Privacy Policy
This policy explains what personal data the Recipantry mobile app processes, why, and what your rights are.
1. Who we are
Yunus Emre Pak ("Recipantry", "we")
Address: Istanbul, Türkiye
Email: [email protected]
2. Data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and password (stored only as a secure hash). If you sign in with Google, your email address and Google account ID come from Google. If you sign in with Apple (iPhone and iPad), your email address (or Apple's private relay address if you chose to hide it) and Apple account ID come from Apple; we don't ask for your name. Your password never reaches us. | Creating your account, signing in, password reset | Contract |
| Pantry items, pantry staples, shopping list, favorite recipes | Recipe suggestions and the app's core features | Contract |
| Profile preferences (featured country, language and region) | Ranking recipes for you | Contract |
| Scan photos | Recognizing the ingredients in the photo | Contract |
| Scan results (recognized ingredients) and technical metrics (duration, cost, error code) | Showing results, counting scans correctly, improving the service | Contract, legitimate interests |
| Subscription status (active or not, period start and end, store event) | Verifying Premium access and scan allowance on our server | Contract, legal obligation |
| Device data for ads (advertising ID, IP address, device type, ad interactions) — only for users without Premium | Showing and measuring ads in the free version; choosing ads based on your interests if you allow it | Consent for personalized ads; legitimate interests for general ads |
We never see your payment details; payments are handled by the Apple App Store or Google Play. The app has no analytics or location tracking. The free version shows ads in the recipe list and recipe details; Premium has no ads. Before any ads, the app asks once for your birth year; the answer stays on your phone and is never sent to us. If you are under 18 or skip the question, you only see general ads: they are not chosen by your interests and your advertising ID is not sent to Google. If you are 18 or over, we ask before showing ads based on your interests (in the EU, UK and US through Google's consent dialog). If you decline you see general ads, and you can change your choice under Profile > Ad preferences. All ads are limited to content suitable for all ages.
3. Scan photos
Photos are resized on your phone and their metadata (EXIF, including location) is removed. They are uploaded to private storage only you can access and deleted once the ingredient recognition finishes, and in any case automatically within 24 hours.
4. Who we share data with
| Provider | Role | Location |
|---|---|---|
| Supabase | Accounts, database and photo storage | EU (Ireland) |
| OpenAI | Recognizing ingredients in scan photos. Photos are sent only for this analysis; OpenAI does not use API data to train its models. | USA |
| RevenueCat | Verifying subscription purchases and renewals. No device identifiers are sent besides your in-app user ID. | USA |
| Google AdMob | Showing and measuring ads for users without Premium. Your account, pantry, recipe and scan data are not sent to AdMob. | USA |
| Apple, Google | App distribution, payments and (if you choose) Sign in with Apple or Google | USA / EU |
Transfers to providers outside your country use the safeguards required by applicable law, such as standard contractual clauses. We do not sell your data; for ads, only the device data listed above goes to Google.
5. How long we keep data
- Scan photos: deleted after processing, at the latest within 24 hours.
- Account, pantry, list, favorite and preference data: until you delete your account.
- When you delete your account, all of the above is permanently deleted. The stores' own purchase records are governed by Apple's and Google's policies.
6. Security
Each user's data is isolated with row-level security in our database, so no other user can see it. Connections are encrypted. AI and payment keys are kept on our server only.
7. Your rights
Depending on where you live (for example under the GDPR in the EU/UK or state privacy laws in the US), you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to complain to a data protection authority. Email [email protected] from your account email and we will reply within 30 days. You can also delete your account in the app (how?).
8. Children
The app is not directed at children. Users under 18 should use it only with a parent's or guardian's permission.
9. Changes
When we update this policy we change the date above and announce material changes in the app.