Overeasy privacy policy
Effective: October 13, 2026
Overeasy turns public recipe links and text you provide into recipes, offers original Overeasy Kitchen recipes, and syncs your saved recipes across your devices. This policy describes the data needed to do that. Overeasy does not sell personal data, serve ads, or track activity across other apps or websites.
Data we collect and why
- Account and device identifiers and authentication sessions provide sign-in, sync, and fraud prevention. Apple or Google supplies its stable account identifier only when you choose that sign-in method.
- A display name and a profile picture identify your account to you inside the app. Both may be supplied by the sign-in provider, and the display name is editable and is never overwritten by a later sign-in. A provider's picture is a link to their own copy, which Overeasy does not host.
- A profile photo you choose yourself is stored by Overeasy, in the same private object storage as your recipe images. It is shown only to you, in your own app: it is never attached to anything you share, never shown in Discover, and never served to another account. It is reachable only through a signed link that expires within hours, it replaces the provider's picture without deleting it, and you can remove it at any time from the avatar in Profile. Removing it, replacing it, or deleting your account deletes the stored photo. Overeasy uses the camera and reads from your photo library only when you choose a picture, and only the picture you choose.
- Imported URLs, public-source metadata, recipe content, thumbnails, and edit history provide imports and device sync.
- Discover includes public recipe-video sources and original Overeasy Kitchen recipes. Imported recipes show public creator attribution; original recipes show Overeasy Kitchen and a generated dish image. Save counts exclude the house account, and star ratings come only from cooks who rate a saved recipe. Discover does not expose who saved a recipe or another account's private edits, notes, or pasted text. A recipe built from text you pasted is not shared. Overeasy Kitchen recipes have no source video and do not appear in Watch, which shows imported public-video recipes.
- Contribute to Discover in Profile is on by default. Turning it off excludes all your existing and future saved recipes from Discover, Watch, and public save counts. Your library and other cooks' saved copies remain; a source can still appear when another contributing cook has saved it. The setting follows your account across devices and can be turned back on. Star ratings you deliberately submit remain separate and can be cleared individually. When a guest library joins a signed-in account, contribution stays off if either account had turned it off.
- A record of which Discover sources were shown to your account, and when, keeps the feed from repeating itself: a source you were shown in the last day sorts below ones you have not seen. Only the source identifier and the time it was last served are stored — never how long you looked, whether you opened it, or anything you did next. Nothing is suppressed permanently, the record is not used for advertising or profiling, and it is deleted with your account.
- A star rating you give a recipe you saved is stored with your account and the shared source the recipe came from. Overeasy shows ratings only in aggregate — how many cooks rated a source and, once at least three have, their average — and never shows who rated a recipe or what any one cook gave. You can change or clear a rating at any time. It is not used for advertising or profiling, and it is deleted with your account.
- A report you send about a Discover recipe is stored with your account and the public source it concerns, with one of four reasons you pick and no text of your own. It hides that recipe from your own Discover and Watch, and the developer reads the reports as a count and the reasons per recipe. It is not used for advertising or profiling, and it is deleted with your account.
- Pasted recipe text and correction notes are encrypted at rest and used only to complete or retry the requested import.
- Request IDs, pseudonymous user identifiers, import job IDs, provider stage, duration, result, rate-limit decisions, and error class support security, reliability, and cost control. Logs exclude recipe/private text, authorization tokens, provider credentials, and raw identity tokens.
- Apple Health receives nutrition only after you explicitly export it from the device. The permission Overeasy asks for is write-only: it can add the serving you export and cannot read anything from Health, including data written by other apps. Health data is never used for advertising or marketing, never sold, never shared with a third party, and never leaves the device through Overeasy — the export is a local write from your phone to your own Health store. Timers and local notifications remain on the device.
Service providers
Overeasy shares only data necessary to operate the selected feature:
- A hosting provider, OVHcloud, runs the server in the United States that stores service data and backups.
- Depending on the successful import path, public URLs, captions, audio, pasted text, or correction notes may be processed by acquisition, transcription, search, and AI extraction providers: Supadata, SoScripted, and OpenRouter with the model providers it routes to. They receive no name, email address, or account identifier. Overeasy asks OpenRouter to route model requests only to providers that do not store or train on them.
- Overeasy Kitchen recipes and dish images are generated and reviewed before publication. Browsing or saving them does not call extraction, nutrition, or AI providers, and does not send your data to those providers.
- Apple and Google process authentication when their respective sign-in option is used.
- Videos play in TikTok's, Instagram's, or YouTube's own player inside the app. That platform receives your IP address and device details under its own policy. Overeasy uses YouTube API Services; see the Google Privacy Policy (http://www.google.com/policies/privacy) and the YouTube Terms of Service (https://www.youtube.com/t/terms).
These processors act to provide Overeasy's service. Overeasy does not disclose data to advertising or data-broker services.
Retention
- Pasted text and correction notes: erased within 24 hours after an import reaches a terminal state.
- Completed or failed import jobs: 30 days.
- Provider-attempt and cost records: 90 days.
- Expired or revoked session and refresh-token hashes: seven days.
- Negative extraction caches: until their short expiry; invalid caches and orphaned thumbnails: 30 days before cleanup.
- Recipe sync history, including deleted recipes: 365 days. A device returning after that window receives a fresh authoritative snapshot.
- Discover impression records: 30 days. They stop affecting what you are shown after 24 hours, well before they are erased.
- Pseudonymous account-deletion audit records: 365 days.
- Recipes, star ratings, recipe reports, and account data: while the account exists, unless removed earlier at the user's request.
- Temporary object uploads: one day; noncurrent object versions: 30 days.
Nightly backups are kept on the server for about two weeks and then deleted.
Account deletion
Every guest, Apple, and Google account can be permanently deleted in Profile → Delete account. The operation verifies the current session, revokes Sign in with Apple credentials when applicable, and removes or anonymizes recipes, imports, sessions, devices, identity links, the display name, the provider's profile picture link, any profile photo you uploaded, provider usage, private text, sync history, Discover impression records, star ratings, recipe reports, and unreferenced objects. It is idempotent so a network retry cannot recreate or partially delete the account.
Deletion cannot be undone. Backups are not used to restore an individual deleted account; any residual copy ages out with the backups and stored object versions described above.
Security and changes
Private text is encrypted with authenticated, versioned keys. Traffic uses TLS, access is rate limited, and workers are restricted from private-network and cloud-metadata egress.
Material policy changes will update the effective date and the in-app disclosure.
Your choices, and children
You can edit or delete recipes, change your name and photo, clear ratings, and delete your account in the app. Depending on where you live, you may have further rights over your data; write to the address below. Overeasy is not meant for children under 13.
Contact
Questions about this policy, a privacy request, or anything that went wrong: hello@chetangoel.me. A person reads it. Overeasy is made by Chetan Goel.