Data and privacy

Last updated: 2026-07-17

Your recipes, pantry, shopping list, and cooking history stay inside your kitchen. This page covers the one narrow exception: an aggregate signal about ingredient names that the operator uses to grow the shared ingredient catalog.

What stays in your kitchen

The operator can’t read these through the admin console:

Your recipes and their text, tags, or categories
Your menu, meal plan, or scheduled cooks
Your pantry contents and overrides
Your shopping list, custom items, and aisles
Your cooking history
Who in your kitchen typed what, or when

What the operator sees

When you type an ingredient name that isn’t in the shared catalog yet, Mirepoix saves it as a pending discovery in your kitchen. The operator’s admin view collects those pending names across every kitchen and shows two things per name:

The ingredient name itself
A count of how many kitchens have seen it

The view leaves out anything that could tie a name back to you:

No kitchen identity, name, or slug
No user identity
No recipe, quick bite, or pantry entry it came from
No name that appears in fewer than three kitchens

That last threshold is a floor, not a setting. A name has to show up in at least three separate kitchens before it’s visible to the operator at all.

Getting to the admin view takes a separate admin sign-in that times out every twelve hours. Every page load lands in the security log.

What it’s used for

One thing: deciding which entries to add to the shared ingredient catalog. New entries give future kitchens nutrition data and the right unit handling out of the box.

The aggregate isn’t fed into any machine-learning model or training pipeline — it’s a read-only signal a person reads and acts on. Adding entries to the shared catalog is a separate, reviewable change to the project’s source, not a click in this view. Names drop off the view once the catalog can resolve them.

AI features and third-party processing

Two features send content outside your kitchen, and both run only when you choose to use them. In each case the content goes to Anthropic, the company that provides Mirepoix’s AI, and nowhere else.

AI import. When you start an AI import, the recipe text and any photos you submit are sent to Anthropic to generate the recipe. So the new recipe can be filed under one of your existing headings, your kitchen’s category and tag names are sent along with it. The request is made with settings that keep your content from being used to train any model. The text you submit is stored on Mirepoix’s servers only briefly — kept with your recent conversation for about three days, then deleted automatically; the photos go sooner, deleted as soon as the draft is made. Even while it’s stored, it’s never used to train a model, and the text you type isn’t written to logs. Photos are downscaled in your browser before anything leaves your device, and camera metadata such as location is stripped in the same step. Only the resized image is sent.

Mirabel. When you ask Mirabel, the in-app help assistant, a question, the text you type — along with the recent back-and-forth of your current conversation, so she can follow what you mean — is sent to Anthropic to generate her reply. If your conversation has been inactive for an hour, Mirepoix starts a fresh one instead of sending the earlier back-and-forth. When you ask about your own recipes, she can also search your recipe collection: the matching recipe titles and their page addresses, categories, and tags are included in that request so she can answer. If you give her recipe text to import, she tries to read it herself first, without sending anything to Anthropic; only when she can’t confidently make sense of it, or you ask her to redo the import with AI, does that text get sent to Anthropic — the same way AI import sends it, along with your kitchen’s category and tag names so the draft can be filed correctly, and with the same no-training settings. If you ask her to import recipe text from the recent conversation, or ask her to revise or condense the draft she made, that text and the draft are sent to Anthropic the same way, with the same no-training settings. If you give her a link to a recipe page, Mirepoix’s server always fetches that page for you, but she tries to read it herself first with no AI; only when the page is too messy to read cleanly, or you ask her to redo the import with AI, does what she found there get sent to Anthropic to build the draft. Pages are fetched only when you ask, are not stored, and each fetch is recorded by site name only. When the page offers a recipe photo, Mirepoix’s server fetches that image too and holds it briefly — until you save the recipe, or the conversation is cleaned up after about three days — so it can be added to the recipe if you save; like any recipe photo, its location metadata is stripped before it’s stored. You can also attach a photo of a recipe — a cookbook page, an index card, a handwritten note — and she’ll read it to build the draft. Photos are downscaled in your browser and camera metadata such as location is stripped before anything leaves your device; only the resized image is sent to Anthropic, and it’s held just long enough to build the draft — deleted as soon as the draft is ready. If you ask her to change one of your saved recipes, that recipe’s text is sent to Anthropic — along with your kitchen’s category and tag names, the same way AI import sends them — so she can draft the edit, and nothing in your kitchen changes until you review the proposed edit and apply it yourself. When you ask her what to cook — a weekly plan or tonight’s dinner — she draws on your cooking history (how many times and how recently you’ve made each recipe), how many of each recipe’s ingredients you’d still need from your pantry, and roughly how long each takes to make, and those figures are sent to Anthropic as part of generating her reply, so she suggests from what you actually cook and have. When you chat with her on a recipe page, your recipe list, your Menu, your Groceries, or your Pantry, a short note about that page rides along with your message — the kind of page and its name, plus a recipe’s own page address — so references like “this recipe” point at the right thing. It’s the page’s type and name only, never anything on the page, and only while you’re chatting with her. Apart from what you ask her to look up, plan, or edit — and that note about which page you’re on — she reads nothing else in your kitchen: not what’s on your shopping list, and nothing tied to your account. The request uses the same no-training settings as AI import. Your recent conversation is now kept on Mirepoix’s servers for a short time — about three days — so Mirabel can pick up where you left off after a reload or on another device, then it’s deleted automatically.

