Privacy.

Who this policy covers

This notice describes WunderGoo, operated by Bold Vibes Labs LLC, including its recipe app, parent account service and public support pages. Parent accounts are for adults. Children do not need an account to use Classic. These public policy pages contain no scripts, tracking pixels, advertising or forms.

Records that stay on your device

Pantry selections, saved batches, preferences and cooking progress are stored locally. The app does not upload child profiles, notebooks or photos to the parent account service. Photo composition happens on the device. Parent sign-in does not sync them. Clearing app or browser storage may remove them.

If a parent exports a backup or shares a picture, the selected destination receives that content and applies its own practices. Copies in device backups or other apps are controlled by those systems. Optional photos and sharing can be skipped.

Parent accounts and security

We process a parent email address and random account identifier to sign in, associate verified purchases and restore access. A device that buys a pass before a parent signs in gets a device account first: a random identifier with no name, email or other personal data until a parent signs in or confirms an email. If you sign in with Apple or Google, we receive that service’s stable identifier for you and your email address (Apple may share a private relay address that forwards to you). Apple sends your name only if you choose to share it; Google sends it with the account. We do not receive a password or your contacts. When you pay on the web, the email you give at checkout is kept as an unconfirmed hint for the email form; it does not sign anyone in until it is confirmed with a code. Sign-in codes and session tokens are protected as hashes on the server. Protected email- and IP-derived identifiers limit abuse of sign-in, account creation and purchase restore. They are kept for one hour. They can still point to you, so we treat them as personal data. Your internet provider and the networks between you and us can see your IP address. If you sign in with Apple we also keep, encrypted, a token Apple issues. When you delete the account we use it to withdraw our access, then delete it. If Apple cannot be reached we keep trying for up to 30 days, then delete it.

Web sign-in uses a secure, HttpOnly session cookie; the native apps keep the session in Keychain or Keystore. A session lasts up to a year and renews while the app is in use. The cookie supports authentication, not advertising. A signed offline access record permits paid use for at most 24 hours, bounded by pass expiry. It contains no child notebook or photo.

Purchases and service operation

We keep the product, purchase time, expiry, refund status, the account a purchase belongs to and the proof we checked. We use them to give you the access you bought, to restore it and to stop a purchase being used twice. When you buy in the App Store or Google Play, the app sends the store your random account identifier so the purchase is tied to your account; the store returns a signed purchase proof, which we verify with the store and keep encrypted. Purchase proofs are encrypted. We store a scrambled ID in place of the store’s own purchase reference. Both still count as personal data.

Apple, Google or Stripe processes payment on its own systems. We do not ask for card details in the recipe app. On the web, Link (Stripe) is the seller. Link keeps your name, email, billing address and payment details for the order, may offer you a Link account, and lets you view orders or ask for your data to be deleted at link.com. We send Stripe your random account identifier so the payment is tied to your account. From Stripe we keep a purchase reference, the product, the time, its status, and the email you gave at checkout as an unconfirmed hint until you confirm it or delete the account. Our service periodically checks purchase status and retries purchase acknowledgement. A store or network failure can delay confirmation. We do not use the account service to collect child activity for advertising.

Retention and deletion

Parent email, Apple or Google account identifiers, the shared name and account linkage remain until account deletion. A parent account with no email, no purchase and no signed-in device is removed after 90 days. Sign-in codes expire after 10 minutes; sessions expire a year after their last renewal and may be invalidated earlier. Sign-in rate-limit records use a rolling one-hour window. Expired sign-in records are deleted by a cleanup that runs with requests and on a schedule, so they can stay a little past their expiry.

Account deletion removes the parent profile, sign-in credentials and linked encrypted purchase proofs. If you signed in with Apple, deletion also asks Apple to revoke this app's access to your Apple sign-in. Small coded purchase records stay to stop a deleted purchase being used again. They have no end date. A record that an account ID was deleted is kept so a restored backup cannot bring the account back. Purchase recovery after deletion is not available.

Our encrypted backups keep a copy for up to 30 days. Our hosting provider (DigitalOcean) also keeps a daily copy of the whole server for disaster recovery and deletes each copy after 7 days. A deleted account can sit in a backup until that copy expires. Test purchases made with store test accounts are kept in a separate test database with the same protections. Local records and exported copies require separate deletion.

