1. Scope
This policy explains how FIRSTBIRD AS processes personal information through Fig, the recipe app made by FIRSTBIRD AS.
FIRSTBIRD AS is a Norwegian company. Questions about privacy can be sent to [email protected].
2. Information we process
Recipe content
The URLs, photos, PDFs, or text you submit to import a recipe, plus any notes, edits, or saved recipes you create. If you ask Fig to import from a URL, Fig fetches that page's content to extract the recipe. When Fig then displays the lead photo of a recipe you imported from a link, that image is loaded directly from the source website's servers, so your device's IP address and request reach that website.
Video imports
When video import is available and you submit a YouTube link, Fig processes the link, video ID and public details from YouTube API Services: the title, description, creator's channel name and ID, duration and thumbnail address.
Fig also reads a limited set of public comments and replies to find the creator's recipe details and corrections. This includes comment text, public channel IDs, display names and posting times. Public comments can contain personal information. Fig does not store other commenters' text once the import has finished.
An AI service analyses the video's audio and images directly from YouTube for spoken and on-screen recipe details. Fig does not download a copy of the video. Fig may also fetch one recipe page linked in the description. The result includes short source references, such as video timestamps, and a record of what could and could not be checked. When Fig shows the video's thumbnail with the recipe, that image is loaded directly from YouTube's servers, so your device's IP address and request reach YouTube. If you press play, Fig loads YouTube's embedded player (in its privacy-enhanced mode) only at that moment; playback then happens on YouTube's player, and Google processes it under its own privacy policy.
Fig uses YouTube API Services for this feature. The Google Privacy Policy explains how Google handles personal information when its services are used.
Social posts
When you submit a link to a public Instagram, TikTok, Facebook or Pinterest post, Fig uses ScrapeCreators, a data provider, to read the post's public details: its caption, the creator's name and handle, its duration, the addresses of its video or images and, for a Pinterest pin, the website the pin links to. ScrapeCreators receives the post's link only, not your account details. ScrapeCreators is a separate company with its own retention: it may keep the responses it returns and records of our requests under its privacy policy.
Fig first uses the caption, or one recipe page the post links to. Only when those do not give the whole recipe does Fig fetch the post's video or images and send them to an AI service (Google's Gemini API) to read spoken and on-screen recipe details. That copy exists only for the import: Fig holds it in memory and uploads it to Google's temporary file storage, asks Google to delete it when the import ends, retries that cleanup for any upload left behind, and Google removes every such file automatically after 48 hours in any case. Fig does not keep or show the post's video or images.
As with video imports, the material the recipe was read from (the caption, and the details the AI service read with their sources) is kept with the import record for 7 days so problems can be checked, and the import record itself for 30 days. The saved recipe keeps the creator's handle, the caption's first line and a link to the post for as long as you keep the recipe.
Ask Fig conversations
The messages — and any photo you attach — you send to Ask Fig, along with the recipe they relate to, in order to generate a response or a recipe change. Fig does not keep a browsable conversation history on its servers; it does keep individual AI responses and recipe changes, linked to your account, to recover an interrupted request without running the AI work again (see §6).
Account and authentication information
Fig creates an anonymous account automatically when you first use it, so your recipes have somewhere to live before you decide whether to sign up. If you later add an email address or sign in with Google, that identifier is linked to the same account rather than creating a new one.
Voice input
If you dictate a note, your device's or browser's own speech-recognition feature converts your speech to text locally or through its own provider (for example, Apple, Google, or your browser vendor) — Fig receives only the resulting text, not the audio.
Subscription information
If you subscribe to Fig, our payment processor provides us with your subscription status, product, purchase platform, and renewal information. We do not receive or store your card details.
Technical information
We receive limited technical data such as device type, operating system, app version, language, approximate region, diagnostic events, security signals and information needed to keep the service reliable. For AI features, we record each request's cost, linked to your account, to measure and manage the cost of providing Fig. These cost records are kept whether or not you turn on optional usage analytics. Only if you have turned optional usage analytics on (below) does the app also send its version, platform (web, iOS or Android) and language with these requests, and we record them with the cost; they are deleted if you withdraw.
