privacy policy
cooked is a free app that shows you restaurant hygiene grades in new york, chicago, los angeles, las vegas, seattle, austin, boston, london, manchester, and birmingham. this policy explains, in plain english, what the app does and does not do with your information.
account-less by design
- no sign-up, no login — we don't even know who you are.
- camera images never leave your phone, and saved spots stay on your device.
- no advertising id, no cross-app tracking, no ad profile.
here's the long version — the same promise, clause by clause.
no account, no sign-in
cooked has no accounts. it never asks for or collects your name, email, or phone number. there is nothing to sign up for.
location
when you use the camera “scan the block” feature or view the map, the app sends your precise location to the cooked backend (api.yallcooked.com, or cooked-api.vakilventures.com on older versions of the app) to find nearby restaurants and calculate where each grade should appear on screen. it is used only to answer that request.
your location is not tied to any account or identity, not used to build a profile, and not used to track you across other apps or for advertising.
camera
“scan the block” uses your camera for a live street view so grades can float over storefronts in the AR overlay. the camera image is used on-device for that overlay only. it is never stored and never sent to any server.
saved spots
spots you save are stored locally on your device only. they are not uploaded to the backend.
analytics
cooked uses google analytics for firebase. google collects:
- a pseudonymous app-instance identifier (the firebase installation / app-instance id — it identifies your install, not you);
- in-app usage and interaction events (which screens you view, and features you use such as scanning or searching);
- a coarse, approximate location that google derives from your IP address.
this is processed on google's servers and used only for aggregate, anonymous usage to improve the app. it is not linked to your identity and not used to track you across other companies' apps or for advertising. cooked does not collect the device advertising identifier (IDFA on iOS, Advertising ID on Android).
learn more: Google Privacy Policy and “How Google uses information from sites or apps that use our services”. analytics is disabled at app startup until you choose to allow it. Change your choice in About → Privacy choices.
this website
yallcooked.com — including the /r/ share pages — uses google analytics 4 to count visits and see which pages people land on. it reports into the same analytics property as the app, so a shared link and the install it leads to show up in one place. it measures pages, not people: no name, no email, no account.
optional website analytics starts only after permission is confirmed by our first-party privacy service. Until then Google receives no analytics requests, including cookieless pings. Our initial policy requires opt-in worldwide. We honor Global Privacy Control everywhere by disabling optional analytics and session replay.
advertising storage, ad personalization and ad-user-data are denied on every request, in every country, permanently. we don't run ads on this site and nothing in the interface can turn them on.
session replay (microsoft clarity)
this site also uses microsoft clarity to see how pages are actually used — where people click, how far they scroll, and where the cursor goes. it produces heatmaps and a replay of the page as it was rendered to you. we use it to find layouts that confuse people, on a site where one page template is reused across a quarter of a million restaurants.
it records interactions with the page, not you: no name, no email, no account, and we never link it to anything that identifies you. the only thing you can type on this site is the restaurant search box, and whatever you search is already in the page's own URL.
session replay is a separate, optional choice on both the website and app. Clarity starts only after explicit permission; rejecting analytics does not require rejecting replay, or vice versa. Search pages and pages with search terms in their referrer are excluded from website replay. App text is masked. Revocation stops collection and clears supported identifiers.
learn more: Microsoft Privacy Statement.
changed your mind? use Privacy choices in the footer or About → Privacy choices in the app. Choices last six months. Privacy records include a Cooked-only pseudonymous installation identifier, choices, policy version and timestamps; our proposed audit retention is 24 months, subject to policy review. Advertising is always disabled. We do not combine consent identifiers across products.
cooked in chatgpt and codex
the cooked plugin is free and accountless. when you ask it to find a restaurant or read an inspection, chatgpt or codex sends cooked only the tool inputs needed for that request: a restaurant name, an optional covered region or street-address hint, or restaurant and inspection identifiers. cooked receives no account profile and does not request your conversation history.
we use these inputs to retrieve public inspection records. search results may be cached for up to five minutes. we do not persist raw search terms, street-address hints, conversation text, or user profiles in the plugin's usage records.
to understand whether the plugin is useful and reliable, we keep daily and lifetime aggregate counts of tool calls, successes, errors, comparisons, ambiguous branch matches, and searches with no matches, plus aggregate response timing. these counts do not identify people and cannot tell us how many unique users or repeat users there are. a daily summary is sent to our private team discord channel; it contains aggregate numbers only.
the restaurant cards shown inside chatgpt or codex set no cookies and load no analytics, session replay, or advertising trackers. if you choose to open a cooked website link, a fixed campaign label identifies the plugin as the source of the visit. it contains no user or conversation identifier. the website's analytics and session replay follow the consent and global privacy control rules described above.
your use of chatgpt or codex is also subject to openai's own privacy policy and settings. cooked is independent of the inspection authorities and provides dated public records, not a guarantee of current safety.
notifications
notifications are optional. if you save a spot and allow notifications, the app registers an anonymous device push token so it can alert you when that saved restaurant's grade changes. this is keyed to an anonymous device identifier — not to your name, email, or any account.
where the grades come from
all grades and inspection results come from official public inspection data — NYC DOHMH, Chicago CDPH, LA County Public Health, the Southern Nevada Health District, Public Health Seattle & King County, Austin Public Health, Boston ISD, and the UK Food Standards Agency's Food Hygiene Rating Scheme for london, manchester and birmingham. grades may be out of date or may not reflect current status, so always verify with the official source. cooked is independent and is not affiliated with, endorsed by, or representing any city, health department, or the FSA.
children
cooked is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
changes
we may update this policy. when we do, we will change the effective date at the top.
contact
questions? email hello@yallcooked.com.
📅 effective October 5, 2026