Privacy Policy

What Data We Collect

• Account data: email address, username, and encrypted password hash
• Profile data: display name, avatar image (optional)
• User content: recipes, ingredient lists, cooking steps, images, notes, reviews, and cooking logs
• Social data: follow relationships, cookbook memberships, recipe shares
• Preferences: language, notification settings, dietary preferences, planner entries
• Vault data: encrypted vault entries accessible only with your vault password
• AI usage: anonymised counts of AI feature calls (recipe import, nutrition, meal planning, translation)
• Technical data: session tokens, error logs, and performance telemetry
• Payment data: subscription status; card details are held by Stripe, not by us

Legal Basis for Processing (UK GDPR)

• Contract performance (Article 6(1)(b)): to operate your account and deliver the service
• Legitimate interests (Article 6(1)(f)): to improve the app, detect abuse, and ensure security
• Consent (Article 6(1)(a)): for optional features such as email marketing, if offered
• Legal obligation (Article 6(1)(c)): to comply with tax, fraud prevention, or law enforcement requirements

How We Use Your Data

• To create, manage, and secure your account
• To store and display your recipes and shared content
• To power AI features (recipe import, nutrition analysis, meal planning, translation)
• To process Pro subscription payments via Stripe
• To send transactional emails (account confirmation, password reset, cookbook invitations)
• To monitor app performance and fix bugs
• To prevent fraud, abuse, and illegal activity

Third-Party Data Processors

We share your data only with processors necessary to run the service:

We do not sell, rent, or trade your personal data. Each processor is bound by a data processing agreement and is required to protect your data.

International Transfers

Some of our processors (Supabase, Google, Cloudflare, Stripe) are based in or route data through the United States. Where data is transferred outside the UK or EEA, it is protected by Standard Contractual Clauses (SCCs) approved by the relevant supervisory authority.

Data Retention

• Account and content data: retained until you delete your account
• Error and performance logs: retained for up to 90 days
• AI usage counts: retained for up to 12 months for rate-limit enforcement
• Deleted account data: removed within 30 days of deletion request, except where required by law

Public vs. Private Content

• Public recipes and profiles can be viewed by any user, including unauthenticated visitors
• Private and secret recipes are visible only to you
• Vault content is encrypted and accessible only with your vault password — we cannot read it
• Shared recipes are visible to the specific users you share with

Cookies and Session Storage

We use strictly necessary cookies and browser session storage to keep you logged in. These are essential for the service to function and do not require your consent under UK GDPR. We do not use advertising, tracking, or analytics cookies.

Your Rights

Under UK GDPR you have the right to:

To exercise any right, email us at info@recico.app. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Children

Recico is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by displaying a notice in the app or by email. Continued use after changes take effect constitutes acceptance of the updated policy.

Contact

For any privacy questions or requests, contact us at info@recico.app.