Privacy policy.

Effective September 12, 2026. PlateHerder is a product of Loop & Pixel LLC.

PlateHerder gathers cooking ingredients and steps from a link or text you provide. Imports belong to your private library. Always check the original source when a detail is missing or unclear.

Creators stay in the picture

We link to the original page and attribute YouTube creators. Videos play through YouTube’s embed. We do not download video or audio, or keep website photos and personal stories.

Public plates are your choice

Original plates are private unless you explicitly publish them. Publishing shares your chosen author name, ingredients, steps, servings and nutrition, but never your private notes or tags. Others may save a private copy with attribution. You can unpublish at any time; copies already saved by others remain in their libraries. Imported sources are not automatically published.

Sharing a plate by link

You can create an unlisted link for a single plate. Anyone with that link can view the shared version, but it is not listed in Discover or the community collection. Original plates share recipe content, photos and nutrition; imported recipes share their original source and creator attribution. Private notes, tags, collections and household details are excluded. Edits are shared only when you update the shared version. Stop sharing disables the link; private copies already saved by recipients remain theirs.

Your library stays private

Google sign-in provides your account identifier, email and basic profile information to identify your account. Guests receive an anonymous sign-in identifier. We store the plates, tags, notes, shopping choices and household information you choose to add so these features can work across visits. Your personal library is not a public search index.

Saved plates are accessible through your account, app connections you approve, and tokens you explicitly create. Unsaved drafts and private extraction caches expire after 24 hours. Expired drafts become inaccessible immediately; database cleanup runs asynchronously. You can delete saved plates and revoke app tokens from your account.

Apps you connect

When you connect an app such as Open Workout System, PlateHerder shows its requested permissions before you approve. Read access includes your plates, nutrition, notes, tags and source details. Other permissions allow saving, editing or deleting plates and starting extractions. Your Google credentials, private YouTube lists, household profiles and shopping lists are not included.

We store the approved app, permissions and connection records for up to one year. Short-lived access tokens and rotating refresh tokens support continuing access; we store token hashes, not reusable token values. Used refresh-token records remain until the connection expires to detect misuse. You can disconnect an app at any time to stop future access. Disconnecting does not delete your plates or data the other app already stored, such as meal history. Review that app’s privacy policy and deletion controls.

What gets processed

Connecting YouTube is optional and requests read-only access through Google. We list your playlists and, if selected, liked videos to help you find cooking sources. Nothing is extracted until you choose a video. With a persistent connection, Google access and refresh tokens are stored privately on our server so access can renew automatically. These tokens are never exposed to other users or stored in browser storage. Older session-only connections keep short-lived access in browser memory until you reconnect using the persistent flow.

Your selected playlist IDs are remembered as private preferences. Playlist titles, creator names, thumbnails and video previews are cached privately for up to 24 hours. Expired previews are inaccessible and queued for database cleanup. Disconnect and clear list previews removes stored Google credentials, these choices and previews without changing anything on YouTube or deleting plates you already saved. You can also revoke access in your Google account connections. YouTube features use the YouTube API Services and are subject to the YouTube Terms of Service and Google Privacy Policy.

If you create or join a household, its members can see the plan, shared shopping list, names and food profiles. Only owners manage access; owners and planners can edit meals and profiles. Adding a YouTube or pasted plate to the plan shares a snapshot of its cooking details, without your personal notes. Website plates share only the title and source link. Shared snapshots remain until removed from the household plan, even if the original personal plate is edited or deleted.

Household dinner-idea searches send the selected restrictions, preferences and dislikes to our AI search provider when you request suggestions. Profile names are omitted. Suggestions and ingredient checks do not verify dietary suitability. Household access requires sign-in; invitations are email-bound, revocable and expire after seven days. Members can leave, and owners can remove profiles or delete a household after removing other connected accounts.

Firebase handles sign-in and stores your library. Vercel serves the app. Google’s Gemini API may process pasted text, cooking page text, or public YouTube URLs to extract cooking details. Avoid pasting sensitive personal information. We keep a hashed daily quota identifier to limit abuse.

PlateHerder shares, transfers or discloses Google user data to the following recipients when needed to provide the features you use:

Google Firebase and Google Cloud. These service providers process your Google account identifier, email and basic profile for sign-in, and store account-linked data on our behalf. This includes Google access and refresh tokens for a persistent YouTube connection, selected playlist IDs, and cached playlist and video metadata. Our backend uses these services to authenticate requests, store your private library and run recipe extraction.
Vercel. Our hosting provider serves PlateHerder and runs its web API. Requests handled by that API can include your sign-in identifier and authentication token, the Google authorization code used to connect YouTube, and playlist or video metadata returned to you. Server-side requests also process Google access and refresh tokens to retrieve the YouTube information you requested. Vercel processes connection information such as IP addresses and request details to operate and protect the service.
Google OAuth and YouTube API Services. We send authorization codes and refresh tokens to Google's authorization service to obtain or renew access. We send access tokens and the relevant account, playlist or video identifiers to Google APIs to verify the connected account and retrieve your selected lists and video information.
Google's Gemini API. When you choose a public YouTube video to import, we send its public URL and public source details, such as its title, creator and description, to Gemini to extract cooking information. Recipe ingredient text may also be processed to match foods for nutrition estimates. During extraction, when you open a saved recipe with missing details, or when you click Calculate nutrition, if known amounts or cooking times are insufficient, we send the saved recipe title, ingredients, quantities, servings and cooking steps to Gemini for rough nutrition and cooking-time estimates with disclosed assumptions. Private notes and tags are omitted. We do not send your Google authorization tokens, Google sign-in profile, private playlist collections or liked-video collections to Gemini. Browsing your lists alone does not send them to Gemini.
Apps you explicitly authorize. An app with your approved PlateHerder library read access, such as Open Workout System, can receive source metadata saved with your plates, including YouTube video IDs, titles, creator names, source links and thumbnail URLs, together with the recipe information described above. We do not give these apps your Google authorization tokens, private playlist membership or liked-video collections. You control these connections from the Connections page.
People you choose to share with. When you share a plate through a household plan or opt into household library sharing, members of that household can see the source details included with the shared plate, such as its YouTube title, creator and source link. This does not give them access to your Google authorization tokens or private YouTube lists. Your Google connection does not make those lists public.

