Help & Reference

Data and privacy

Last updated: 2026-10-15

Your recipes, pantry, shopping list, and menu history stay inside your kitchen. This page covers the narrow exceptions: an aggregate signal about ingredient names that the operator uses to grow the shared ingredient catalog, counts about how well ingredient matching did on the new recipes you add, and what the AI features send to four outside AI companies — to Anthropic only when someone in your kitchen uses Mirabel or asks the Add Recipe sheet to read a recipe with AI, to Mistral AI only when someone imports a recipe from a photo, and to Typesafe AI and OpenAI on their own, though a kitchen owner can turn recipe sketches off. What goes to Typesafe AI includes the name of a new item you type onto your shopping list, so Mirepoix can suggest its aisle, a recipe you import with no category, as Mirepoix read it, with your kitchen’s category names, so Mirepoix can suggest one, and every line of text read from a photo you import, so Mirepoix can sort it into a recipe. It also covers what leaves your kitchen when a member sends it somewhere through an app or tool they connect with their own token: one a kitchen owner lets members connect by turning on agent access, or the Mirepoix iPhone app once it’s out, which connects whether agent access is on or off. And it covers the pieces an error report can carry when something goes wrong: such a report goes to Honeybadger, an error-monitoring company, and it can include a page’s address, which can name a recipe or an item on your shopping list, and words from your screen. It covers a recipe line a member chooses to send with Report this when Mirepoix can’t count that line’s nutrition: the line’s text reaches the operator, the project’s private issue tracker on GitHub, and the AI agents that work on the shared catalog, on models from Anthropic and OpenAI, as described under Reported nutrition gaps. Last, for a kitchen that has asked the operator for one, it covers the Pantry diary: a record of what each member does at the Pantry and on the shopping list, and when, which the operator and the AI agents working for them, on models from Anthropic and OpenAI, read, with that kitchen’s menu history, to study and improve the Pantry and Groceries, as described under Pantry diary.

What stays in your kitchen

The operator can’t read these through the admin console:

What the operator sees

When you type an ingredient name (or an app or tool adds one for you) that isn’t in the shared catalog yet, Mirepoix saves it as a pending discovery in your kitchen. The operator’s admin view collects those pending names across every kitchen. It shows two things drawn from kitchen data — yours and everyone else’s — per name:

The view also shows a suggested USDA food match for each name — found by looking that same name up against the bundled USDA reference data, offered as a starting point for a new catalog entry. The lookup uses only the name shown above; the match itself — its description, nutrients, everything about it — is USDA’s own public data, nothing pulled from your kitchen or anyone else’s.

The view leaves out anything that could tie a name back to you:

That last threshold is a floor, not a setting. A name has to show up in at least three separate kitchens before it’s visible to the operator at all.

A gap a member reports with Report this skips that floor. Because a cook chose to send it, a single report from a single kitchen reaches the operator, with the line’s text. Reports aren’t part of this view; how they reach the operator, and who else reads them, is described under “Reported nutrition gaps.”

Getting to the admin view takes a separate admin sign-in that times out every twelve hours. Every page load lands in the security log.

What it’s used for

One thing: deciding which entries to add to the shared ingredient catalog. New entries give future kitchens nutrition data and the right unit handling out of the box.

The aggregate isn’t fed into any machine-learning model or training pipeline — it’s a read-only signal a person reads and acts on. A reported gap, described next, is used for a related thing: deciding which entries to add to the shared catalog, and which entries need nutrition data or a weight filled in. It’s a signal that a person and the AI agents working for them read and act on. The operator doesn’t use it to train any machine-learning model, or feed it into a training pipeline. Adding entries to the shared catalog is a separate, reviewable change to the project’s source, not a click in this view. Names drop off the view once the catalog can resolve them.

A kitchen’s Pantry diary, described under “Pantry diary,” isn’t part of this view, and the “one thing” above doesn’t cover it: the operator and the AI agents working for them use it to study and improve the Pantry and Groceries, which includes fitting and testing models on it.

Reported nutrition gaps

When Mirepoix can’t count a recipe line’s nutrition — its name has no catalog match, its catalog entry has no nutrition data, or there’s no weight on file for its unit — the line’s detail panel on the recipe page offers kitchen members Report this. Tapping it sends a report, so the shared catalog can be fixed for every kitchen. Signed-out visitors and people who aren’t members of the kitchen don’t see the button. A kitchen the operator has suspended doesn’t either, but one that’s read-only because its plan has lapsed can still report.

A report holds:

Nothing else goes into a report: no kitchen, no member or account, and no recipe — not its title, its other lines, or which recipe the line came from. The server’s logs can still tie a report back to all of these for a while, the member through what Mirepoix keeps about each sign-in, as described next. Mirepoix works out the name, the gap and the text itself, on its own server, from the line you tapped; the tap sends only which line it was.

A report isn’t anonymous. It names no kitchen, but Mirepoix has few kitchens, and the wording of a line can be enough to tell whose it is. Matching a report’s time against what else the server keeps can also tie it back:

Neither the logs, what’s kept about a sign-in, nor the counters are part of a report or go to GitHub with it.

Where a report goes. Mirepoix’s server only stores reports. It never connects to GitHub or sends a report anywhere itself. From time to time, the operator, or an AI agent working for them, reads the new reports with a command run from the operator’s own computer. The command only reads; it changes nothing on Mirepoix’s server. It files what it reads on GitHub, in the project’s private issue tracker: one issue for each gap, quoting the reported lines’ text, and a new comment on that issue when more reports of the same gap arrive. The operator and the AI agents that work on the shared catalog for them read those issues. Those agents run on models from two AI companies: Anthropic, for the agents that do the catalog work, and OpenAI, for one that reviews their changes. A reported line’s text may also be kept in the project’s private source code on GitHub, as evidence for a catalog change. The promises under “AI features and third-party processing” cover what Mirepoix’s own features send; they don’t cover these agents. Whether Anthropic or OpenAI may keep or train on a reported line is set by the operator’s terms with them, and GitHub keeps what it holds under its own terms.

How long it’s kept. Mirepoix deletes a report 90 days after it’s made, in a cleanup that runs once a day, whether or not anyone has read it yet. A report holds no recipe or kitchen, so deleting the recipe, or your whole kitchen, doesn’t delete it: it’s deleted on the same 90-day schedule. An encrypted backup may keep an older copy until it rotates out, as described under “Backups.” Text that has already reached GitHub stays there after Mirepoix deletes the report: an issue, its comments and the project’s source code have no set end.

Mirepoix doesn’t contact anyone about a report, and there’s no status to check. Reporting changes nothing about the ingredient for your kitchen.