Children and outside services

WunderGoo is for supervised family use. We do not collect personal information from children. Accounts and purchases belong to the parent. Adult checks put purchases and external actions behind a parent step; they do not establish identity or legal parental consent. We do not request child names or child email addresses for parent accounts. Please avoid children’s identifying information in support correspondence.

External ingredient-shopping sites and parent-selected destinations have their own privacy practices. The app and the website use no advertising or analytics SDK. If we change how we handle data, we update this page and our store disclosures first.

Requests and policy changes

Use Account & deletion to delete the parent account. Contact support@wundergoo.com for questions or requests about access, correction or deletion of other information. We may ask you to confirm it is you. Never send sign-in codes. Available rights and complaint channels depend on applicable law.

The date at the top shows which version this is. Where the law requires it, we tell you about big changes in the app or by email before they start.

Service providers and locations

This website, the web app and the parent account service run on a server we operate at DigitalOcean in San Francisco, United States. Cloudflare runs our domain’s DNS and email routing and stores our encrypted backups (Cloudflare R2). DigitalOcean also keeps a daily copy of the whole server for disaster recovery, deleted after 7 days. Web purchases are sold through Link, the Stripe merchant-of-record service (Stripe, Inc., United States); Stripe processes the payment, calculates and remits any sales tax or VAT, sends the receipt and handles payment disputes, and your card statement shows LINK.COM followed by our descriptor. Purchases in the App Store or Google Play are processed by Apple or Google under their own terms. Parent sign-in emails are sent through Resend (United States). No advertising or analytics provider receives anything from the app or this site. Resend, DigitalOcean and Cloudflare handle data only for us. Google hosts our support mailbox (Gmail). Link (Stripe) is the seller of web purchases and handles your payment details under its own privacy policy. Apple and Google handle store purchases and sign-in under theirs. None of them may use your information for their own advertising on our behalf.

Operational records

Parent email, Apple or Google sign-in identifiers, the shared name and purchase linkage are kept until you delete the account. A parent account with no email, no purchase and no signed-in device is removed after 90 days. A checkout email is kept as an unconfirmed hint until it is confirmed or the account is deleted. Sign-in codes expire after 10 minutes. A session lasts up to a year and renews while the app is in use. Sign-in rate-limit records use a rolling one-hour window. Encrypted purchase proofs are cleared once the purchase is final; independent Google purchase evidence is cleared 60 days after its expiry. Small coded purchase records that stop a deleted purchase being used again have no end date. Our encrypted backups keep a copy for up to 30 days. Pantry, notebook and photos live only on your device. We do not hold them.

Support correspondence

Support and privacy emails are kept in our mailbox for as long as needed to resolve the question and for up to 24 months afterwards for follow-up and record keeping, then deleted. Mail to our @wundergoo.com addresses is routed by Cloudflare into a Gmail mailbox that we operate, and our replies go out through Resend. Those companies process the mail to deliver it and nothing more. Please leave children’s names, faces and identifying details out of messages. If some arrive we remove them from the thread once your question is answered.

Your privacy choices and rights

Depending on where you live you may have rights to access, correct, delete or export information about you, to restrict or object to its use, and to complain to a supervisory authority. Write to support@wundergoo.com to exercise them; we may ask you to confirm it is you. We reply within the time your law sets, and within 30 days. We do not sell personal information and do not share it for cross-context advertising. Residents of the European Economic Area, the United Kingdom and California have the rights those laws provide. If you are in the EEA or the UK: we use your parent email and purchase records because we need them to provide the pass you bought (contract), and we keep the small security records to prevent fraud (our legitimate interest). Everything is stored in the United States by us and the providers named above; the transfer relies on their standard contractual clauses and, where it applies, the EU–US Data Privacy Framework. You can complain to your national data protection authority, or in the UK to the ICO (ico.org.uk). We have no EU or UK representative. When a child’s device loads the app or a recipe, it sends the ordinary connection data (such as an IP address) that any website needs to deliver pages and keep the service working. We use that data for nothing else and keep no child records. Our web servers do not keep a log of visits. If a request fails, a short error note without your IP address is kept for fixing faults. Parent accounts are for adults only.