Privacy Policy

ReciPics is committed to protecting your privacy. This Privacy Policy explains what data the app and our services process, why, and what rights you have. Sections 1 to 10 apply to users of the ReciPics app. Section 11 applies to creators and business contacts.

1. Who is responsible (controller)

Vladimir Skromny, operating ReciPics, Switzerland, is the controller. Contact: hello@recipics.app.

2. Information We Process

ReciPics has no accounts and no login. We do not ask for your name or email address in the app. The app processes the following:

• Images. Camera and library images you submit to generate a recipe are sent to OpenAI through our backend.
• Voice recordings. Recordings you make for voice input are sent to OpenAI for transcription through our backend. The recording file is kept on your device only temporarily.
• Text. Text you type or paste (ingredients, meal descriptions, recipe text, questions to the recipe assistant) is sent to OpenAI through our backend.
• Profile information (health-related). If you enter allergies, dietary restrictions or health conditions (health data) in a profile, they can be included in the request sent to OpenAI so that recipes fit your needs. This is health-related information and can also reveal, for example, religious or ethical convictions. It is sent only after you have given your explicit consent in the app, and only the information needed for the recipe in question is included. The app works without these entries. You can withdraw your consent at any time in the app, after which this information is no longer sent. The profile name is not sent.
• Recipe links. A link you import (the full web address) is sent to our backend to extract the recipe.
• Usage and device data (analytics). If analytics is on (see section 3), the app sends to our analytics provider PostHog: a random identifier created at installation (device ID), the screens and actions you use (product interaction and other usage data, for example onboarding steps, paywall views, recipe generation and import, grocery list use), purchase events (purchase history: plan, price, currency), the number of free tokens used, error types and codes (diagnostic data) and the duration of some actions (performance data), device model, operating system version, language, time zone, screen size, network type (Wi-Fi or cellular) and app version. Analytics data is associated with this random installation identifier (a pseudonymous identifier that Apple's privacy label counts as data linked to you), not with your name, email address or Apple ID. We do not send recipe titles or the web domains of imported recipes to analytics, and the app does not access your device location. IP addresses may be processed by PostHog when events are sent, and PostHog may derive an approximate location (such as country or city) from them.
• Apple Search Ads attribution. If you installed the app after tapping a Search Ads ad, Apple provides campaign, ad group and keyword identifiers and related attribution details, such as the ad identifier, conversion type and country or region (Apple label category: advertising data). We use this advertising data only to measure which ads lead to installs and how those installs use the app. We store this advertising data on your device and, if analytics is on, add it to the analytics events sent to PostHog.
• Purchases. Purchases are handled by Apple (StoreKit). We do not receive your payment details or Apple ID.

The app does not show a tracking permission request and does not track you across other companies' apps and websites.

3. Why we process it and legal basis

• Recipe generation, transcription, recipe import and assistant answers: to provide the app you requested (Art. 6(1)(b) GDPR).
• Health-related profile information: only with your explicit consent (Art. 9(2)(a) GDPR; under the Swiss Federal Act on Data Protection, your express consent). You give it in the app before this information is first sent, and you can withdraw it at any time.
• Analytics (measuring which features are used, finding and fixing problems):
  • In the EU/EEA (including Germany) and in the United Kingdom, analytics is off by default. It starts only after you accept in the app (Art. 6(1)(a) GDPR or UK GDPR and the national rules on access to information on your device, such as section 25 TDDDG in Germany and PECR in the UK). You can withdraw your consent at any time in the app under Profile (the person icon at the top left of the Home screen) > Privacy.
  • In Switzerland, analytics is on by default, based on our legitimate interest in improving the app, and you can switch it off at any time in the app under Profile (the person icon at the top left of the Home screen) > Privacy.
  • In other regions, analytics can be switched off in the app under Profile (the person icon at the top left of the Home screen) > Privacy.
• We do not show advertising in the app, we do not use your data for advertising targeting, we do not sell it, and we do not track you across other companies' apps and websites.

