Last updated: July 20, 2026
This Privacy Policy explains how the Cookito mobile application and related services ("Cookito", the "app", "we", "us") collect, use, and protect your information. Cookito helps you track the food in your kitchen and discover recipes.
By using Cookito, you agree to the practices described here. If you do not agree, please do not use the app.
Cookito is operated by Tomás Lopes, based in Portugal. For any privacy question or request, contact us at cookito@tomaslopes.dev. For users in the European Union, we act as the "data controller" for the personal data described below.
Scanning is the heart of Cookito. When you take a scan, the photo is transmitted to an automated image-recognition model that returns a list of likely ingredients, which you then confirm or correct. We use these photos to generate your scan results and to operate and troubleshoot the feature. We do not sell your photos, and we do not use them to identify you personally.
Cookito depends on trusted third parties to function. Each processes only the data needed for its role, under its own privacy terms:
We are not responsible for the independent practices of these providers; we encourage you to review their privacy policies.
We do not sell your personal data. We share information only: with the service providers listed above so they can perform their functions; where required by law or to respond to lawful requests; to protect our rights, users, or the security of the service; or in connection with a business transfer (such as a merger or acquisition), in which case we will notify you.
Where the GDPR applies, we process your data on these bases: performance of a contract (to provide the app you asked for), legitimate interests (to secure, maintain, and improve the service and prevent abuse), consent (for example, camera access, which you can withdraw in your device settings), and legal obligation where applicable.
We keep your account and kitchen data for as long as your account is active. Scan photos are retained only as long as needed to provide and troubleshoot the feature and are not kept longer than necessary for that purpose. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain records to comply with legal, accounting, or security obligations.
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email cookito@tomaslopes.dev and we will respond within the time required by law. EU/EEA users also have the right to lodge a complaint with their local data-protection authority.
We use reasonable technical and organizational measures to protect your data, including encrypted connections and access controls at our providers. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
Cookito is not intended for anyone under 16, or the minimum age of digital consent in your country. We do not knowingly collect personal data from children below that age. If you believe a child has provided us data, contact us and we will delete it.
Your data may be processed on servers, or by providers, located outside your country, including outside the EU/EEA. Where that happens, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to protect your data.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you in the app. Continued use of Cookito after changes take effect means you accept the updated policy.
Questions about this Privacy Policy or your data? Reach us at cookito@tomaslopes.dev.