Last updated: 2 August 2026
Khao is designed to be private. This policy explains, in plain language, exactly what the app does and does not do with information. It is deliberately short because Khao collects very little.
Khao has no account system and no analytics. Everything you do in the app — your taste preferences, diet, allergies, household, meal times, likes and saved dishes — is stored only on your device. Khao does not operate a server that receives your personal data.
This is worth stating plainly rather than leaving you to infer it. Working out which dish to suggest — reading your palate, your allergies, your household's rules, the time of day and the time of year, and ranking the whole recipe list against them — runs on your device, every time. There is no request to anybody's server in that path, because there is no server. It is why the app still works with no network at all, and it is why nobody, including us, has to be trusted with your allergies.
More → Leftover Remix lets you speak what is in your fridge, or photograph it, instead of typing it. Both are optional, both are used only on that one screen, and typing works exactly as it always has. Khao uses the microphone and the camera nowhere else in the app.
Nothing is recorded and nothing is uploaded.
Khao then shows you what it thought it heard or saw, and adds nothing until you tick it. The only thing either route can leave behind is the list of ingredient names you confirmed, saved to your own kitchen list on this phone, exactly as if you had typed them.
iOS will ask your permission for the microphone, for speech recognition and for the camera the first time you use one of these. If you say no, that route stops being offered, the app tells you how to turn it back on, and nothing else changes. You can change your mind at any time in Settings → Khao.
The following is saved locally on your iPhone or iPad (in the app's own storage) and is never transmitted to us:
You can see all of it — You → Privacy & your data → Export my data produces a readable file. That file is created only when you tap the button, it is stored inside the app's own private space on the phone, it is left out of iCloud and iTunes backups, and it is deleted again as soon as you leave that screen. You can erase everything from You → Privacy & your data → Delete my data, which also removes any export. Deleting the app removes all of it too.
Household → Invite by link lets you send someone a link so they can fill in their own diet, allergies and dislikes on their own phone, instead of you guessing.
Nothing about this passes through us, because there is nothing for it to pass through. There is no server, no account, and no database. Everything each phone needs travels inside the link itself.
#, which browsers never send to a web
server — so the site hosting that page cannot see it even in principle,
and it is not stored, logged or forwarded anywhere.Two honest limits, stated rather than glossed over. First, anyone who sees both the invitation and the reply can read the reply, because the invitation is what carries the key; there is no way around that without a server holding a secret, and a server holding other people's allergies is precisely what Khao refuses to have. Second, an invitation is a message: once sent, you cannot un-send it, in the same way you cannot un-send any other message.
For as long as you keep the app, and not a moment longer. Because Khao holds nothing about you anywhere except on your own device, there is no second copy sitting on a server with a retention clock running on it. Your settings and history stay on the phone until you erase them from You → Privacy & your data → Delete my data, or until you delete the app — either one removes the lot straight away. The export file is the shortest-lived thing here: it exists only while that screen is open. We keep nothing, so there is nothing for us to hold on to, and no backup of it for you to ask us about.
If you allow notifications, Khao schedules local meal reminders on your device. These are generated on the phone; no reminder content is sent through us. Khao does not use remote push notifications.
Khao displays every dish as an illustration drawn on the device. It does not download photos from any server, and it contains no analytics, no advertising software and no third-party frameworks of any kind.
So that new dishes can be added without waiting for an app update, Khao checks once per
launch whether a newer dish list is available. It fetches a single public file over HTTPS:
raw.githubusercontent.com/anirudhkapoor1996-web/khao-catalog/main/catalog.json
This request contains nothing about you — no account, no identifier, no cookie, no preferences, no search terms, no request body. It is the identical request for every user of the app, and it is the only automatic network request Khao makes. The file is a list of recipes and nothing else: Khao downloads no code, and every feature and rule in the app is the same before and after.
The downloaded list is validated on the device before it is used — dish count, unique IDs, and allergen data are all checked — and anything that fails validation is discarded. If the request fails, or you are offline, the app works exactly as before using the recipes built into it.
Like any request to any website, GitHub's servers will see the IP address it came from, in the same way they would if you loaded a web page. We have no access to those records and receive nothing from them.
When you tap to order a dish, Khao opens Zomato or Swiggy — either the installed app or their website — with the dish name as a search. Khao sends nothing else, and only when you tap. Anything you do there is governed by their privacy policies, not this one.
Khao is not directed at children and does not knowingly collect information from them. Under India's Digital Personal Data Protection Act, 2023, a child is anyone under 18 years of age. Khao has no account, collects no age information and builds no profile of any user, so it does not track or profile children — or anyone else.
Under India's Digital Personal Data Protection Act, 2023, you have the right to know what personal data is held about you, to correct or erase it, to complain about how it has been handled, and to nominate another person to exercise these rights on your behalf. Because Khao holds your information only on your own device, you can exercise the first two immediately and without asking anyone, from You → Privacy & your data.
If you are unhappy with how your information has been handled, contact Anirudh Kapoor, anirudhkapoor1996@gmail.com. We will respond within 90 days, as required by Section 13 of the Act, and usually much sooner. If you are not satisfied with the response, you may complain to the Data Protection Board of India.
None. Khao does not sell, rent, or share your personal data with third parties, for advertising or for any other purpose. Your diet, allergies, household and swipes are never used to target advertising — that is a limit built into how the app works, not a promise about what is on the screen today, and it does not expire.
Khao is operated by Anirudh Kapoor, an individual based in India. In the language of India's Digital Personal Data Protection Act, 2023, that makes him the "Data Fiduciary" for Khao and you the "Data Principal". This policy is governed by the laws of India, and the courts at Gurugram, Haryana have jurisdiction over any dispute arising from it.
If this policy changes, the "Last updated" date above will change. Material changes will be noted in the app.
Anirudh Kapoor — anirudhkapoor1996@gmail.com