Privacy

This privacy policy applies to the RecipeCat website and iOS app, including its Share Extension and widgets.

1. Controller

Burzinski & Jaenisch GbR
Burgunder Str. 1, 14197 Berlin
Deutschland
Email: info@bejanic.de

We are not legally required to appoint a data protection officer and have not appointed one. You can send privacy questions and requests directly to the email address above.

2. Visiting the website

When you visit the website, technically necessary connection data is processed, in particular your IP address, date and time, requested URL, referrer, browser and device details, and language preference. This is necessary to deliver the website, defend against attacks and investigate errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

We use Databuddy to analyse page views, clicks, session duration, referrer domain, browser and device type, approximate region, JavaScript errors and Web Vitals. Databuddy receives the IP address when the connection is established, states that it anonymises it immediately, and stores an anonymous visitor ID in localStorage and session data in sessionStorage. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the statistical analysis and technical improvement of the website.

Databuddy states that it uses no cookies, cross-site tracking or personalised advertising and that it honours Global Privacy Control and Do Not Track. You can also object to the analytics at any time by contacting info@bejanic.de.

3. Account and sign-in

We use Clerk for sign-in, session management and account security. This involves processing your user ID, email address, name, sign-in method, session data and security data. If you voluntarily choose Sign in with Apple or Google, the selected provider sends the account data you approve to Clerk. Apple or Google also processes data under its own responsibility.

The legal basis is Article 6(1)(b) GDPR where processing is necessary for your account and use of RecipeCat. Security and abuse prevention also rely on Article 6(1)(f) GDPR.

4. App content and synchronisation

We process your user ID and the content you save in RecipeCat: recipes, ingredients, steps, notes, tags, pantry items, weekly plans, shopping lists, source URLs, source attribution and settings. For shared households, we also process the household name, memberships, roles and invitations. This data is synchronised between your devices and authorised members.

The legal basis is Article 6(1)(b) GDPR. Content remains on your device and, where synchronisation is provided, in our database. Providing this data is necessary for the relevant app feature; without it, we cannot provide that feature.

5. Recipe imports, AI and voice input

When you start an import, we process your description or the public URL you provide. For web and video imports, our systems retrieve the source. For videos, metadata, audio and selected frames are processed temporarily. Extracted text and images, as well as recipe or ingredient descriptions you enter manually, are sent through Vercel AI Gateway to Google Gemini to generate structured recipes, nutrition estimates and ingredient descriptions. Ingredients may also be sent to Parallel to find current price sources.

Video retrieval runs in an isolated E2B sandbox. The sandbox is terminated after the import. Temporary video, audio and image files are not stored as part of your RecipeCat library. The source URL, attribution, a preview image from the source provider, import status and generated recipe may remain stored in your account.

For voice input, we send the recording or live audio stream to Deepgram. For voice commands, the app may additionally use Apple's speech recognition. Whether Apple processes audio on the device or on Apple servers depends on the device, language and operating system. We do not permanently store the raw microphone recording; recognised text is stored only if you use it in a RecipeCat feature.

This processing is necessary to provide the feature you request under Article 6(1)(b) GDPR. AI results may be wrong and should be checked. There is no solely automated decision with legal or similarly significant effects within the meaning of Article 22 GDPR. Do not submit private, age-restricted or confidential content, or special categories of personal data.

6. Camera, photos, microphone and local data

The camera, photo library, microphone and speech recognition are used only after you grant the relevant iOS permission. When scanning, text is recognised from selected images on your device; that recognised text can then be sent like a manual recipe description to our API and the AI services named above. Selected images are not automatically uploaded to your cloud library. Settings, offline data, widget content and temporary import data may be stored locally in the app group or device keychain.

You can revoke permissions at any time in iOS Settings. This does not automatically delete content already stored on our servers.

7. Sharing and shared households

When you create a recipe or cookbook link, anyone with the unguessable link can access the shared content for up to 30 days. Sharing the same recipe or cookbook again reuses that link and refreshes the expiry. Share the link only with people who may view the content. Importing stores a copy in the recipient's account.

In a shared household, authorised members can see its content and other members' display names and can edit shared content. Invitation data is processed until expiry, revocation or acceptance. The legal basis is Article 6(1)(b) GDPR.

8. Subscriptions and purchases

Purchases and subscriptions are handled by Apple. We use RevenueCat to display and verify subscription status. This involves processing a RecipeCat user ID, RevenueCat customer ID, product, transaction, subscription and entitlement data and, where applicable, a referral code you entered. We do not receive full payment data such as credit card numbers.

The legal basis is Article 6(1)(b) GDPR. We process legally required accounting records under Article 6(1)(c) GDPR. Apple additionally processes purchase and payment data under its own responsibility.

9. Notifications and referral measurement

If you allow push notifications, we store Apple push tokens and associate them with your account and import. We send the token and notification content to Apple Push Notification Service. Local weekly plan reminders remain on your device.

During onboarding, we measure the voluntary referral programme using a random installation ID, the events view, submit or skip, the submitted referral code, app version, build and locale. We do not use this data for advertising or combine it into a cross-device advertising profile. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is measuring the source of new installations and the operation of the referral programme. You can object at any time by contacting info@bejanic.de.

10. Recipients and processors

We use the service providers listed below. The specified data is transferred only when you use the relevant feature. The linked privacy notices and provider subprocessor lists give further details. Social networks and other source websites whose URL you import are not RecipeCat processors. When our systems retrieve them, they receive technically necessary connection and request data and process it under their own terms.

11. International transfers

Some recipients process data in the USA or other countries outside the EEA. Transfers to certified US companies may rely on the adequacy decision for the EU-US Data Privacy Framework under Article 45 GDPR. Otherwise, we rely in particular on the European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR and supplementary safeguards. You can request a copy of the relevant safeguards at info@bejanic.de.

12. Retention

We generally retain account and library data until the account or relevant content is deleted. Import jobs and source URLs remain stored to display history, troubleshoot errors and prevent duplicate imports while your account exists or until you request deletion. Temporary import media is deleted after processing completes or is cancelled; E2B sandboxes are terminated immediately afterwards. Sharing links expire after 30 days.

We delete push tokens when they are deregistered or reported invalid by Apple. Referral events are retained only as long as needed for programme measurement and abuse prevention. Under its current data policy, Databuddy generally stores analytics data while our project exists; performance measurements are deleted after one year. We delete the analytics project if we permanently stop using Databuddy. Security and server logs are deleted according to the technical and contractual retention periods of the hosting providers. Legal retention duties, especially for accounting and business records, may require storage for six to ten years. Data is then deleted or anonymised.

13. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on Article 6(1)(f) GDPR. You may withdraw consent at any time for the future. You may also lodge a complaint with a data protection authority.

Our competent authority is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany, email: mailbox@datenschutz-berlin.de. You may also contact the authority at your residence or place of work. To exercise your rights, email info@bejanic.de. We may ask for proof of identity to prevent unauthorised disclosure.

14. Security, changes and no data sales

We use appropriate technical and organisational safeguards, including encrypted transmission, access restrictions, isolated processing environments and signed internal jobs. No internet transmission can be guaranteed to be absolutely secure.

We do not sell personal data, use it for personalised advertising or create advertising profiles. We update this policy when features, providers or the law change. We will provide notice in the app or on the website about material changes.