How long this is kept. Mirabel conversations — and the drafts and import text in them — are kept on Mirepoix’s servers for about three days, then deleted automatically. That’s long enough to recover a request you started on another device or after closing the tab, not a lasting record. An encrypted backup may keep an older copy until it rotates out.

Both features draw on your kitchen’s monthly AI allowance, which they share.

Recipe photos

When you add a photo to a recipe, Mirepoix removes its location metadata before storing it. That covers the GPS a camera records and the location a photo editor can add. Stored recipe photos carry no location.

This matters most when you share. A recipe holds one photo, and a shared link shows it as the preview — the full-size photo, not a thumbnail. Because the location is already gone, the link can’t reveal where the photo was taken.

Cooking history

Crossing a recipe off your menu as made records that you cooked it, and when. That record powers the dinner picker’s variety and Mirabel’s meal-planning suggestions — forgotten favorites, quick wins, and the rest. It stays inside your kitchen: the operator can’t read it through the admin console. It’s kept for 13 months and then deleted automatically, so suggestions can reach back across the seasons without keeping the record indefinitely. (When you ask Mirabel what to cook, figures derived from it are sent to Anthropic to generate her reply, as described under “AI features and third-party processing.”)

What never happens

Your kitchen’s content — your recipes, tags, pantry, shopping list, cooking history, and the link between any of those and your account — never:

Gets sold
Gets shared with third parties
Gets used for advertising, recommendations, or behavioral profiling
Gets exported to third-party analytics
Gets used to train any machine-learning model, by the operator or by any third party
Gets mapped to your kitchen identity in the admin view, in logs, or in exports

The one exception is the k-anonymized ingredient-name aggregate described above under “What the operator sees.” That aggregate is used solely by a human operator to decide which entries to add to the shared catalog. It isn’t sold, isn’t shared with third parties, isn’t used for machine-learning training, and contains no link back to your kitchen.

The other carve-out is the content you choose to send through the AI features, described above under “AI features and third-party processing.” That happens only when you start an AI import or ask Mirabel a question, applies only to what you submit in those moments, and is made with settings that keep your content from being used to train any model. The content you send through the AI features is now kept briefly on Mirepoix’s servers — about three days — to deliver and recover your request, associated with your kitchen and account for that window, then deleted automatically. It’s still not sold, not shared, not used to train any model, and still kept out of logs.

