery lines you've edited, and any items you've added to the list yourself.

Spuno no longer keeps a pantry. Earlier versions stored a list of ingredients you had marked as already on hand; that feature was removed, and the app no longer reads, writes or updates it. If your account still holds one from an older version, it is inert, remains protected by the same per-account security rules, and is removed when you request account deletion.

From Spuno 1.24.0, this data lives in a kitchen. Recipes, weekly plans, grocery list state, the kitchen's planning preferences (dietary rules and nights per week) and usage records are kept in a kitchen area of the database instead of directly under your account. Today every kitchen has exactly one member, and its identifier is your Firebase account identifier, so nothing about who can read your data changes. The first time 1.24.0 or later opens, it copies your existing data into that area once. The originals are kept, unchanged, until a later version of the app removes them, and both copies are deleted together if you delete your account. Whether you have finished setting the app up stays with your account rather than the kitchen.

Recipe photos you upload are stored in Google Cloud Storage, under a path scoped to your account. Firebase Security Rules prevent one signed-in account from reading another account's private Firestore or Storage data. Google, Spuno's operator, and authorized service providers may process that data only as needed to operate, secure, support, or comply with legal obligations for the service.

Spuno also keeps a server-only cache of canonical recipe URLs and recipe fields derived from public recipe pages. Cache entries contain no Firebase account identifier or raw page content, are not readable by app clients, and expire after 60 days.

How you use the app

Spuno records how you move through the app, so we can see which parts work and which parts people give up on. These records now also help the weekly plan learn what you tend to cook — see How your weekly plan is personalised below for exactly how, and what it can and cannot do. This is first-party only: the records are written to your own account's area of the same database as your recipes, by the app itself. No analytics or advertising SDK is involved, and nothing is sent to an analytics company.

This data is pseudonymous, not anonymous. It is stored under your Firebase account identifier, which means it is linked to you, and we say so rather than calling it anonymous. From Spuno 1.24.0 each record also names the account that wrote it — the same identifier, since your kitchen's identifier is your account's — so a record stays attributable to the person who made it if a kitchen ever has more than one member.

What a record contains:

• What happened and where — for example "a recipe was shown on the Cookbook list in third position", "a plan was saved with five nights", "an import stopped at the parsing step", "a grocery row was ticked".
• Identifiers already in your account — recipe and plan identifiers, so a record can be matched back to the thing it describes.
• Numbers, yes/no answers, and times — positions, counts, and a coarse bucket for how long a recipe was open (0, 5, 15, 30, 60 or 120 seconds), never a precise duration.

What a record never contains:

• Anything you typed or that a website wrote. No recipe names, notes, search text, cravings, ingredient lines, grocery lines, web addresses, or error messages.
• Your email, name, contacts, advertising identifier, or device identifiers.
• Your location.

Where a record needs to refer to a word you used — a search term, a tag, a grocery item — it stores a short one-way fingerprint of that word instead of the word itself. A fingerprint of a common word can be guessed by trying common words against it, so we do not describe these as anonymous or irreversible; they exist to keep your words out of the record, not to make the record unidentifiable.

These records are append-only: neither we nor you can edit one after it is written. They are deleted with your account like everything else, and they expire on their own after 180 days.

AI-assisted recipe import

Spuno first tries to read structured recipe data deterministically on your device or server. A complete deterministic result is not sent to an AI model. For photo imports, or when a recipe page does not provide enough structured data, a Google Cloud Function sends the photo (or, for a multi-page recipe, every page you selected, in one request) or the page's readable text and URL to Anthropic (the maker of Claude) to extract recipe fields. Spuno does not deliberately include your Firebase account identifier, name, or email in that AI request, although a photo you choose could itself contain personal information.

Under Anthropic's standard commercial API terms, API inputs and outputs are deleted from its backend within 30 days, except where longer retention is required for safety-policy enforcement or by law. Anthropic does not use commercial API inputs or outputs to train its generative models by default. A capped number of imports per day is enforced to control cost; imports happen only after you choose to start one.

Importing from an Instagram or TikTok post

A recipe posted to Instagram or TikTok is readable only by a real browser, so when you paste one of those links Spuno loads that post in a hidden in-app browser and reads the caption on your device. The caption is parsed on the device too; no AI model and no Spuno server is involved, and the caption is never uploaded. The post's own site receives a normal page request from you, including your IP address and user agent, and applies its own privacy practices.

If the caption yields a recipe, two things the post itself declares are kept: the creator's @handle, stored as the recipe's creator, and the post's cover image, whose bytes are copied into your own storage when you save. Spuno does not read comments or direct messages, and cannot.

How your weekly plan is personalised

When Spuno builds a weekly plan it looks at four things, so the week does not repeat itself and leans toward food you like:

• Your recent weekly plans, to avoid serving the same meals you were given in the last four weeks. Plans older than that are ignored.
• Your recipe ratings, so a recipe you marked make again is favoured.
• How many times you have marked a recipe cooked.
• How you have used the app over roughly the last three weeks — the usage records described in How you use the app. Opening a recipe and reading it, choosing one deliberately, saving or sharing one, and finishing a shopping list all count in a recipe's favour.

