Privacy

The short version: there is no analytics, tracking or advertising on this site, and no accounts. But recipe text is sent to a server to be read — that is how the ingredient parsing works, and it is worth being precise about.

What gets sent, and where

Your recipe text goes to two places.

This site’s own server (/api/parse), which forwards it to Anthropic’s Claude API to be broken into structured ingredients. Anthropic processes the text to produce the response. Anthropic does not train its models on API inputs; their retention policy is described in the Anthropic privacy policy.
Individual ingredient search terms (/api/foods) — words like tomatoes, canned — which are looked up against USDA FoodData Central.

What is stored on this site’s server:

The parsed result of each recipe, keyed by a hash of the text, so that a recipe analysed once does not need to be analysed again. The recipe text itself is not stored — only the hash and the structured ingredient list the model produced from it.
Food records fetched from FoodData Central, cached so the site is not rate-limited. This is public nutrition data, not anything about you.

Neither is tied to a cookie, a session, an account, or an IP-based identifier. There is nothing in the database that links a recipe to a person.

What is never sent: your serving count, your edits, your swaps, your saved recipes, or the results. All of that is computed and kept in your browser.

If you would rather send nothing

The parser runs locally too. If /api/parse is unreachable, the site falls back to its built-in rule-based parser and its built-in food table, and works entirely offline after the page loads. Blocking /api/ in your browser gives you that mode deliberately — slightly less accurate matching, no data leaving your device.

What stays on your device

Saved recipes, in localStorage under ni.saved.v1. Never uploaded. Clearing site data deletes them.
The food lookup cache, under ni.foods.v2, so repeat lookups are instant.
Everything you edit — amounts, servings, ingredient swaps.

The analysis lives on its own page, so your recipe has to travel from the box you pasted it into to /analysis/. It travels in the URL fragment — the part after the # — and browsers never transmit a fragment to a server. So the recipe reaches the results page, survives a reload, and can be shared as a link, without any of it being sent here or recorded anywhere.

“Copy share link” builds the same kind of link from the recipe as you have edited it. It is visible only to whoever you send it to.

Importing from a web page

“Import a recipe from a web page” asks this site’s server to fetch that page and read the schema.org Recipe block it publishes — the same structured data that puts ingredients and cook times into a search result.

Only the ingredient list, the title and the serving count are read. The method is deliberately not fetched; there is a link back to the page for that.
Nothing is stored. The page is fetched, read and discarded within the request. The recipe then lives in your browser like any other, and travels to the results page in the URL fragment.
The site you are importing from sees a request from this server, not from you. Your IP address is not passed on. The request identifies itself as NutritionalValuesBot.
Addresses that are not on the public internet are refused, including after a redirect, so the fetcher cannot be pointed at anything private.

The suggestion form

The feedback form is the one place on this site where something you type is deliberately stored so that a person can read it later. It is worth being explicit about, because everything else on this page says the opposite.

Your message is stored and read. It is never published and never shown to another visitor.
Your email address is optional. That is the entire reason this is a form and not a mailto: link — an email client attaches your address whether you wanted it there or not. Leave it blank and nobody knows who sent it. If you do fill it in, it is used only to reply to you about your suggestion. It is not shared, not sold, and not added to any mailing list.
Your IP address is not stored. Something has to tell one sender from another to stop the form being flooded, so a salted hash of the address is kept instead. It cannot be turned back into an address.
Nothing about your recipes is attached. Recipes are not in the browser’s outbound path for this form at all.

Cookies

None. The site sets no cookies and loads no third-party scripts, fonts, pixels or embeds. The Content-Security-Policy blocks any attempt to add them.

Server logs

Cloudflare, which hosts the site, keeps standard request logs for operational and security purposes, covered by Cloudflare’s privacy policy. The /api/stats endpoint exposes aggregate counters only — how many lookups were served from cache, how fresh the food data is — and never any content.

Changes

If this ever changes — analytics, accounts, storing recipe text — it will be stated on this page before it ships, not after.