Torrere
Torrere — Privacy Policy
Effective date: 22 September 2026
This policy explains what Submarius LLC (“Torrere”, “we”, “us”) collects when you use the Torrere apps and the Torrere website, why, who else sees it, how long we keep it, and what you can make us do about it.
It is written to be read. Where something is a genuine limitation rather than a reassurance, it says so.
1. The short version
- We collect the account you create, the things you write to the assistant, the recipes that come out of it, and enough billing and usage data to charge you correctly and stop the service being abused.
- To answer you, we send your messages, your recipe and your cook profile to Anthropic, PBC, an AI provider in the United States. Section 5 is the important one.
- We do not sell your data, we do not share it for advertising, and there is no analytics or tracking SDK in the apps or on this site.
- You can get a copy of your data, correct it, or have it deleted. Section 11.
2. What we collect
Your account. Your email address, a hash of your password (never the password), and — if you use one — the public half of a passkey. Passkeys are created and held by your device; the private key never reaches us.
What you write. Your messages to the assistant, and the recipes they produce. A recipe is stored as a versioned document, so we hold its history as well as its current state — that is what makes “undo” work.
Your cook profile. What you tell us about your kitchen, your household and your tastes, so the assistant works with what you have. It deliberately holds no diets, religious or medical — the app will not accept one.
Allergies. Kept separately from the profile above, because allergy and intolerance data is health data and we treat it as the more sensitive category the law makes it: we ask for your explicit consent on the screen where you enter it, and we record that consent. It is sent to the assistant as a rule naming the foods to keep out, never as a fact about you. Withdrawing consent switches the feature off and stops the data being used; we keep a record that you declared it and withdrew it, which is the evidence that we were allowed to hold it at all. Deleting your account removes it outright.
Photos and pasted text. If you paste text for the assistant to read, that text is stored with the recipe it produces. A photo is not: it is read once, in the moment, and the image itself is never written down — we keep only a record that a photo was read, its size and dimensions and a fingerprint of it, for 90 days. Photos are sent to the AI provider inline with the request and are never uploaded to a separate file store there, so there is no second copy to forget about.
Billing. Which plan you are on, when it renews, and whether a payment succeeded. We never see your card number. Payments on the web are handled by Stripe; on iPhone and iPad by Apple; on Android by Google. Each of them tells us that a subscription exists, not how it was paid for.
Usage and cost. Every request to the AI model writes a metered row: which model, how many tokens, what it cost and how long it took. The row holds no message content — that is enforced in code, not by policy. We use these rows to bill correctly, to hold the free allowance to its limit, and to notice abuse.
Technical data. Your IP address and the time of a request, in web-server logs and in the security records behind sign-in throttling and session-reuse detection. Native apps send a device attestation from Apple or Google, which tells us the device is genuine and how much free use it has had. That check is deliberately kept in a separate database from everything above, because combining a device identifier with health data is something Google’s own terms forbid and we would rather not be able to do it at all.
Page visits. When a page on this website or the web app loads, we record which page it was, whether it loaded, the name of the site that sent you (never the full address you came from), and the kind of browser, such as Safari or Chrome, or the name of the search engine or crawler. We do not store your IP address with it, set no cookie for it, and tie it to no account. To count one visit as one, we make a code from your address and browser using a secret that is replaced every midnight and never written down, so the same visit can be counted today and cannot be recognised tomorrow. The apps load their screens from your phone, not from us, so none of this comes from them.
What we do not collect. No advertising identifiers. No location. No contacts. No analytics SDK, no session recording, no third-party tracker, no cookie banner, because there is nothing to consent to: the only cookie we set is the one that keeps you signed in.
3. Why we are allowed to hold it
Where the GDPR or UK GDPR applies:
| What | Basis |
|---|---|
| Account, recipes, messages, cook profile (other than allergies) | Performing our contract with you |
| Allergies and intolerances | Your explicit consent (Art. 9(2)(a)) — withdrawable at any time |
| Sending your content to the AI provider | Performing our contract, plus the separate in-app consent we ask for before your first message |
| Billing records | Contract, and our legal obligation to keep tax records |
| Security, abuse prevention, spend limits | Our legitimate interest in not being defrauded, balanced against your rights |
| Service emails (verification, password reset, receipts) | Contract |
We do not send marketing email. If that ever changes we will ask first.
4. Cookies
One cookie, set when you sign in on the web, holding your session. It is
HttpOnly and Secure, and it exists so you do not have to sign in on every
page. Clearing it signs you out. There are no advertising, analytics or
cross-site cookies to refuse.
5. AI processing by Anthropic, PBC
This is the part most worth reading.
To answer you, we send your content to Anthropic, PBC, in the United States, which processes it on our behalf under a contract and returns the response. What we send:
- your chat messages;
- the recipe document you are working on;
- photos you send for the assistant to read;
- the foods you have told us to avoid, sent as a rule naming those foods and not you;
- what you have told us about your kitchen, your household and your tastes.
We ask you to agree to this on a screen in the app, before your first message. If you do not agree, the assistant cannot run — there is no version of this product that works without it.
Anthropic, PBC acts as our processor: it uses what we send to produce the response and does not use it to train its models.
One limit we cannot design away, stated plainly. Anthropic, PBC keeps what we send it for up to 30 days for abuse monitoring. If its safety classifiers flag a session, it may retain that session for up to 2 years, and the classification scores for up to 7 years. All of that is outside our control, it survives your deleting your account with us, and it caps what any promise of deletion can honestly mean. It is disclosed here, and again on the receipt you are shown when you delete.
