Effective date: 28 June 2026 · Last updated: 30 August 2026
This Privacy Policy describes how DishDash ("we", "us", or "our") collects, uses, and protects information when you use the DishDash mobile application ("the App"). By using the App you agree to the practices described in this policy.
Account information
Content you create
Recipe generation data
When you generate a recipe, the request is sent through our servers to Google Gemini to produce a result. Depending on which generator you use, that request may include: what you typed (e.g., "pasta, under 30 minutes, vegetarian"), the filters you selected (diet, cuisine, calorie or nutrition targets), items from your pantry inventory, and your chosen recipe language. This data is processed by Google under Google's Privacy Policy. We do not store your prompts beyond what is necessary to display the result.
Two features send more than text. If you import a recipe from a cooking video, the video file is downloaded by your phone and passed through our servers to Google Gemini, which reads the on-screen text and narration in order to transcribe the recipe. If you import a recipe from a web page, your phone fetches that page directly and the recipe is read from the page itself — the address you provide is not sent to us.
Recipes we have shown you
Some recipe generators can answer from a shared library of recipes rather than creating a new one each time. So that you are not shown the same recipe twice, we keep a short list of the recipes already served to your account. It contains recipe identifiers only — no prompt, no content you created, and nothing about how you used the app.
Nutrition lookups
To show calories and macros for a recipe, the ingredient lines of that recipe are sent from our servers to USDA FoodData Central, a public food-composition database operated by the U.S. Department of Agriculture, to be matched against known foods. Only the ingredient text is sent — no account identifier, and nothing that identifies you.
Health & fitness data (Tracker)
The Tracker can show your daily step count. With your permission it reads today's aggregated step total from Health Connect, the phone's central health store, so that steps already recorded by your phone, watch, or another fitness app are counted once. If Health Connect is unavailable or you decline, the app can instead count steps from your device's built-in step-counter sensor (the Physical activity permission), or you can enter progress manually — the Tracker works without either permission.
The Tracker also records the water and calorie totals and daily goals you enter yourself.
All of this health and fitness data is stored only on your device, in the app's private storage. It is never uploaded to our servers, never written to your cloud account, never shared with any third party, and never used for advertising or ad targeting. We cannot see it. Step data read from Health Connect is used solely to display your progress in the Tracker, is not retained beyond the day it belongs to, and is removed when you clear the app's data or uninstall the app. You can withdraw Health Connect access at any time in Health Connect's own settings, and revoke the Physical activity permission in Android Settings.
Microphone & voice input
Some screens offer voice input — adding pantry items by speaking, and dictating a recipe request. The microphone is active only while you are using that voice control, and only after you grant the microphone permission. The audio is passed to your device's speech-recognition service (on most devices this is provided by Google) which converts it to text; we receive only the resulting text, and we do not record, store, or transmit audio ourselves. Voice input is entirely optional — every screen that offers it also accepts typing.
Using the app as a guest
You can browse the app as a guest without creating an account. In guest mode no account is created and no personal data is stored in our cloud; features that require an account (such as saving to your recipe book) are unavailable, and anything the app keeps — such as Tracker progress and your language choice — stays on your device.
Subscriptions and payments
DishDash Premium is sold through Google Play Billing. Your payment is handled entirely by Google Play — we never see or store your card details, billing address, or any payment information. Purchases are governed by Google's Privacy Policy and the Google Play terms.
So that the app knows whether your subscription is active, we store a record against your account containing the Google Play purchase token, the product identifier, the subscription state, and the date it renews or expires. Google Play also notifies our servers when a subscription is renewed, cancelled or expires, so that record stays accurate. It is used only to decide whether to unlock Premium features, and is not shared with anyone or used for advertising.
Usage quota
We track the number of recipe generations per user per day to enforce free-tier limits. This counter is stored in Firebase and is not shared with third parties.
Device and session identifiers
The free daily allowance is counted per account, and an account costs nothing to replace. So that the allowance cannot simply be reset by deleting an account or registering another one, the app sends two identifiers with the requests that spend it:
Alongside these we keep a hash of your email address, for the same purpose. These records hold only the day's generation count; they are deleted automatically after three days. They are used solely to enforce the free-tier limit and to keep a subscription to one device. They are never used for advertising, profiling, or tracking you across other apps or websites, and they are not shared with anyone.
