Privacy Policy

Last updated: October 20, 2026

This Privacy Policy explains what information ReCult collects, how we use it, and the choices you have. It applies to the ReCult website at recult.app, the ReCult app (on iPhone and the web), our email programs (including The Steal daily deal), and the ReCult accounts we operate on social platforms.

ReCult is operated by BDM LLC, doing business as ReCult ("ReCult," "we," "us"). We build tools that help people find useful local information, genuinely good deals, and meals that fit them. We aim to collect as little personal information as possible and to be clear about what we do with it.

If you live in Washington or Nevada, or your health data is collected in Washington, also see our separate Consumer Health Data Privacy Policy.

The website and our emails

Information we collect

• Email address — when you subscribe to The Steal or another ReCult update, so we can send you the emails you asked for.
• Optional details you provide — such as a general location or area of interest, used only to make what we send more relevant.
• Referral and campaign codes — if you arrive through a share link or refer someone, we record the code so referrals are counted correctly.
• Basic technical and usage data — such as the pages you open, links you click in our emails, and general device/browser information, used to operate and improve the service and to measure whether our content is useful.

We do not ask for, and you should never send us, sensitive information such as passwords, payment card numbers, or government identifiers.

How we use it

• To send the emails and updates you signed up for, including the daily deal.
• To operate, maintain, secure, and improve recult.app and our content.
• To understand which deals and pages are useful, in aggregate.
• To respond to your questions and requests.
• To comply with legal obligations and prevent abuse.

Affiliate links

Some deal links may be affiliate links, meaning ReCult can earn a commission if you buy through them at no extra cost to you. Whether a link is an affiliate link never changes which deal we choose to feature.

The ReCult app

• Your account — your email address, profile details you choose to add, and the settings you pick. We use them to run your account and keep it secure.
• Pulse — posts, media, messages and reactions you create. Public posts are visible to other people; messages go to the people you send them to.
• Shop — the deals you search for and save. When you buy, you complete the purchase with the merchant, under the merchant's own privacy policy.
• Eat — the pickup food orders you place: the restaurant, the items and choices, the pickup name and time, and the order status. See Payments and orders below.
• ReCult Plus — whether you subscribe, and your subscription status. See ReCult Plus subscriptions below.
• Location — the city or area you choose, used to show local content and meals. The app does not need your precise background location.
• Health data — only if you add your lab results. See Health data below.

The ReCult app shows no ads and contains no advertising trackers.

Health data (lab results and your Menu)

You can add your lab results to ReCult so we can show them to you and, if you allow it, use them to build your personal restaurant Menu. Lab features are only for people 18 or older. Before your first import you sign an authorization that explains all of this; you can view it or revoke it anytime in the app under Settings → Health data.

ReCult isn't medical advice. Talk to your doctor before making changes to your diet or treatment.

What we collect

• Lab results you import: test names, values, units, reference ranges, test dates, and the lab or provider name.
• Report files you upload, email or photograph (PDFs and images).
• Food details you add: allergies, how you eat (for example vegetarian), foods you like or don't, and your usual meal times. If you use Daily progress, your daily meal log and goals.
• Your Menu profile: the nutrition focus we work out from your confirmed results (for example "lower sodium").
• Connections: which health-record sources you connected, their status, and the access tokens needed to read them.
• Your choices: your signed authorization (name and date) and your consents, for example whether results may personalize your Menu.

Where it comes from

• You: a PDF you upload; a PDF you email or forward to your private ReCult address (labs-…@recult.app) — we read only PDF attachments and never store the email text; or a photo or scanned PDF of a report.
• Your health system, through a patient-authorized connection you approve (SMART on FHIR; first Stanford Health Care through Epic). It is read-only and you can disconnect it anytime.
• Apple Health is not currently offered. ReCult does not read or write any Apple Health data.

How we use it

• To import your results and show them to you.
• Only with your separate permission, to personalize your Menu by ranking restaurant dishes for you.
• To keep the service secure and to respond to your requests.

You review and confirm every extracted value before it can change your Menu. AI is used only to read, organize and explain; it never diagnoses you, sets health thresholds, or decides what is safe for you. Those decisions come from fixed rules.

We never sell your health data. We never use it for advertising or marketing, or to decide which restaurants or products are promoted. Restaurants and merchants never receive your health data or the reason a dish was recommended to you.

Service providers that handle it

These companies process health data only on our instructions, to run ReCult for you:

• OpenAI, L.L.C. — reads photos and scanned PDFs to copy the lab values, only after you agree for that report. We send them with storage turned off (Responses API, store: false). OpenAI may keep them for up to 30 days for abuse monitoring, then deletes them, and doesn't use them to train its models. Records from your health system are never sent to OpenAI; ReCult's own software reads them.
• Cloudflare — hosts ReCult (Workers), stores your data (D1 database and R2 file storage), and receives the emails sent to your private lab address (Email Routing). Health values, files and access tokens are encrypted at rest (AES-GCM) and readable only by your account.

When you connect a health system, that health system (and its record vendor, such as Epic) knows you authorized ReCult to read your records.

