Privacy

What is stored in your browser

One entry in your browser, which we cannot read and which is not tied to your name.

One entry in your browser’s local storage, called whatShouldIEat.v1. It holds everything the game knows about you: which dishes you have picked and rated, how often, your level, XP, streak and badges, the diets and rules you have set — including any faith you picked one under — dishes you have saved or struck off, your settings, the date you last opened it so it can say “welcome back”, and today’s suggestions so a second visit does not have to fetch them again.

It never leaves your device. We cannot read it, it is not backed up anywhere, and it is not tied to a name. Clearing your browser data for this site deletes it permanently — there is no copy to restore from, which is the trade for not having to make an account.

If you sign in or subscribe

Two cookies, and Whop holds everything else — this app never sees your card, your email or your name.

Signing in is handled by Whop. When you do, two cookies are set on this site — wa and wr — which hold the tokens that prove to this app that you are signed in and whether your subscription is active. They are how Premium follows you to another device instead of being locked to one browser.

Payments happen on Whop, not here. This app never sees your card, and it does not store your email or your name — when it needs to know who you are or whether you have paid, it asks Whop and uses the answer.

Signing out clears both cookies. Cancelling is done from your Whop account, and cancelling before the trial ends means you are not charged.

The AI features

The AI features send what you type to an AI service, with nothing attached that says who you are.

The assistant has two tiers. Standard — the three free questions a day, and what a Premium member can pick for a quick answer — is answered by free public AI services that need no account or key: LLM7 (llm7.io) and Pollinations (text.pollinations.ai), one of which is called first and another alongside it when it is slow, and further free services when we have an account with them. They are sent the conversation so far and our instruction, and nothing else: not your taste profile, not your name, not your account. Our server makes the request, so they see our server’s address and not yours. Our server also remembers, for a few hours and only until it restarts, the answer to a first question it has just been asked, however it is punctuated, so the same question is not sent twice. If none of them answers, the same conversation and instruction (and still nothing else about you) is sent to Google’s cheapest Gemini model as a last resort, a small number of times an hour at most. If that does not answer either and the question is plainly about what to eat, it is answered from the app’s own menu instead, the page says so, and it is not counted; anything else gets a busy message and is not counted. Advanced (Premium) is different: it is answered by Google’s Gemini only, never by the free services above, and if Gemini cannot answer it tells you so instead of passing your conversation to anyone else.

Advanced, for Premium members, is answered by Google’s Gemini. It is also sent a short list of dishes you have liked and avoided and the food rules you have set, so the answer is worth having; a photo, only if you attach one, shrunk on your device and sent once, not kept; and, only if you switch on “Look it up”, Gemini searches the web for that question. Your last Advanced conversation is kept in this browser only, so it is there tomorrow; “New chat” deletes it.

When you hold Dot and talk to it, what you type, plus the last few lines of that chat, is sent to the same free services (LLM7 and Pollinations), together with a fixed list of facts about the app. Dot is a companion for a short friendly chat, not a general assistant, and declines tasks. Nothing about you goes with it, and nothing is kept: the chat lives in the page and is gone when you close it.

The menu builder and the five daily suggestions are answered by Google’s Gemini, with the same short list of dishes you have liked and avoided.

Nothing identifying goes with any of it: no name, no email, no account number, no location. Each service’s own terms govern what it does with what it receives, and if that is not something you want, these features are the only ones that use them — the decide game itself never calls out anywhere.

Nearby, and your location

Only if you allow it, only to the map services, and never to us.

Nearby asks your browser for your location, and your browser asks you first. Say no and the feature simply does not run; nothing else in the app is affected.

If you say yes, your coordinates are sent to the map services that can answer the question — OpenStreetMap’s Overpass and Nominatim, and Photon — to look up places around you. They are not sent to us, and they are not stored anywhere by this app.

The price, in your currency

Two lookups by your IP, with no prompt first, because that is all an IP address is good for here.

The Premium price is quoted in US dollars, because that is the currency the plan is actually priced in. On the pricing page, your browser separately asks two public services what that comes to where you are: freeipapi.com, for which currency your country uses, and open.er-api.com, for today’s exchange rate. Neither is told anything beyond the request itself, and neither is us — this app’s own server is not involved and stores nothing from either answer.

Unlike Nearby, this runs without asking first, the same way any website knows roughly where to send a page before you click anything on it. If either service cannot answer, or answers with a currency this browser does not know how to print, nothing is shown — there is no second, guessed version of the number.

It is also only ever an estimate. What you are actually charged is set at checkout, by Whop, which handles tax and currency itself — see the note above the price on that page.

The shared browser

Treat it as a shared screen, because that is exactly what it is.

Order it together, cook along and shop the list together run a real browser on a service called Hyperbeam, which both of you drive. Anything you type in that browser — including anything you type into somebody else’s checkout — goes to Hyperbeam and to the site you are visiting, exactly as it would in a normal browser.

Treat it as a shared screen, because that is what it is: whoever has the link can see what is on it.

