STOOM Kitchen ("STOOM", "we", "us" or "our") provides kitchen software for recipes, menus, planning, service, shopping, larder, sharing, backup, billing, AI assistance and related website services.
The data controller is Stoom.kitchen Ltd, a company registered in England and Wales under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS].
This Privacy Policy explains what personal data and kitchen data we collect, why we use it, who we use to process it, and the choices and rights you have. It applies to the STOOM Kitchen app, the STOOM website, support channels, billing flows and connected server services.
For privacy questions or data-rights requests, contact privacy@stoom.kitchen.
STOOM is local-first. The app stores working kitchen data in browser or app storage, including IndexedDB and local storage. This lets STOOM work when the network is unreliable and keeps ordinary cooking tasks from depending on a live server call.
We use local storage, service-worker caches and limited cookies or session storage to:
If you clear browser storage, use private browsing, replace a device or uninstall the app, local-only data can be lost unless you have exported a backup, synced the kitchen or enabled cloud backup. You can clear local data through your browser or operating-system settings, but doing so may break offline access or device recovery.
AI features are optional and may process recipe text, menu text, photos, OCR output, larder context, shopping context, voice transcripts or other kitchen content needed to answer your request. STOOM Cloud AI routes requests through STOOM's server and selected AI providers according to plan and policy. BYOK provider keys you add in the app are stored on your device and are not stored as secrets on STOOM servers.
Voice features may process audio or transcripts to understand commands. AI and voice results can be wrong; review recipes, quantities, allergens, timings, prices and safety-critical information before relying on them.
We use trusted service providers to operate STOOM. The providers may change as the product evolves, but they are used only where needed to provide, secure, bill, support or improve the service.
We do not sell, rent or trade your personal data.
We do not automatically subscribe you to marketing emails. Transactional messages, such as recovery, billing, trial, support and security emails, are sent where needed to provide the service. Marketing-style messages are opt-in or otherwise sent only where lawful, and you can unsubscribe or contact us at any time.
Where UK GDPR or EU GDPR applies, we rely on the following legal bases:
Local app data remains on your device until you delete it, clear storage, uninstall the app or import/restore over it. Synced kitchen data, media pointers, backups, subscription records, support messages and operational logs are kept for as long as needed to provide the service, preserve backups, resolve support issues, meet legal obligations and protect the platform.
When you delete a kitchen, it is locked immediately, retained for a limited recovery period (currently 30 days) so an accidental deletion can be reversed, and then permanently deleted from our systems, sync history and backups as far as is technically practicable. Limited financial and transaction records are kept after that for legal, accounting and fraud-prevention reasons, no longer linked to an identifiable kitchen.
Cloud backup snapshots and media backups follow the retention settings and plan rules in the app and server. Some records, such as invoices, payment logs, admin audit events and abuse-prevention logs, may need to be retained even after you stop using STOOM.
Depending on where you live, you may have rights to access, correct, export, restrict, object to or delete personal data. You can export kitchen data from the app, and you can contact us for account, support or server-side deletion requests.
We may need to verify your request before acting on it. We may also need to retain limited records where required by law, security, billing, dispute handling or abuse prevention.
To exercise your rights, contact privacy@stoom.kitchen.
We use practical security measures including HTTPS, access controls, server-side checks, admin audit logging, payment-provider controls, backup controls and local-first design. No internet service can be guaranteed perfectly secure. Keep your device, kitchen ID, join codes, backups, email account and BYOK provider keys safe.
STOOM and its providers may process data in the United Kingdom, European Union, United States or other locations depending on infrastructure, support and provider operations. Where required, we rely on appropriate contractual and legal safeguards for international transfers.
STOOM is not designed for children to use without supervision. If you believe a child has provided personal data without appropriate permission, contact us and we will review the request.
We may update this Privacy Policy as STOOM changes. We will update the "Last updated" date and, for material changes, may provide additional notice in the app, by email or on the website.
If you have questions, concerns, or requests related to privacy, contact us:
Email: privacy@stoom.kitchen
Post: Stoom.kitchen Ltd, [REGISTERED ADDRESS]
If you are not satisfied with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. If you are in the EU, you may complain to your local supervisory authority.