Imported ingredient matches

When you add a new recipe — typed into the editor, imported with Add Recipe, saved from Mirabel, added by an app or tool with your token (described under “Agent access (beta)”), or brought in from a file or a backup archive — Mirepoix records what its ingredient matcher decided about that recipe’s ingredient names shortly after the recipe is created, weighed against the shared catalog only. One record per distinct name in that recipe: the name as the recipe wrote it, which catalog ingredient the matcher picked or that it had no candidate at all, whether it was confident, and how far ahead of the runner-up its pick was. A recipe you bring back from Recently deleted isn’t recorded again, and neither is a file import that overwrites a recipe you already have. Editing a recipe afterward doesn’t add more records, and nothing else does either. Two things from before 2026-10-01 stay as they were. Some records carry a note, for a name the matcher was sure of, of whether a Typesafe AI check on the new recipe set its pick aside or replaced it. And some records were added later by an operator’s rerun of that new-recipe check, for names still waiting on a match. That check and its rerun no longer run; the operator’s rerun of matching over lines, described under “AI features and third-party processing”, writes no records here.

If you later choose an ingredient for one of that recipe’s lines in the recipe editor — a catalog ingredient, one of your own kitchen’s ingredients, or Keep as written — the choice is stamped onto that recipe’s record for the line’s name, when it has one: which catalog ingredient you chose, or that you kept the line as written, and when. A choice you make before renaming the line (other than in capitalization or spacing) is dropped when you save, and isn’t stamped; if you rename the line first and then choose, in the same save, the stamp goes on the record for the name the line had before that save. Choosing one of your kitchen’s own ingredients that isn’t in the shared catalog is stamped as a correction too, but it names no ingredient: the record has room only for a catalog one, so it says the matcher was wrong without saying what you picked instead. One of your kitchen’s own ingredients that is based on a catalog ingredient is stamped as that catalog ingredient. Only the first correction is kept; a later choice for the same name on that recipe doesn’t overwrite it. The stamp lands on that recipe’s record alone, not on other recipes that use the same name. A choice made while you’re creating a recipe isn’t stamped, because that recipe’s records are written just after it’s saved, and neither is a choice for a line you add in the same save. Corrections recorded before this change, from the retired Review ingredients dialog, stay as they were.

These records stay inside your kitchen. There’s no admin page for them — the operator’s admin console doesn’t show them at all. They’re deleted when the recipe is deleted, and nothing else expires them: they last as long as the recipe does.

What leaves your kitchen is counts. The operator can run a report on the server that groups these records by which path a recipe came in on — the editor counts as one — and shows, per path: how many kitchens, how many ingredient lines, how many the matcher was confident about, how many it was unsure about, how many had no candidate, and how many were later corrected. No ingredient name, no recipe, no kitchen identity — and a path shows up only when at least three separate kitchens have added recipes through it, the same floor the catalog-gaps view uses. That report can also print the records line by line, ingredient names included, for a single kitchen the operator names by hand when running it. That’s a command on the server, not a page in the admin console.

Each new recipe also writes one line to the server’s own log carrying those same counts for that recipe — how many ingredient lines, how many confident, how many unsure, how many with no candidate — along with which path it came in on (the editor counts as one) and which kitchen it happened in. Counts only: that line carries no ingredient name, though other lines in the same log can, as described under “Sign-in and security logs.”

All of this is used for one thing: measuring how well ingredient matching does on recipes it has never seen before, so the matcher and the shared catalog can be improved. A correction is the only honest signal that a match was wrong, which is why it’s recorded. None of it is fed into a machine-learning model or a training pipeline — the matcher is ordinary code working against the shared catalog, and a person reads these numbers and acts on them.

AI features and third-party processing

Four outside AI companies receive content from your kitchen: Anthropic powers Mirabel, Mistral AI reads the text on photos you import, Typesafe AI checks ingredient lines and suggests aisles for new shopping-list items and categories for imported recipes, and OpenAI draws recipe sketches. For each, this section says what kind of content goes, when, what you can turn off, and what the company may do with it. The help pages for Mirabel, importing from a photo, checking ingredients, aisle suggestions, importing with Add Recipe and recipe sketches describe how each feature works today; the promises are the ones on this page.

Four things hold for all four:

Mirabel and AI import (Anthropic). Mirabel, the in-app assistant, is powered by Anthropic, and so is the AI import she runs when a recipe needs reading with AI, which the Add Recipe sheet also runs when you ask it to (see “Importing with Add Recipe” below). Nothing goes to Anthropic unless someone in your kitchen uses her or asks the sheet to read a recipe with AI (a line sent with Report this, and a kitchen’s Pantry diary, aside — see “Reported nutrition gaps” and “Pantry diary”). When they do, what’s sent is what she needs for that request. That’s what you type and the recent back-and-forth of your conversation, and the recipe text and web pages you give her to import. When what you ask calls for it, it’s also content from your kitchen: your recipes, your Menu and how long recipes have spent on it, your Pantry, your shopping list, and your kitchen’s category and tag names. With each message she also gets a short note of which page you’re on, and your kitchen’s saved cooking preferences if it has any. A photo you attach doesn’t go to Anthropic: it’s resized on your device, its camera and location data are removed before it’s sent, and then it goes to Mistral AI to be read, as described under “Photo import (Mistral AI)” below. Mirepoix keeps it only until her draft is ready, then deletes it. The draft made from it joins your conversation like any other, so the text read from the photo goes to Anthropic with your later messages to her, and when you ask her to change or condense it. When you give her a link, Mirepoix’s server fetches the page for you. Pages are fetched only when you ask, are not stored, and each fetch is recorded by site name only. When the page offers a recipe photo, Mirepoix’s server fetches that image too and holds it briefly — until you save the recipe, or the conversation is cleaned up after about three days — so it can be added to the recipe if you save; like any recipe photo, its location metadata is stripped before it’s stored. She can’t change anything in your kitchen on her own: anything she offers to add, change or take off waits for you to tap to confirm. Under its commercial terms, Anthropic may not train its models on what Mirepoix sends it. Anthropic deletes what it receives within 30 days, unless it needs to keep it longer to enforce its usage policy or the law requires it. Mirabel says which imports she reads on Mirepoix’s own server first.

Importing with Add Recipe. The sheet that Add Recipe opens reads a link or pasted text on Mirepoix’s own server, without Mirabel, and nothing it reads goes to Anthropic unless you choose it. When a read doesn’t come out cleanly and you tap Read it with AI, the page or text you gave the sheet is read with AI import, the same one Mirabel runs, and goes to Anthropic as described above for an import, with your kitchen’s category and tag names, but without Mirabel: none of it goes into her conversation. While that read runs, Mirepoix’s server holds the link or text you gave the sheet, and then the draft it makes, until the sheet picks the draft up, and deletes it then. If the sheet never picks it up, for example because you closed it, nothing can read it 30 minutes after you tapped, and it’s cleared from the server’s cache within two weeks. From a photo hands the photo to Mirabel, and then it’s read as described under “Photo import (Mistral AI)” below. When you give the sheet a link, Mirepoix’s server fetches the page for you, under the same rules as a page Mirabel fetches: only when you ask, not stored, and each fetch recorded by site name only. When the page offers a recipe photo, Mirepoix’s server fetches that image to show it to you in the editor, and again when you save the recipe, so it can be added. Nothing of it is kept in between, and if you don’t save, nothing of it is kept at all. Like any recipe photo, its location metadata is stripped before it’s stored. The ingredient lines it reads, from a page, pasted text or a file, can go to Typesafe AI, as described next. When what it reads gives the recipe no category, the recipe as Mirepoix read it (its title, description, ingredient lines and steps) can also go to Typesafe AI, with your kitchen’s category names, so it can suggest a category, as described under “Category suggestions for imports” below.