4. Recipients and service providers

These providers process data on our behalf (processors, "Auftragsverarbeiter") or under their own terms:

• OpenAI (USA): receives images, audio, text and, with your consent, health-related profile information, in order to generate recipes and to transcribe voice input. Data is processed to provide the feature; our providers may keep data for a limited time under their own terms.
• Vercel (USA): hosts our backend, which forwards requests to OpenAI and handles recipe import. It processes the content of requests and your IP address in order to provide the feature; our providers may keep technical data for a limited time under their own terms.
• Recipe import: the link you import is processed by our backend, which fetches the page. For some sources our backend may use Apify Technologies s.r.o. (Czech Republic) and an AI model provider.
• PostHog (EU hosting region): product analytics, if analytics is on. It receives the events and device data described in section 2.
• Apple: Search Ads attribution (AdServices), App Store purchases and the App Store and TestFlight services.
• Google Workspace (Gmail): support correspondence by email.

We do not sell your data.

5. International transfers

OpenAI, Vercel and other providers may process data outside Switzerland and the EU/EEA, in particular in the USA. Vercel Inc. is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework (register read 21.10.2026, Active), and transfers to Vercel rely on that certification. OpenAI is not certified under the Data Privacy Framework; for OpenAI and other recipients in countries without an adequacy decision, we rely on other safeguards provided for by law, such as Standard Contractual Clauses (with a Swiss addendum for Switzerland). You can request information about the safeguards at hello@recipics.app.

6. Storage and retention

• Your recipes, library, grocery list, profiles and history are stored on your device and are not synced to us. They are removed when you delete the app. The app keeps a limited history and removes the oldest entries.
• Images, audio, text and profile information are processed to provide the feature. Our providers may keep data for a limited time under their own terms.
• Analytics data is kept only as long as needed for the purposes described in this policy.
• Support emails are kept only as long as needed to answer you and to document the correspondence.

7. Security

App communication with our backend is encrypted in transit (HTTPS). No security measure is absolute.

8. Your rights and how to exercise them

You have the right to access, rectification, erasure, restriction, data portability (where applicable) and to object to processing based on legitimate interest, and you can withdraw a consent at any time. Under the Swiss Federal Act on Data Protection you have the corresponding rights (Art. 25 ff.).

Analytics data is stored under a random identifier that is not linked to your name, so we can normally not assign it to you. Switching analytics off in the app under Profile (the person icon at the top left of the Home screen) > Privacy stops further collection, and deleting and reinstalling the app creates a new random identifier. For questions or requests about data held by us, write to hello@recipics.app. Data on your device can be deleted by deleting the app or its entries in the app. For data that OpenAI or other providers process, their own terms apply as well (section 4).

You may complain to a supervisory authority, for example the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or the data protection authority in your EU country.

9. Children

ReciPics is not intended for children under 16 in the EU/EEA, and not for children under 13 elsewhere. We do not knowingly process children's data.

10. Changes to this policy and earlier app versions

We may update this Privacy Policy. The current version is always on this page.

This version describes app version 3.7.19 and later. Earlier versions of the app worked differently: they showed a tracking permission request, included a Google Firebase component (configured with analytics switched off), loaded website icons from a Google service when you opened the recipe import screen, sent analytics from the first launch without an opt-in or opt-out choice and including imported recipe titles and web domains, and earlier still used a third-party attribution provider (AppsFlyer). If you use an earlier version, please update the app.

11. Creator and Business Contacts (Partnership Outreach)

This section applies to creators and businesses we contact about a possible partnership with ReciPics. It does not apply to users of the app (see sections 1 to 10). It is provided under Article 14 of the UK GDPR and EU GDPR and Article 19 of the Swiss Federal Act on Data Protection (revDSG). We also link to this notice in our first message to you, and in any case within one month of obtaining your data.

