Last updated: 24 August 2026

Nod Chef has no account to create, no sign-in, and no server that holds anything of yours. Your recipes, your photographs and the camera feed never leave your device. That is the promise this whole app is built around, and nothing below weakens it.

Two things do leave: an anonymous crash report when something breaks, and an anonymous count of which features get used. You can switch both off. This page says exactly what they are.

What stays on your device

• Your recipes — titles, ingredients and steps that you type, paste, or save from the catalog. Stored on your device.
• Recipe photos — resized on your device and stored with the recipe. Location data and other camera information are removed in the process and are not kept.
• Your settings — appearance, language, gesture and sensitivity values.
• Your purchase status — whether the one-time unlock has been bought. Handled by Apple; we only cache the result locally.

The camera

Nod Chef uses the camera in two ways, and in neither case is anything recorded or uploaded:

• Front camera — to detect the small movement of your head that moves you through recipe steps. The feed is processed live on your device by Apple's ARKit and is never written to disk, never shown as a recording, and never sent anywhere. You can turn head tracking off at any time and use taps instead.
• Back camera — only when you choose to take a photograph for one of your own recipes. The image is stored with that recipe on your device.

If you pick an existing image instead, iOS shows you its own picker and hands Nod Chef only the image you selected. Nod Chef does not browse or read your photo library.

The recipe catalog

The catalog is downloaded from our content server over HTTPS, the same way any app downloads its content. It is a download: the request carries nothing about you, there is no account, no cookies and no identifier, and nothing you do in the app is sent back with it. Saving a catalog recipe copies it onto your device.

Diagnostics — and how to switch them off

Settings › Diagnostics has one switch. It is on by default and turns off everything in this section.

Crash reports (Sentry). When the app crashes or freezes we receive the technical report — where in the code it happened and what the app was doing. It is configured to attach no device identifier, no IP address and no user information, so a report says what broke, not whose app it was.

Usage counts (PostHog). Anonymous counts of what the app is used for: that a recipe was saved and by which route, that cooking started, that a head gesture moved a step, how head tracking behaved during a session, that the unlock screen was seen. This last one is why it matters — head control has to work in real kitchens, on real counters, and those numbers are the only way to tune it for phones that are not ours.

What is never sent, by construction: the text of your recipes, their titles, ingredients, steps or photographs; anything you type; your name, email or location; any image from either camera. The events can only carry counts, yes/no values and a fixed list of words. There is nothing in them that identifies you, and neither service is used to build a profile of you or to follow you into other apps.