Privacy policy

Last updated 30 September 2026

Cauldron is a cooking app: recipes, meal plans, grocery lists, batch cooking and a meal log. This page explains what the hosted service at cauldron.craftingtable.cc keeps about you, why, and how to get it back or delete it. It's written to be read, not to hide things.

Who runs it

Cauldron is run by one person, Devasenan Murugan, in Canada. Devasenan is also the person in charge of protecting personal information, as Québec's privacy law (Law 25) requires. Questions, requests and complaints go to [email protected].

If you use a copy of Cauldron that someone else hosts, they run it, and this policy doesn't cover it.

What's stored

Your Google name and email address. You sign in with Google; Cauldron gets your name, your email and whether Google has checked it. It never sees your Google password, contacts or anything else.
What you add: your recipes (ingredients, steps, notes and photos), your meal plans and meal log (what you ate, when you ate out and the calories you guessed), grocery lists and saved lists, prepped ingredients and what's in your fridge, favorites and folders, foods you added or adjusted, and your settings (calorie goal, theme, catalog view).
Imports: the links you import from, and a record of each import. Files you upload to import (a PDF, a photo, a recipe file) are kept only until the import finishes, then deleted.
Feedback you send from Settings: what you wrote, with the app or website version (on the website, your browser too), and in the app your phone's model and Android version.
Your sign-in session: a random token, stored only as a scrambled hash, with when it expires.
Server logs: the server records requests (IP address, time and address asked for) to help fix problems. They aren't analysed or shared, and they're cleared whenever the server software is updated.

Photos you add to your recipes are stored on the server under long, random addresses. They aren't listed anywhere, but anyone who has a photo's exact address can open it, so don't upload photos you need to keep secret.

Google user data

When you choose "Continue with Google", Google shares three things with Cauldron: your name, your email address and whether Google has verified that address (the basic openid, email andprofile permissions). Cauldron asks for nothing else from your Google account: not your contacts, Gmail, Drive, calendar or photos.

How it's used: your email identifies your account, so your recipes and plans are there each time you sign in, on the website and in the app; your name is shown in the app. Nothing else.
How it's stored: in Cauldron's database on its server, with the rest of your account.
Sharing: Google user data is never sold, never used for ads, and never shared with anyone, except when the law requires it.
Deleting it: deleting your account (Settings → Account) removes your name and email for good. You can also remove Cauldron's access in your Google account settings.

Cauldron's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Imports and Google's Gemini

When you import a recipe, what you import (the link, the web page's text, the PDF, photo or file, or the video) is sent to Google's Gemini API, which reads it and writes the recipe. For web pages and videos the Cauldron server fetches the page first. Google handles what it receives under its Gemini API terms, which allow it to keep the data for a limited time and, depending on the plan, to use it to improve its services. Don't import anything private. Nothing is sent to Gemini unless you start an import.

Cookies and storage

The website sets one cookie, cauldron_session, to keep you signed in. It lasts 30 days, can't be read by scripts on the page (HttpOnly), and is only sent over HTTPS.
The Android app doesn't use a cookie: it keeps a sign-in token in the app's private storage and sends it with each request.
The website remembers your theme (light or dark) in your browser's local storage, so the page doesn't flash the wrong colours while it loads.
The website loads its fonts from Google Fonts and the sign-in button from Google, so your browser contacts Google when you open it. Google's privacy policy covers that.
The starter recipes' photos come from Wikimedia Commons. The server keeps its own copy, but until it has one, your browser loads the photo from Wikimedia.

What Cauldron doesn't do

No ads.
No tracking or analytics: no trackers, no profiles of what you do.
Your data is never sold, rented or shared for marketing.

Your recipes, plans and lists are private to your account. The recipe library everyone sees is written by Cauldron, not by other users. As the administrator, Devasenan can technically reach the database, and only looks at it to keep the service running or when you ask for help.

Where it's hosted

Cauldron runs on its owner's own server, at home in Canada, and your data is stored there. Traffic reaches it through Cloudflare, which protects the connection and may pass it through servers in other countries on the way. Cloudflare sees your IP address, like any network provider, but not what's stored. Google provides sign-in and imports, as described above.

How long it's kept

Everything is kept for as long as you have an account. When you delete your account, it's removed from the live database straight away, along with your photos. Backups of the database may still hold a copy for up to 30 days, until they're replaced.

Get your data, or delete it

Download it: Settings → Account → Download my data gives you a file (JSON) with all of it, on the website and in the app.
Change it: edit or delete anything in the app at any time.
Delete your account: Settings → Account → Delete my account. It removes your account and everything in it, and can't be undone.

You can also ask for any of this by email, or ask what's held about you, at [email protected]. If you're not happy with the answer, you can complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Children

Cauldron isn't meant for children under 14. Don't sign up if you're younger than that.

Changes

If this policy changes, the new version goes here with a new date. Big changes will also be announced in the app before they apply.