Your information
Privacy
Last updated 9 September 2026
Who we are
Dish Dice is a small, independent project. We are the data controller for the personal information described here.
Contact us about anything on this page at hello@dishdice.app. It is a real address and a person reads it.
What we collect, and why
We collect as little as we can. There is no advertising, no analytics, no tracking, and nothing is sold or shared for marketing.
| What | Why | Legal basis |
|---|---|---|
| Your email address | To create your account, sign you in, send you a password reset, and tell you about things that affect your account | Performance of a contract |
| Your password | To sign you in. Stored only as a scrypt hash — we never hold the password itself and cannot recover it | Performance of a contract |
| What you put in the app: recipes, restaurants, ingredients, meal plans, shopping lists, and any photos you upload | To provide the service | Performance of a contract |
| A one-way hash of your IP address, and your email address, when you sign up, sign in, or ask for a password reset | To limit how often those can be attempted, so accounts cannot be guessed at and the form cannot be used to send mail to strangers | Our legitimate interest in keeping the service secure |
| A session token in a cookie | To keep you signed in | Performance of a contract |
| If you send us feedback from Settings: what you wrote, your email address, and a few details about your device (which screen you were on, your screen size, your browser) | To read it, understand what you were looking at, and reply to you. A copy is emailed to us, so it also sits in our mailbox | Our legitimate interest in improving the app and answering you |
We do not collect payment details, because Dish Dice is free. We do not collect your location, contacts, or anything from your device beyond what is listed above. Nothing about your device is collected unless you send feedback, and then only the three details named in the table.
Cookies
Dish Dice sets one cookie, dishdice_session. It keeps you signed in, lasts 90 days, and is removed when you sign out. It is strictly necessary for the service to work, so we do not ask for consent to it and there is no cookie banner.
We use Cloudflare Turnstile on the signup form to tell people from bots. It runs a check in your browser and may store data there to do so; it is configured without a Cloudflare clearance cookie. Cloudflare describes how it works in its Turnstile documentation.
We use no analytics or advertising cookies of any kind.
Who else handles your information
We use a small number of providers to run the service. They process data on our instructions only.
| Provider | What they do | Where |
|---|---|---|
| Cloudflare | Runs the app, stores your uploaded photos, sends our emails, forwards replies, provides the signup bot check, and generates the dish pictures on AI meal ideas | Global network |
| Neon | Hosts the database holding your account and everything you create | Amazon Web Services, us-east-1 (United States) |
| Anthropic | Powers the optional AI features. See below for exactly what is sent | United States |
| Replies you send to hello@dishdice.app arrive in a Gmail inbox | United States |
Your information is therefore stored and processed in the United States. Those transfers rely on the providers' standard data protection terms, which include the safeguards required for international transfers.
The AI features, specifically
Some optional features send data to an AI provider to generate a suggestion. Three go to Anthropic:
- Naming a dish from a photo sends the photograph you took.
- Suggesting ingredientssends the recipe's title, and its photo if it has one.
- “Inspire me” sends the titles of meals already in your library.
One goes to Cloudflare, on their Workers AI service:
- The picture on an AI meal ideasends the suggested dish's title and up to six of its ingredient names, so a photograph of that dish can be generated. Nothing of yours is sent: the title and ingredients are ones the AI has just invented, not anything from your library.
Pictures generated this way are labelled AI image when shown as the main dish photo, and the file itself carries a standard machine-readable tag saying it was generated by AI. You can replace one with your own photograph at any time.
Your email address and account details are never sent. If you would rather this did not happen, simply do not use those features — the rest of the app works without them.
AI suggestions can be wrong. They are a starting point, not a source of truth, and in particular they are not reliable about allergens, dietary requirements or food safety. Please read the house rules.
How long we keep things
- Your account and everything in it: until you delete it.
- Sign-in sessions: 90 days, refreshed while you keep using the app, and removed immediately when you sign out.
- An unfinished signup: 24 hours, then it is deleted automatically.
- A password reset link: 1 hour.
- The security records described above (hashed IP and email): removed after 24 hours.
- Feedback you send us: kept while it is useful, and deleted along with everything else if you delete your account. The copy that reaches our mailbox is deleted when we clear it out, which is not automatic.
When you delete your account we remove everything: your login, everything you created, and every photo you uploaded. It happens straight away and cannot be undone. The two things that remain are our shared list of which supermarket aisle common ingredients belong in, which contains no information about you, is not linked to any account, and does not record who contributed to it; and any feedback you emailed us, which sits in our mailbox like any other email you might send someone. Tell us and we will delete that too.
Your rights
You have the right to ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form.
You can act on two of those yourself, immediately: change your password and delete your account and everything in it from Settings. For anything else, email hello@dishdice.app.
Complaints
If you are unhappy with how we have handled your information, please tell us at hello@dishdice.app. You can complain in any way that suits you — you do not have to use a particular form.
We will acknowledge your complaint within 30 days, look into it, keep you updated while we do, and tell you the outcome without undue delay.
Children
Dish Dice accounts are for adults. You must be 18 or over to create one. The app is meant to be used by a whole household, but the account belongs to an adult and we do not knowingly collect information about children. If you believe a child has created an account, email us and we will remove it.
Changes
If we change this policy we will update the date at the top, and if the change matters we will email you about it.
Questions about any of this? hello@dishdice.app.