Last updated: 19 October 2026
This policy explains what Crave It collects, why, who else sees it, and what you can do about it. It describes the app as it actually works. If anything here does not match what the app does, that is a defect and we want to hear about it: privacy@getcraveit.app.
Crave It is operated by Stryker Capital LLC, 7995 Blue Diamond Rd #102-119, Las Vegas, NV 89113, United States. For data protection purposes we are the controller of the personal data described below.
---
---
Your email address, and a password if you signed up with one. If you sign in with Google or Apple we receive the identifier and email address that provider gives us — with Apple that may be a private relay address, which works fine.
Your display name, handle, biography and avatar, and the date you joined. This is visible to anyone using the app, which is the point of it.
The allergies and dietary restrictions you enter. We treat this as health information, which in the EEA and the UK is special-category data, and some dietary choices also imply a religious belief. We collect it for one reason: so that recipes and suggestions exclude things that would harm you or that you do not eat.
Where it goes:
It is not shown on your profile, not visible to other users, and not used for anything else. You can leave those fields empty — the AI features still work, they simply will not know what to avoid.
Recipes you write, photos you upload, captions, comments, collections, meal plans, grocery lists and reviews. Recipes and public posts are public. Collections, meal plans and grocery lists are yours.
Who you follow and who follows you, what you liked or saved, direct messages you send and receive, who you have blocked, and reports you file.
When something breaks, the app sends us the error, its stack trace, the page it happened on, your browser's user-agent string and the IP address the report came from. We use this only to find and fix faults.
We also record a short list of product events so we can tell whether the app works: that an account was created, that a recipe was saved, that a post was made, that a link was shared, that a meal plan was applied, that ingredients were added to a list, that a recipe was printed. Each is stored with your user id, the time, the screen it happened on and a small number — how many items were added, for example. Never the content: not a recipe title, not a message, not an ingredient list. These are our own logs on our own servers, not a third-party analytics product, and they are kept for the same short period as the error logs below.
When somebody taps a creator's invite link we add one to a counter for that creator: which creator, which platform the tap came from, and when. No IP address, no user-agent string, and nothing that identifies the person tapping — it is a tally, not a record of you, and it is never joined to your account. An earlier version of this feature paired a tap with an app install using the device's address and browser signature; that is fingerprinting, we said here that we do not do it, and so it was removed rather than disclosed.
If you turn on notifications we store a push token for that device. Nobody can read it back, including you, and it is deleted when you turn notifications off.
No advertising cookies, no tracking pixels, no fingerprinting, no session recording, and no third-party analytics product — the product events described above are our own logs, and no analytics company receives anything about you. We do not collect your precise location, your contacts, or anything else from your device beyond what is described above.
---
For anyone in the EEA or the UK, the legal bases are:
We do not use your content or your data to send you marketing. The only email we send is transactional: password resets, email verification and security notices.
---
ChefyAI, recipe generation, the meal planner, the caption helper and the pantry and dish scans are built on Google's Gemini API. When you use one, we send Google:
We do not send Google your email address, your handle, your password, your direct messages, or any identifier that tells them who you are.
Two things worth being clear about:
---
A small number of providers run the service. We do not sell personal information to anyone, and we do not share it for cross-context behavioural advertising.
Other users see what you make public: your profile, your recipes, your public posts and your comments. A post set to followers-only or private is enforced by database rules, not merely hidden in the app.
We may disclose information where we are legally required to, or where we believe in good faith that it is necessary to prevent serious harm — and we will tell you unless we are prohibited from doing so.
---
We never see your card. We do not receive, store or have any access to your card number, and nobody at Crave It can. Payment is handled entirely by the store you bought through:
What we hold is the outcome, not the payment: whether your account is currently entitled to Pro, which store it came from, the product you bought and when the current period ends. That is one small record against your user id.
We also count your use of the AI features each month, so that the free allowance can be enforced and so you can see how much of it is left. It is a count, not a copy — we do not keep the prompts in order to do it.
If somebody invited you, we store the user id of whoever invited you and a record of any reward it earned them. We do not tell them anything else about you, and they cannot see your account, your email or whether you are still subscribed.
Billing records outlive your account. Tax and accounting law requires us, and the stores, to keep records of a sale for a number of years. If you delete your account, the record that a payment happened is retained for that period even though your profile is gone. This is the one category of data that an erasure request cannot remove, and we would rather say so than imply otherwise.
---
Our database, file storage and servers are in the United States (Google Cloud, us-central1). If you are in the EEA or the UK, using Crave It means your data is transferred there. Those transfers rely on the Standard Contractual Clauses in Google Cloud's data processing terms.
---
We keep your account data for as long as your account exists. Beyond that:
---
Settings, or write to privacy@getcraveit.app. There is also a public page at /delete-my-data that explains it, readable without signing in.
Deleting removes your profile, your handle, your preferences (including your allergies and dietary information), your push tokens, your block list, your posts, your comments, your photos, your collections and everything in them, your meal plans, your reviews, your notifications, your follows in both directions, your direct messages and their contents, and your login itself. It is not a flag on a record; the data goes.
Two honest exceptions:
---
Wherever you live, you can ask us to show you what we hold, correct it, or delete it. Write to privacy@getcraveit.app and we will answer within 30 days.
In the EEA or the UK you also have the right to restrict or object to processing, to receive your data in a portable form, to withdraw consent at any time, and to complain to your data protection authority. You do not have to come to us first, though we would rather have the chance to fix it.
In California you have the right to know what we collect and why, to have it deleted or corrected, and not to be treated differently for asking. We do not sell or share personal information, so there is nothing to opt out of. We do not use or disclose sensitive personal information — which is what your allergy information is — for any purpose other than providing the app.
We will never require an account or a payment to exercise a right, and we will not refuse a request because you made one before.
---
Crave It is not for children. You must be at least 13, and at least 16 if you are in a country whose law sets the age of digital consent at 16. We do not knowingly collect anything from a child below that age; if we learn that we have, we delete the account and its content. If you believe a child is using the app, tell us at privacy@getcraveit.app.
---
Access is enforced by database rules rather than by the app alone, so a private post or a direct message is unreadable to anyone it is not for, whatever a client asks for. Traffic is encrypted in transit. Push tokens are write-only. Administrative access is limited to a named allowlist.
No service is perfectly secure, and we would rather say so than imply otherwise. If you find a vulnerability, please tell us at privacy@getcraveit.app before telling anyone else and we will work with you.
---
We use no advertising or analytics cookies. The app keeps a few things in your browser because it cannot work otherwise: your sign-in session, your theme choice, and your grocery lists, which live on your device rather than on our servers. Clearing your browser storage signs you out and removes those local lists.
---
If we change this policy in a way that materially affects you, we will say so in the app before it takes effect. The date at the top always reflects the current version.
---
Stryker Capital LLC
7995 Blue Diamond Rd #102-119, Las Vegas, NV 89113, United States
privacy@getcraveit.app