Staple
Privacy policy
Staple — last updated 20 August 2026.
This describes what the app actually does, checked against the source rather than written from a template. If a line here and the code disagree, the code is the bug.
The short version
Staple stores your recipes so they reach your other devices. To turn a link into a recipe it sends the page's text to an AI model through a third party. It does not sell anything, show ads, or track you across other apps.
What is collected
| what | why | where it goes | |
|---|---|---|---|
| Account | An anonymous account id, created on first launch before you are asked anything | There has to be somewhere to put a recipe you save before you sign in | Firebase Authentication |
| Account, signed in | Your Google account's name, email address and profile picture URL | So the library reaches your other devices, and so the account sheet can show whose it is | Firebase Authentication |
| Your content | Recipe links, text you paste or type, the recipes themselves, your servings and your shopping list | It is the product | Cloud Firestore |
| Pictures | A copy of the photograph the recipe's own page advertises, and any photograph you pick for a recipe out of your own library | Publishers redesign and move pages; a copy is what keeps the card looking right in a year | Cloud Storage |
| Diagnostics | Crash reports, and the device model and OS version attached to them | To find out what broke without asking you to reproduce it | Firebase Crashlytics |
| Logs | Your account id, the recipe id and the source URL, on each import | To trace an import that failed | Google Cloud Logging, 30 days |
There is no advertising identifier, no analytics product, and no cross-app tracking. Firebase Analytics is switched off explicitly.
The part worth reading twice
Recipe pages are sent to an AI model. When you share a link, our server fetches that page, reduces it to its text, and sends that text to Google's Gemini through OpenRouter, which routes the request. Anything you paste is sent the same way. So:
- Do not paste something into Staple that you would not want a third party to process.
- The request carries no account id and nothing that identifies you — just the page's text.
- OpenRouter and the model provider handle that text under their own terms.
The pictures are readable by anyone holding the link. A stored picture gets a Cloud Storage download URL containing a token. That URL is kept only in your own recipe, and it is not guessable — but it keeps working after the recipe is deleted, and removing a photo from a recipe does not delete what was uploaded. For a picture copied off a recipe page that is a small thing; the photograph was already public on the web. For one you picked yourself it is not, so pick one you would be willing to have live at an unlisted URL. Deleting your account deletes the stored pictures themselves.
Choosing a photo does not give the app your library. The picker the app opens is the system's own and runs outside the app; the app receives the one picture you chose and nothing else, which is why it never asks for photo permission.
Who else can see it
Google, as the operator of Firebase and Google Cloud, where the data is stored. OpenRouter and the model provider, for the page text described above. Nobody else. Nothing is sold, and nothing is shared for advertising.
Data is stored in Google's eur3 multi-region (European Union). The extraction functions run in europe-west4 (Netherlands). The model call leaves that boundary.
Deleting it
In the app: account sheet → Delete account…. That erases your recipes, your shopping list, your stored pictures and the account itself. It cannot be undone and support cannot reverse it.
By mail: hello@getstaple.app, from the address on the account.
Deleting a single recipe removes it everywhere, and it is immediate. Cloud Logging entries expire on their own schedule (30 days) and are not deleted on request, because they are keyed to an account id that no longer resolves to anybody.
Children
Staple is not directed at children and is not designed for anyone under 13.
Changes
The date at the top moves when this changes. A change that affects what is collected or who receives it will be said in the app before it takes effect.