How long we keep it

• Extracted results and your Menu profile: until you delete them or your account.
• Report files you uploaded: until you delete them.
• OpenAI's processing copies: up to 30 days.
• Backups: cleared within 6 months after you delete.

Your rights over your health data

• See it and get a copy. Your results are in the app. Download a copy in the app under Health data, or ask us for one. You can also ask us which service providers and third parties received it.
• Correct it. Fix values during review, or upload newer labs.
• Delete it. In the app, Settings → Health data → Delete removes your reports, files, results, connections (revoking access where the source allows), consents, your private lab email address and your Menu profile. When you disconnect one source you choose whether to keep or delete its results. Deleting your ReCult account also deletes all your health data.
• Withdraw consent. Revoke your authorization in Health data (this stops new imports; existing data stays until you delete it), stop using results for your Menu, or disconnect a source.
• Ask us. Email [email protected] with the subject "Privacy request" from the email on your ReCult account. We may ask you to confirm the request from your signed-in account so we know it's you. We respond within 45 days; if we need more time, we tell you why and may take up to 45 more days. Requests are free.
• Appeal. If we decline your request, email [email protected] with the subject "Appeal". We decide in writing within 45 days. If we still deny it, you can contact your state attorney general (for example the Washington or Nevada Attorney General).

We won't treat you differently for using any of these rights.

California residents

We handle lab results as medical information under California's Confidentiality of Medical Information Act. We don't disclose it without your authorization, except to service providers that process it for us under contract. We don't share personal information with third parties for their own marketing. Depending on the law that applies to you, you can ask to know, get a copy of, correct, or delete your personal information, as described above.

Payments and orders

When you order food in Eat, you pay by card through Stripe. For some restaurants, checkout runs on Square and you can pay with Cash App ("Order by Cash App"); Square and Cash App are run by Block, Inc.

• Card details. You enter your card or Cash App details with the payment processor. ReCult never receives or stores your full card number; the payment processor does, under its own privacy policy.
• What ReCult receives. Your order details (restaurant, items, choices, totals, pickup name and time) and a payment confirmation from the processor, such as whether the payment succeeded or was refunded.
• What the restaurant receives. Only what it needs to prepare your order: the items and choices, any note you add for the kitchen, and the pickup name and time.
• Restaurant payouts. Restaurants are paid through Stripe. A restaurant gives its business and payout details to Stripe directly during setup.
• No health information. Restaurants and payment processors never receive your lab results, your Menu profile, your health goals, or the reason a dish was suggested to you.

We keep order records for as long as you have an account, and longer where tax, accounting or payment rules require it. Refunds are covered in our Terms of Service.

ReCult Plus subscriptions

ReCult Plus is an optional, auto-renewing subscription: $4.99 per month or $39.99 per year, with a 7-day free trial for new subscribers.

• Billed by Apple. Payment is charged to your Apple ID. Apple handles your payment details; ReCult never sees them.
• What ReCult receives. Your subscription status from Apple: which plan you have, whether it is active or in a trial, and when it renews or ends. We use it only to turn Plus features on or off for your account.
• Renewal. Your subscription renews automatically unless you cancel at least 24 hours before the current period ends.
• Manage or cancel anytime in iPhone Settings → Apple ID → Subscriptions.

How we share information

We do not sell your personal information. We share it only with service providers who help us run ReCult, and only as needed for them to perform that work — for example:

• Email delivery providers that send our emails on our behalf.
• Hosting and infrastructure providers that serve recult.app and the app (Cloudflare).
• Payment processors (Stripe, and Square / Cash App run by Block) that process food order payments and refunds, as described in Payments and orders.
• Restaurants you order from, which receive only the order details needed to prepare your food.
• Apple, which bills ReCult Plus subscriptions to your Apple ID and tells us your subscription status.
• AI document reading for lab photos and scans (OpenAI), as described in Health data.
• Social platforms (such as Pinterest, Instagram, YouTube, Facebook, and Telegram) when we publish public posts. Your own use of those platforms is governed by their privacy policies, not ours.

We may also disclose information if required by law, or to protect the rights, safety, and security of ReCult and others.

Your choices and rights

• Unsubscribe anytime. Every email includes a one-click unsubscribe link, and we honor standard one-click unsubscribe headers. When you unsubscribe, we stop sending and remove you from the active list.
• Access, correction, and deletion. You can ask us to tell you what we hold about you, to correct it, or to delete it, by contacting us below. You can delete your app account in Settings → Account.
• Health data. See your rights over your health data.
• Do Not Track. Our sites don't currently respond differently to browser Do Not Track signals.

Security

We use encrypted connections, encrypt health data at rest, and limit access to what's needed to run the service. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

Data retention

We keep personal information only as long as needed for the purposes above — for example, for as long as you are subscribed or have an account — and then delete or de-identify it, unless we are required to keep it longer for legal reasons. Health data follows the health data schedule.

Children's privacy

ReCult is not directed to children under 13, and we do not knowingly collect personal information from them. Lab features are only for people 18 or older. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above, and material changes will be reflected on this page. We will never start using health data in a new way, or share it with someone new, without asking you first.

---

Contact us