Security Policy

Last updated: 3 November 2026

Keeping your account and data safe matters to us. This page explains how we protect Smart Kitchen Assistant, what you can do to stay safe, and how to report a security problem.

1. How we protect your data

• Encrypted connections: the whole site is served over HTTPS, so data between your device and us is encrypted.
• Hashed passwords: email/password accounts are stored as one-way hashes (bcrypt). We never store or see your actual password.
• Google sign-in: if you sign in with Google, Google handles your password; we only receive your name and email.
• Payments: card details are handled entirely by Stripe. We never see or store full card numbers.
• Server-side keys: keys for our AI and recipe providers are kept on our servers, never in your browser.
• Trusted infrastructure: data is stored with Firebase (Google Cloud) and the site is hosted on Netlify.
• Minimal data: we only collect what we need to run the service. Display and accessibility preferences stay on your device.

2. Keeping your account safe

• Use a strong, unique password (we require at least 8 characters with a mix of letters, numbers and symbols).
• Don't share your login details, and log out on shared or public devices.
• We will never ask for your password by email, phone or message.
• Be wary of emails pretending to be us. Our emails only link to smartkitchenassistant.co.uk.
• Don't put personal or sensitive information into AI recipe requests.

3. If something goes wrong

If we become aware of a data breach that affects your personal data, we will tell affected users and, where required, the Information Commissioner's Office (ICO) within 72 hours, as required by UK GDPR.

4. Reporting a security issue

If you think you've found a security vulnerability, please email smartkitchenassistant@gmail.com with the subject "Security report" and as much detail as you can. Please:

• Give us reasonable time to fix the issue before sharing it publicly.
• Don't access, change or delete other people's data.
• Don't run tests that could disrupt the service (e.g. denial of service or spam).

We aim to acknowledge reports within 3 working days and will keep you updated while we fix it. We won't take legal action against anyone who reports an issue in good faith following these guidelines.

5. Changes

We may update this policy as the service changes. The date above shows when it was last updated.

See also our Privacy Policy, Accessibility Statement and Terms of Service.