Optional usage analytics
Optional usage analytics are off unless you turn them on in Settings → About → Share usage analytics. The choice belongs to your Fig account and applies on every device where you are signed in to it. A choice you make before signing in carries over to a new account. Account choices take precedence over guest opt-ins; a guest withdrawal recorded after the account's latest opt-in also applies. If you turn them on, we record how you use the app — for example which screens you open, when a session starts and how long it lasts, whether an import worked and, if it did not, the reason and the name of the website — linked to your account. These records never include the content of your recipes, notes or questions. The app version, platform and language of your requests are recorded with them. Until you turn them on, no optional usage events are recorded or buffered on any device.
You can withdraw consent at any time by turning the same switch off, on any of your devices. That device stops recording at once. As soon as your withdrawal reaches us, we delete the linked analytics records covered by the consent you withdrew, as described in §6, and from then on we store no further optional usage events from any of your devices. Your other devices stop collecting them when they next connect to Fig; anything they send before then is refused, not stored. If the device you switch off on is offline, it completes the withdrawal when it next connects. You do not need to delete your Fig account, and your access to Fig's features is unaffected.
Recipes you share
Opening Share prepares a shareable card privately. Choosing a card image, making an AI image and changing the framing stay private too: only you can see them. The recipe becomes public when you tap Share or Copy link. From then on, anyone with the link can see the shared version of the recipe (its title, ingredients, steps, servings, total time and, for a recipe imported from a web page, that page's address) and its card images. Your notes, collections and account details are never part of it. If you change the recipe afterwards, the public version stays as it was until you tap Share or Copy link again. Downloading the image on the web saves the image only and does not make the recipe public.
If you add your own photo to a shared recipe card, it stays private until you tap Share or Copy link, and is then part of the public card. Before it can be used, it is turned upright, resized and stripped of its embedded details (such as location and camera), and checked automatically for content the photo rules don't allow, by the moderation service listed in §5. The uploaded original is stored privately during this process and scheduled for deletion after the check. A photo that fails the check cannot be added to a shared card.
An AI image is made only when you ask for one. To make it, a short description of the dish (its name, main ingredients and cooking methods) is sent to the AI provider listed in §5; nothing else about you or the recipe is.
Reports you send
If you report an Ask Fig answer, a share image or a recipe from inside the app, we receive the reason you chose, any comment you add, a copy of what you reported as you saw it (the text, the image address, or the recipe's title and source link), the app's language and version, and your account identifier, so we can review it.
Feedback you send
If you send feedback from Settings, we receive the topic you chose, your message, your device type (iPhone/iPad, Android or web), the app's language and version, and your account identifier. If you ask us to reply, we answer at your account's email address; we don't use it for anything else.
Operational records
AI usage records and subscription status support the features you use. We also keep cost records and the dates of your first import and first Fig+ purchase to understand the costs of free and paid use. These records are kept independently of the optional analytics setting.
Website information
Our website may receive standard server log information, including IP address, browser type, requested pages and the time of a request.
When someone opens a shared recipe link, we count the visit by the name of the site it came from (for example news.ycombinator.com). For this count, we do not set a cookie, store anything on the visitor's device or include a visitor identifier. The standard server logs described above are separate.
3. How we use information
We use information where reasonably necessary to:
- extract and structure recipes from what you submit, and generate Ask Fig's responses;
- provide and operate Fig's other features;
- maintain authentication, preferences and saved content;
- manage your subscription, if you have one;
- prevent abuse, fraud and automated misuse;
- diagnose faults and improve reliability;
- measure and manage the cost of providing Fig;
- understand how Fig is used, through optional usage analytics, so we can improve it;
- review content you report to us, and act on it;
- respond to feedback, support and other communications;
- comply with legal obligations and protect our rights.
We do not use the content you submit or import — recipe sources, photos, notes, or Ask Fig messages — to train or fine-tune AI models, and we do not permit our AI providers to train on it.