• Who is responsible (controller): Vladimir Skromny, operating ReciPics, contactable at hello@recipics.app.
• What we process: your name, your public handle, the public business or contact email you list on your profile, bio or website, public content we quote when we write to you (for example captions or comments), our message history and your replies, and your opt-out status.
• Where it comes from: your own publicly accessible profile, bio or website (for example on Instagram, TikTok or YouTube). We do not buy contact data.
• Why: to contact you about an app partnership with ReciPics, and to keep a record of contacts and opt-outs so that we do not write to you again after you ask us not to.
• Legal basis: our legitimate interest in approaching creators and businesses about a partnership that promotes ReciPics (Article 6(1)(f) UK GDPR / EU GDPR). Under the revDSG, processing is justified by our overriding private interest in the same purpose (Article 31 revDSG). We balance this against your rights, contact you only at a business or public contact address, and stop when you object.
• How long we keep it: contacts who do not reply are deleted 12 months after our last message to you; if you reply, we keep the conversation only while the discussion is active and then for up to 12 months. If you opt out, we keep only a minimal suppression entry (your handle and/or email address) so that we honour your request; our legitimate interest is in honouring your objection, and we keep it for as long as needed for that purpose.
• Who receives it: we do not sell your data. It is handled only by the following providers, which act on our instructions as processors (or, for the social platforms, under their own terms):
  • Google Ireland Limited / Google LLC (Gmail / Google Workspace): sending and storing our emails.
  • Meta Platforms Ireland Limited (Instagram): direct messages sent through Instagram. The platform handles them under its own terms.
  • TikTok Technology Limited (Ireland) / TikTok Pte. Ltd.: direct messages sent through TikTok. The platform handles them under its own terms.
  • Apify Technologies s.r.o. (Czech Republic): collection of publicly accessible profile information and public posts and comments, used to research which creators may be a fit for a partnership.
  • Anthropic PBC (USA): AI assistance to assess the fit of a public profile and to draft messages, based on the public information described above.
• International transfers: where a provider is located outside the UK, EU/EEA or Switzerland, we rely on an adequacy decision or on safeguards. Google LLC states that it complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks (policies.google.com/privacy/frameworks), so transfers to Google in the US rely on those frameworks. Anthropic PBC (USA) does not state a Data Privacy Framework certification; its Data Processing Addendum incorporates the Standard Contractual Clauses (Modules Two and Three) together with a Swiss Addendum, and we rely on those. Transfers to the EU/EEA, such as to Apify in the Czech Republic, are covered by the adequacy findings between those territories; Apify's data processing addendum notes that it may transfer personal data to the United States and to its own sub-processors, under its own transfer safeguards. For Instagram (Meta) and TikTok, see the next paragraph. You can request a copy of the safeguards at hello@recipics.app.
• Instagram and TikTok messages: for messages you receive or send through Instagram or TikTok, those platforms process the data as independent controllers under their own privacy policies, not on our behalf. Meta states that it transfers data using the European Commission's Standard Contractual Clauses and publishes a separate EU-U.S./Swiss-U.S. Data Privacy Framework disclosure; TikTok states that it relies on adequacy decisions and Standard Contractual Clauses (and, absent those, Article 49 GDPR) and does not mention the Data Privacy Framework.
• Your rights: you can ask us for access to your data, rectification, erasure or restriction of processing. You can object at any time to our processing on grounds relating to your particular situation, and you have an absolute right to object to direct marketing, after which we will stop. Under the revDSG these rights are set out in Articles 25 and 32. Data portability does not apply to this processing. To exercise any right, or to opt out, simply reply "stop" to any message from us or write to hello@recipics.app. You may also complain to a supervisory authority: the UK Information Commissioner's Office (ico.org.uk), the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), or the data protection authority in your EU country. We carry out no automated decision-making or profiling with legal effect. In Switzerland you may also bring a claim before a civil court.

12. Contact

For privacy-related inquiries, contact us at hello@recipics.app.