The news page

Our server fetches the headlines, so the publishers never see you at all.

Headlines are fetched by this site’s own server, not by your browser. That means the publishers never see you: no request from your device reaches the Guardian, Eater, NYT Dining, The Kitchn, Smitten Kitchen, Saveur or King Arthur Baking unless you tap through to read the article, at which point you are on their site under their rules.

The planner and the kitchen

Your week and your cookbook are kept against your Whop account so they follow you between devices. Photos and voice are never kept.

If you use the meal planner, each week you plan is stored in our database (Turso) against your Whop user id: the dishes, recipes and notes in each slot, which shopping-list lines you ticked, your household size and the prep plan. If you are on Premium and save recipes to your cookbook, each one is stored the same way. Delete a recipe and it is deleted; tell us and we will delete the lot. We also count how many AI requests each account makes per feature per day, so one account cannot run up the bill; those counts are deleted every day.

The planner’s AI, the dinner-party planner and the nutrition and cost estimates send Google’s Gemini the dish names involved and the food rules that apply — never your name, and for a dinner party only how many guests there are, not who. Nutrition and cost estimates are worked out per dish and shared by everyone (a lasagne’s nutrition does not depend on who asked), so they are not linked to you.

A fridge photo, or a photo of a recipe you are copying, is shrunk on your device, sent once to Gemini to read, and not stored by us anywhere — not in the database, not in a log; only the recipe you choose to save is kept. A recipe you paste in is sent to Gemini to be tidied up. When you get a recipe from a website, our server fetches the page you gave it, so that website sees our server and not you; if the page has no recipe card, the page’s text (not anything about you) is sent to Gemini to read the recipe out of it.

When you scan food, the barcode is read on your device — by your browser, or by an open-source reader (ZXing) that your browser downloads from the jsDelivr CDN the first time you scan. Our server then asks Open Food Facts about that barcode and nothing else, and keeps the product’s details for a week for everybody. Your recent scans are remembered in this browser only.

Hands-free cook mode reads the steps aloud on your device. Its voice commands use your browser’s own speech recognition, which in Chrome sends what the microphone hears to Google to be transcribed — that is your browser’s doing, under its own privacy terms, and we never receive the audio. Timers, nutrition targets, your budget, dinner-party drafts and recent scans stay in this browser only.

TV

The channel hears you watch it, the way any website hears you visit it. The guide is fetched by us, so the listing services never see you.

The channels are free, ad-supported channels listed in iptv-org, an open database of free TV — food channels, and groups of others to watch while you cook and eat. Our server reads iptv-org’s list once an hour, so iptv-org sees our server, never your device. What is on now and next is fetched by our server from the guide services each channel publishes its listings to — Plex and Pluto TV — so those services do not see you either.

When you open a TV group, your browser checks each candidate channel in it before listing it, with one small request to that channel’s own stream server (up to about twenty of them), so you only see the channels that actually play where you are. Those servers see your IP address when it checks, as any website would.

When you press play, your browser streams the channel straight from that channel’s own servers, which see your IP address and your browser, exactly as any website does, and may count the view for their adverts. The video player code is a well-known open-source library (hls.js), loaded from the jsDelivr CDN the first time you press play, so jsDelivr sees that request too. morsels45 does not relay, record or keep a history of what you watch.

Radio

The station hears you play it, the way any website hears you visit it. Nobody else does.

The list of stations comes from Radio Browser (radio-browser.info), a free community directory. This site’s server asks it for the list, so the directory never sees your device. When you play a station, the server also tells the directory which station was played — the station’s id and nothing else, no account and no address — because counting plays is how the directory ranks stations and its terms ask every app to do it.

The music itself streams straight from the station to your browser. That means the station sees your IP address and your browser, exactly as any website you visit does, and its own privacy policy applies to that. morsels45 does not relay, record or keep a history of what you listen to; the last channel and station are remembered in this browser only, so the radio can pick up where you left off.

The daily three

Your mood, your one good thing and your trivia answer, kept against your Whop account so they follow you between devices.

If you use the daily check-in, the one-line journal or the daily question, what you enter is stored in our database against your Whop user id, one row a day for each: the mood you tapped, the line you wrote, the answer you picked. That is what lets your streak and yesterday’s line be there when you sign in on another device. It is used for nothing else and shown to nobody else.

Analytics, and what counts as one

Seventeen events, listed by name, and none of them carries anything about you.

This app is hosted by Whop, which adds its own analytics to every page it serves — that is the platform’s, not ours, and it is covered by Whop’s privacy policy.

Google Analytics 4 is also on. It counts page views and receives the same short list of events below — the same names and the same payloads, not a second, richer copy. It is set up without Google Signals, without advertising features, without a user id and without demographics, so what it knows is what happened on this site rather than who did it. Google’s own terms cover what they do with that.