Ingredient checks and aisle suggestions (Typesafe AI). To read and match ingredient lines — whether a line is an ingredient or a heading, how the items in a line like “chickpeas or white beans” relate, and which ingredient in the shared catalog a line names — Mirepoix sends ingredient lines and names to Typesafe AI, with entries from the shared catalog to choose among. They come from your recipes and QuickBites, and from recipe pages you import. When Mirepoix pieces a recipe together from text itself — text you paste or a single file you give Mirabel or the Add Recipe sheet, a web page without structured recipe data it can read, or a video’s description — it also sends the lines its reader takes for the ingredient list, with any headings inside that list, so Typesafe AI can say which of them are ingredients. When you import a recipe from a photo, Mirepoix sends every line of text Mistral AI read from it, so Typesafe AI can say which lines are the title, the ingredients, the steps and so on. Some of those lines turn out not to be ingredients: a heading, the recipe’s title, a step or tip, a serving, time or nutrition line, or part of the website around the recipe. Each line goes as it’s written, so anything inside one, such as a web address or a name, goes with it. Mirepoix adds nothing that identifies you or your kitchen, and no page address of its own. Nothing else from a recipe, or from the text or page it came from, goes with these checks. These checks run on their own, without anyone asking — for example shortly after a recipe or QuickBite is saved, while a recipe page or text is imported, or when the operator reruns matching over lines already saved — and there’s no setting to turn them off. Typesafe AI’s answer can change which ingredient a line is matched to; Check ingredients covers how. Typesafe AI also suggests an aisle for a new item on your shopping list. When you type an item onto the list, Mirepoix can send its name to Typesafe AI, with the aisle names from the shared catalog to choose among, to ask which aisle a shopper would most likely find it in. Nothing else from your list, your stores or your kitchen goes with it. These suggestions also run on their own, and there’s no setting to turn them off. The answer only decides which aisle the new item first lands in. Typesafe AI’s privacy policy says it won’t train or fine-tune any model on what it receives. How long Typesafe AI keeps what it receives is set by that policy, which names no fixed period.

Category suggestions for imports (Typesafe AI). When you import a recipe with the Add Recipe sheet, from a link, pasted text or a single file, and what Mirepoix reads gives the recipe no category of its own, Mirepoix can ask Typesafe AI to suggest one. It sends the recipe as Mirepoix read it, the same draft the editor then opens with: its title, its description, and each step’s heading, ingredient lines and instructions, with the name of any other recipe a step points to. It sends your kitchen’s category names with it to choose among, and asks which category a cook would file the dish under. A very long recipe is cut short. Each part goes as it’s written, so anything inside it, such as a name or a web address, goes with it, but Mirepoix adds nothing that identifies you or your kitchen, and no page address of its own. Nothing outside that draft goes: not the comments, menus, links to other recipes or the rest of the page or text Mirepoix left out of it, and not the recipe’s servings, times, tags or source. When Mirepoix pieces a recipe together from text itself, a line from around the recipe can end up in the draft, and then it goes too; you’d see it in the editor. These suggestions run on their own, and there’s no setting to turn them off. The answer only fills in Category in the editor, which you can change before you save. When Typesafe AI picks none of your categories, or doesn’t answer, Category stays at None, as before. What Typesafe AI may do with what it receives is the same as for the checks above: its privacy policy says it won’t train or fine-tune any model on it, and sets how long it’s kept.

Photo import (Mistral AI). When you import a recipe from a photo, Mirepoix sends each photo to Mistral AI, which reads the text on it. Each photo goes on its own, resized on your device and with its camera and location data removed before it’s sent, with nothing that identifies you or your kitchen and nothing from your conversation. Everything in the photo goes with it, so anything else in the picture, such as a handwritten name, goes too. Mistral AI only reads the text; it doesn’t write any of the recipe. Nothing goes to Mistral AI unless someone in your kitchen imports a recipe from a photo. Under its commercial terms, Mistral AI doesn’t train its models on what Mirepoix sends while training is turned off for Mirepoix’s account, and it is. Mistral AI may keep a photo under its own terms, for a period those terms don’t state.

Recipe sketches (OpenAI). Mirepoix draws a small sketch of each recipe for its card. To do that it sends the recipe’s text — never its photo — to OpenAI, whose models decide whether the recipe can be drawn and draw it. Sketches are on for every kitchen unless a kitchen owner turns off Draw a sketch of each recipe for its card under Recipes in Settings. They’re made on their own in the background, after a recipe is saved or later, and again when a member of your kitchen asks for a new sketch of a recipe. Turning the setting off stops sending: a sketch already under way may still finish, and cards stop showing sketches. An owner can turn it off even while the kitchen is read-only. OpenAI doesn’t use what it receives through its API to train its models unless the customer opts in, and Mirepoix hasn’t. OpenAI keeps requests and its replies for up to 30 days to watch for abuse, longer when the law requires it or it’s reasonably necessary to protect OpenAI’s services or anyone else from harm. Anything from your recipes that Mirepoix leaves with OpenAI is deleted, or set to expire, within that time. Mirepoix keeps what comes back with the recipe — the drawing and OpenAI’s written answer, or a note that the recipe couldn’t be drawn. These aren’t part of a kitchen export, and they’re deleted when the recipe or the kitchen is deleted; an encrypted backup may keep an older copy until it rotates out. Sketches already made stay stored while the setting is off, so turning it back on shows them again.

How long this is kept. Mirabel conversations — and the drafts and import text in them — are kept on Mirepoix’s servers for about three days, then deleted automatically. Her answers can also carry two small bookkeeping notes, kept and deleted on that same schedule. The first applies only when an answer failed, and records whether trying again could help, so Mirepoix can leave out a Try again button that couldn’t work. The second applies only to a recipe draft, and records that you saved a recipe from it — a yes, not which recipe — so Mirabel stops treating a recipe you’ve already saved as the draft in front of you, and the choices under the draft show it as Saved. The first holds nothing you typed or anything else from your kitchen, and the second holds only that yes. Neither is sent to Anthropic — each is written on Mirepoix’s own server after the answer is made. That’s long enough to recover a request you started on another device or after closing the tab, not a lasting record. An encrypted backup may keep an older copy until it rotates out.

AI import, photo import and Mirabel draw on your kitchen’s monthly AI allowance, which they share. The ingredient checks and the aisle and category suggestions don’t, and neither do recipe sketches.

