Privacy Policy

1. Information We Collect

We collect information you provide and information generated when you use the service:

• Account Information: Name, email address, and authentication credentials (including Google OAuth profile — name, email, avatar — when you sign in with Google).
• Profile & Preferences: Dietary restrictions, allergies, disliked ingredients, household size, cooking skill level, location and cuisine preference, and TTS voice preference.
• Content You Provide: URLs you submit for extraction, extracted transcripts, and recipes/collections/meal plans you create.
• Usage Data: Recipes you extract, save, cook, or clone, pages visited, and device/browser metadata (IP address, user-agent) collected for security and rate-limiting.
• Cookies & Similar Tech: Essential cookies for authentication (session), onboarding state (onboarding), and your cookie-consent choice. We use no third-party advertising cookies. See §7.

2. How We Use Your Information

• Provide, maintain, and improve Recipee — including turning videos you submit into structured recipes.
• Personalize meal suggestions, recommendations, and voice guidance to your stated preferences.
• Authenticate you and keep you signed in; enforce rate limits and prevent abuse.
• Communicate about updates, security alerts, and support.
• Generate aggregated, de-identified analytics (e.g., most-cooked recipes) — never tied back to you personally.

3. Legal Bases (GDPR)

Where GDPR applies we process your data on these bases: contract (to deliver the service you requested), legitimate interests (security, improving the product), consent (e.g., analytics cookies where you accept), and legal obligation where required.

4. Sharing & Third-Party Services

We do not sell your personal information. We share it only with service providers as needed to run Recipee:

• Google OAuth — to sign you in when you choose “Sign in with Google.” Google’s privacy policy applies to data Google handles.
• AI providers (Google Gemini, Groq) — transcripts, prompts, or video data you submit may be sent to these providers to generate recipes and meal suggestions.
• MongoDB Atlas — hosts our application database (recipes, user data) on servers in the EU/US.
• Cloudflare — protects and accelerates https://recipee.win (DDoS protection, caching static assets).
• Hosting (Contabo / Coolify) — runs our web, media, and Redis services.

We require these providers to handle your data only as instructed and with appropriate safeguards. Any URLs you submit may be processed by AI partners to produce the final recipe.

5. Cookies

We use only essential cookies:

• session — authentication (httpOnly, secure on HTTPS).
• onboarding — remembers whether you finished onboarding.
• recipee-cookie-consent (localStorage) — remembers your Accept/Decline choice for the cookie banner.

If you Decline, we set no additional cookies. You can clear these at any time in your browser settings; clearing session will sign you out.

6. Data Retention

We keep your account and content until you delete your account. Voice audio cached in Redis is keyed by voice+text and auto-expires after 30 days (LRU, 1 GB cap). Server logs for security are retained for up to 30 days. Backup copies, if any, age out within 30 days after deletion.

7. Data Security

We use reasonable technical and organizational measures — TLS in transit (HTTPS), hashed passwords (argon2), httpOnly session cookies, and managed infrastructure. No method is 100% secure, but we work to protect your data and will notify you of material breaches as required by law.

8. International Transfers

Your data may be processed in the EU (our Contabo server in the EU, Cloudflare PoPs, MongoDB Atlas EU region) and, for AI processing, in the US (Google/Groq). Where required we rely on Standard Contractual Clauses or equivalent safeguards with those providers.

9. Your Rights and Choices

Depending on where you live you may have the right to:

• Access, correct, or delete the personal information we hold about you
• Export your data (recipes and profile) — contact us and we will provide it
• Object to or restrict certain processing, or withdraw consent where processing is based on consent
• Lodge a complaint with your local data-protection authority

To exercise these rights, email [email protected]. We will respond within 30 days. Deleting your account removes your personal data; public recipes you shared remain linked to a de-identified author unless you ask us to remove them as well.

10. Children’s Privacy

Recipee is not directed to children under 13 and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. We will post the new version at https://recipee.win/privacy, update the “Last updated” date above, and, for material changes, notify you by email or in-app notice at least 30 days before they take effect.

12. Contact Us

Questions about this policy or your data? Contact us at [email protected] or via https://recipee.win — we will reply within 30 days.