Privacy Policy — Receptli

Effective from 21 October 2026 — version 2026-10-21. English translation; the Slovak version is the original.

1. Who processes your data

The controller is OnIT s. r. o., company ID 55 010 903, registered office Ľudovíta Fullu 3012/6, 841 05 Bratislava — Karlova Ves, Slovakia, entered in the Commercial Register of the Bratislava III City Court, section Sro, insert 164718/B. Contact: support@receptli.app. We have not appointed a data protection officer.

2. Summary

• Receptli is an app for adults to keep their own recipes in a household of up to 5 people.
• Households with a subscription can join a Family and read one another's recipes. E-mail addresses are never shown between households.
• We do not sell your recipes, photos or source pages, and do not use them for advertising or model training. The app contains no advertising or analytics SDKs and uses no cookies.
• AI processing is optional and enabled by a separate consent. Selected sources are then processed by Google (Gemini API); Facebook, Instagram and TikTok posts, and some inaccessible public web pages, are read for us by Apify.
• The server and database run at Hetzner in Germany. Source files and recipe photos are encrypted on disk.
• Subscriptions are bought through the App Store or Google Play; purchases are verified by RevenueCat. We never receive payment card details.

3. What we process and why

3.1 Account and sign-in

We store your e-mail address, account creation date, app language and recipe language. Sign-in uses a six-digit code sent to your e-mail; the code is valid for 10 minutes and we store only its hash together with the IP address it was requested from, the number of attempts and timestamps. The IP address limits the number of requests and ensures the code is verified by the same device that requested it. After sign-in we store hashes of the access token (15 minutes) and the refresh token (30 days of inactivity). You can also sign in with Apple or Google. For such sign-in we store the provider's user identifier and the e-mail it supplied; the provider is an independent controller for its own sign-in service. We send your e-mail address only sign-in codes, a confirmation that your account was deleted, and notices of changes to the terms of use or this policy; we send no advertising e-mails.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR); securing sign-in and limiting abuse: legitimate interest (Art. 6(1)(f)).

3.2 Age confirmation and consents

Receptli is for people aged 18 and over. We keep a record of your age confirmation and of granting or withdrawing AI processing consent: type, text version, language, time granted and time withdrawn. We do not collect your date of birth.

Legal basis: performance of a contract and demonstrating consent (Art. 7(1) GDPR); legitimate interest in protecting a service intended for adults.

3.3 Recipes and household content

We store recipes (title, ingredients, quantities, steps, notes, classifications, tags, language, and the link to the source page where a recipe came from one), recipe drafts awaiting review, one recipe photo, your household's meal plan and shopping list, and for each record who created or last changed it. Content belongs to the household: all its members see and edit it. Household members see each other's e-mail addresses and who added a recipe; the owner also sees the number of AI drafts used by each member. With a recipe we also store members' ratings (1 to 5 stars), records of when the household cooked it and who logged that, an optional short cooking note (up to 280 characters, written only by whoever logged the cooking) and whether the recipe is on the Want to cook list.

Recipes and notes may indirectly reveal diet, health or religion (for example gluten-free, diabetic or fasting cooking). You save them voluntarily for your own use; we build no profiles from them. Photos of notebooks and pages may contain other people's data — upload only what you are allowed to, and remove unnecessary data first.

Legal basis: performance of a contract (Art. 6(1)(b)).

3.4 Import source files

For an import we store the source the draft is made from: photos and screenshots (JPEG, PNG, WebP, HEIC), PDF pages, text downloaded from a link, pasted text, the caption and video of a social media post, and a suggested recipe photo downloaded from the page or post. Source files are encrypted in storage (AES-256-GCM), have non-public identifiers and are read only by a signed-in household member while reviewing the draft. Once the draft is saved as a recipe or discarded, we delete the source files within 24 hours; a saved recipe no longer has access to them. A post video is never displayed and is deleted immediately after processing.

Legal basis: performance of a contract (storage and display during review); sending them to the AI provider rests on the consent in 3.5.

3.5 AI processing (separate consent)

AI import starts only after your explicit consent in the app ("Privacy & AI"), which you can withdraw in the same place at any time. Withdrawal stops further sending; recipes already created remain and you can delete them yourself.

What is sent to the AI provider Google (Gemini API): the selected photos and PDF pages as full images, text downloaded from a link or pasted text, a post's caption and its video, together with our instruction and, where requested, a request to translate into the app language. The model therefore sees everything on the submitted pages, including any handwritten notes. Not sent: your e-mail, account or household identifier, the recipe photo, other recipes. A video larger than 12 MB is uploaded to Google's temporary file storage and deleted after processing.

