Privacy Policy

Last updated: September 23, 2026

Saffra ("the app", "we", "us") is an AI cooking companion built by HyperSage AI Labs LLC. This policy explains what data we collect, how we use it, and the choices you have. It's written in plain English — no dark patterns.

The short version

• We collect only what the app needs to work: your identity (via Sign in with Apple or Google), your cooking profile (equipment, allergies, preferences), your pantry, your conversation history with the chef, and recipes you import or write yourself.
• We use this data solely to operate the app — personalize the chef, remember your pantry, adapt recipes for you. We do not sell it, we do not use it to train models, we do not share it with advertisers.
• Voice commands are transcribed by Apple's speech recognition service, which may process audio on Apple's servers.
• Your conversations with the chef do leave your device: each message, along with a summary of your profile and pantry, goes to our server and on to OpenAI to generate the reply. AI features also process selected photos, imported recipe or receipt text, search words, planning context, and recorded cooking questions as described below. These transfers require your explicit AI data-sharing permission.
• You can delete your account and all associated data at any time.

Your permission for AI features

Version 1.3.2 and later: the separate AI permission controls below are part of this update. Earlier versions can send information when you use their AI features without this separate choice. Until you install the update, avoid AI chat, imports, photo analysis and voice features if you do not want that processing.

Before AI sharing is enabled, Saffra shows a separate disclosure naming HyperSage, OpenAI and Apple, the information each receives, and two choices: Allow AI data sharing or Continue without AI. A safety acknowledgement, a subscription, or an iOS microphone permission does not grant this permission. Existing installations must make this new choice too; older acknowledgements are not carried forward as AI consent.

Without AI sharing, you can browse the recipe catalogue, receive Saffra's deterministic daily picks, manage pantry and shopping lists, save recipes manually and use timers. These account features may still synchronize with HyperSage's servers; they are not all offline storage. AI chat, adaptation, smart imports, AI receipt/photo parsing, semantic recipe search, meal-plan generation, cloud speech and premium voice are blocked until you allow sharing. Demo preview responses are bundled examples and do not send your draft to an AI provider.

You can review or withdraw permission under Settings → Privacy & Data → AI data sharing. Withdrawal blocks new AI requests and cancels active connections, including speech recognition. It does not recall information already received by a service provider or undo processing already started on our server. Signing out resets the device permission; deleting a local permission record is not account or provider-data deletion.

What we collect

Early-access waitlist (closed 26 August 2026)

• Email address — the email typed into the signup form this site ran until 26 August 2026, plus a timestamp and the source label saffra-website. We use it for one thing: to send you a single message when TestFlight opens. We never sell it, we never share it with advertisers, and we never send marketing email beyond the launch notification. You can ask for removal at any time by emailing support@hypersage.ai.

Account (in the app, post-launch)

• Apple or Google user ID (opaque identifier from Sign in with Apple or Sign in with Google) — to log you in.
• Email address — only if Apple or Google passes it to us, and only to contact you about your account. We never send marketing email.

Profile

• Kitchen equipment, dietary restrictions, allergies, likes, dislikes, skill level, cuisine preferences, household size, budget, time constraints, cooking style notes, preferred voice, unit system — collected during onboarding so the chef can tailor its suggestions. You can edit or clear any of these in Profile / Me.

Pantry

• Items you add manually, via barcode scan, via receipt scan, or by photographing a shelf — including names, quantities, expirations, brand, and allergens.
• Receipt scans: OCR runs on your iPhone via Apple's Vision framework. The receipt image stays on your device in this flow; the extracted text, including any names, prices or store details visible on the receipt, is sent through our server to OpenAI for ingredient parsing after AI permission. When you attach a picture to chat or use an image-based recipe import, that chosen image follows the photo-processing route instead.
• Ingredient photos (fridge, counter, or shelf): this one is different. When you photograph a shelf so Saffra can identify what's on it, the image is uploaded to our server and passed to OpenAI's vision model, which returns a list of the foods it thinks it can see. We show you that list to confirm before anything is added to your pantry. We do not persist ingredient-scan images in our application database; they are held for the request. Provider retention and protection terms are separate from this application storage behavior. Chat attachments and image-based recipe imports also send the photos you select to OpenAI. Private cook-journal photos are local unless you explicitly choose to share or export them.

