Privacy Policy

Hit VPN: Cook Together, published by SOOTY INVESTMENTS LTD, preserves Simmeroa's private cooking sessions, recipes and timers. It also offers an optional VPN, a WebSocket tester and connection explanations by AI. This policy describes those features and our support pages.

Recipes and preferences

Saved recipes, ingredient checklists, serving choices, timers and cooking history stay on your device. Language, appearance and first-launch preferences are also stored locally. Recipe searches run locally. Updating the app preserves this data and its existing installation identity.

Private kitchens and calls

The app creates a random installation identifier and signing key when it needs the service. The service receives that identifier and its public verification key to authenticate requests. The private key stays in the device Keychain. No personal profile, email address or telephone number is required to cook.

Our service stores your cook label, kitchen membership, recipe choice, invitation code, shared step and related times so an invited partner can join and follow the same step. Share invitations with people you trust.

Camera and microphone capture starts after you choose to start a call and grant the system permissions. Live pictures and sound pass through our relay to the other cook and are processed transiently, rather than saved as recordings. Transport is encrypted; calls are not end-to-end encrypted. The other cook may independently record what you share. You can mute or stop a call. Leaving the call screen or backgrounding stops audio and video. Solo cooking works without camera or microphone permission.

Optional VPN

After your explicit consent and the system's configuration permission, the native Network Extension carries IPv4 Internet TCP and UDP packets through HTTPS to our service on simmeroa.cloud. Apple’s OS TLS protects transport to the managed HTTPS relay. The existing installation identifier and public signing key authorise the session; the private signing key remains in this device’s protected Keychain. We store public peer and virtual IPv4 allocation records until deletion. Sessions expire after one hour, and the app discloses traffic limits and lets you disconnect or reconnect.

The managed HTTPS relay and our VPN server process destinations, DNS queries and packet contents in transit so they can forward traffic. HTTPS website traffic retains its separate website encryption. Our app server does not retain browsing activity, destination, DNS-query, packet-content or peer-address logs. Managed hosting providers may process operational connection information under their own practices as described below. This is not end-to-end packet encryption or a promise about third-party retention.

The server supplies Cloudflare public DNS at1.1.1.1; that resolver processes queries under its own privacy practices. Local-network, Apple push-notification and cellular service traffic, and iOS's mandatory exceptions, remain outside the tunnel. IPv6 Internet is blocked. The VPN does not promise anonymity or protection for every system connection. NetworkExtension system tunnels are unavailable in iOS Simulator.

WebSocket testing

The tester connects only to an endpoint you choose. That endpoint receives the authentication settings and messages you send. Choose servers you trust, and use encrypted wss connections for sensitive data. Unencrypted ws connections are explicitly identified. Local-network access requires system permission.

Authentication settings and the foreground session's bounded, timestamped logs stay in memory. The tester stops in the background. Known authentication values are redacted from displayed and exported logs; message contents can still contain information you choose to send. An export writes the selected log to the destination you choose. We do not upload diagnostic message contents automatically.

Our optional public sample endpoint echoes only the sample data you send. It has no access to private kitchen records or VPN credentials and no outgoing network access. It processes peer addresses temporarily for short-lived connection limits; it does not save message contents or a diagnostic history.

AI explanations

Before an explanation, the app shows the exact metadata snapshot and asks permission to send it to OpenAI. It contains the selected language and up to 30 event types, relative elapsed times, byte counts and fixed error categories. Endpoint addresses, message contents, authentication values, files and location are excluded. Declining does not restrict cooking, the VPN or tester. You can withdraw this consent in Settings.

Our backend forwards the snapshot and its instructions through the developer's gateway to OpenAI. OpenAI processes that content under its privacy policy. We do not promise an OpenAI retention period, training exclusion or special account arrangement. Generated explanations are suggestions to check, not new network measurements.

The gateway keeps bounded timing, usage and error diagnostics and its authenticated client identifier; it does not record request content or retain completed answers. Our backend keeps request identifiers, installation ownership, timestamps, a hashed IP-address risk bucket, completion/error status and an answer hash for up to 30 days to enforce allowances and prevent abuse. It does not ordinarily store the metadata snapshot or generated answer. An answer reaches the developer only when you separately preview and submit a content report; that report retains its shown answer and reason for 30 days.

Separate short-lived security records keep random request identifiers, a hashed network risk bucket and timing/lease fields without installation identifiers or AI content. They preserve network limits and the app's daily allowance through data deletion. Routine cleanup removes them after 48 hours while the service operates. Deletion still removes the personal AI request records and submitted content reports.

Hosted sessions and launch observations

Hosted pages use a persistent website store for cookies and localStorage, including HttpOnly session cookies. A device-only encrypted Keychain copy of unexpired persistent same-host cookies supports native HTTP handoffs after restart; it excludes session-only cookies and private browsing. Retrying, closing a page, backgrounding and restarting do not erase the session store. Website sign-out or an explicit reset clears the relevant session. Private website stores, when used, remain separate. Cookies and storage are not copied between unrelated origins.

Trusted hosted-flow requests include the installed app's version and build. When the enabled native App Store storefront-country check passes, a deterministic app-specific success selector is also sent. The country reading stays on-device; the selector conveys the aggregate observation. It does not identify a user, installation source or purpose. These observations support hosted routing and the one-time first-launch rating invitation; they do not authenticate an account or grant paid access.

Reports and support

A cooking report contains your reason and details, the kitchen identifier, reporting and reported installation identifiers, and submission time. A block stores the relationship between identifiers, ends the kitchen and prevents those installations joining again. Reports are forwarded privately to our support system, with retries for temporary delivery failures.

The support form receives your message, reply address and any name or subject you provide. Our support system stores these details and forwards them privately so we can respond. Avoid sending passwords, authentication codes, private documents or other sensitive information unnecessary for your request. A submission confirmation records acceptance, rather than promising mailbox delivery.

Hosting and security

The app's own domain carries hosted pages, backend requests and AI requests through a regional managed proxy. Cloudflare supplies domain infrastructure and compatibility routes for previously released clients. Hosting and support providers process information required to operate those services. Network requests necessarily expose connection information such as an IP address; infrastructure providers may retain operational and security logs. Signed requests carry short-lived values to reject invalid or replayed traffic.

We use information to provide these features, protect the service and respond to requests. We do not sell personal information, use it for advertising tracking, or include advertising or analytics SDKs. The app has no purchases or subscriptions.

Retention and deletion

Local cooking data remains until you clear it or remove the app's data from the device. Invitations expire after 24 hours. Routine cleanup removes kitchen records seven days after expiry, cooking reports after 30 days and used authentication values after ten minutes. Cleanup runs while the service operates.

Active installation, block and VPN public-peer records remain until deletion. VPN session leases expire after one hour; rate counters use one-minute windows. A retired installation's random identifier, public verification key and deletion time remain to reject reuse. This security record contains no private signing key, VPN packet contents, local recipe history or call recordings. Support correspondence, including delivered reports, remains until a privacy request or administrative removal.

In My Kitchen, open Settings. Clear this device removes local cooking data. Delete my data disconnects and removes the app's VPN configuration, deletes hosted kitchens, membership, reports, blocks, VPN public peers and AI records, retires the installation identity, clears the hosted session and withdraws AI consent. Completion is confirmed only after service acknowledgment, including VPN revocation. If interrupted or unavailable, retry the same deletion to finish it.

For access, correction, deletion or privacy questions, use the support page. We may ask for information that verifies ownership of the requested records. Your rights depend on where you live; you may also raise concerns with your local data protection authority.