Privacy Policy

CookinBuddy is a freemium recipe and shopping list app for iOS. This Privacy Policy explains what personal data we collect when you use CookinBuddy (the “Service”), why we collect it, who we share it with, and the rights you have over it.

Who We Are (Data Controller)

The data controller responsible for your personal data is:

• Błażej Kustra (sole proprietorship)
• ul. Romana Kiełkowskiego 10B/12, 30-704 Kraków, Poland
• NIP (Tax ID): 6793333158 · REGON: 541922108
• Email: kustrablazej@gmail.com

Information We Collect

We collect the following categories of data when you use the Service:

• Account data — your email address, name, and optional username. If you sign in with Apple or Google, we receive the email address and name associated with that account.
• Content you create — recipes, shopping lists, folders, and photos you upload (for example, photos of recipe cards or cookbook pages). This content is stored on our servers to provide the core functionality of the Service.
• Device and usage data — IP address, device model, operating system version, app version, crash reports, and in-app usage events (for example, which features you use). We use this to keep the Service working, diagnose problems, and improve the app.
• Push notification tokens — if you enable notifications, we store a device token so we can deliver them.
• Purchase data — if you subscribe, Apple processes the payment. We never see or store your card details; we receive subscription status information (such as plan and renewal state) via Apple and RevenueCat.

The app does not collect location data.

How We Use AI

Some CookinBuddy features are powered by artificial intelligence. When you import a recipe from a link, photo, or pasted text, or when you generate a shopping list, the relevant content (the photo, the page text, or your recipes and prompt) is sent to OpenAI, our AI service provider, to be processed. We send only what is needed to provide the feature you requested.

According to OpenAI's policy, data submitted through its API is not used to train its models by default. You can read more in OpenAI's privacy policy.

Third-Party Service Providers

We use the following third-party providers to operate the Service. Each processes data on our behalf for the purpose described, under its own privacy policy:

• Amazon Web Services (AWS) — hosting, data storage (including your uploaded images), and email delivery
• OpenAI — AI processing for recipe import and shopping list generation
• PostHog — product analytics (in-app usage events)
• Sentry — error tracking and crash diagnostics
• RevenueCat — subscription management
• Apple — payment processing and (optionally) Sign in with Apple
• Google — (optionally) Sign in with Google

We never sell your personal data, and we do not share it with third parties for their own advertising.

Sharing Within the App

If you share a recipe or shopping list with someone, the people you invite can see that content and, depending on their role, your name or username. Content you don't share stays private to your account.

We may also disclose personal data if required to do so by law, or to protect the rights, safety, or property of our users or the Service.

International Data Transfers

Some of our providers (such as AWS, OpenAI, PostHog, Sentry, and RevenueCat) may process data in the United States or other countries outside the European Economic Area. Where that happens, transfers are protected by recognized safeguards such as the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Data Retention and Deletion

We keep your data for as long as your account is active. You can delete your account at any time in the app under Settings → Account → Delete account, or by emailing us at kustrablazej@gmail.com from the address on your account.

When you delete your account, we delete your personal data and the content you created — including your recipes, shopping lists, and uploaded images — within 30 days, except where we are legally required to keep certain records (for example, for tax or accounting purposes). Content you shared with others may remain visible to them if they keep their own copy.

Your Rights

Under the GDPR and applicable data protection laws, you have the right to:

• access a copy of the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data (“right to be forgotten”);
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format; and
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email us at kustrablazej@gmail.com. We will respond within one month. You also have the right to lodge a complaint with your local supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl).

Children

This Service is not directed at anyone under the age of 13, and we do not knowingly collect personal data from children under 13. If you are in the European Economic Area and under 16, you may only use the Service with the consent of a parent or guardian. If you believe a child has provided us with personal data, contact us and we will delete it.

Security

Your data is transmitted over encrypted connections and stored in access-controlled infrastructure; uploaded images are kept in private storage that is not publicly accessible. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security, but we work to protect your data using commercially reasonable safeguards.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the effective date above. If a change materially affects how we handle your personal data, we will notify you in the app or by email before it takes effect.

Contact Us

If you have any questions about this Privacy Policy or how your data is handled, contact us at kustrablazej@gmail.com.