Privacy notice

Version 1.8. Effective from 26 October 2026.

At a glance

• We hold your account, what you ask us to cook, what you save, and what you cook and rate.
• Allergies, diet and targets need your consent. Withdraw it in Account, and we delete them.
• Recipes are written by AI. The models never get your name or email, and they do not keep or train on your requests.
• We do not sell your data. A crowd score is a total from at least 10 cooks, never with your name.
• Download your data, or delete your account, in Account.

A private beta for adults aged 18 or over, in the places in section 9.

1. Who is responsible

Kudakwashe Mutasa, trading as Dishcourse, decides how your data is used. Email: headchef@dishcourse.net. There is no separate data protection officer. Where a country in section 9 requires one, it is Kudakwashe Mutasa, at that address. If Dishcourse becomes a company, we will name it here and tell you first.

2. What we collect

Your account. Email, a password stored only as a hash we cannot read, the name you want to be called, when you joined, and which invite you used.

How you found us. The invite or referral link, any campaign tag, and the name of the site that sent you. Recorded once, when the account is made. No cookie.

Your kitchen. Ingredients you pick, cravings and notes you type, weekly shop answers, staples, saved recipes and ideas, food shops, plans, prices, how far you got in a recipe, whether you cooked it, and how you rated it.

We log each request. The words you typed in a craving leave that log after 30 days. The ingredients, cuisines and moods we took from them stay.

Allergies, diet and targets. Allergies, foods you avoid, and your diet. Calorie and protein targets saved before October 2026 are in this group. Budget, and how many people you cook for, are ordinary settings. We do not ask for weight, height, age or sex.

Use of the kitchen. For each recipe or plan: the kind of request, the model, its size and its cost. No recipe text. We also count which ingredients Your Taste Map showed you each day, so it cannot be copied out.

For each request, what it came to: served, refused and why, failed and at which step, or left before it finished. With it, how long it took, how many tries it needed, whether a phone, a tablet or a computer sent it, and how many suggestions your allergies and foods you avoid took out. A number, never which foods. We use it to find faults, and a rule that hides more than you meant.

What you tell us. If you tell us something was wrong with a recipe, an order or a week, we keep the reason you picked. A note in your own words is optional and deleted after 30 days. The reason beside a low rating is kept with the rating.

Technical. Your IP address and browser type reach our host with every request. We use the address, or a scrambled form of it, briefly to limit abuse.

We do not buy data about you.

3. Why, and the legal basis

You can object to legitimate interests at any time (section 11). An email, a password and a name are required. Everything else is optional. Without allergies or a diet, Dishcourse still works, and it cannot filter for them.

4. Allergies, diet and targets

Allergies, and calorie or protein targets, can be information about your health. A diet such as halal or kosher can say something about your beliefs.

We store and use them only with your consent, asked when you first enter them. If they were already stored, we ask before your next order, and delete them if you say no. You can refuse and still use the rest of Dishcourse.

Withdrawing consent in Account deletes them at once. Saved recipes stay until you delete them. They never go into crowd scores, and other cooks never see them.

The allergy check is a help, not a guarantee. Read the allergen notice in our terms of use.

5. The AI kitchen

Recipes, ideas and plans are written by AI models. We send the model what you asked for, constraints such as time and servings, and, with your consent, your diet, allergies, foods you avoid and targets.

We never send your name, email or account number. Do not put personal details in the craving box.

We only use hosts that keep no copy of your request and do not train on it. That limit is fixed in the code.

Shared recipes. The same request, word for word and setting for setting, may return a recipe already written for someone else. It carries no name or account. A typed craving or note is never shared, and neither is the experimental card.

Suggestions for you. From what you cook and rate, we work out your taste each time you ask, and use it to suggest a dish and to show your palate in Account. It is not stored, sold or shared. Your ratings are what we keep. Counts of ingredients, cuisines and moods are kept with no account attached. The sentence you type is not part of that count. This only picks recipe ideas. We do not make decisions about you by automated means that have a legal or similarly significant effect.