So the operator can see what the AI features cost to run, Mirepoix also keeps a monthly tally of that spending for each kitchen, on its own servers. For each kind of work that goes to Anthropic — Mirabel’s chat, AI import, condensing a recipe, and revising one — it records what that month’s requests to Anthropic cost, how many there were, how many of them had to prepare Mirepoix’s own standing instructions at Anthropic afresh, and how many could reuse them from a recent request, which costs less. Those instructions are the same for every kitchen and hold nothing from yours. For photo import, it records what that month’s photo reads at Mistral AI cost and how many photo imports there were. For recipe sketches, it records what that month’s sketch requests cost at OpenAI and how many there were, whether or not a request ended in a drawing. Each sketch’s own cost is also kept with the sketch, and deleted with it. Keeping these figures doesn’t make sketches draw on the AI allowance. The tally holds nothing you typed and none of your kitchen’s content, and says nothing about which member made a request, which recipe a sketch was for, or when, beyond the month. Unlike the allowance, it doesn’t clear at the start of a month: each month’s tally is kept until the kitchen is deleted, and an encrypted backup may keep an older copy until it rotates out. The operator reads it one kitchen at a time with a command on the server; it isn’t a page in the admin console.

Recipe photos

When you add a photo to a recipe, Mirepoix removes its location metadata before storing it. That covers the GPS a camera records and the location a photo editor can add. Stored recipe photos carry no location.

This matters most when you share. A recipe holds one photo, and a shared link shows it as the preview — the full-size photo, not a thumbnail. Because the location is already gone, the link can’t reveal where the photo was taken.

When you delete a recipe, its photo is kept for as long as the deleted recipe is, so Restore in Recently deleted can bring it back. Meanwhile the photo isn’t shown anywhere, and Mirepoix stops serving it at its old address. For a kitchen that’s published, a copy cached on the way out can go on answering that address for up to an hour. Delete forever deletes it along with the recipe, though an encrypted backup may keep an older copy, as described under “Backups.”

Adding a recipe to your menu records when it joined, and taking it off records when it left. Those stretches — which weeks a recipe has spent on your menu — power Mirabel’s meal-planning suggestions, like forgotten favorites, and two touches on your Recipes page: it’s one of the signals that can lift a recipe to the top of a large category instead of behind the fold, and it sets the order recipes take within a folded list. Those page touches are for your kitchen’s own members: someone who opens a published kitchen’s link without being a member of it sees the recipes themselves, in full — no working set and no fold. The record itself stays inside your kitchen too: the operator can’t read it through the admin console. For a kitchen that asked for a Pantry diary, though, the operator and the AI agents working for them may read its menu history beside the diary, as described under “Pantry diary.” It’s kept for 13 months after a recipe leaves the menu and then deleted automatically, so suggestions can reach back across the seasons without keeping the record indefinitely. Deleting a recipe deletes its menu history at once. Restoring the recipe from Recently deleted doesn’t bring that history back, and a new recipe given a deleted recipe’s name starts with none. (When you ask Mirabel what to cook, figures derived from it are sent to Anthropic to generate her reply, as described under “AI features and third-party processing.”)

Pantry diary

The Pantry diary is a record of what a kitchen does at the Pantry and on its shopping list. It’s off for every kitchen. The operator switches it on for a kitchen only when that kitchen asks, and only once the kitchen’s owner has confirmed that its members know. There’s no setting for it in Mirepoix, and members aren’t notified when it starts. To have it switched off, ask the operator.

What it records. While the diary is on, each change to an item’s Pantry or shopping-list state records, for every item the change touched:

It also records a member’s tap that reached Mirepoix but changed nothing, with the item’s name and what the tap was. And once a day it records every item on the Pantry page, with which part of the page it’s in, how many days it has left, and its reminder length.

It doesn’t record which pages anyone opens, anything typed anywhere else, your Menu (menu history, described above, already records when recipes join and leave it), or your recipes. It keeps no IP address or browser name.

Who reads it, and why. The operator reads it with a command on Mirepoix’s server. It isn’t a page in the admin console, and Mirepoix shows it nowhere in the app. The operator, and the AI agents working for them, use it to study and improve the Pantry and the shopping list: they chart it, look for patterns in it, and fit and test models on it, away from the running app. What’s learned from it may change the app for every kitchen. Those agents run on models from Anthropic and OpenAI. The promises under “AI features and third-party processing” cover what Mirepoix’s own features send; they don’t cover these agents. Whether Anthropic or OpenAI may keep or train on what the agents read is set by the operator’s terms with them. Beside the diary, the operator and those agents may also read the kitchen’s menu history, described above under “Menu history,” for the same purpose and under everything this paragraph says. Findings drawn from the diary, such as counts and charts, may be written up in the project’s private source code on GitHub, with no set end; the diary’s entries themselves stay with the operator and those agents. It isn’t sold, used for advertising, or shared with anyone else.

How long it’s kept. Each entry is deleted automatically 13 months after it’s recorded. Switching the diary off deletes every entry for the kitchen at once, and deleting the kitchen deletes them too. When a member leaves the kitchen, or is removed from it, the entries naming them stay. Deleting a member’s account keeps the entries, but they no longer name anyone. An encrypted backup may keep an older copy until it rotates out, as described under “Backups.” A copy the operator takes from the server to study isn’t deleted by any of these. The diary isn’t part of a kitchen export.

Pending imports

When you capture a page with your own recipe-import bookmarklet, save one from Safari’s Share menu with the Mirepoix iPhone app, or have an app or tool you connect with your own agent token save one (described below), Mirepoix holds what it harvested on the server, tied to the kitchen member who captured it, in that member’s pending-imports tray. What the bookmarklet and the Share button gather is:

The Mirepoix iPhone app isn’t available yet, so no one can save a page with its Share button today — see The iPhone app (coming soon). What this section says about the Share button, and about the copy of your capture token the app keeps on your iPhone, describes how they’ll work once the app is out.

The Share button gathers the same kinds of things from the page that the bookmarklet does, and sends them with the same personal capture token to the same place, so a capture from either is held under the same rules. The Share button only saves the page for later; it doesn’t start an import. A capture is kept so you can import it at your leisure instead of finishing the import the moment you capture, until you import or dismiss it — dismissing deletes it right away, and importing deletes it once the import has gone through. One you never touch is deleted automatically after 30 days. Nothing about a pending capture is sent to Anthropic until you choose to import it; what importing it can send is described above under “AI features and third-party processing.”

So the Share button can save on your behalf, the iPhone app keeps a copy of that capture token — the same one behind your bookmarklet in Settings — on your iPhone, together with the kitchen it saves into. It’s kept where only the Mirepoix app and its own extensions — its Share button and its home-screen widget — can read it, and it’s deleted when you sign out of the app. If you don’t have a capture token yet, signing in to the iPhone app creates one: the same token your bookmarklet in Settings would use, stored the same way on Mirepoix’s servers. Nothing else new is stored on Mirepoix’s servers for the Share button. Once the app is out, the app also keeps its agent token, whether or not your kitchen has agent access turned on, described under “Agent access (beta)”, on your iPhone in that same place only the Mirepoix app and its own extensions can read. When the app’s sign-in ends, or the app switches to another kitchen, it stops using that token at once and asks Mirepoix to revoke it. It keeps a copy of the token in that same place only until Mirepoix confirms it’s revoked, which can wait until your iPhone is next online, and then deletes it. After a switch, it gets a token for the new kitchen. Reset bookmarklet in Settings replaces the token, and the copy on your iPhone stops working; the Share button then asks you to open the app once, so it can fetch the new one.

