Cookable
Privacy Policy
Revision date: 2026-09-16
Effective date: 2026-09-16
Applies to: Cookable for Android (Google Play package uz.abumme.cookable), version 1.x
Cookable is published by Islomov Mekhrojbek, an individual, Republic of Uzbekistan ("we", "us"). We decide how the data described here is used. Questions and requests: lazydevscat@gmail.com.
The short version
- No account. Cookable never asks for your name, email address or phone number.
- Your fridge, your weight and your goals never leave this device. Neither do your food diary, body details, targets, allergens, diet choices, meal plans, shopping list or leftovers.
- A few technical things do leave your phone, each for one job: usage events for analytics (Firebase Analytics, by Google), your subscription status (RevenueCat and Google Play) and, if notifications are allowed for Cookable, a push registration for occasional reminders (OneSignal). Section 2 lists exactly what each one receives.
- One thing to know: when you search for a food and Cookable doesn't recognise it, the words you typed are sent with the analytics events, so we can add missing foods.
- No ads, no advertising ID, and we don't sell your data.
- Uninstalling Cookable deletes everything it stored on your phone. There is no cloud copy.
1. How Cookable is built: two zones
The private zone: on your phone, and only there
What's in it
- Your product list (what's at home) and your leftovers
- Your food diary: what you ate, when, the meal, portions, and the calorie and macro estimates
- The body details you can enter for a calorie suggestion: sex, year of birth, height, weight, activity level, goal, pregnancy or breastfeeding status, and your own calorie target if you set one
- Your household size, the basics you always have at home, and your household's allergen and diet choices
- Your meal plans, shopping list, cooking history, and which recipes you opened or hid (used only to order suggestions)
- Your running cook timers and your app settings, including language
Where it lives. In Cookable's private storage on your device.
Who can see it. You. It is never sent to us or to anyone else, and it is never used for analytics.
Backups. Cookable switches off Android backup for all of its data, so none of it is copied to your Google account backup or moved by Android's device-to-device transfer. One consequence: on a new phone, Cookable starts fresh. A Premium subscription can be restored on a new phone (section 2.2); the private zone can't.
Offline. Recipes, matching, calorie counting, meal plans and cook timers all work without an internet connection.
The public zone: not in this version
Cookable 1.x has no public features: no reviews, no shared prices, no profiles and nothing you post. If we ever add them:
- they will be optional and will need a separate account;
- creating an account will never upload anything from your private zone;
- we will update this policy and tell you in the app before they launch.
2. What leaves your device, and why
Cookable uses four outside services. Each receives only what is listed here. All of them see your device's IP address, as any internet connection does.
2.1 Firebase Analytics (Google)
Why: to see which features people use, where food searches fail, whether timers ring on time, and how many people view the Premium page or start a trial.
Events Cookable sends, and everything they contain:
| Event | What it contains |
|---|---|
| Onboarding finished | Nothing else |
| Products added | How many products were added at once |
| Recipe opened; cook mode started | The ID of the recipe in Cookable's own catalog |
| "I cooked this" | The recipe ID and the number of portions |
| "I ate this" | Where the meal came from (a recipe, leftovers, a food, a dish eaten out, or a rough entry) and the meal (breakfast, lunch, dinner or snack). Not what you ate, how much, or its calories |
| A food search found nothing | The text you typed (up to 60 characters) and where you typed it: onboarding, the product list, or quick add |
| Ingredient swap shown, applied or undone | The ID of Cookable's swap rule |
| No swap exists | The ingredient ID and the cooking context |
| Premium page viewed | Which screen opened it |
| Trial started; purchase | For a purchase, the product ID |
| Day plan made | Whether the plan passed its checks, and whether it was the free weekly day |
| Timer started; timer finished; timer rang late | How many timers were running; for a late timer, how many seconds late |
What Firebase records on its own: a random app-instance ID for this installation; device and app details such as device model, operating system version, app version and language; an approximate location (country, region, city) that Google derives from your IP address; when the app was first opened, sessions and time in the app; subscription and purchase events that Google Play reports (product, price, currency); and, if you arrived through a Google Play campaign link, which campaign.
What Cookable turns off: the advertising ID (its permission is removed from the app), ad personalisation, and the Android ID. Only the version of Cookable published on Google Play sends analytics.