Conversations

• Messages you send to the chef and the chef's replies, so the chef has memory across sessions. Older conversations are periodically summarized and the raw messages are deleted.
• Photos you attach to a chat message — the + button in the Saffra (chat) tab lets you attach up to four photos, from your photo library or the camera, to a message to the chef. Those images are uploaded to our server and passed to OpenAI's vision model along with that message so the chef can answer about them. We do not store them: they are held in memory for the length of that request and then discarded, they are not sent again on later turns, and the saved conversation records only a marker such as [shared 2 photos] in place of the pictures. We do not train our own models on the pictures. OpenAI processing and retention follow its applicable API terms, described below.

Recipes

• Recipes you enter manually, import via URL or image, and adapted versions created for you. AI URL import may send the URL and extracted page text to OpenAI; adaptations send the source recipe, your instructions and relevant cooking profile. Generated images may use the recipe description as an OpenAI image-generation prompt. Manually saving a private recipe and its optional photo does not itself call an AI model; selecting that recipe for a later AI feature can include its details in the AI request.
• Recipes you write yourself — the title, ingredients, steps, an optional family or author credit, and an optional photo. They are private to your account: no other user can see or search them, and they are never used in anyone else's recommendations. Saving one does not send it to OpenAI or any other AI model. Its photo is stored on our server with location and camera details removed, and is shown only to you. If you ask Saffra to adapt one of your recipes, its text is sent to OpenAI like any other recipe she adapts.

Community content (opt-in)

Community sharing is not available in the current version of Saffra, so none of the following is collected today. It describes what would be collected if community sharing becomes available and you opt in.

• Public handle & display name — only if you opt into the Community and pick a handle.
• Cook posts you explicitly share to the community, including the photo you uploaded, the caption you wrote, and which recipe the photo is for. Anyone using the app can see posts whose moderation state is live; your private cook photos (the default) stay on your device and are never uploaded.
• Likes, comments, follows, blocks, reports you create on community content.
• Moderation metadata — for every community post we keep a short record of our automated vision classifier's "food / not food" and "safe / unsafe" decisions, plus the removal reason if a post is taken down. This is used to enforce the rules, not to build a profile of you.
• Notifications — an in-app inbox of likes, comments, and follows you have received. Not sent to you via push in the current version.

Voice

• When you use voice mode, audio is transcribed by Apple's Speech framework. The app does not require on-device recognition, so audio may be sent to Apple's servers. This recognition stream is not sent to HyperSage.
• In Cooking Mode the recorded clip is also sent to our server and forwarded to OpenAI's Whisper for a second transcription. This is not a rare backstop: it runs for every spoken question, because Whisper reads question-length kitchen speech more accurately than Apple's transcript, and it also runs whenever Apple returns nothing or returns something the app cannot parse. A navigation command Apple recognizes cleanly (“next”, “back”) is not sent, and dictation in the chat composer is never sent. Our transcription route does not persist the raw audio after the request. This is not a promise about Apple or OpenAI retention under their applicable terms.
• Text-to-speech uses OpenAI's text-to-speech. Audio is generated on our server and streamed to your device. Audio for publicly available curated recipes is cached (content-addressed) so we don't re-generate the same clip for every user.

Usage

• Per-user counters of chat messages, recipe adaptations, photo scans, voice characters, and Whisper seconds, used to enforce lifetime, monthly and daily limits and for aggregate cost monitoring. Not shared externally.

We do NOT collect

• We do not request location, contacts, calendar or browsing-history access. You may optionally enter dietary/allergy information and nutrition preferences, including goal-estimate inputs such as age, sex, height, weight and activity level. Free text or selected media may contain other information you choose to provide.
• Any analytics that track you across apps or websites.

How we use it

• Operate the app — personalize recommendations, remember your pantry, stream chef responses.
• Safety — enforce rate limits and guard against abuse.
• Community safety — if community sharing becomes available: run an automated vision check ("is this food?" / "is this safe?") on every community photo before it's visible to others, and review user reports so we can remove rule-breaking content quickly.
• Product improvement — only via aggregate metrics (e.g., "how often does the chef call lookup_recipe?"), never with identifiable data.