Changes

2026-07-17 — Stopped recording which existing catalog ingredient a confirmed match binds to. When you match an unrecognized ingredient name to one already in the shared catalog, Mirepoix no longer keeps a note of that pairing in your kitchen. Nothing read this note anymore — the tool that once did was removed on 2026-07-15 — so what you and the operator see is unchanged; this simply stops collecting data that was no longer used. The ingredient name and its cross-kitchen count, described above, are unaffected.
2026-07-16 — Importing a recipe from a link now also brings over the source page’s photo. When the page offers one, Mirepoix’s server fetches that image along with the recipe and holds it briefly — until you save the recipe, or the conversation is cleaned up after about three days — so it can be added to the recipe when you save. Like any recipe photo, its location metadata is stripped before it’s stored; it’s never used to train a model and stays out of logs. This narrows the earlier statement that a fetched page is “never stored”: the page itself still isn’t, but a photo it offers now is, briefly.
2026-07-15a — Mirabel’s recent conversations, and the recipe text, links, and photos in an import, are now kept briefly on Mirepoix’s servers instead of only in your browser — long enough to deliver a slow import and to pick up where you left off after a reload or on another device. They’re associated with your kitchen and account for that window, kept for about three days and then deleted automatically (photos are deleted as soon as the draft is made), still never used to train a model and still kept out of logs. This corrects the earlier statements that the conversation lived only in your browser and that import text and photos weren’t stored.
2026-07-15 — Narrowed what the operator can see. The offline tool that read which existing ingredient a name had been matched to has been removed, so the catalog-growth signal is back to what it showed before 2026-06-30a: the ingredient name and a count of how many kitchens have seen it. The three-kitchen floor and the rest of this section are unchanged.
2026-07-12 — Mirabel now knows which page you’re on. When you chat with her on a recipe page, your recipe list, your Menu, your Groceries, or your Pantry, a short note about that page — its type and name, plus a recipe’s page address — is sent to Anthropic with your message, so references like “this recipe” resolve. It’s the page’s type and name only, never its contents, and it uses the same no-training settings as AI import; nothing new is stored.
2026-07-11 — A recipe now holds one photo instead of a gallery of up to ten, so this page no longer describes a “cover” photo chosen from several. What Mirepoix does with a photo is unchanged: location metadata is still removed before storing, and a shared link still previews the full-size photo. This only corrects the description.
2026-07-07a — Corrected the description of how Mirabel imports pasted recipe text and linked recipe pages. The earlier wording said that pasted text and linked-page content were always sent to Anthropic; since deterministic-first import landed (pasted text, and structured recipes on linked pages), Mirabel now tries to read both herself first, without AI, and content reaches Anthropic only when she can’t confidently parse it on her own or you ask her to redo the import with AI. No behavior changed — this only corrects the description.
2026-07-07 — Mirabel can now suggest what to cook — forgotten favorites, newest recipes, and quick wins. When you ask her what to make, figures from your cooking history (how many times and how recently you’ve made each recipe) and how many of each recipe’s ingredients you’d still need are sent to Anthropic to generate her reply, using the same no-training settings as AI import; nothing new is stored. This corrects the earlier statement that Mirabel had no access to your pantry. Separately, this page now discloses that cooking history is kept for 13 months and then deleted automatically — previously undocumented; the retention window grew from about three months to support the new “forgotten favorites” suggestions.
2026-07-02 — Ingredient matching for AI import now happens entirely on Mirepoix’s own server, without sending anything to Anthropic. Unresolved ingredient names no longer leave your kitchen for this purpose — the suggested matches you confirm are computed locally instead.
2026-07-01 — Mirabel can now propose edits to your saved recipes. When you ask her to change a recipe, that recipe’s text is sent to Anthropic with your request to draft the edit, using the same no-training settings as AI import; nothing is stored, and no change is made until you preview and apply it yourself. Each applied edit is recorded in the recipe’s history, labeled as made via Mirabel.