Some limits are worth stating plainly, because they are what keep this modest:

• It can only ever favour a recipe, never push one down. Spuno's records include things that could be read as disinterest — a card you scrolled past, a meal you swapped out. Those are deliberately discarded rather than used against a recipe, because a recipe quietly buried for reasons you cannot see or correct is a much larger claim than one gently favoured.
• A recipe you have barely seen counts for nothing at all. Below a handful of appearances a recipe contributes exactly zero, however it was used. Two glances are not a preference.
• Everything you can express is worth the same as one shared ingredient. Ratings, cook counts and usage share a single budget with a fixed ceiling, so the strongest possible preference can move a recipe by about as much as sharing one main ingredient with another meal that week. Reusing ingredients across the week is still what decides most of it.
• It is not shown to you, and it stores nothing new. The planner reads what is already there when it builds a week and writes nothing back. There is no profile document and no score saved anywhere.
• Turning it off is one switch. These records are only written while usage recording is on; with it off, Spuno neither writes them nor reads them, and the plan is built from your ratings, your cook counts and your recent plans alone.

Only recipes in your own cookbook are ever planned, and everything above is your own data in your own account. Nothing leaves your device except the ordinary reading of your own records.

Recipe sharing

If you explicitly share a recipe — for example, to send it to a friend — Spuno creates a point-in-time snapshot at an unguessable link. Anyone with that link can view the snapshot; it is not otherwise discoverable and is never modified after creation. It carries no reference to your account — no account identifier, no rating, no cook count, and no personal note.

If the recipe's photo was taken or uploaded in the app, Spuno copies that photo to a location named after the share link rather than after your account, so the snapshot's photo link contains no account identifier either. A photo that came from a recipe website is linked as the website serves it and has never carried one.

Snapshots created by older versions of the app are the exception. The copied-photo behaviour described above arrives in Spuno 1.19.0, and it applies from the moment the app doing the sharing has been updated to that version or later — not from the date at the top of this page. Spuno does not force updates, so a share created from an install that has not yet updated still carries the photo's original storage link, which contains your Firebase account identifier, whenever that share was made. The identifier grants no access to your account or to any other data of yours, and the shared page never displays it, but someone holding two such links could tell they came from the same account. Older snapshots are left as they are rather than rewritten; re-sharing a recipe from an updated app creates a fresh snapshot with no identifier in it.

Shared snapshots do not currently expire automatically or have an in-app revoke control. Contact us with the share link if you need one removed.

Service providers and technical data

Spuno uses Google Firebase and Google Cloud for authentication, database, file storage, server functions, security attestation, and operational logs. Two other providers appear in narrow roles, described below: Anthropic for AI-assisted import, and Vercel for the public share page. Firebase Authentication can process account identifiers, provider contact information, IP addresses, and user-agent data. Cloud Functions can process the caller's IP address and invocation metadata. Spuno's own function logs record bounded timing, result category, and error category; they do not deliberately record recipe content, imported URLs, Firebase account identifiers, photos, or model output.

The public recipe page at spuno.app — what someone sees when you send them a share link — is hosted by Vercel, not by Google. Vercel can process a visitor's IP address, user agent and request metadata in its own logs.

The page reads one recipe snapshot by its link id. It holds no credentials for your account, receives no Spuno account data, and the snapshot itself carries no account identifier. It is served with no-store, so it is not cached by a CDN, and carries noindex, so it is not listed by search engines. It is deliberately left crawlable, so that link previews in Messages, Slack and similar apps can read its title and image; keeping it out of search is the noindex's job, not the crawler's.

Two things on that page go beyond displaying the recipe. Both belong to the website rather than the app, and This website, below, describes them in full:

• While Spuno is in beta, the page offers a form to join the beta. This runs the website's own JavaScript in your browser — no third-party script is involved. Nothing is sent unless you type an email address and submit it.
• The rest of spuno.app counts page views; this page deliberately does not. The counter used on the marketing and legal pages is not loaded here, because someone following a share link never chose to visit the site.

The page sets no cookies.

Optional sign-in uses Google or Apple as selected by you. When Spuno retrieves a recipe page or displays a remotely hosted recipe image, the relevant website receives normal connection information such as your IP address and user agent and applies its own privacy practices.

What we don't do

Spuno does not run analytics or advertising SDKs, sell personal data, use personal data for targeted advertising, or build user profiles for marketing. It shares data with the service providers described above only to provide and secure features you request.

The usage records described in How you use the app are first-party: they are written by the app into your own account's area of our database, using the same Google Cloud services that already store your recipes. They are used to improve the app and, from Spuno 1.19.0 onwards, to help personalise your weekly plan as described in How your weekly plan is personalised. Which app version is installed is what decides that, not the date at the top of this page. They are not used for advertising, not sold, not shared with an analytics company, and not used to build a marketing profile.

App Check

Spuno uses Apple's App Attest (via Firebase App Check) to confirm that requests to our backend come from a genuine copy of the app, rather than a script. This is a technical anti-abuse measure, not advertising or marketing. App Check processes an App Attest attestation and short-lived security tokens to establish app and device integrity.