App integrity
Before our servers answer a request, the app proves that it is a genuine, unmodified copy of DishDash using Google Play Integrity and Firebase App Check. Google issues that attestation and, in doing so, processes information about your device and app installation under Google's Privacy Policy. We receive only the verdict — genuine or not — and none of the device information behind it.
Feedback you send us
If you send feedback from Settings, we receive the message you wrote, the contact details you choose to add (optional — leave it blank and we cannot reply), and technical context that helps us act on it: your account identifier or the word “guest”, the app version, your app language and theme, and your device manufacturer, model and Android version. Feedback is only ever sent when you tap Send.
Advertising
The App uses Unity Ads, AppLovin MAX and Google AdMob to show rewarded ads (which unlock additional recipe generations). Their SDKs collect your device's Advertising ID (ad ID) and related ad-interaction data to serve ads, measure ad performance, and detect and prevent ad fraud. AppLovin MAX is a mediation service: it may pass your Advertising ID to the advertising networks in its pool in order to fill an ad request. You can reset your Advertising ID or opt out of ad personalisation at any time in your device's Google Settings → Ads.
Device & usage information
Google's Firebase services (Authentication, Firestore, and Cloud Functions) process technical information such as your IP address as needed to operate the app securely and reliably. The App does not use Firebase Analytics or Crashlytics, and we do not maintain our own analytics on your in-app behaviour.
We do not use your health and fitness data for advertising, profiling, or any purpose other than showing you your own progress in the Tracker.
We do not sell, rent, or trade your personal information. We share data only with:
We never share your health and fitness data. Step, water, and calorie data does not leave your device, and is not disclosed to any of the parties above — including our advertising partners.
We may disclose information if required by law or to protect the rights and safety of our users.
The App does not use browser cookies. It does, however, rely on the mobile equivalent — device identifiers and local storage read or written by the Google services listed above:
Third-party vendors, including Google, use these identifiers to serve ads based on your prior use of the App. For details of how Google uses information from apps that use its services — and the controls available to you — see How Google uses information from sites or apps that use our services.
You can opt out of personalised advertising in your device's Google Settings → Ads → Opt out of Ads Personalisation. Opting out does not remove ads; it makes the ones you see less relevant. If you are in the European Economic Area or the United Kingdom, the App asks for your consent through Google's User Messaging Platform before it makes its first ad request, and makes no request at all until that question has been answered.
Comments you post on community recipes are visible to all users (including guests). Comments include your display name and profile photo. You can delete your own comments at any time within the app. Other users may report comments that violate our guidelines; reports are reviewed and are not public.
Your data is retained as long as your account exists. When you delete your account (Settings → Delete Account), we permanently delete your saved recipes, meal plans, shopping lists, pantry inventory, cooking history, and your Firebase account. Community comments you posted are also removed. Deleting your account also removes your subscription record, your daily generation counter, and the list of recipes we have shown you. If you have an active subscription, deleting your account does not cancel it — manage or cancel a subscription in the Google Play Store, otherwise it will continue to renew. Feedback you have sent is kept so that we can act on it, and you can ask us to delete it at any time.
There is one deliberate exception. The short-lived record that carries the day's generation count — the hashed email address and hashed device identifier described in section 1 — is not removed when you delete your account, because removing it would make deleting and recreating an account a way to reset the free daily allowance. That record holds only a date and a count, contains nothing you created and nothing that identifies you, and is deleted automatically after three days.
Advertising identifiers and related ad data are retained by our advertising partners in line with Google's data retention policies, AppLovin's Privacy Policy, and Unity's Game Player and App User Privacy Policy.
Health and fitness data (steps, water, calories, and your daily goals) is held only in the app's private storage on your device, for as long as the app is installed. Step totals read from Health Connect are kept only for the day they belong to. You can erase all of it by clearing the app's storage in Android Settings, or by uninstalling the app; because it is never uploaded, there is nothing for us to delete on our side.
DishDash is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
All data is transmitted over HTTPS. Firebase security rules ensure that each user can only access their own data. Account passwords are handled and stored securely by Firebase Authentication and are never visible to us in plain text. We regularly review our security practices, but no system is 100% secure.
We may update this policy from time to time. Material changes will be announced in the app or via email. Continued use of the app after a change constitutes acceptance of the updated policy. The "Last updated" date at the top of this page always reflects the most recent revision.
If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:
dishdashsupport@gmail.com