1. Introduction
Palate ("we", "our", or "the app") is a personal, non-commercial culinary AI assistant operated by Donovan Everitt. This Privacy Policy explains how we collect, use, and protect your information when you use Palate at palate.goldhamster.box.ca.
2. Information We Collect
2.1 Jellyfin Account Data
Palate authenticates users exclusively through your self-hosted Jellyfin media server. When you sign in, we verify your credentials with your Jellyfin server and receive your username and unique Jellyfin user identifier. This data is used solely to authenticate you and maintain your session in Palate. Google accounts are never used for login or authentication.
2.2 Optional Google Calendar Integration
If you choose to explicitly connect your Google Calendar in Settings, Palate requests access to your Google Calendar via OAuth 2.0 with the calendar scope. This permission is used exclusively to create, update, and delete meal plan events in a calendar you designate. Google OAuth is never used for Palate login or user account creation. OAuth access and refresh tokens are encrypted at rest using AES-256-GCM authenticated encryption. You may disconnect and revoke this integration at any time from Palate Settings.
2.3 User-Generated Content
Recipes, meal plans, chat sessions with Sage (our AI assistant), and culinary preferences you create within Palate are stored in our database to provide the service.
2.4 API Keys
If you provide a Google Gemini API key for AI features, it is encrypted using AES-256-GCM before storage. The plaintext key is never stored or logged.
3. How We Use Your Information
- Authenticate your identity with your Jellyfin server and maintain your session
- Store and display your recipes, meal plans, and AI chat history
- Synchronize meal schedules to your Google Calendar (only when you explicitly connect and enable this feature)
- Query the USDA FoodData Central API for nutritional information on your behalf
- Process AI requests through the Google Gemini API using your provided key
- Remember your display preferences (measurement system, calendar settings)
4. Data Storage & Security
Your data is stored in a PostgreSQL database on a server hosted by Whatbox.ca in Canada. We implement the following security measures:
- API keys and Google OAuth tokens are encrypted at rest with AES-256-GCM using unique initialization vectors and authenticated tags
- Authentication is strictly handled by your self-hosted Jellyfin server
- All connections to the app are served over HTTPS
- Content Security Policy headers restrict resource loading
- Rate limiting is applied to API endpoints
5. Third-Party Services
Palate integrates with the following third-party services:
- Google Calendar API & OAuth 2.0 — for optional meal plan synchronization (configured in Settings, never used for login)
- Google Gemini API — for AI-powered recipe synthesis and analysis
- USDA FoodData Central — for deterministic nutritional data
Each of these services has its own privacy policy. We encourage you to review them. We do not sell, share, or transfer your data to any other third parties.
6. Data Retention & Deletion
Your data is retained for as long as your account exists. You may request deletion of your account and all associated data at any time by contacting [email protected]. Upon deletion, all personal data, recipes, chat history, and stored tokens will be permanently removed from our systems.
7. Google API Services User Data Policy
Palate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide and improve the features you explicitly enable. We do not use Google user data for serving advertisements, and we do not allow humans to read your data unless required for security purposes, to comply with applicable law, or with your affirmative consent.
8. Children's Privacy
Palate is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated "Last updated" date. Continued use of Palate after changes constitutes acceptance of the revised policy.
10. Contact
For any questions or concerns regarding this Privacy Policy or your data, please contact:
Donovan Everitt
[email protected]