Third-party services

We share data with these service providers only to the extent needed to run the app:

• Apple — Sign in with Apple, and speech recognition: the audio you speak in voice mode is transcribed by Apple's Speech framework. The app does not require on-device recognition, so audio may be sent to Apple's servers. This recognition stream is not sent to HyperSage.
• Google — Sign in with Google, only if you use it. Governed by Google's privacy policy.
• OpenAI — with your AI permission, depending on the feature: (1) chef messages, selected chat photos, recent conversation history or summaries, cooking profile, pantry, equipment, current recipe/step and tool results; (2) recipe adaptation/import instructions, URL/page text or selected recipe images, recipe descriptions for generated images, and recipe search words for embeddings; (3) receipt text and selected ingredient photos; (4) meal-planning choices and relevant pantry/profile/recipe information; (5) recorded cooking questions for transcription and text requested for premium voice; and (6) selected community photos/captions for automated safety review if community sharing becomes available. Context can include allergies, dietary and nutrition preferences or other personal details you entered. Conversation titling and summarization can process earlier conversation text. OpenAI is the configured AI, embedding, image, transcription and premium-voice provider for the production service reviewed for this release. See OpenAI's business terms and API data controls.
• USDA FoodData Central — ingredient names are sent to look up nutrition information. No personal data.
• Open Food Facts — barcode lookups send just the barcode number. No personal data.
• Google Firebase — holds the email addresses from the closed early-access waitlist until the launch notification is sent.
• Fly.io, Cloudflare R2, Upstash Redis — hosting infrastructure.

Our service providers process information under the terms applicable to their services and our accounts. Application-side deletion or non-storage does not mean a provider retains nothing. We do not sell your information or use your content to train our own models. OpenAI's standard API terms exclude API content from training by default unless customers opt in to sharing. Retention can include safety monitoring, legal requirements and endpoint-specific storage, as explained in the API data controls linked above.

Same or equal protection. OpenAI, Google Firebase and Cloudflare R2 receive only the data they need to provide their part of Saffra, under terms that limit their use of it to providing that service to us (and, for OpenAI, to abuse monitoring and legal compliance) and that require confidentiality and security. We confirm that they protect your data to the same or an equal standard as this policy describes and as Apple’s App Store Review Guidelines require. None of them may sell it or use it for advertising. Fly.io and Upstash host our servers and cache under terms that let them use hosted data only to provide and improve their hosting services; they have no right to sell that data or use it for advertising.

How long we keep it

• Account + profile + pantry — until you delete your account.
• Conversations — individual messages may be auto-summarized and deleted after ~20 turns; summaries persist until you delete the conversation.
• TTS audio cache — generated speech may be cached to avoid generating the same audio repeatedly. Private cache records are associated with the account; publicly curated recipe narration may be shared across users.
• Voice audio sent for transcription — our request handler does not persist the raw recording; third-party retention follows the applicable provider terms.
• Ingredient/shelf photos — not persisted by the ingredient-scan request handler. This does not describe chat attachments, saved recipe photos, community uploads, operating-system temporary files or the provider's separate retention.
• Community posts, photos, comments, likes, follows, blocks, notifications (only if community sharing becomes available; none exist today) — until you delete them individually or delete your account. When you delete your account we hard-delete the photos from object storage and remove the associated rows. Reports you've filed are retained in an anonymized form so we can keep acting on repeat abuse.
• Waitlist email — until launch notification is sent or you ask for removal, whichever is sooner.
• Recipes you write yourself, and their photos — until you delete your account, which deletes them.
• Chat photo attachments — not stored; held only for the length of the request they are sent with, then discarded. The saved conversation keeps a marker such as [shared 2 photos], not the pictures. This describes our application storage; OpenAI retention follows its applicable API terms.

Your choices

• Withdraw AI permission in Settings → Privacy & Data → AI data sharing. Existing saved pantry and recipe data remain available; previous provider transfers cannot be recalled by the switch.
• Edit or delete any profile field in Profile / Me.
• Delete pantry items or conversations any time. Recipes you write yourself and their photos are removed when you delete your account.
• Sign out via Profile / Me.
• Delete your account → from Profile / Me, or by emailing support@hypersage.ai. In-app deletion runs the cascade immediately (photos, posts, comments, likes, follows, blocks, notifications); email requests are processed within 30 days.
• Block another community member, and report a post or comment, from their public profile or the post itself — available if community sharing becomes available. Every report is reviewed, and we always respond to abusive content within 24 hours.
• Turn off premium voice in Settings to use on-device iOS voices only — no text leaves your device to be spoken.

Kids

The app is not directed at children under 13. We don't knowingly collect data from children.

International transfers

Our servers are in the United States. If you're in another country, your data is transferred to the US for processing. We rely on standard contractual clauses where required.

This website

These pages at hypersage.ai/saffra/ are covered by the HyperSage AI Labs website privacy policy: no cookies and no identifiers, only anonymous daily totals of page views and App Store button taps. Nothing the website counts is connected to the app.

Changes

If we update this policy, we'll note the new date above and flag material changes in-app.

Contact

• Email: support@hypersage.ai
• For early-access list questions: support@hypersage.ai