Never included: your weight, body details, goals, targets, allergens, diet choices, calorie or macro numbers, diary entries or your product list.
2.2 RevenueCat (RevenueCat, Inc.)
Why: to know whether Premium is unlocked on this phone, to restore it on a new phone, and to count trials and subscriptions.
What it receives: a random, anonymous app-user ID that RevenueCat's software creates on your phone; the details of your Google Play purchases of Cookable (which plan, purchase, renewal and expiry dates, trial status, price and currency, order ID and purchase token); whether the Premium page was shown or closed; and technical details sent with each request, such as operating system version, app version, language and store country.
Never: your name, email address, payment card, or anything from the private zone. Cookable sends RevenueCat no customer attributes and no advertising identifiers.
2.3 Google Play (Google)
Why: to take payment and manage your subscription.
Purchases are made through Google Play, under your Google account and Google's privacy policy. In Google Play's developer tools we see order details such as the order number, the product, dates, price and your country or region. We never receive your payment card details.
2.4 OneSignal (OneSignal, Inc.): reminders
When it runs: only while notifications are allowed for Cookable. On Android 13 and later, that means you allowed them (Cookable asks when you start your first cook timer). On Android 12 and earlier, notifications are allowed unless you turn them off, so OneSignal starts the first time you open Cookable. Cookable never asks for notifications on OneSignal's behalf. If you turn notifications off, OneSignal isn't started the next time Cookable opens.
Why: to send an occasional reminder, for example after a couple of quiet weeks. Before a reminder is shown, Cookable checks its daily limit on your phone and silently drops the reminder if the day's one prompt has already been used. Timers you start never count toward that limit.
What it receives: a push token and OneSignal's IDs for this installation; device details (device model, operating system and app versions, mobile carrier name, network type, and whether the device is rooted); language, time zone and country; whether notifications are allowed; when the app is opened and for how long; whether a reminder arrived or was opened; and crash or freeze reports about OneSignal's own software. To deliver reminders, OneSignal uses Google's Firebase Cloud Messaging, which creates the push token and a Firebase installation ID.
Never: tags, email addresses, phone numbers, location, or anything from the private zone. Reminders can't be based on your diary, weight, goals, allergens or plans, because OneSignal never has them.
2.5 Cook timers
Cook timers don't use any of these services. Their alarms and notifications are created on your phone.
2.6 Emails you send us
If you email us, we receive your email address and what you write, and we use them only to answer you.
Each provider's own privacy policy: Google (https://policies.google.com/privacy), RevenueCat (https://www.revenuecat.com/privacy), OneSignal (https://onesignal.com/privacy_policy).
3. Device permissions
- Notifications: for cook timers (the running-timer notification and the "done" alert) and, while allowed, reminders. On Android 13 and later Cookable asks when you start your first timer.
- Alarms & reminders (exact alarms): so a timer rings on time. You grant it in Android settings; Cookable offers a shortcut the first time you set a timer.
- Foreground service, wake lock and vibration: keep a running timer on time with the screen off, and let a finished timer ring and vibrate even when notifications are off.
- Run at startup: puts running timers back on schedule after the phone restarts. OneSignal also uses it to restore notifications.
- Internet and network state: for subscriptions, analytics and reminders.
- Google Play billing: for buying Premium.
- Push messages and app-icon badges: added by OneSignal's software, to receive reminders and show a count on the app icon in some launchers.
- Google Play install referrer: added by Firebase Analytics, to tell which campaign, if any, led to the install.
Cookable keeps the screen on while you're in cook mode; that needs no permission. Cookable doesn't ask to be exempted from battery optimisation: it can open Android's battery settings page for you, and the choice is yours.
Cookable does not request your location, camera, microphone, contacts, photos, media or files, calendar, phone, health data or advertising ID.
4. What we don't do
- We don't sell your personal information, and we don't share it for cross-context behavioural advertising.
- We don't show ads, and we don't use your data for advertising or marketing profiles.
- We don't use anything from the private zone for analytics, marketing or anything else off your device.
- Cookable doesn't send your data to chatbots or other outside models. Every number it shows is calculated by the app's own code.
5. Children and teens
- Cookable is made for adults. It is not directed at children under 13, and we don't knowingly collect personal information from children under 13.
