Privacy Policy

Information you provide

Account information, including your email address and authentication data needed to sign you in.

Private cooking data you choose to save, such as imported recipes, cook logs, ratings or structured outcome feedback, plate photos, pantry items, food preferences, plans, School progress, and private certificate history.

Messages you send through the contact form, including your name, email address, subject, and message.

Content you submit to AI-assisted features, such as questions, recipe text, or other prompts needed to provide the requested feature.

One account across Chef and Bar

Chef Primera (chef.primerafood.com) and Bar Primera (bar.primerafood.com) share one account. When you sign in on either product, your session is kept in a browser cookie named primera-auth set on the parent domain primerafood.com, which is what lets the other product recognise you without a second sign-in. That cookie holds only your session credentials. It is strictly necessary for sign-in, it is set only after you sign in, and it is not used for advertising, profiling, or cross-site tracking.

Signing out on either product clears the shared session on both. Export and deletion of your account happen on Chef Primera's account page, which is the one place the shared account is managed.

Bar Primera currently keeps no private account data of its own: its Library and School pages are public reference content that work without an account, and a signed-in visit stores nothing beyond the shared session. If Bar Primera starts saving account data, this policy will say what it saves.

Information generated by use

Chef Primera uses first-party product analytics to understand whether the product works and whether people return. A random anonymous device UUID is stored in your browser's local storage and a separate random session UUID is stored for the browser session. Product-event rows can include those identifiers, whether the session was signed in, a normalized route, language, acquisition-source category, event name, and bounded event metadata. These analytics rows do not contain your email address, authenticated user id, raw IP address, private recipe/import text, photos, or diet settings, and are pruned after 90 days.

For abuse and cost controls on current analytics-event, contact, chat, speech, and search-miss endpoints, Chef Primera can store a salted, shortened hash derived from the caller's network address with a daily request count. The raw network address is not stored in that key, and the key is designed to expire after about 24 hours.

For the signed-in recipe-import limit, Chef Primera can separately store a salted, shortened hash derived from the authenticated account identifier with a daily import count. The raw account identifier is not stored in that abuse-control key, and the key is designed to expire after about 24 hours.

When search returns no result, Chef Primera also stores a daily aggregate miss count by language. The search text itself is not persisted in search-miss telemetry.

We do not use third-party advertising trackers, and Chef Primera does not sell personal information to advertisers.

How information is used

To provide account sync, private recipe storage, cook history, School progress, planner and pantry features, support, safety controls, and product reliability.

To operate AI-assisted features and enforce usage or abuse controls where those features have real service cost.

To investigate failures and improve canonical Chef Primera content using aggregate signals. Private notes, photos, imported recipe text, and raw account history are not published into the public recipe catalog.

Service providers

Chef Primera currently uses infrastructure and service providers including Vercel for application hosting and delivery, Supabase for authentication, database, and storage services, Anthropic for supported text-AI features, xAI for supported speech features, Resend when configured for contact-form email delivery and for an internal operator notice when a new account is created (it contains only the account email address, creation time, and language), and Upstash (Vercel KV) for the short-lived abuse-control counters and daily search-miss aggregates described above. Those abuse-control keys use salted hashes rather than raw network addresses or raw account identifiers. Bar Primera runs on the same Vercel hosting and the same Supabase authentication project and currently uses none of the other providers listed here.

These providers process information only as needed to deliver their part of the service and are subject to their own terms and privacy commitments.

When you import a recipe from a link, the Chef Primera server fetches the link you submitted to read its content. For supported video platforms, currently YouTube and TikTok, the server contacts that platform's endpoints to read the video's public details; for any other link, it requests the website you pasted. Those requests come from the server and do not include your account identity.

Private and public boundaries

Canonical recipes, techniques, ingredients, regions, and the Failure Index are public reference content.

Your imported recipes, cook logs, photos, pantry, preferences, plans, and account-specific School history are private account data. Imported recipes are not added to the canonical catalog, sitemap, or public search index.

If you explicitly issue a verifiable School certificate, its verification URL is designed to be shareable. Anyone who has that URL can see a bounded verification record: the certificate scope, distinction, issue date, current validity, curriculum identifier, and limited learned/mastered/total skill counts. Public verification does not expose your email address, account identity, raw cook history, notes, ratings, photos, or revocation reason.

Retention and deletion

Account data is retained while your account remains active unless a shorter operational period applies to a specific telemetry system. First-party product-event rows are limited to a 90-day retention window, and the salted daily network- and account-derived abuse counters are designed to expire after about 24 hours.

Account export and deletion are provided on Chef Primera's account page, which manages the one account shared with Bar Primera. Account deletion is intended to remove user-owned data across the Primera products, subject to limited records that must be retained for security, legal, fraud-prevention, or operational reasons.

You can also ask a privacy question or request help at support@primerafood.com.

Security

Chef Primera uses access controls intended to keep private account data scoped to its owner. No online service can guarantee absolute security, so use a unique credential and contact us if you believe your account or data has been exposed.

Children

Chef Primera and Bar Primera are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Bar Primera describes alcoholic drinks and is intended for adults of legal drinking age where they live.

Changes

If this policy changes materially, the updated version will be posted here with a new effective date.