4. Legal bases for processing
Where the GDPR or equivalent law applies, we rely on the following legal bases:
- Performance of a contract — to provide the features you ask for: importing and structuring recipes, generating Ask Fig responses, saving your recipes and notes, authentication, and managing a subscription.
- Legitimate interests — to keep Fig secure and reliable, prevent abuse and automated misuse, diagnose faults, handle content or intellectual-property reports, and establish, exercise or defend legal claims. We also use AI cost records and first-import and first-purchase dates to measure the costs of free and paid use, investigate unexpectedly expensive operations and keep the service financially sustainable. We weigh these interests against your rights and interests. You can contact us to object to this processing or request information about our assessments.
- Consent — for optional usage analytics enabled through Settings → About → Share usage analytics, including the app's first-session and account-creation milestones and the app version, platform and language sent with your requests, and for other optional processing where we ask for it. We do not rely on another basis for these records, and do not keep them on another basis after you withdraw. You can withdraw analytics consent using that same switch; §6 explains deletion of the records covered by it. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Device permissions, such as camera or microphone access, are controlled through your device settings.
- Legal obligation — to comply with a legal obligation that applies to us.
6. Retention and security
We keep personal information only for as long as your account exists and the purposes described in this policy require it. The one exception is the email notifications we receive about reports and feedback you send, which follow their own schedule, set out below: they can outlast your account by up to 30 days, and longer only in the narrow case described there. Apart from those, we don't operate a separate retention schedule that holds a copy of your data past that for security, fraud, or legal/accounting purposes — deleting a recipe or note in Fig removes it from your account and, unlike full account deletion below, it can still surface again in Recently Deleted for its normal 30-day window before that copy is purged too.
Fig's database does not run on a plan with point-in-time recovery or a guaranteed backup schedule, so there is no separate long-lived backup copy of deleted records for us to describe. Like any web service, our hosting provider's own request-level logs exist briefly as an operational byproduct of serving traffic and roll off automatically on a short, rolling basis under that provider's own default retention; we don't export or separately archive them, and they're deliberately minimal by design — recipe content, imported page content, and Ask Fig message text are never written to them.
To recover requests that were interrupted (a dropped connection, say) without running the AI work again, Fig keeps each delivered AI response — an Ask Fig answer, a recipe change, an import's result — linked to your account. It can be replayed for 24 hours; the stored copy remains with your account until it is replaced or your account is deleted, and it is deleted with your account. This is not a conversation history: there is no list of past conversations to browse or restore.
Video imports have their own short retention. The raw material an import read — the description, the creator comments Fig inspected and the AI's evidence record — is kept for up to 7 days so a fresh import can be troubleshot, then deleted; the import record itself is deleted within 30 days. The recipe you save from it, and its source preview (the video's title, creator name and thumbnail address), stay with your account like any other saved recipe. Because the preview is YouTube API data, Fig removes the stored title, creator name and thumbnail address 30 days after they were fetched and fetches them again from YouTube the next time you open the recipe; if the video is no longer available, the preview is removed for good. These clean-ups run on a schedule on our servers, whether or not you use the app. Deleting the recipe, or your account, deletes the recipe and its preview.
Imports from Instagram, TikTok, Facebook and Pinterest posts follow the same 7-day and 30-day schedule for the caption, the AI's evidence record and the import record. Their source credit (the creator's handle, the caption's first line and the post link) is not YouTube API data and stays with the saved recipe; the temporary copy of a post's video or images is not kept (see "Social posts" above).
Ordinary usage analytics records are kept for up to 13 months. The first-session and account-creation milestones are kept while your account exists. Both are deleted sooner if you withdraw your consent: once the withdrawal reaches us, we delete every usage analytics record and milestone collected with it, and the app version, platform and language recorded with your requests, without deleting your account. Statistics already made anonymous before withdrawal are unaffected.