- If you're under 18, Cookable tracks without targets. It doesn't set calorie goals or deficits for anyone under 18. It works this out from your year of birth alone, so it treats you as under 18 until the January after the year you turn 18.
- If you believe a child under 13 has used Cookable, uninstalling removes everything on the device, and you can contact us about the service data in section 8.
6. Health-related information
Your diary, weight, goals and allergen settings are sensitive. That's why they stay in the private zone and never reach us.
Cookable is a wellness app for everyday cooking and eating. It is not a medical device and does not diagnose, treat, cure, or prevent any medical condition.
All values are estimates (±10–20%). Not medical advice; consult a physician if you have a medical condition.
Filtering is based on typical product composition. Always check labels on packaged foods.
7. How long data is kept
| Where | How long |
|---|---|
| On your phone | Until you delete it (section 8) |
| Firebase Analytics | Event and user-level data: 2 months, then deleted automatically. Totals that aren't tied to an installation (for example, "1,200 recipes opened this week") may be kept longer |
| RevenueCat | While Cookable uses RevenueCat, unless you ask us to delete it (section 8) or the law requires us to keep purchase records longer |
| Google Play | Under Google's policies |
| OneSignal | While Cookable uses OneSignal, unless you ask us to delete it (section 8) |
| Emails to us | As long as needed to answer you and to keep a record of requests, such as deletion requests |
8. Deleting your data
On your phone. Uninstall Cookable, or open Android Settings → Apps → Cookable → Storage → Clear storage. Because nothing is backed up, this is permanent.
With the outside services. Email lazydevscat@gmail.com with the subject "Delete my data". Cookable has no accounts, so we can only find records you can point us to:
- Subscription records (RevenueCat): include the Google Play order number from your receipt email (it starts with "GPA."). We'll delete the RevenueCat record for that purchase. Google Play keeps its own order records under Google's policies.
- Analytics (Firebase) and reminders (OneSignal): Cookable doesn't show the random IDs these services use, so we usually can't find your records. Analytics data expires after 2 months (section 7). To stop new analytics data, uninstall Cookable; to stop reminders and OneSignal, turn off notifications for Cookable.
We'll reply within one month.
Subscriptions. Deleting your data doesn't cancel a subscription. Cancel in Google Play → Payments & subscriptions → Subscriptions.
9. Your rights
Depending on where you live (for example, the EU/EEA, the UK, California and other US states), you may have the right to:
- access the personal data we hold about you, or get a copy of it;
- correct it or delete it;
- object to or restrict how we use it;
- withdraw consent where we rely on consent;
- complain to your local data-protection authority.
California: we don't sell or share personal information as the CCPA/CPRA defines those terms.
To use any of these rights, email lazydevscat@gmail.com. We'll answer within one month. The honest limit: because Cookable doesn't know who you are, some data may be impossible for us to match to you (section 8).
10. Legal bases (EU/EEA and UK)
| Processing | Legal basis |
|---|---|
| Subscriptions (RevenueCat, Google Play) | Performance of a contract: we need it to give you what you bought |
| Analytics (Firebase) | Our legitimate interest in understanding and improving Cookable. The events carry no profile data and no advertising ID. You can object by emailing us |
| Reminders (OneSignal) | Our legitimate interest in sending occasional reminders about the app. You can stop them at any time by turning off notifications for Cookable |
| Answering your emails | Our legitimate interest in answering you, and our legal obligations when you use a data-protection right |
11. International transfers
Google, RevenueCat and OneSignal may process data in the United States and other countries. Where the law requires a safeguard, these transfers rely on the European Commission's Standard Contractual Clauses in each provider's data processing terms. Google and OneSignal are also certified under the EU-U.S. Data Privacy Framework.
12. Security
- The private zone is protected by Android's app sandbox and by your phone's own lock and encryption. Use a screen lock.
- Everything Cookable and these services send is encrypted in transit (HTTPS/TLS).
- No system is perfectly secure. We keep what leaves your phone small, so there is little to protect.
13. Changes to this policy
When we change this policy, we update the effective date at the top. For important changes, such as adding any public feature, we'll tell you in the app before the change takes effect.
14. Contact
Islomov Mekhrojbek (individual) · Republic of Uzbekistan · lazydevscat@gmail.com