Retention and deletion

• Private recipes, plans, preferences, grocery state, and uploaded recipe photos remain until you delete them through an available in-app control or request account deletion. Any pantry record left over from an earlier version of the app is retained on the same terms and removed on account deletion, even though nothing in the app reads it.
• Deleting a recipe removes its Firestore record. Every app-uploaded photo attached to that recipe is then deleted from Storage by a server cleanup process. Images hosted by recipe websites are controlled by those websites rather than Spuno.
• Usage records (see How you use the app) expire automatically 180 days after they are written, and are deleted immediately when you delete your account. The one-time copy into your kitchen keeps each record's original expiry; copying does not restart the 180 days.
• Server-only recipe-cache entries expire after 60 days. Anthropic's API retention is described in AI-assisted recipe import above.
• Public recipe-share snapshots do not currently expire automatically. Contact us with the link to request removal.
• Firebase and other processors may retain limited security, operational, or backup data for a period after deletion under their applicable terms or where required by law.

Your controls

• Deleting your account deletes your usage records along with everything else. There is no separate opt-out control for them today; if you want them removed before then, contact us.
• Delete individual recipes and manage grocery items from within the app. Deleting a recipe also schedules deletion of its app-uploaded photos. Individual photos can be removed from a recipe by editing it.
• New week on the grocery list clears every checkmark and nothing else — your added items, edited amounts and meal plan are untouched.
• Deleting the app does not delete your data. Your recipes and plans remain stored on our servers. On iPhone, the credential identifying your account is normally retained by iOS even after the app is deleted, so reinstalling usually signs you back into the same account with your data intact.
• Erasing or resetting your device can leave an unlinked anonymous account unreachable. Note what this does and does not mean: you would lose access to the data, but the data itself remains stored on our servers until deletion is requested. Linking Google or Apple avoids this.

Deleting your account

• You can delete your account and all of its data from inside the app. Open the account sheet and choose Delete account and data (or Erase everything and start fresh if you have not linked a Google or Apple account). You will be shown exactly what will be destroyed and asked to confirm; the deletion cannot be undone.
• This applies to guest accounts too. An anonymous session holds real recipes, plans and photos, so it gets the same control — no sign-in is required to erase your data.
• If your account is linked to Google or Apple, you will be asked to sign in with that provider one more time first. This confirms the person holding the phone owns the account being destroyed. Cancelling that prompt, or signing in with a different account, deletes nothing.
• Signing in with Apple: the same prompt is used to revoke Spuno's access to your Apple ID, so Spuno stops appearing in your Apple ID's list of apps using Sign in with Apple. If that revocation cannot be completed, the deletion is cancelled rather than partially performed — nothing is deleted and you can try again.
• What deletion removes: your recipes, your weekly plan, your grocery list and its saved edits, your saved preferences, your usage records, every photo you uploaded, any public recipe-share snapshots created from your account and the shared copies of their photos, any inert records left by earlier versions of the app, your kitchen together with the original copies made before 1.24.0, and the account itself. Deletion runs in an order that leaves nothing stranded if it is interrupted: if a step fails, nothing further is deleted and running it again completes the job. So that an update still running on another of your devices cannot recreate anything, deletion also leaves a one-way fingerprint of the account identifier — no other data, readable by no app — that expires automatically within a few days.
• What deletion does not remove: server-only recipe-cache entries, which hold derived recipe fields keyed by web address, contain no account identifier, are shared across all users, and expire on their own after 60 days. They are not attributable to you.
• After deletion, the app signs you out and starts a new, empty guest session on this device.
• Requesting deletion instead. If you cannot use the in-app control — you no longer have the app installed, you have lost access to the account, or the in-app route fails — email support@spuno.app and we will delete the account and its data for you. Please include enough information to identify the account (the email address you signed in with, or the approximate date and device). Because public recipe-share snapshots intentionally contain no account identifier, include any share links you also want removed.

This website

Everything else in this policy describes the Spuno app. The website at spuno.app is separate and much simpler: it sets no cookies, carries no advertising or cross-site trackers, and builds no marketing profile of you.

It does count page views, using Vercel Web Analytics — a counter built into our hosting provider. For each view it records the page, the referring site, your browser and device type, and an approximate location (country, region, and city). Visitors are distinguished by a hash derived from the incoming request rather than by a cookie, and that hash is discarded after 24 hours, so what we see is aggregate counts rather than individual people. Recipe share pages do not load the counter.

If you submit your email address to join the beta, we store that address, the page you submitted it from, and the time, in a database hosted by Supabase, so we can send you an invite, and we're notified of new signups. To stop the form being abused we also store a one-way hash of your IP address for a short period; the address itself is never written down. Email support@spuno.app to remove your email from that list at any time.

Changes

This policy may be updated as Spuno's features change. The last updated date above is the date this text was last revised; it is not the date on which anything described here started happening. Changes to what the app does arrive with an app update and take effect on a device once that device has installed it, which is why the two statements above that depend on a build are keyed to the app version rather than to a date.

Spuno is made by PCF Digital LLC, based in Marietta, GA. Questions or requests, including access or deletion, go to support@spuno.app.