Website measurement
Epicure loads Google Analytics and, when configured, PostHog after your first interaction or after a short delay. They measure page visits and product reliability. PostHog is configured without session recording or surveys and creates person profiles only for identified users. Epicure does not ask you to create a website account.
These services may process browser, device, cookie, page, and interaction information under their own policies. Read the Google privacy policy and the PostHog privacy policy.
Kitchen requests and uploads
When you ask Epicure to compose a recipe, analyze an uploaded food image, create a recipe image, or estimate nutrition, the selected ingredients, instructions, preferences, and uploaded image data needed for that request are sent through Epicure's self-hosted web and API services. AI generation is routed through OpenRouter, with provider data collection disabled in the application configuration.
Avoid including personal or sensitive information in recipe prompts or uploads. OpenRouter documents its handling of input, output, and request metadata in its privacy policy and data-collection guide.
Security checks and FlavourBench
Cloudflare Turnstile protects public forms from automated abuse by evaluating browser and interaction signals. Cloudflare describes that processing in its Turnstile documentation and privacy materials.
FlavourBench stores a signed browser identifier in an HTTP-only, same-site cookie scoped to its API and derives a season-scoped pseudonym. Without research consent, raw prompt and output content is retained operationally for 30 days and then redacted. Hashes, votes, costs, and derived metrics remain. Consented records still require sanitization and release review before research export.
What the MCP service processes
When your MCP client calls a tool, Epicure processes the ingredient names, filters, and other parameters in memory to produce a deterministic result from the bundled flavour model. Epicure has no MCP accounts, cookies, advertising profiles, or conversation database.
Tool arguments, ingredient queries, result content, prompts, chat history, uploaded files, credentials, and raw IP addresses are never written to Epicure application logs.
Minimal operational telemetry
- Timestamp and MCP tool name
- Response size and processing latency
- Success state or exception class
- A 16-character client-IP hash whose random salt rotates at UTC midnight
This telemetry operates the service, diagnoses failures, measures latency, and limits abuse. It is not used for advertising, user profiling, or model training.
Retention
Telemetry stays in a local rolling container log capped at two 2 MiB files. Old records are overwritten on rotation and are not forwarded to a long-term analytics store. Because the random hash salt rotates daily and is not separately retained, KAIKAKU cannot link hashes across salt rotations.
Infrastructure and sharing
Cloudflare provides DNS, TLS termination, DDoS protection, rate limiting, and the outbound tunnel to KAIKAKU's local compute. Cloudflare may process network metadata under its privacy policy. The MCP application does not send tool inputs to Google, OpenRouter, Anthropic, or another model provider. KAIKAKU does not sell MCP data or share it with advertisers or data brokers.
Your choices
You can leave the website, use browser privacy controls, and avoid submitting prompts or uploads to stop future website and kitchen requests. Disable or remove the connector to stop future MCP processing. Epicure normally cannot associate MCP telemetry with a named person, but privacy questions and rights requests can be sent to [email protected].
For the complete repository policy and change history, read the versioned privacy policy.