Loading…
The short version: your data is kept in Europe, apart from the text an AI service reads to help make the memory book; nobody can find you unless you choose to be found, photos, stills and video of you come off the gathering's pages the moment you ask, and you can erase your data, not just hide it. Recordings of gatherings are the one exception to erasure, explained below.
Culinary Connections is run by Linda Steinbock, trading as Touching Distance, Inh. Steinbock (UID CHE-495.934.647), Schwanenstrasse 44, 8840 Einsiedeln, Switzerland. She is responsible for your data. For any question about it, or to exercise your rights, write to linda@touchingdistance.com.
If you leave your email address on our home page, we keep it on a list of its own, apart from any account. We use it only to tell you when Culinary Connections opens and to invite you to one of the first gatherings. We keep it until you ask us to remove it, by writing to the address above.
Your name, email, and password (for your account); the profile you choose to write (values, interests, stories, never demographic categories); your time zone, which your browser tells us when you accept an invitation, finish signing up or set up a gathering, so we can show you every time in your own hour (you can change it on your profile); for a gathering you host, your guests see the city of its time zone beside the hour; the gatherings you take part in; the photos, quotes, and reflections you add to a gathering's memory book; and, when a gathering uses our own video call with recording on, a recording of the call in sound and video and written transcripts of it.
People you have cooked with can see your profile card, minus any field you hide. Nobody else can see it until you turn discovery on. If you do, people one shared gathering away can see it too, never further, and never through public search. You can turn it off again anytime in Settings.
Whoever uploads a photo must confirm they have permission or a reasonable basis to share it. If you appear in a photo, or in a still, a clip or the one-minute film made from a gathering's video call, whether or not you use this product, you can have it taken down, no questions asked: any participant can act for you, or use its removal link. It comes off every page of the gathering at once, and the app gives out no new links to it. A clip taken down also takes down the one-minute film made with it. Previously issued image and video links may keep working until they expire, for up to five minutes after takedown. We also attempt to delete uploaded photos from storage. We retain the files of stills, clips and the film in private storage while we test the service. Copies already downloaded, or still open on someone's screen, cannot be recalled. We never run facial recognition or any biometric processing.
A gathering on our own video call is recorded. Our call page gives a recorded call's link only to people who have agreed to the recording, and the call shows whether it is recording the whole time. Recording starts when a second person joins and stops when the host leaves the call, ends the gathering, or everyone has left. Whereby, our video service, records the call and writes a transcript while it runs. We then move the recording and Whereby's transcript into our own storage and delete Whereby's copies. We find quotes in Whereby's transcript, or in our own transcript of the recording instead. Whereby's transcript names the account on the device each line was said on. When that account belongs to one of the guests, a quote said on that device is printed under their name unless the host changes it. The host approves everything that goes into the memory book. Nobody can watch or download the raw recording in the app. An AI service reads the transcript to find quotes, the recipe as it was spoken and the stories people told. It also writes a few lines for the memory book: why the recipe was chosen, a title for each story and the photo captions. For those lines, it also reads what guests write for the book, meaning their note when they said yes and the quotes and comments they add. Once the host approves the book, the lines on why the recipe was chosen also become the gathering's summary, unless the host has written their own. It never receives sound or video. Quotes are printed exactly as they were said, and the book marks which lines were written with AI. The host approves everything before anyone receives it. We never run facial recognition. We keep the recording and the transcripts after the memory book is made, so the book can be made again if someone asks. All of them are deleted when the gathering is deleted, or once everyone who took part has erased their account.
Leaving hides your profile and stops new invitations while past gatherings stay intact. Erasure goes further: your account and profile are deleted or anonymized, your contributions are deleted, and your name in past gathering records becomes an anonymous placeholder. The gathering itself remains for the people who were there. Recordings are the exception. A recording belongs equally to everyone in it, so it stays after you erase, with your voice and image in it, until the gathering is deleted or every other participant has erased too. In our copy of Whereby's transcript, your name is replaced on the lines you spoke. Everything else clears from this platform immediately, but not from the services we rely on to run it: our analytics and error-monitoring providers hold a record keyed to an internal identifier, our email provider keeps a delivery log of the address and subject line, and Anthropic, the AI service that helps make the memory book, keeps what it read for up to 30 days (up to 2 years for anything its safety systems flag as breaking its usage policy), each for that provider's own retention period. Ask us and we will pursue those directly.
Your account, gatherings, memory books and recordings are stored with managed providers in the EU region. Whereby, which runs the video calls, is based in Norway. The AI service that helps make the memory book is Claude, from Anthropic. It receives the transcript text, the gathering's title, date and dish, the host's invitation words, the names of the gathering's host and guests, what guests write for the book and the captions they give their photos, never sound, video or the photos themselves. Anthropic stores what it receives in the United States, may process it in other countries, deletes it within 30 days, and does not use it to train its models. Anything its safety systems flag as breaking its usage policy it keeps for up to 2 years. We plan to move this work to a service that processes in the EU. When we make our own transcript of a recording, it is made on our own equipment in Switzerland. While the service is being tested, the working copies on that equipment are kept. Analytics is limited to a fixed set of product events recorded server-side; there is no advertising tracking, no session recording of how you use the site, and no engagement profiling.
Security and audit logs (who did what, when) are kept for a defined period with restricted access, then removed.