Privacy Policy

Effective: 12 July 2026 · Applies to the Recipy app and this website

1. Data Controller

Tim Schoen
Speckenbarg 11
22848 Norderstedt, Germany
E-mail: recipy.support@gmail.com

2. Summary

No ads, no tracking: the app contains no advertising, analytics or tracking SDKs, and we never sell data.
Your content stays on your device: recipes, fridge items, meal plans, shopping lists and your cooking streak are stored locally only.
AI only when you ask: content is sent to our server and AI services only after your explicit consent and only to create your recipe.
Delete in the app: you can permanently delete your account including all server data at any time in Settings.

3. Data we process on our server

3.1 Account

When you register we store: your self-chosen username, display name, password (exclusively as a salted cryptographic hash — we cannot read your password), creation date, and session tokens (hashed, valid for 30 days, at most 5 active sessions). An e-mail address is not required to register.

3.2 “Sign in with Google” (optional)

If you sign in with Google, we receive your Google account ID, your verified e-mail address and your name from Google. We use this data solely for sign-in and account recovery. Legal basis: Art. 6(1)(b) GDPR.

3.3 Device identifier and usage counters

The app sends a randomly generated device ID (not an advertising identifier) as abuse protection. Per account we store the number of AI imports used and the premium status. Legal basis: Art. 6(1)(b) and (f) GDPR.

3.4 AI import content

When you start an import, the app transmits the respective content to our server: photos/screenshots (e.g. recipe cards, grocery receipts), typed text, voice recordings, or the content of a link you paste. Our server forwards this content to AI services for analysis (section 5). Content is processed to answer your request; results of link imports are kept in a volatile server cache for up to 24 hours to speed up repeat requests. Legal basis: your consent (Art. 6(1)(a) GDPR), which you grant in the app before your first import.

4. Data that never leaves your device

Recipes, favorites, fridge contents, meal plans, shopping lists, cooking streak/badges and app settings are stored locally on your device and are not transmitted to us. Your sign-in token is kept in your device’s protected storage (iOS Keychain / Android Keystore).

5. Recipients and third-party services

Google Gemini API (Google LLC, USA): analysis of import content (images, text, link content) to create recipes.
Groq API (Groq Inc., USA): alternative analysis of the same content (failover) and transcription of voice recordings.
RevenueCat (RevenueCat Inc., USA): management/verification of subscription purchases. Receives a pseudonymous user ID (your account ID), never names or content.
Apple App Store / Google Play: payment processing. We never receive your payment details.
Vercel (Vercel Inc., USA): hosting of this website and the waitlist.

Transfers to US providers may occur (Art. 44 ff. GDPR); they rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified.

6. App permissions

Camera / photo library: only to capture or select recipe photos, screenshots and grocery receipts.
Microphone: only for the optional voice note when writing a recipe.
Notifications: only for your cooking timers.
Face ID / biometrics (optional): locks the app locally; biometric data never leaves your device.
Apple Health (optional, only if enabled): the app writes estimated nutrition values of cooked meals to Apple Health. No health data is transmitted to us.

7. Children’s privacy

Recipy’s content is suitable for ages 6 and up. Creating an account and using the AI features requires consent under data-protection law; if you are under 16, you may only use these features with the consent of a parent or legal guardian (Art. 8 GDPR). We do not knowingly collect personal data from children without such consent — if you believe a child has provided us data without it, contact us and we will delete it.

8. Website waitlist

If you join the waitlist on this website, we process your e-mail address to notify you once about the app launch. Legal basis: Art. 6(1)(a) GDPR. You can request deletion at any time via recipy.support@gmail.com.

9. Retention

Account data and usage counters: until you delete your account.
Session tokens: at most 30 days.
Import content: processed for the duration of your request; link results cached for at most 24 hours.
Local device data: until you delete it in the app or uninstall the app.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw any consent at any time with effect for the future. You may also lodge a complaint with a data-protection supervisory authority. Delete your account: directly in the app under Settings → “Delete account” — this permanently removes your account, import history and premium assignment from our server.

11. Changes

We update this policy when the app or the legal situation changes. The version published here applies.