Privacy

Your account: an id and your email address. Your kitchens and devices: their names, models and when they last spoke to us. Your approximate location, worked out from your connection, used to choose a nearby network route for your kitchens. Your usage and billing records.

Your kitchen itself is a computer we run for you, so whatever you and your cooks put on it is held on it until you destroy it.

We keep your logs by default. That means your cooks' conversations and your terminal output, exactly as they appeared. They can contain anything that was on screen, including passwords, keys and personal information. We store them encrypted, for 365 days unless you choose otherwise.

They are yours. In Counter › Sous-Chef you can see them, turn logging off, change how long they are kept, and delete them at any time. Destroying a kitchen does not delete its logs; delete them there too if you want them gone.

We train a personal model (a LoRA) from your logs only if you press Cut my LoRA. We first run your logs through a filter that removes passwords, keys, tokens, card numbers, email addresses and similar. A filter can miss things, so review your logs before you press it. Your model is used for you. We do not use your logs to train models for anyone else.

In Counter › Sous-Chef you can see your most recent LoRA and delete it at any time.

If you sign in to another agent on a kitchen, or link one, we keep that sign-in encrypted and may place it on your other kitchens, so you sign in once. See and remove them in Counter › Agents.

Sites you sign in to in your kitchen's browser stay in that browser. When you use Friendly mode for a sign-in or payment, that site's session is copied between your kitchen and your phone for you, through our servers, without being kept.

To show you your kitchen, its screen and pages pass through our servers on the way to your device.

Your kitchen's internet traffic normally leaves through your own device, your desktop or phone, while OpenKitchen is open on it, so websites see your connection. Otherwise it leaves through a Mullvad VPN node, or through Amazon if you choose that. Secure connections stay encrypted end to end, and we do not record the sites visited or their contents through this route. Kitchens cannot reach your local network through your device.

Our test of each route's speed makes small requests to a few public websites.

Sous-Chef is the agent your cooks run on by default. Its replies come from third-party AI models through OpenRouter. What is sent is what any coding agent needs to do its work: what you and your cooks say to it, and what it reads in your kitchen, which can include files, terminal output and web pages. If you switch a cook to another agent, that agent's provider handles what that cook sends, under your own account with them.

Amazon Web Services runs kitchens, storage and model training. Heroku runs our servers. OpenRouter and the AI providers behind it answer agents. Tailscale connects kitchens and devices. Mullvad carries traffic as above. Stripe, Square and Apple handle payments; we do not hold your card number. We do not sell your data.

Delete logs, your LoRA and sign-ins yourself at any time in Counter, and destroy a kitchen from Courts. To delete your account and everything under it, choose Delete account in the OpenKitchen or Yumbutton app, or write to support. We keep only the billing records the law requires.