We use AI through the paid tier of the Gemini API (Google LLC, USA) with billing enabled, not through a public chat product or the free tier. Under Google's terms for paid Gemini API services, inputs and outputs are not used to improve Google products, and Google processes them as our processor under its Data Processing Addendum; Google does, however, document temporary retention for abuse monitoring. We do not promise zero retention at Google.

Facebook, Instagram and TikTok posts are read for us by Apify (Apify Technologies s.r.o., Prague, Czech Republic). Apify receives only the cleaned link to the post (without tracking parameters) and returns its caption, video and thumbnail; it never sees your account or e-mail. Videos longer than 3 minutes are not downloaded.

A YouTube link: we read the video's title, description and thumbnail through the YouTube Data API (Google LLC); our server does not download the video itself — Gemini API reads it directly from YouTube by link and processes at most its first 15 minutes. Receptli uses YouTube API Services; in addition to this policy, the YouTube Terms of Service (youtube.com/t/terms) and the Google Privacy Policy (policies.google.com/privacy) apply. Data obtained through the YouTube API is kept for at most 30 days.

A link to an ordinary web page is first fetched by our server. If direct access to a public page fails, we send the cleaned link without tracking parameters to Apify, which returns the page text. Apify does not receive your account identifier or e-mail. We write the page's domain, your account identifier and the outcome to the operations log so that we can limit abuse of our service against third-party sites.

AI output may be wrong or incomplete; you review every draft before saving. This is not automated decision-making with legal effects.

Legal basis: your consent (Art. 6(1)(a)); to the extent a source contains your own sensitive data, explicit consent (Art. 9(2)(a)). Your consent does not authorise processing other people's sensitive data.

3.6 Subscription

The household owner buys the subscription in the App Store or Google Play. At purchase the app sends your household identifier to RevenueCat as the customer identifier, together with the purchase data supplied by the store and the SDK (transaction and product identifiers, platform and technical device data). Our server reads the subscription state from RevenueCat and stores: store, product, purchase identifier, start and end of the paid period, whether renewal is on, and the state (active, grace period, ending, refunded, locked). We also keep an AI allowance ledger: the time, number of drafts and pages of each successful import and who performed it. We never receive card numbers or billing details; the stores are independent controllers for the payment. We also keep a history of subscription status changes: the status, auto-renewal, the end of the paid period and the time of the change.

Legal basis: performance of a contract (Art. 6(1)(b)).

3.7 Invitations, sharing and Families

A household invitation is a code valid for 7 days; we store its hash and the time it was created, accepted or revoked. A recipe share link is valid for 7 days; we store the token hash and your name for sharing, if you set one in your account (otherwise none). Whoever opens the link sees, without signing in, the recipe's title, ingredients, method and photo and this name; a copy saved by the recipient carries it until you delete your account. Source files are never shared.

A Family is a group of up to 5 households. The owner of a household with a subscription founds it and invites other households with a code or link valid for 7 days; for an invitation we store the code's hash, who created it and the time it was created, accepted or revoked. A household's owner joins and leaves a Family on behalf of the whole household, and the household needs a name of its own first. While a household has a subscription, all members of the households in the Family see its recipes and recipe photos, its name and, on each recipe, the author's name (the name for sharing), if they set one. The Family also shows its name, the households' names, how many members each has and whether a household is waiting for a subscription. E-mail addresses, meal plans, shopping lists, source files and recipe drafts are never shown between households. You can save another household's recipe to your own as a copy; the copy carries the author's name, or without one the name of their household, and stays with you after you leave the Family or the original is deleted. When a household leaves the Family, the others no longer see its recipes; copies they already saved remain. With a recipe they also see the household's average rating, the number of ratings and how many times the household cooked it; who rated, individual members' ratings and cooking notes are never shown between households.

Legal basis: performance of a contract (a feature you or your household's owner triggered).

3.8 Notifications and device permissions

Cooking timers use your device's local notifications; they are scheduled on the phone and send nothing to our server. Camera and photo access is used only to pick a source or a recipe photo when you ask for it; metadata is stripped from photos when they are resized.