The third way is an app or tool you connect with your own read-and-change agent token, described under “Agent access (beta).” Mirepoix doesn’t fetch the page for it: the app or tool reads the page itself and sends what it gathered, the same kinds of things the bookmarklet gathers. The limits in the list above are what the bookmarklet and the Share button apply while gathering, so they don’t bind an app or tool. What Mirepoix itself enforces on a page saved this way is: text up to 40,000 characters, even when structured recipe markup is found; each block of structured recipe markup up to 30,000 characters, with no separate limit on their total; the page’s title and site name up to 300 characters each; its address up to 2,048 characters; up to 40 ingredient lines; and the whole capture up to 64 KB, the limit every capture has, however it’s saved. It lands in the tray of the member the token belongs to, in the token’s kitchen, and from there it’s kept and deleted exactly as a bookmarklet capture is. Sending the same page content again within 10 minutes, while the first is still waiting in that member’s tray in that kitchen, keeps the one entry, whichever way each was saved. It counts toward the same daily limit as the bookmarklet and the Share button: at most 50 captures made in the last 24 hours can be waiting in a member’s tray at once, counting every way of saving and every kitchen, and importing or dismissing one frees its place. A capture saved this way records nothing about which token saved it. When you import a capture, however it was saved, a recipe photo its markup names is fetched the way a linked page’s photo is, as described under “AI features and third-party processing.”

Agent access (beta)

Agent access lets the members of a kitchen connect their own apps and tools to it, such as a command-line tool. It’s off for every kitchen until a kitchen owner turns it on in Settings, and members aren’t notified when an owner does. The Mirepoix iPhone app also connects with a token, once the app is out (it isn’t yet), but agent access doesn’t govern it: the app connects whether agent access is on or off. This section covers both kinds of token.

What it allows. Once agent access is on, a member can create a token: a secret that lets an app or tool use that one kitchen as that member. You create one on your Account page, or by approving a command-line tool as described below. Whether agent access is on or off, the Mirepoix iPhone app creates its own token while you’re signed in to it, once the app is out. A token is either read-only or read-and-change. A read-only token can read the kinds of kitchen data listed below. A read-and-change token can read the same, and it can also add recipes and change existing ones. Adding a recipe never overwrites one already in the kitchen: if a recipe with that name is there, nothing is saved. A change never saves over a newer edit: if someone changed the recipe’s text after the app or tool read it, nothing is saved. A change that renames a recipe also updates the other recipes that link to it, as the recipe editor does, and the app or tool is told those recipes’ titles. A read-and-change token can also save a page to its member’s pending-imports tray, as described under “Pending imports.” When an app or tool saves a page, or asks what saving one would do (which a read-only token can ask too, without anything being saved), it’s told whether the page is saved — or, when it only asked, would be — or was already waiting in that tray, and the page’s title as Mirepoix reads it from what was sent; past the daily limit, it’s told only that the limit has been reached. A read-and-change token can also change the shopping list and the Pantry. It can put items on the shopping list, check them off, uncheck them, and take them off. For a Pantry item, it can say you need it, which puts it on the shopping list; say you have it, so the Pantry asks again after a length it may choose from the Pantry’s own, 3 days to 12 weeks, or in a week if it chooses none, as picking 1 week under Have it does; or have the Pantry ask about it today. Either of the last two can also take the item off the shopping list. A read-and-change token can also add recipes to the Menu and take them off, but not QuickBites. Either change records when the recipe joined or left the Menu, as described under “Menu history,” the same as a change made on the Menu page; neither the Menu nor its history records which member or token made it. A token you create on your Account page or by approving a device is read-only unless you choose otherwise; the iPhone app’s token is always read-and-change. The help page lists what a token can do.

What a token can read. Depending on what an app or tool asks for, a token can read five kinds of kitchen data:

Where it goes. What a token reads goes wherever the member who holds it sends it — for example to Apple, when the iPhone app answers you through Siri, or to whichever AI model a member drives a command-line tool with. Mirepoix doesn’t control those destinations; their own terms apply there, including whether what they receive is used to train a model. Your kitchen’s data is shared among its members, so recipe text and other content written by other members can reach those destinations this way too.

What Mirepoix keeps about a token. Mirepoix stores, on its own servers, only a fingerprint of each token (a digest it can check a presented token against), never the token itself; the Account page shows a new token once, when you create it. With the fingerprint, Mirepoix keeps which member and which kitchen the token belongs to, its kind (the iPhone app, or the command line and the Account page), its access, the name you or the device gave it, when it was created and last used, and when it was suspended, if it was. For the iPhone app’s token it also keeps which sign-in the token belongs to and an installation id the app generates. The name is shown to you, on your Account page and in the emails below, and to your kitchen’s owners in Settings. Once a token other than the iPhone app’s adds or changes a recipe, its name is also shown to every member of the kitchen, in that recipe’s history, as described next. The iPhone app’s token is the exception on your Account page: it appears there as part of its sign-in, under “Where you’re signed in”, without its name. An app or tool holding a token can also ask Mirepoix about that token: its kitchen’s page address, its kind, its access, its name, when it was created and when it was last used, and whether it can make changes right now, which depends on its access and on the kitchen’s plan. Mirepoix gives that answer only to whoever presents the token.

What recipe history keeps. When a token adds or changes a recipe, that recipe’s history records the change the way it records any other: as a version saved by the member the token belongs to. That version is also marked with where the change came from. A token created on your Account page or by approving a device shows as via CLI, followed by the token’s name. The iPhone app’s token shows as via Siri, without its name; the name is still stored with the version, but history never shows it. When a token’s change renames a recipe, each other recipe updated to link to the new title gets a version saved the same way, with the same mark. Every member of the kitchen can see a recipe’s history. The mark is a copy, kept with the version, so it stays after the token ends: when it’s revoked, suspended, or deleted after 90 days unused, when agent access is turned off (which ends every token but the iPhone app’s), when its member leaves or is removed from the kitchen, or when its member’s account is deleted. Once the account is deleted, the history no longer shows the member’s name, but it still shows the token’s. The mark is kept with the version for as long as the version is kept, and every version is deleted when the kitchen is.

How a token ends. You can revoke, on your Account page, any token you created there or by approving a device, and an app or tool can revoke its own. A kitchen owner sees every member’s tokens for the kitchen in Settings and can revoke any of them. An iPhone app’s token comes back, though, whether an owner revoked it or it was suspended. While its member stays signed in, the app gets a new one when it’s opened after Siri has found the old one refused, or once the old one is a day old. To cut off a member’s iPhone app for good, the owner removes the member from the kitchen, as described below. Turning agent access off deletes every token for the kitchen except the iPhone app’s, and turning it back on restores none of them; the iPhone app’s tokens stay. A token created on the Account page or by approving a device that goes unused for 90 days stops working and is deleted, the next time it’s presented or by Mirepoix’s daily cleanup, whichever comes first. The iPhone app’s token ends with the sign-in that created it. Leaving a kitchen, or being removed from it, makes your tokens for it stop working and deletes them, the iPhone app’s included, and deleting your account or the kitchen deletes them too.