2026-06-30a — The operator’s catalog-growth signal now also shows, for a name at least three kitchens independently matched to the same existing catalog ingredient, which ingredient they matched it to — the cue to add that name as an alternate spelling. The same three-kitchen floor applies, the matched-to name is the catalog’s own, and nothing ties it back to your kitchen.
2026-06-30 — AI import now sends unresolved ingredient names to Anthropic to suggest catalog matches. When an imported recipe has ingredients the shared catalog doesn’t recognize, just those names — no quantities, recipe text, or photos — are sent to Anthropic, and you confirm which suggestions to apply. This uses the same no-training settings as AI import; the names aren’t stored or logged.
2026-06-28a — Mirabel can now import recipe text from the recent conversation when you ask her to, instead of requiring you to paste the same text again. This uses the same recent browser-stored conversation already sent when you ask Mirabel a question; nothing new is stored.
2026-06-28 — Mirabel now starts a fresh conversation after 24 hours of inactivity, instead of sending older browser-stored back-and-forth with a new question. This narrows what is sent to Anthropic after a quiet period; nothing new is stored.
2026-06-15 — Recipe photos now have their location metadata removed before they’re stored. A stored photo carries no location, whether a camera or a photo editor recorded it. Camera location (EXIF) was already removed; this adds the location some editors store separately. A recipe’s cover is the full-size image a shared link previews. Removing the location keeps that link from revealing where a photo was taken.
2026-06-15 — Corrected the AI-import disclosure. When you run an AI import — through the import dialog or by asking Mirabel to import, revise, or condense a draft — your kitchen’s category and tag names are sent to Anthropic along with the recipe, so the draft can be filed under one of your existing headings. This has always happened; the page now says so. No behavior changed, and the same no-training settings still apply.
2026-06-11 — Two new ways to start an import. A bookmarklet you keep in your browser reads a recipe from a page Mirepoix can’t open itself — anything behind a login or paywall — and hands the page’s text to Mirabel to build a draft after you confirm. That captured text travels in the page address and doesn’t reach Mirepoix’s servers until you confirm the import, after which it is sent to Anthropic the same way the existing import is. On a phone, you can also share a recipe link to the installed app; Mirabel opens on that link and turns the page into a draft, exactly as pasting a link already does. Both feed the import that already existed — nothing new is stored.
2026-06-11 — Mirabel can now import a recipe from a photo you attach in the chat. The photo is downscaled in your browser, has its camera metadata stripped, and is sent to Anthropic to build the draft — not stored. (This is the same photo handling the AI import dialog used; that dialog has been folded into Mirabel.)
2026-06-11 — Mirabel can now open a recipe link you paste and turn the page into a draft. When she does, Mirepoix’s server fetches that page and sends what it finds to Anthropic to build the draft. Pages are fetched only when you ask, are not stored, and the fetch is logged by site name only.
2026-06-11 — Mirabel can now turn recipe text you give her into a recipe draft and revise it on request. The text you provide and the working draft are sent to Anthropic to do that, exactly as AI import does; nothing new is stored, and drafts only become recipes when you open and save them in the editor yourself.
2026-06-11 — Mirabel can now search your recipes when you ask her about them: the matching recipe titles and their page addresses, categories, and tags are sent to Anthropic as part of generating her reply. Nothing is sent unless you ask, nothing new is stored, and she still can’t change anything in your kitchen.
2026-06-10 — Corrected the third-party-processing section. AI import is no longer described as the only feature that sends content outside your kitchen: Mirabel, the help assistant, also sends your question and recent conversation to Anthropic when you use her. Neither feature’s behavior changed — the page was simply out of date.
2026-06-07 — Disclosed that AI import sends the text and photos you submit to Anthropic to generate a recipe (user-initiated, made with no-training settings, not stored or logged), and that photos are downscaled with camera metadata stripped in your browser before upload.
2026-05-25 — Tightened the scope of “your data” claims to specifically name kitchen-private content, and added an explicit carve-out paragraph for the k-anonymized ingredient-name aggregate. No change to what the operator collects or sees; the prior wording was accurate but read as broader than the underlying behavior.