ChefGPT

GDPR overview

There is no GDPR mention anywhere. Searching the eighteen text files and thirty-three archived HTML pages collected from the site returned no occurrence of the GDPR, of data protection or of the European Union. No Article 27 representative is named, no data protection officer, no dedicated privacy address. The policy sets out no legal basis for processing, no retention period and no transfer mechanism, and says nothing about access, rectification, erasure or portability. What exists instead is a six-section privacy policy of roughly 3,500 characters, last updated on 27 January 2023, whose only security commitment is "commercially reasonable physical, administrative, and technical safeguards". The Google Play data safety card, declared by the publisher, adds that no data is shared with third parties, that data is encrypted in transit and that deletion can be requested.

Who owns the data?

The terms of service are unusually direct on this point: every piece of content the service generates, recipes included, belongs to ChefGPT, and reproducing or distributing it requires prior written consent. On the collection side, the privacy policy — last updated on 27 January 2023 — describes data gathered at registration, when placing an order, subscribing to the newsletter, answering a survey or filling in a form, together with usage data and preferences. ChefGPT states that it does not sell, trade or transfer personally identifiable information to outside parties, with an exception for the trusted third parties that help operate the service, and reserves the right to disclose information where the law requires it.

Reuse rights

Little is left to the user. The terms grant no licence over generated content: recipes belong to ChefGPT, and reproducing or distributing them is subject to prior written consent. Use of the service is limited to personal purposes, with commercial or business use requiring written agreement in advance. Nothing in the published documents addresses exporting a cookbook, reusing a meal plan commercially, or the portability of the information a user has entered. In practice you may cook from what the app produces, but you should not assume a right to publish it.

Hosting summary

Nothing is published about hosting. The privacy policy names no country, no region, no provider and no subprocessor; its only commitment is to "commercially reasonable physical, administrative, and technical safeguards". A DNS lookup on 9 August 2026 resolved the domain to 76.76.21.21, an anycast address announced by AS16509 (Amazon.com, Inc.) and geolocated to the United States. An anycast CDN node indicates where a page is served from, not where data is stored, so nothing about the jurisdiction of processing should be inferred from it. The publisher, MIU Digital Limited, is based in Hong Kong. The only structured statement available comes from the Google Play data safety card, declared by the publisher: no data shared with third parties, data encrypted in transit, and deletion available on request. Anyone with a hosting-location requirement will have to ask the vendor directly.