6. Crowd scores

A rating can count towards a crowd score, such as "rated 4.3 by 12 cooks", once at least 10 cooks have rated that pairing. It is a total and an average. It never shows who rated.

Email headchef@dishcourse.net while you have an account and we will take your ratings out. If you delete the account first, they stay, with nothing that links them to you, and we cannot find them afterwards.

7. Who else handles it

We do not sell your data, and we do not use it for advertising. Each company below acts on our instructions, under a data processing agreement, except Vercel during the beta. Dishcourse is a hobby project during the beta, so the site runs on Vercel's free plan, which Vercel's agreement does not cover. When the beta ends we move to Vercel's paid plan and its agreement.

We also share data if the law requires it. If Dishcourse is sold, your data passes with it under this notice, and we tell you first.

8. Analytics and storage on your device

The list is in the cookies and storage notice.

• A cookie keeps you signed in. The browser keeps drafts and preferences so the app works. Signing out clears what is yours.
• We count visits and page speed without cookies and without identifying you. Turn this off in the cookies notice, or in Account.
• Product analytics run only if you allow them. We record which parts you use and a view of the session, with what you type hidden. An AI service, Google in the United States, may review that view to help us find problems. Turn this off in Account.

9. Where it goes

Your account is stored in London, and our servers run in London. Some providers are in the United States, so some data is processed there.

• Where a US provider is on the UK Extension to the EU-US Data Privacy Framework, we rely on that.
• Otherwise we rely on the UK International Data Transfer Addendum in our contract with that provider. OpenRouter's contract includes it.
• Germany and Ireland are covered by UK adequacy regulations.

Ask headchef@dishcourse.net for a copy of the safeguards.

Where the beta is offered. Adults in the United Kingdom; Australia, Canada, Hong Kong, Israel, Kenya, Mexico, New Zealand, Singapore, South Korea and Switzerland; and the United States, except Washington and Nevada. Not elsewhere yet, including the European Union. We do not check where you live. We follow UK data protection law. Where the law where you live gives you more, you get that too.

• Kenya. We have not confirmed we meet the extra rules on health information. If you live in Kenya, do not enter allergies, diet or targets. Check every recipe yourself.
• Canada. If you live in Quebec, we assessed storing your data outside Quebec before we did it.
• United States. We do not sell your data or use it for targeted advertising. We do not answer "Do Not Track", because we do not follow you across other websites. In a state with a privacy law you have the rights in section 11, including an appeal if we refuse a request. Washington and Nevada are excluded because of their consumer health data laws.
• South Korea, Singapore and Switzerland. Section 7 is the full list of who handles your data, and where.

10. How long

11. Your rights

You can see your data and get a copy, correct it, delete it, restrict it while a concern is looked at, object to legitimate interests, take it with you in a file a computer can read, and withdraw consent as easily as you gave it.

In Account you can download your data and delete your account. Deleting removes the account at once. Ratings stay in crowd scores, unlinked (section 6). The acceptance record is kept for the period in section 10. The analytics and food-and-body switches are there too.

Anything else: headchef@dishcourse.net. We answer within one month. We may ask you to confirm from your account email. It is free. If we refuse, we say why, and you can ask us to look again by replying. Section 12 is where to complain. In a US state with a privacy law, that includes the state attorney general.

12. If you are unhappy

Tell us first, at /privacy/complaint or headchef@dishcourse.net. We acknowledge a complaint within 30 days and tell you what we find.

You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, or 0303 123 1113. Outside the UK, you can complain to the regulator where you live.

13. Children

You must be 18 or over. We do not knowingly keep data from anyone younger. Tell us if a child has an account and we will delete it.

14. Changes

If we change how we use your data, we update this notice, change the version, and tell you in the app or by email before it takes effect. Earlier versions are available if you ask.