When an import finishes on our server, we send you a push notification ("Your recipe is ready" or "The recipe could not be imported"). The app asks for permission to show notifications at your first import or timer. If you allow them, we store with your account the device's push token (the address a notification is delivered to), the platform (iOS or Android) and the time of the last registration. The notification contains only this generic text and internal identifiers of the import, never the recipe title or source. It is delivered by the Expo service through the Apple Push Notification service on an iPhone or through Google's Firebase Cloud Messaging on Android; for this, Expo also receives at registration the device token from Apple or Google and a random identifier of the app installation. The Firebase Cloud Messaging library in the Android app registers the device with Google as soon as the app starts. If registration fails, we write only the step that failed and the system's error message to the operations log. You can turn notifications off in the device settings; when you sign out, the app removes the token from your account.

Legal basis for the push token: performance of a contract (a notification about an import you started); notifications appear only with your permission on the device.

3.9 Data on the device

The app keeps a copy of recipes, the meal plan and the shopping list on the device (SQLite) for offline use, a queue of unsent changes, sign-in tokens in the system's secure storage, and your settings. This data syncs with the server; signing out and uninstalling removes it from the device. We use no cookies.

3.10 Operations, security and support

Server logs contain the request identifier, error code, timings and limits; never recipe content, sources or e-mails in error text. We back up the database and the encrypted file storage daily; one copy of the backup, encrypted on our server with a key only OnIT holds, is stored off-server at Backblaze (section 4). If you write to us, we process your message and whatever you attach; do not send sign-in codes or other people's sensitive documents.

For every recipe export (JSON, ZIP, PDF, print) we record the export type, the number of recipes, the household's subscription status and the time, together with the account and household identifiers. This helps us understand how exports are used and how they relate to subscription cancellations; we never store recipe content or file names.

Legal basis: legitimate interest in secure and reliable operation, in improving the service and in defending claims (Art. 6(1)(f)); support: performance of a contract.

4. Recipients and transfers outside the EU

For transfers to the USA we rely, for each recipient, on the safeguard listed in the table: certification under the EU-U.S. Data Privacy Framework (a Commission adequacy decision) and the Commission's standard contractual clauses, which form part of the data processing addendum with that recipient. Support can provide a copy of the relevant clauses on request. We disclose data to no other third parties unless required by law.

5. How long we keep data

You delete your account directly in the app; if that is not possible, ask support by e-mail. Deletion is immediate: we remove the account, all sign-ins, the consent records, device push tokens and your own household with all its recipes, meal plan, shopping list, photos and source files; share links you created stop working. Your name for sharing also disappears from the copies in other households that carry it; the copies themselves remain. The owner of a household with other members transfers ownership first. Recipes, meal plan and shopping list entries you added to a shared household stay with that household and its owner is shown as their author from then on. Deleting the account does not cancel the subscription in the App Store or Google Play — cancel it in the store. Right after deletion we send a confirmation to the account's e-mail address; if a subscription still renews, it says where to cancel it. Data disappears from backups after 14 days.

6. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection under Art. 15 to 21 GDPR. You withdraw AI processing consent in the app as easily as you granted it; withdrawal does not affect the lawfulness of earlier processing. You may object to processing based on legitimate interest on grounds relating to your particular situation.

You download your recipes via the export in the app (the basic export is a JSON file with your household's recipes; the extended export is a ZIP archive that also holds the photos and a JSON-LD copy; both work in a locked household) or by asking support. Send requests to support@receptli.app, even if you have no account or are a person captured in someone else's photo. We verify identity proportionately to the risk, usually via the account e-mail. We respond without undue delay and within one month at the latest; for complex requests we may extend by a further two months and will tell you.

You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Galvaniho 7/B, 821 04 Bratislava, www.dataprotection.gov.sk, or with the supervisory authority in the state of your habitual residence.

We make no automated decisions with legal or similarly significant effects (Art. 22 GDPR). An AI recipe draft is an aid that you edit.

7. Children

Receptli is not intended for people under 18 and we do not knowingly process their data. If we learn that an account belongs to a minor, we delete it.

8. Security

The connection to the app is encrypted (TLS). Source files and recipe photos are encrypted on disk with a key kept separately from the data, sign-in and share-link tokens and codes are stored only as hashes, the server runs under its own account with restricted access, and the database is separated from the operator's other services. Only people who need access for operation and support have it.

9. Changes

When processing changes materially we update this document and inform you in the app or by e-mail. If a change requires new consent, we ask for it before the processing in question; continued use does not replace it. The Terms of Use are a separate document: https://receptli.app/en/terms.