Privacy by architecture
Your meals, your family, your kitchen — none of it leaves your iCloud.
Meal planning is intimate. Who’s home tonight, what your kid won’t eat, what your spouse is allergic to, what you cook when you’re tired. We didn’t want to be the company that has that file on you.
So we built WFD on top of your own iCloud, not on a server we control.
How your data flows
Every meal in your library, every dinner you’ve logged, every shopping check, every Queue item, every shared household — all of it lives in your private CloudKit container. That’s a per-user data store provided by Apple. We don’t have a database. We literally cannot see your library because there’s no place for us to look.
When you share a household with your spouse, the data sync happens between your two iCloud accounts using Apple’s CloudKit sharing. We aren’t in the middle. Your spouse sees your meals because Apple’s infrastructure delivered them — not because our server forwarded a copy.
How the AI features work
WFD uses three kinds of intelligence, in this order of preference:
Apple Intelligence (on-device). Voice transcription and the “Ask WFD” voice assistant run entirely on your iPhone. Nothing leaves the device.
Your iCloud (the CloudKit mirror). Household sync, photo sync, allergy info, shared meal libraries — all moves device-to-device through your Apple ID. We don’t host any of it.
Our recipe assistant API. Some features ask our Worker on api.donbon.com for help, which uses Anthropic’s Claude to do the thinking. Here is everything that gets sent, and when:
- Auto-filling ingredients — the meal name, and the cuisine if you set one.
- Suggesting instructions — the meal name, its ingredients, cuisine and rough cooking time.
- Finding a stock photo — the meal name.
- Capture the Fridge — the one photo you chose to take, of your fridge, pantry, counter, grocery bag or receipt. It’s read for the food in it, the list comes back for you to check, and the photo is thrown away. It isn’t stored, by us or by anyone.
We don’t send your name, your account, your device identifier, your other meals, your family info, your shopping list, or your history. Nothing is retained: each request is answered and discarded.
Finding restaurants
If you ask WFD for restaurants nearby, your location has to go somewhere to answer that. Depending on your settings it goes to Apple’s MapKit, handled on your device, or — for Plus — straight from your phone to Yelp. We’re not in the middle, and we keep no record of where you’ve been.
What we don’t do
We don’t run analytics. We don’t have ads. We don’t sell your data because we don’t have your data. We don’t recommend brand-name ingredients because no brands pay us to do that. Our recipe suggestions come from a general-purpose model with no commercial bias toward what Whole Foods is selling this week.
There’s no community feed because there’s no community we’re cultivating. We don’t want to be the social network of dinner. We want to help your family decide what to eat tonight and then move on with our day.
The architecture in one line
If we deleted our database tomorrow, your app would still work. Because we don’t have a database.
If “we take privacy seriously” makes you skeptical, you’re our customer.