We may also disclose Google user data when required by applicable law or a valid legal process. We do not sell Google user data, share it with data brokers, or transfer it for advertising purposes. Google user data is used and transferred only as permitted by the Google API Services User Data Policy, including its Limited Use requirements.

How we protect your data

We use technical controls to protect personal information and sensitive Google account data, including private YouTube playlist information and authorization tokens:

Encryption in transit. Our production website uses HTTPS/TLS to protect information sent between your browser and PlateHerder. Our server communicates with Google authentication and YouTube APIs over HTTPS and uses encrypted connections to Cloud Firestore.
Encryption at rest. Account data, private playlist selections and cached previews stored in Cloud Firestore are protected by Google's managed encryption at rest. This protection also applies to Google access and refresh tokens stored for persistent YouTube connections.
Account access controls. Our server verifies sign-in credentials and checks account ownership or household permissions before providing private data. Direct database reads and writes from browser clients are denied by our Firestore security rules. Database access by our backend uses server credentials.
Credential protection. PlateHerder does not receive or store your Google password. Persistent YouTube authorization tokens are stored in account-specific records accessed by our backend and are not returned to the browser or shared with other users or connected apps. Server secrets are kept in server-side configuration. For older session-only connections, the short-lived Google access token is held in browser memory, not local storage. Private YouTube API responses use cache-control instructions that prevent browser and shared-cache storage.
Limited retention and user control. Private playlist previews expire after 24 hours and become inaccessible while database cleanup runs. The in-app Disconnect and clear list previews action removes stored YouTube tokens, playlist selections and previews. Saved plates remain until you delete them. You can also revoke Google's permission through your Google account connections and request account-data deletion using the contact details below.

Browser storage and third-party content

We keep daily aggregate counts of Discover results delivered, accepted saves, extraction outcomes and whether nutrition could be calculated. These records contain public video IDs and counts, without account identifiers, private recipes, search text or Google tokens. They help us improve recommendations and imports and are scheduled for deletion after approximately 30 days. Delivered results are not a record of videos you watched.

Discover remembers a small set of recently shown public YouTube video IDs in your browser tab's session storage. We use IDs from the past hour when you refresh recommendations to put different videos first; older IDs are ignored. This does not access your YouTube viewing history.

When you choose Not for me in Discover, we store that video or creator ID with your account so it stays out of your suggestions; Undo removes it. When you follow a creator, we store their public YouTube channel ID, name and profile photo link with your account until you unfollow. To suggest new videos and creators, we look up the public creators of YouTube videos in your saved plates and keep those suggestions with your account for up to six hours. To group Your plates by creator, we remember which public channel each saved video came from for up to 30 days.

Firebase uses browser storage to keep your sign-in session. The installable app caches public assets for its offline screen; it does not cache your private API responses there. Our hosting and authentication providers process connection information, such as IP addresses and request details, to deliver and protect the service.

YouTube supplies embedded players and thumbnail images. Loading this content connects your device to Google, which may collect device and playback information and use cookies or similar storage under its privacy policy. YouTube controls any advertising within its player. PlateHerder does not sell your personal information or use your Google account data for advertising.

How we limit use of Google data

We use connected Google account data to provide the features you request. We follow the Google API Services User Data Policy, including its Limited Use requirements. We do not use your private playlist data to train general-purpose AI models. Playlist browsing does not send your private lists to Gemini; choosing a public video to import is a separate action.

Deletion and privacy requests

Delete saved plates from Your plates and clear YouTube selections with Disconnect and clear list previews. Revoking access at Google stops future authorized access; use the in-app disconnect action as well to clear stored selections. Sign-out alone does not delete data. Saved account data remains until removed; temporary previews follow the expiry periods above.

To request account deletion, removal of associated data, or help with a privacy question, email aaron.willey@gmail.com from the address used for your account. We may ask you to verify ownership before processing a request. Never send a password or access token. Household snapshots shared earlier must also be removed from the household; mention these in your request so we can help.

Add household profiles only for people whose information you are authorized to manage. Food restrictions can be sensitive: use only the details needed for meal planning, and remember that other household members can see them.

Source removal

If you own a source and want it excluded, contact us with its URL. We honor creator requests by blocking new imports and removing extraction caches.

Updates

We will update this page and its effective date when our practices change. If a change requires additional permission, we will request it before using data for that purpose.