Automatic suspension. A token that goes over its own rate limits in three separate stretches within a day is switched off automatically, and the member it belongs to is emailed. The shared hourly budget for one member in one kitchen can refuse a token’s requests too, but that never counts toward switching a token off. A switched-off token can’t be used again; it stays in your list and the owners’ list, marked as suspended, until someone dismisses it or it ends in one of the ways above. The iPhone app’s token shows as suspended on its sign-in’s row instead of in your list. The iPhone app replaces its own switched-off token with a new one the next time it’s opened while you’re signed in, which deletes the old one.

Emails. Mirepoix emails you whenever you create a token on your Account page, and whenever a device you approved collects its token. That email names the token, the kitchen, its access, and the time, and shows the IP address and browser of the request that created it. For an approved device, that’s the request that collected the token — for a command-line tool, normally the machine that asked to connect and the software name it sent, not the browser you approved it in. The iPhone app’s token gets no email of its own: signing in to the app is a sign-in like any other, and you’re emailed about a sign-in from a device Mirepoix doesn’t recognize. Mirepoix also emails you when one of your tokens is suspended, as described above.

The request log. Mirepoix’s own request log, described under “Sign-in and security logs,” records each request’s IP address and the address it asked for. For an app or tool, that address names which operation it asked for, and in which kitchen; the log doesn’t keep what it sent for that operation to work on. The API accepts content only when it’s sent as JSON; a request carrying content sent any other way is refused without running. Saving a page to Pending imports can also write the page’s host to the separate security log, as described under “Sign-in and security logs.”

Connecting a command-line tool by approving it. A command-line tool can connect without you copying a token: it shows you an eight-character code, and you type that code on Mirepoix’s Connect a device page (/device) in a browser where you’re already signed in. While the request waits, Mirepoix keeps the name the tool gave itself, the IP address the request came from, the software name the request sent (its user-agent string), and when it asked. The approval page shows you all four so you can tell whether the request is yours. If you approve, you choose which kitchen the tool may use and whether its token is read-only or read-and-change, and the request records that you approved it, that kitchen and access, and when. If you deny it, the request records when. It also records when the tool last checked back and when it collected its token. Once the tool has collected its token, that token is a command-line token like one you create on your Account page: Mirepoix keeps, emails about, and ends it as described in this section. A request lasts ten minutes. Mirepoix deletes it within about an hour of its expiring or of the tool collecting its token. A request you approved is deleted as soon as that kitchen’s agent access is turned off, you leave or are removed from that kitchen, or the kitchen or your account is deleted. On Mirepoix’s own servers, both codes are stored only as fingerprints, never as the codes themselves.

What the command-line tool keeps on your own computer. “What Mirepoix keeps about a token” and “Connecting a command-line tool by approving it” describe what Mirepoix’s own servers keep. Mirepoix’s own command-line tool, described in The command-line tool, also keeps some things in files on the computer you run it from — files only that computer account can read, that Mirepoix’s servers never see:

If the tool is stopped while saving, a leftover temporary file of its own, which can hold a token or a device code, is deleted by the first command you run once it’s ten minutes old; it leaves other files alone. If a login succeeds but its new token can’t be saved or isn’t one the tool can use, the tool tries to revoke it at once; if that fails too, or the token is one it can’t send at all, it tells you which token to revoke on your Account page.

What the iPhone app keeps on your iPhone for Siri. Once the app is out, it keeps some of your kitchen’s names on your iPhone, so Siri can recognize what you say. It reads them with its agent token, as described under “What a token can read,” when it gets its token and when you open the app, at most once every 15 minutes:

All of it is for the kitchen the app is in. Signing out of the app, or switching it to another kitchen, deletes the copy, takes the names out of iOS’s search index, and withdraws the suggestions. The app itself sends none of these names anywhere. When you use one of the app’s Siri actions, what leaves your iPhone for Mirepoix is the request that action makes with its agent token, one of those described under “What it allows.” Where Siri’s answer can go from there is described under “Where it goes.” When Siri adds to Reminders instead, what reaches Mirepoix is described next.

The app gives iOS no item names from your shopping list as suggestions for Siri’s phrases. When you check something off and Siri asks “Which item?”, the app gives Siri the items on your list that match your answer. It looks first in the copy of your list it keeps for its widget, and otherwise reads the whole list with its agent token, leaving out what’s already checked off. If more than one item matches, the names Mirepoix offers to choose from go to Siri too.

What the iPhone app reads from Reminders. Once the app is out, you can turn on Add with Siri through Reminders on your Account page in the app and choose one of your lists in Apple’s Reminders app, so that what Siri adds to that list ends up on your shopping list. Turning it on asks iOS to give the app full access to your reminders. iOS grants that access to all of your lists at once, but the app reads only these:

When you open the app, when it gets its agent token, while it’s open and Reminders changes, and in the background when iOS allows, the app sends those titles to your kitchen as items for your shopping list, with its agent token. That’s the same request “What it allows” describes for putting items on the shopping list, and it’s sent to the kitchen the app is in. A title longer than 100 characters isn’t sent. The app then deletes from that list each reminder whose item Mirepoix answers is now on your shopping list, or was already there; any other reminder stays for next time. If you share that list with other people in Reminders, this includes reminders they add, and deleting them removes them from the list for everyone who shares it. Which list you chose, its name, and the identifiers iOS gives it and its account are stored only on your iPhone, in the app’s own storage. Turning the setting off forgets them, and so does signing out of the app; switching the app to another kitchen keeps them, and from then on items go to the new kitchen. Turning it off doesn’t take back the app’s access to your reminders, because iOS gives an app no way to do that; you can take it back in iOS’s Settings, under Privacy & Security, then Reminders. The app’s own log on your iPhone records how many reminders each import sent and deleted, never a title. Nothing new is kept on Mirepoix’s servers: what arrives is the request the app’s token already makes to put items on your shopping list, and Mirepoix’s log keeps of it what “The request log” describes. In a kitchen with a Pantry diary, the diary records each item this adds, as it does any other add, as described under “Pantry diary.”

Dates and times

So dates and clock times read the way you expect them to, Mirepoix asks your browser what it already knows about where it is and how it writes things down. On each visit your browser records two small notes on your own device: the name of its time zone — an entry from the standard public list, like America/New_York — and three formatting hints, namely which day your week starts on, whether you use a 12- or 24-hour clock, and whether you write the day or the month first.

These are hints, and Mirepoix checks each one against a fixed list of values it accepts. Anything it doesn’t recognize is treated as not set rather than stored.

When you create a kitchen, those four values are saved as that kitchen’s own settings. That is the part worth stating plainly: before, they were only ever read for the request at hand; now a new kitchen starts out holding them. From then on they are ordinary kitchen settings — shown and editable under Dates and times in Settings, changeable by a kitchen owner like any other setting, and no longer tied to whichever browser happened to create the kitchen. Changing them there is what governs; your browser’s notes don’t overwrite a kitchen that has its own.

