What we do,
and how to check it.

The extension sends a conversation only when you click Send to Uncook. It waits encrypted on our servers for up to 30 minutes and is deleted when the Uncook page opens it. When you choose chats for a new task, they are sent to Anthropic's Claude models to list their topics. When you click the tool's button, the conversation is sent to an AI model to do your task: for Handoff, Merge, Summarize, Memo and AI Profile, OpenAI's GPT models; for some steps, Anthropic's Claude models. If OpenAI is unavailable, Anthropic's Claude models carry out your task. The task is kept as described below.

We keep your task, encrypted. For each task, your account also keeps which AI it came from, the chat's address and its title, for as long as the task is kept. The conversation itself is not kept with the task.

Your task is kept, encrypted, for as long as your plan says: 7 days for a free try without an account, 30 days if we email it to you, 30 days on a free account. With Pro, a valid pack or an invitation: in your history, then 12 months after it ends, with an email 30 days before we delete it. You can delete any task, or your account, at any time.

The conversation you brought isn't kept with the task.

Supabase

Our main database, in the European Union (Ireland).

OpenAI

The conversation you bring, with its title, to do your task with Handoff, Merge, Summarize, Memo and AI Profile. We disable storage of responses in our OpenAI API account. OpenAI may still keep the conversation for up to 30 days to detect abuse, and longer where required by law or reasonably necessary to protect its services or third parties from harm. It may not train models on it.

Anthropic

The conversations you pick, to list their topics and suggest a task, and the conversation you bring, for the steps of your task that run on Claude, or for the whole task if OpenAI is unavailable. It deletes it within 30 days, and may keep it longer to enforce its Usage Policy or comply with the law. It may not train models on it.

Upstash

A second database: sessions, counters, account records and your saved tasks, encrypted.

Resend

The emails we send you.

Vercel

Hosts the site and runs the code. Its server logs record the usual technical details of a request, including your IP address.

Each of them is bound by a data processing agreement that limits it to acting on our instructions. Some of them process your data outside the European Union; those transfers are covered by the European Commission's standard contractual clauses.

To keep automated abuse out, we count requests by network block, using only the start of your IP address, never the full address. These counters are kept for up to 2 days. Our host's server logs record your IP address; the privacy policy explains this.

When you turn Mask on, it looks for links, emails, keys, IBANs, card numbers, phone numbers and handles and replaces the matches before the AI that makes your task reads the conversation. Names, companies and places are found by a model, best effort. Check your task before you send it on. The list of replacements comes back with your task.

Tests in our repository check masking in the request built for the model and the list of replacements. They cover test cases, not every possible sensitive detail.

No SOC 2 report, and no other certification. We would rather publish a short list that is true than a long one that is not.

Where your data is held, and where it is processed, is set out on the trust page — Trust & confidentiality.