Pages you import. The assistant does not search the web and cannot go looking for a page you have not given it. When you hand it a link, that page is normally fetched by our own servers, not by your browser and not from your address.
There is one exception, and it matters because it involves your own connection. Some sites refuse our servers. When that happens, the iPhone, iPad and Android apps open the page in a web view inside the app and read it on your device — so that request comes from your address, and the site sees it the way it would see any visit from your phone.
6. Who else sees it
Everyone we use, and what they get. They are processors: they act on our instructions and may not use your data for their own purposes.
| Who | What they get | Where |
|---|---|---|
| Anthropic, PBC | Messages, recipe, photos, cook profile — see section 5 | United States |
| Amazon Web Services | Hosting. Everything lives on servers we run in AWS | United States (Ohio) |
| Amazon SES | Your email address and the text of service emails | United States |
| Stripe | Web payments. Your email address and your subscription; your card number goes to Stripe, not to us | United States / Ireland |
| RevenueCat | Mobile purchase receipts and your Torrere account identifier | United States |
| Apple, Google | Purchases made through their stores, and device attestation | Per their own policies |
We disclose data to anyone else only where the law requires it, or where it is necessary to establish or defend a legal claim. If we are ever compelled to hand over your data, we will tell you unless we are legally prevented from doing so.
International transfers. We operate from the United States. If you are in the UK, the EEA or Switzerland, your data is transferred there under the European Commission’s Standard Contractual Clauses (and the UK Addendum where it applies), which each processor above has signed.
7. How long we keep it
Retention is set when a record is written, not decided later, and a job runs every night to retire what has passed its date.
| What | Kept for |
|---|---|
| Your account, recipes and cook profile | Until you delete them, or the account |
| Chat messages | 90 days from when they were written |
| Every version of a recipe | For the life of the recipe — its history is what makes undo work |
| Imported pages and photo records | 90 days |
| Login records — when and from where you signed in | 400 days |
| Usage and cost rows (no content) | 400 days |
| Page visits on the website (no address, no account) | 400 days |
| Safety and abuse records | 400 days — they are the evidence behind a suspension |
| Proof that you consented, reduced to the fact and its date | 6 years after deletion |
| Encrypted backups of both databases | 35 days from when each nightly copy is made |
What the nightly job enforces today, and what it does not. It sweeps chat messages and conversations, imported pages, login records, the usage and cost rows, and page visits. Two things it leaves alone, and we would rather say so than claim otherwise: the conversation you are currently in, so the app can pick up where you left off; and the sentence that produced a recipe you still have, which stays with that recipe for its life because it is part of the recipe’s history. Safety and abuse records carry their period but are not yet swept by the job.
8. Security
Everything is encrypted in transit. The database is not reachable from the internet at all — it listens only on the server’s own loopback interface. Passwords are hashed with a memory-hard function; we could not tell you your password if we wanted to. The AI provider’s key is not stored on the server’s disk; it is fetched at start-up from a secrets store. Message content is deliberately kept out of every log.
None of that makes us unbreakable, and we are not going to claim it does. If your data is ever exposed in a way that puts you at risk, we will tell you and the relevant regulator within the time the law allows.
9. Children
Torrere is not for children. You must be at least 13 to use it, we do not knowingly collect anything from anyone younger, and the app is rated accordingly in both app stores. If you believe a child has given us their data, write to support@torrere.com and we will delete it.
10. Deleting your account
You can delete your account and everything in it:
- In the app — the Account tab, then Delete account.
- By email — if you cannot get into the app, https://torrere.com/delete explains how to ask us instead.
Deletion removes your profile, the foods you asked us to avoid, your recipes, your chat history, and revokes every link you have shared. Done in the app it happens immediately and it cannot be undone — there is no grace period and nothing to cancel — and you are shown a receipt saying what was removed and what was kept. Asked for by email, it is done once we have checked the request came from you.
What we keep afterwards, and why. The fact that you consented, reduced to the date and the purpose, for six years, because it is the proof we were allowed to hold your data at all. Billing records the tax authorities require. Cost totals with your identity stripped out and replaced by a one-way hash. And, for the phone you deleted from, a record of how much free cooking was used on it and on the account it was signed in to, with the account no longer attached — that record is what stops deleting an account from starting the free allowance over. All of those are named on your receipt.
Backups are the honest caveat. A copy of your account may remain in our encrypted backups for up to 35 days after you delete it. Backups are used only to restore the service after a failure, and if we ever restore from one we re-apply every deletion recorded since it was taken before the service comes back. That is a documented procedure we carry out by hand, not something the software does on its own, and we would rather tell you that than imply otherwise.
And the limit in section 5: a session flagged by the AI provider’s classifiers is outside the reach of this deletion.
11. Your rights
Wherever you are, you can ask us to:
- give you a copy of your data — write to support@torrere.com and we will put one together for you;
- correct anything wrong;
- delete it (section 10);
- stop or limit a particular use;
- withdraw a consent — for the allergy feature, or for AI processing — without affecting what was lawful before you withdrew it.
Write to support@torrere.com from the address on your account. We answer within 30 days and we do not charge for it. If you are in the UK or the EEA you can complain to your national data protection authority; we would rather you came to us first.
If you are in California, we do not sell or share personal information as CCPA defines those words, we have not in the past 12 months, and we will not discriminate against you for exercising any right above.
12. Changes
We may change this policy. If a change is material we will tell you before it takes effect — by email, or in the app — and the effective date at the top will change. Continuing to use Torrere after that means the new version applies.
13. Contact
Submarius LLC 30 N Gould St Ste R, Sheridan, WY 82801, United States +1 941-384-6733 support@torrere.com