For a kitchen that has no time zone saved, your browser’s note is used for that request only, to work out what “today” means for you, and isn’t stored.

A time zone is coarse location information, and it’s worth saying so plainly. An identifier like America/New_York tells Mirepoix roughly which part of the world you’re in, and the standard list labels its zones with city names, so a place name is often right there in the text. What it is not is a precise location: Mirepoix keeps no coordinates and no address, and a zone is shared by everyone across a wide band of the map — it doesn’t narrow you down within that band, and nothing here is used to work out where you are beyond making your dates and clock read correctly.

These settings stay inside your kitchen, the operator can’t read them through the admin console, and none of them is sent to Anthropic.

Sign-in and security logs

Mirepoix writes short lines to a security log so the operator can spot abuse like a password-guessing run. Most lines record a refusal at a security checkpoint — a sign-in, an invitation or join code, an email change, an agent token, or an incoming payment-provider message that didn’t pass — or a member typing too many codes on the Connect a device page. Others record a security event that succeeded, such as a sign-in completing, a new device appearing, a passkey being registered, sessions being ended or revoked, an invitation or join code being used, a kitchen transfer completing, an agent token being created, revoked, or suspended, a device asking to connect by approval or a member approving or denying one, or a kitchen owner turning agent access off. These lines never contain your recipes or anything else in your kitchen. Which details a line carries depends on which checkpoint wrote it. Some note only what happened; others also record the network address (IP) the request came from, an email address, an identifier for the account, kitchen, or sign-in the request belonged to, or some combination of these:

You already see your own request’s IP address and browser in the sign-in, new-device, passkey-change, and new-agent-token emails Mirepoix sends you — which reach you through Mirepoix’s email company, as described under “Error reports and email” — and the approval page shows you the IP address and software of a device asking to connect. What this section adds is that the IP address is also kept in the server’s security log — the browser is not — alongside the admin catalog-gaps page views described above.

Enforcing those limits also means counting recent attempts, and unlike the log lines above — written only when one of the events described there occurs — a counter is written on every attempt. The sign-in and sign-in-code counters are filed under the email address that was typed together with the request’s IP address. The rest are filed under the request’s IP address alone, or under your account, your kitchen, one of your agent tokens, or you and one kitchen together — no other counter pairs an address with an IP. (The agent API counts by IP address before it checks any token, then counts each token’s requests, and counts each member’s requests in each kitchen, reads and changes alike, against a shared hourly budget. Connecting a device by approval counts a device’s requests to connect, and its checks for its token, by IP address, and counts codes typed on the Connect a device page by your account and by IP address.) Pairing the two is deliberate: it keeps someone else’s attempts from using up the allowance for your own sign-in.

To enforce these limits, Mirepoix temporarily stores counts of recent attempts using the identifiers described above. Each counter stops affecting access when its rate-limit window ends; the sign-in and sign-in-code windows last 15 minutes, and the agent API’s last one minute, or one hour for the shared budget for a member in a kitchen. Connecting a device by approval uses ten-minute windows, except for a device’s checks for its token, which use one minute. To switch off a token that keeps going over its own limits, Mirepoix also keeps notes under that token, written only when a limit refuses it: one per limit, which stops counting when that limit’s window ends, and a list of when it went over its own limits, one entry per window, each of which stops counting after a day. The counters and these notes are removed later through routine cache cleanup.

Alongside the security log, Mirepoix’s server keeps an ordinary request log, as web servers generally do. It writes a line for nearly every request it receives, whether anyone is signed in or not, recording the network address (IP) the request came from, the address it asked for, and when. That address is a page’s own address, so it can name your kitchen and the recipe or page you opened, and some addresses name an item: checking one off your shopping list, or answering about one in your Pantry, asks for an address with the item’s name in it. The line also records which part of Mirepoix answered and how, but nothing a request sent beyond its address: not a recipe you save, an item you add, a name you give a store, an aisle or a category, what you send to Mirabel, or the name of a file you import. When the server hands work to a background job, it writes a line naming the kind of job, never what it handed over. The operator reads this log to keep the service running and to trace abuse, such as a run of requests from one address. The front-end server that receives each request before passing it to Mirepoix keeps a log of its own, which also records each request’s IP address and the address it asked for, along with how the request was answered and the software name it sent (its user-agent string). That log is capped at about 10 MB: once it fills, older lines are dropped to make room for new ones, so how far back it reaches depends on how busy Mirepoix is, not on the calendar, and an update to Mirepoix doesn’t clear it.

The security log and the request log are one log on Mirepoix’s server, kept and cleared together. They don’t expire on a set schedule — what clears them is a new release. Each time Mirepoix is updated the server starts fresh with an empty log, and updates ship every few days, so a line usually survives days rather than months. A storage budget of about 300 MB caps the log as well, but at the rate these lines are written it has never been reached, so it isn’t what removes them. Each update keeps the logs of the five server copies before it and deletes older ones, so a line lasts until about the sixth update after it was written — usually a couple of weeks or less, and longer whenever releases are further apart. There’s no fixed ceiling here: how long one of these lines survives tracks how often Mirepoix is updated. The hosting company’s daily copies of the whole server, described under “Backups,” can keep these logs for up to a week longer. And when a request or a background job fails, the last lines the server wrote to these logs before the failure can travel with its error report to Honeybadger, as described under “Error reports and email,” where Mirepoix’s updates don’t clear them.

Error reports and email

Two more companies handle part of Mirepoix’s work: Honeybadger collects reports of errors, and Resend delivers Mirepoix’s email.

Error reports (Honeybadger). When something goes wrong — a page fails, a save errors out, a background job breaks — a report goes to Honeybadger, an error-monitoring company, so the operator can find and fix it. A report is sent only when something goes wrong; Honeybadger isn’t sent a record of ordinary use. Reports come from two places.

When a request to Mirepoix’s server fails, the server’s report carries:

When a background job fails, its report carries what the job was handed, and the same kind of trail. Less is blanked out of it than out of a request’s report: recipe text, a list item, a name and other things you type are blanked where the job holds them under a label Mirepoix knows to blank, as are passwords, sign-in codes and tokens, but the rest is reported as the job was handed it. That’s usually identifiers. Some carry more: the one that updates nutrition after one of your kitchen’s ingredients changes carries those ingredient names; the one that sends a sign-in code carries the IP address and browser that asked for the code; and one that sends you an email carries what that email names, such as your kitchen’s name, a passkey’s or token’s name, an old and a new email address, or an IP address and browser.

When a page hits an error in your browser, your browser sends the report to Honeybadger itself, so Honeybadger sees your network address, as any site you reach does. The report carries what went wrong, the page’s address and the address of the page you came from, your browser’s software name, and a short trail of what happened on the page before it: pages you went to, requests the page made, notes it wrote to the browser’s console, and the text of what you tapped or clicked, up to 300 characters, with a description of where it sits on the page that can include the labels and titles on it and around it. That text can be a recipe’s title, an item on your shopping list, or words from one of Mirabel’s answers. Mirepoix’s sign-in cookies can’t be read from the page, so a browser’s report never carries them.

