Privacy
Updated 2026-10-10. This page is the policy for Tomato Potato.
Who this is
Tomato Potato is made by Scrolling Is Evil LLC. Questions: support@scrollingisevil.com.
What the phone stores
Recipes you import or type, grocery lists, planner notes, the ZIP code you enter for grocery carts, and your settings stay in a local database on your phone. There is no Tomato Potato account. Uninstalling the app deletes that local data.
What leaves the phone
If you paste a TikTok or Instagram Reels link, the app sends the link, and the caption when it has one, to our extract service at tomatopotato-extract.scrollingisevil.workers.dev. Cloudflare hosts that service.
For a YouTube link, the phone reads the video page from youtube.com first. It then sends the extract service the video's title, description, captions or transcript, and some comments.
If you import a recipe or a grocery list from photos, the app sends those photos (up to four pages) to the extract service.
The extract service asks xAI to turn the text or photos into ingredients and steps, then sends the result back to your phone. The app asks for your OK before the first photo or video link goes to xAI (see the next section).
Sending photos and video links to xAI
Before a photo or a video link (TikTok, Instagram, Facebook or YouTube) is read, the app shows a screen that says what is sent, to whom, and why, with Allow and Not now. Nothing goes to xAI until you choose Allow. The choice is saved on your phone and you can change it at any time with the switch in Settings. If it is off, photo and video imports do not run, and you can still paste the recipe text or a recipe site’s link, which are read on your phone.
What is sent: the photo, or for a video link the link plus the caption, description and comment text that come with it. xAI reads it and returns the ingredients and steps. xAI’s API security FAQ says xAI never trains on API inputs or outputs without explicit permission and stores API requests and responses for 30 days to audit suspected abuse or misuse. Tomato Potato does not give xAI your name, an account, or a device identifier, because the app has none.
Website recipes that include structured recipe data (JSON-LD) are read on the phone. The app fetches the page itself, and that page is not sent to xAI.
Do not import a source that contains someone else’s private data.
Anonymous step counts
Starting with version 1.2.1, the app can send anonymous step counts, which count how often a few steps happen across all users, so we can see where new users stop. Earlier versions send nothing. When you reach one of these steps, the app sends our service at tomatopotato-extract.scrollingisevil.workers.dev the step name and the app version (and, for the plan screen, which button opened it), and nothing else. The steps are: opening the app for the first time, saving your first imported recipe, sending your first grocery list to a store cart, seeing the plan screen (with what opened it), starting a free trial, buying a plan, and opening the app again on a later day.
The service adds one to that day’s total (by UTC calendar day, not the time) for the step and version, and keeps those daily totals for analysis. It does not receive a device identifier, recipes, lists or links, and it does not store your IP address or the time. Like any web request, the request shows your IP address to Cloudflare; our service uses it only for a moment to limit how often one address can send counts. The totals cannot be traced back to a person or a phone.
You can turn this off in Settings with the switch Share step counts. We rely on our legitimate interest in seeing where new users stop. The totals hold no personal data, so there is nothing to delete for one person. Counts are not sent from debug builds or from our own test accounts. Whether you opened the app on a later day is worked out on your phone from the first-open date it keeps there; that date is never sent.
Grocery carts
Send to Kroger or Send to King Soopers asks you to sign in on Kroger’s site. Our service keeps the sign-in token Kroger returns for up to 30 days so later sends work. It sends Kroger the item names and your ZIP code to find a nearby store and match products.
If a send fails, our service saves the list (store, item names, and product links) for 24 hours so the link it gives you keeps working.
Other stores open their website or a Google search in your browser, with the ingredient names in the address.
Purchases
Tomato Potato sells a monthly plan and a yearly plan. Apple or Google takes payment. RevenueCat checks whether a plan is active, using an anonymous app user ID and the store’s purchase record. Recipes and lists are not sent to RevenueCat.
On iPhone, RevenueCat also collects Apple’s AdServices attribution token. It tells us which Apple Search Ads campaign, if any, led to the install. It is not an advertising identifier.
Backup
Google Drive backup is optional. It uses Google sign-in and stores a backup file in the hidden app-data folder of your own Drive. We do not receive that file.
You can also export a backup file through the share sheet and import it again. Where that file goes is up to you.
Sharing
Share sends a recipe, the plan, or the grocery list only when you tap it. The link at the end names where in the app it came from (list, plan, recipe or invite), not who sent it. A shared recipe link includes the address of the recipe's source, and opening it is a request to scrollingisevil.com. Cloudflare hosts that page and logs the request like any page visit; the page does not store the address.
What we keep
The extract service holds the link, text, or photos only while the job runs. Cloudflare logs each request to our service (time, address requested, result, and network details such as IP address) for a few days. We read those logs to see when imports fail. They are not tied to your name, and there is no account to attach them to.
Processors
Cloudflare hosts the extract and cart service. xAI reads the text or photos to draft a recipe. Kroger handles Kroger and King Soopers sign-in and carts. RevenueCat checks purchases. Google handles Drive backup. Apple and Google run the App Store and Google Play, and may collect their own diagnostics if you allow it on the device.
Each of those companies handles data under its own privacy policy. We do not sell recipes, links, or lists. There are no ads in the app, and the app does not read an advertising identifier.
List of our other apps
Settings shows a list of our other apps. The app loads that list from a public file at scrollingisevil.com. The request carries no name, account, device identifier, or data from the app. Like any web request, it shows your IP address to Cloudflare, which hosts this site. If the request fails, the app shows the list built into it. Tapping a row opens that app’s store page.
Kids
Tomato Potato is not directed at children under 13. We do not knowingly collect personal information from them. If you think we have, email us and we will delete what we hold.
How to leave
Delete the app to remove the local recipe book. To delete the Drive backup, open Google Drive on the web, go to Settings → Manage apps, and choose Delete hidden app data for Tomato Potato. Deleting the app does not cancel a plan; cancel in your App Store or Google Play subscription settings.
To ask us to delete a stored Kroger token or anything else we hold, email support@scrollingisevil.com. We cannot delete a recipe that only exists on your phone.
If this policy changes, the new text is posted at this URL with a new date.