Privacy Policy

1. Name and Contact of the Data Controller

Operator: Roman Moroz
Alpenstr. 12
86159 Augsburg
Germany
Email: rfrost.apps@gmail.com

2. Data We Collect

• Account Information: Email address, Google sign-in data
• Usage Data: Ingredient selection, recipe preferences, session activity
• Device & Log Data: Device model, OS, IP address, crash logs
• Payment Data: Managed entirely by Apple (we do not store payment data)
• Uploaded Images: Only processed for detection, not stored permanently

3. Purpose of Processing

We process your personal data for:

• Generating recipes and managing preferences
• User authentication and subscription management
• Improving performance and usability
• Security and abuse prevention
• Legal compliance

4. Legal Basis

• Art. 6(1)(b) GDPR – Performance of a contract
• Art. 6(1)(a) GDPR – Consent (e.g. camera access)
• Art. 6(1)(f) GDPR – Legitimate interest (analytics, improvement)

5. Data Sharing

We share data only with service providers under strict data protection agreements:

• Firebase (Google LLC) – Auth, database, crash reporting, analytics
• OpenAI – Ingredient detection via API (optional camera feature only)
• Apple – Subscription and billing (handled via App Store)

6. Data Storage and Retention

Your data is stored on secure Google Cloud infrastructure via Firebase. Recipe data is not permanently stored unless saved by you. Account/subscription data is retained as legally required or until you delete your account.

7. Data Transfers Outside the EU

Some providers (e.g. Firebase, OpenAI) may process data in the USA. We ensure safeguards like standard contractual clauses (SCCs) are in place for compliance.

8. Your Rights (GDPR)

You have the right to:

• Access your data (Art. 15)
• Rectify incorrect data (Art. 16)
• Request deletion (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7(3))

Email: rfrost.apps@gmail.com to exercise your rights.

9. Data Deletion

You can request full account and data deletion at any time unless legal obligations require retention.

10. Supervisory Authority

If you believe your data rights have been violated, you may lodge a complaint with your local data protection authority. In Germany, this is typically your federal state’s supervisory body.

11. Updates

We may update this Privacy Policy as needed. Major changes will be communicated. Please review regularly for updates.