A shared recipe's public version and its card images are kept until you stop sharing it, delete the recipe or delete your account; then the link stops working and the card images are removed. When you share a changed version, the previous card images are removed after 7 days, so link previews already posted keep working for a short while. AI images and photos you added but did not publish stay private. For each shared recipe Fig keeps the three most recent AI images and the two most recent photos, plus any images used by the current public card or private draft; older unused images are removed, and all of them are removed when you stop sharing the recipe, delete it or delete your account. A record that an image was made (not the image) is kept with your account, so daily limits and costs stay correct. A share you prepared but never published, and did not open or change for 30 days, is removed with its images. Copies that other people or apps made of a shared link or image (for example a messaging app's preview, or a post) are outside Fig's control.
Reports you send are kept while your account exists, so we can review them and keep a record of what we did; they are deleted with your account. Feedback is kept while your account exists and is deleted with it.
When you send a report or feedback, we're also notified by email, with what you sent (and your account's email address, if you asked us to reply). These notification emails are separate from the records above: we keep them only while we deal with what you sent, and delete them within 90 days after that, or straight away if you ask us. When you delete your account, we're notified, and we delete the notification emails linked to it within 30 days. The one exception: if a report concerns a serious breach of our rules or a legal claim, we may keep what's needed for as long as that matter requires.
First-import and first-purchase dates are kept while your account exists, independently of optional analytics consent.
Records of what individual AI requests cost are kept for at most 90 days. After that we keep only monthly totals in which every figure combines at least five accounts and cannot be linked to anyone, and a record that a request was completed in a given month — without its cost or content — so the same request is never run or charged twice. That completion record is deleted when you delete your account; the monthly totals remain. A request whose charge is still being settled is kept until the settlement has been applied. If our servers cannot record a request's outcome for 30 days, that outcome is abandoned: its result is discarded and a short review record without it is kept for 14 days.
You can ask us to erase these records or object to processing based on legitimate interests; see §8. Deleting your account removes its linked usage events, milestones and cost records, including those from guest identities merged into it.
What remains without an account link includes daily totals (for example, how many people opened a screen on a given day), counts of visits to shared recipe links by referring site, and the monthly AI cost totals described above.
We use reasonable technical and organizational measures to protect information — for example, your uploaded photos are stored in a private location only your account can access. No internet service can, however, guarantee absolute security.
7. Account deletion
You can delete your Fig account and its data at any time, whether you signed in anonymously, with an email address, or with Google. Full details — exactly what's deleted, what's retained and why, and the two ways to request it (in the app or at cookwithfig.com, or by emailing us) — are at cookwithfig.com/delete-account/, which this section summarizes.
Deleting your account permanently deletes your authentication record, saved recipes and their sources, video import records, notes and note photos, collections and favorites, usage and entitlement counters, usage analytics and AI cost records (including those from before you signed up, as a guest), and your RevenueCat customer record, along with the AI responses kept to recover interrupted requests (§6). Fig keeps no browsable Ask Fig conversation history, so there's no separate history to delete there. One de-identified, shared cache — mapping a public recipe's source to its already-structured result, with no user identifier attached — is unaffected by any individual account's deletion, as are the unlinked totals described in §6; see the deletion page for why. Reports and feedback you sent are deleted with your account, and the email notifications about them within 30 days of it (§6).
Deletion through the app or the web sign-in flow starts when you confirm. We confirm success once your account has been deleted; interrupted cleanup is retried automatically. A request by email is completed within 30 days of us verifying it came from your account's email address. Neither deletion method cancels an active App Store, Google Play, or web subscription — that has to be cancelled separately, in the store you subscribed through, or it will keep renewing.
8. Your choices and rights
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability or objection regarding personal information. You may also have the right to complain to a relevant data-protection authority.
To make a request, contact us using the email address below. We may need to verify that the request relates to you before acting on it. For account deletion specifically, see §7 above.
9. Children
Fig is not directed to children below the minimum age required to consent to online services in their country. We do not knowingly collect personal information from children in violation of applicable law.
10. Changes to this policy
We may update this policy as Fig develops. The effective date at the top of the page shows when it was last revised.
11. Contact
FIRSTBIRD AS
Norway
[email protected]