What this app tells them directly is a short list, and here is all of it: that a decision started, that it reached an answer, that an answer was accepted, that a Premium card was shown, that somebody tapped through to pay, and — if you answer the one-tap question that comes up after five decisions — which of the four options you tapped. Three more about coming back: that somebody returned on a later day and how many days it had been, that the home-screen offer was shown, and that it was taken. One more after an answer: which of the free things on the “while you’re here” row was tapped. The site’s own pages around the game add six: that a page was viewed, that a checkout button was pressed, that somebody tapped “pick for me” on the homepage, and — on the homepage’s five-question preview — that it reached an answer, that the answer was pointed somewhere, and that somebody went through to the app. Seventeen in total, and every one goes to both places or to neither. Along with those go the number of questions it took, how many dishes were turned down, which Premium card it was, and, on the accepted one only, the name of the dish.

The question has four buttons and no text box, so what is recorded is which button — there is nothing else for it to carry.

What does not go: your dietary rules, your saved dishes, your ratings, your taste profile, anything you type, and anything that identifies you. The reason those are safe is not a promise, it is where they live — see the section above.

There is no advertising pixel of our own here, and nothing that follows you to other sites.

One exception, and it is on right now: Microsoft Clarity records anonymised replays of sessions on this site — where a cursor went, what was tapped, where somebody got stuck — so we can see why people stop rather than guessing. It masks text content by default, it is not tied to your name or your account, and it is covered by Microsoft’s privacy policy. It is here to find broken screens, and it will be taken out again when it has.

Cookies and your choice

Essential ones are always on and are not a choice. Whether the ad network and the analytics tags may use cookies is your choice. Ads run either way.

Essential: this site and the app keep your settings, your progress and your saved dishes in your browser, and, if you sign in, the two Whop cookies described above. The app cannot do what you asked without them, so they are not offered as a choice. Your cookie choice itself is stored the same way.

Not essential, and yours to decide: the advertising network (Adsterra) and the analytics tags (Google Analytics and Microsoft Clarity) set their own cookies. We do not file them under “essential”, because they are not.

What the choice changes. The ad network cannot draw an ad without its own cookies: asked to draw one with none, it draws nothing, which is why a cookie-free ad was only ever an empty box. So the choice is the network’s code running or not. Where the law lets us show ads without asking first, the network’s code runs on the page from your first visit whatever you press, and “Essential only” turns off Google Analytics and Microsoft Clarity and nothing else. Where you have to be asked first (the EU, the EEA, the UK, Switzerland, and anywhere we cannot tell where you are) and you have not pressed “Accept all”, the ad network is not contacted at all: the box shows a Premium card that says ads need cookies, and Google Analytics and Microsoft Clarity do not load. Pressing “Accept all” turns the card into an ad straight away. The banner is the same everywhere and refusing is exactly as easy as accepting.

You can change it at any time with the button at the top of this page, or “Cookie settings” at the foot of the app’s front page. What it cannot change: where we show ads without asking, the ad network sees your IP address and browser and may set its own cookies each time an ad loads, because that is how a web page gets an ad; and Whop, which hosts this site, adds its own page-view analytics to every page it serves, outside this app’s control. Both are listed under everybody this app talks to, below.

Server logs

Your IP is never stored. Your free AI questions are counted against your free account, or, if you are not signed in, a scrambled one-day version of your address.

The AI features limit how often one person can call them. For the burst limit — no more than a dozen questions a minute — the server holds the IP address your request arrived from in memory only, for that minute, and never writes it down.

The free allowance — three Standard assistant questions a day — has to survive a server restart, so it is counted in a database (Turso). If you are signed in with a free Whop account, the count is kept against your Whop user id, a number from 0 to 3 and the date, so it follows you from one device to another and clearing your browser does not refill it. Rows from earlier days are deleted as soon as the next question is counted, and the count is never joined to what you asked.

If you are not signed in, what is stored is not your IP address: it is a keyed hash of it, made with a secret that changes every day, next to a number from 0 to 3 and the date. Tomorrow the same address makes a different hash, so days cannot be joined into a history, and the hash cannot be turned back into an address without our secret. A household sharing one internet connection shares that allowance — the price of not asking anybody to sign in.

If you are a Premium member you are not counted against it. Dot, the companion, remembers your days together, pats and games, and the name you choose for it to call you (if you do), in this browser only; none of it is sent anywhere.

When a sign-in does not finish, the server notes the step it stopped at and the kind of browser or app it happened in — “Safari (iOS)”, say — and the site you came from, but nothing that identifies you. Those notes are kept for seven days, so a broken sign-in can be found and fixed.

Ordinary request logs are handled by Cloudflare, which serves this site.

Children

No chat, no profiles, no posts, nothing to upload.

This is a food app with no chat between users, no profiles, no public posts and nothing to upload. Buying Premium goes through Whop, whose own terms set the minimum age for having an account and paying.

Getting your data, or getting rid of it

It is in your browser, so you can delete all of it yourself in one tap.

Everything the game knows about you is in your own browser, so deleting it is a matter of clearing this site’s data — or using "Wipe this profile" on the profile screen, which empties it from inside the app.

For anything held by Whop — your account, your subscription, your payment history — ask Whop directly, since that is where it lives.