Press one button. Find out what's for dinner. Cook it.
Last updated 25 August 2026
The short version. whok has no accounts and no sign-in. It does not track you, carries no advertising and no third-party tracking code, and nothing about how you use the app is reported anywhere. The recipes live inside the app on your phone, so browsing, randomising and cooking work with no network at all and send nothing anywhere.
Three things do leave your phone, and only when you choose them: a meal photo you send in, a feedback message you write, and a report you file about someone else's photo.
whok is made by Louis Whittome, an individual developer in the United Kingdom, who is the data controller for anything described here. Contact: hello@whok.app.
Your household size, your dietary and allergen filters, your favourites and your record of meals you have cooked are stored only on your device. They are never uploaded. Deleting the app deletes all of it.
whok also keeps a running count of how many meals it has suggested to you and how many of them you went on to cook, shown to you in Settings. That count is kept on your phone, is not attached to any identifier, and is not sent anywhere — there is no analytics service behind it, and nobody but you can see it.
If you choose a photo of a meal you cooked and send it, it is uploaded and stored on Cloudflare R2. Every photo is reviewed by hand before it is shown to anyone. Approved photos are then public: they appear in the app for everyone who opens that recipe, and they are served from a public address.
Only send photos of food you cooked. Do not send photos with people, faces, documents or anything else identifying in them — once a photo is approved it is public, and that cannot be undone for copies already downloaded.
Photos are stripped of location and camera metadata during upload. Rejected photos are deleted.
The first time whok needs to talk to its server it generates a random code and keeps it on your device. It is not your Apple ID, not your advertising identifier, and not Apple's vendor identifier — it is a random number that means nothing outside whok, and it is not connected to your name, email or phone.
It is sent with photo uploads and reports for one reason: to enforce the limit of five uploads per device per day, and to block a device that repeatedly sends things it shouldn't. Reinstalling the app generates a new one.
The feedback form in Settings submits to a Google Form. That means Google receives whatever you type, including the optional email address, and handles it under Google's privacy policy. The email field is optional and exists only so a reply can be sent; leave it blank and the feedback is anonymous. Nothing else about you or your phone is attached to a feedback submission.
Reporting a photo sends the photo's identifier, the reason you pick and your device code, so the report can be reviewed and abuse traced back to the device that caused it.
Cloudflare hosts the server, the photo storage and the database. Google receives feedback submissions as described above. That is the entire list. Nothing is sold, rented or shared with advertisers, data brokers or anyone else, and there is no analytics provider.
Approved photos are kept while the recipe uses them. Rejected photos are deleted on rejection. The upload record — the device code, the time and the recipe — is kept so the daily limit and any ban still mean something. Feedback stays in the Google Form until it is dealt with.
Under UK GDPR you can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Because there are no accounts, the practical way to do this is to email hello@whok.app describing the photo you sent or the feedback you left so it can be found. Photo uploads and reports are processed on the basis of legitimate interests — running the service and keeping it free of abuse. You can complain to the Information Commissioner's Office if you are unhappy with how this is handled.
whok is a cooking app for general audiences and is not directed at children. It does not knowingly collect anything from a child under 13.
If this policy changes, the date at the top changes with it.