How long Honeybadger keeps a report is set by its own terms, not by Mirepoix.

Email (Resend). Mirepoix’s emails — sign-in codes, invitations, and the notices described on this page — are delivered by Resend, an email-delivery company. Each one passes through Resend with what it says. Besides your email address, depending on the email, that can be your name, your kitchen’s name, another member’s name or email address, a sign-in, invitation or confirmation code and its link, the old and new address of an email change, the name of a passkey, a device or an agent token and the app it’s for, and the IP address and browser of the request it’s about. No email carries your recipes, Menu, Pantry or shopping list. How long Resend keeps what it delivers is set by its own terms, not by Mirepoix.

Backups

Every hour, Mirepoix backs up its databases and the files it stores, such as recipe photos, so a backup holds your kitchen’s content and your account. The logs described above aren’t part of it. Each backup is encrypted on Mirepoix’s server before it’s sent to a storage company, away from that server, and the storage company doesn’t hold the key, so it can’t read them. Older backups are thinned out as they age: Mirepoix keeps the newest backup from each of the last 24 hours, seven days, four weeks and twelve months in which a backup was made, and deletes the rest. The count is of backups, not of the calendar: while backups run every hour that comes to about a year, but if they stopped for a while, the oldest kept ones would reach back further by the same gap. So something deleted from Mirepoix — a recipe, a conversation with Mirabel, a whole kitchen — can stay in an older backup for about a year, or longer after such a gap, until that backup is deleted in turn. Separately, the company that hosts Mirepoix’s server keeps a copy of the whole server for each of the last seven days. Backups are there to bring Mirepoix back after a failure; the operator also restores one from time to time to check that restoring works.

What never happens

Your kitchen’s content — your recipes, tags, pantry, shopping list, menu history, and the link between any of those and your account — never:

The Pantry’s own Recommended reminder length is worked out inside your kitchen from your own answers. It’s shown only there, and never shared or used for anything else, apart from the Pantry diary of a kitchen that asked for one, which records it each time it changes, as described under “Pantry diary.”

The one exception is the k-anonymized ingredient-name aggregate described above under “What the operator sees.” That aggregate is used solely by a human operator to decide which entries to add to the shared catalog. It isn’t sold, isn’t shared with third parties, isn’t used for machine-learning training, and contains no link back to your kitchen.

The import-matching counts described above under “Imported ingredient matches” are the second carve-out, and a narrower one: they carry no ingredient name at all, and the cross-kitchen report shows a figure only once at least three kitchens stand behind it. The one place a kitchen identity does appear is the server’s own log line for a new recipe, which records which kitchen the recipe was added in beside those counts — never an ingredient name, and nothing else from the recipe. Like the aggregate above, none of it is sold, shared with third parties, or used for machine-learning training.

A third carve-out is the content the AI features send to the four outside AI companies described above under “AI features and third-party processing”: to Anthropic when someone in your kitchen uses Mirabel or AI import; a photo you import to Mistral AI, to read its text; ingredient lines, the lines Mirepoix’s reader takes for a recipe’s ingredient list when it pieces one together from text, every line of text read from a photo you import, the names of new items typed onto the shopping list, and a recipe imported with no category, as Mirepoix read it, with your kitchen’s category names, to Typesafe AI, on their own; and a recipe’s text to OpenAI, unless a kitchen owner turns sketches off. Mirepoix adds nothing that identifies you or your kitchen, none of the four uses it to train its models, and Mirepoix’s logs never hold it. What Mirabel works with is kept on Mirepoix’s servers for about three days, associated with your kitchen and account for that window, then deleted automatically. What Mirepoix keeps from a sketch stays with the recipe until the recipe or the kitchen is deleted, except that its cost also goes into the monthly spending tally described there. None of it is sold, or shared with anyone beyond those four.

A fourth carve-out is what an error report can carry to Honeybadger, described above under “Error reports and email”: a page’s address, which can name your kitchen, a recipe or a shopping-list item; what a failed request sent, apart from what’s blanked out; the server’s recent log lines, which can name an ingredient; an identifier for your kitchen or a recipe; what a failed background job was handed, such as ingredient names; and, from your browser, the addresses of recent pages and requests, console notes, and the text of what you tapped or clicked. A report is sent only when something goes wrong, and only so the operator can find and fix it. Mirepoix doesn’t sell it or use it to train any model.

A fifth carve-out is a recipe line a member sends with Report this, described above under “Reported nutrition gaps”: the ingredient’s name, which gap it is, the line’s unit and its text. It skips the three-kitchen floor, because a cook chose to send it. It goes to GitHub, in the project’s private issue tracker and possibly its source code, and the AI agents working for the operator read it there, on models from Anthropic and OpenAI. A report names no kitchen, but it isn’t anonymous: Mirepoix has few kitchens, and matching its time against the server’s logs can tie it to your kitchen, the recipe, the exact line and the IP address it came from, and matching that address against the one Mirepoix keeps for each sign-in can tie it to the member who sent it, for as long as the logs keep the tap’s line. Mirepoix doesn’t sell it, use it for advertising, or train any model on it. Whether Anthropic or OpenAI may keep or train on a reported line is set by the operator’s terms with them, and GitHub keeps it under its own terms.

A sixth carve-out is the Pantry diary, described above under “Pantry diary,” kept only for a kitchen that asked the operator for one: a record of each change to an item’s Pantry or shopping-list state, with the member who made it and when, and a daily list of what’s on the Pantry page. Everything this paragraph says also covers that kitchen’s menu history, which the operator and those agents may read beside the diary. It names your kitchen and the member who acted, so it’s released from the line about mapping your content to your kitchen identity, and from “the link between any of those and your account.” It’s a record of how your household uses the Pantry and the shopping list, read to study and improve them, and what’s learned from it may change the app for every kitchen, including what the Pantry suggests, so it’s released from “recommendations” and “behavioral profiling.” The operator and the AI agents working for them may fit and test models on it, so it’s released from the training promise too. Those agents run on models from Anthropic and OpenAI, so it reaches those companies, and whether they may keep or train on what the agents read is set by the operator’s terms with them; findings drawn from it may also be written up in the project’s private source code on GitHub. Beyond that, it isn’t shared. Mirepoix doesn’t sell it, use it for advertising, or export it to third-party analytics.

The last carve-out is content a member of your kitchen directs elsewhere with their own token, described above under “Agent access (beta).” For an app or tool a member connects with a token they create, it applies only if a kitchen owner has turned agent access on. For the Mirepoix iPhone app’s token, once the app is out, it applies whether agent access is on or off. Kitchen content an app or tool reads with a member’s token goes wherever that member sends it — Mirepoix doesn’t send it there or choose where it goes — and what happens to it there, including whether it’s used to train a model, is up to that destination and its own terms. Mirepoix itself still doesn’t sell it, share it, or use it to train any model.

Changes

See also

Last updated October 15, 2026