Privacy Policy

Version dated 2026-10-12 · "Smakora" app, version 0.3.0

The short version: we collect the minimum needed to run the app: your email, your content, and — only if you fill them in and give a separate consent — nutrition data. We do not sell data, show no ads and use no third-party analytics. Some processing is done by third-party services (AI, email, image storage) — they are listed below. You can delete your account, with all its data, at any time.

1. Who is responsible for your data

The data controller is ФОП Яковенко Дмитро Олександрович (the Administrator), who provides the "Smakora" app (the App) with a free tier and paid subscriptions. Full details are on the Seller details page. You can reach them via the feedback form or by email at [email protected] — the same address handles personal-data requests.

Processing is carried out in accordance with the Law of Ukraine "On Personal Data Protection" and, for users in the EU/EEA, with the General Data Protection Regulation (GDPR) — section 9 below is written for them. By registering — either through the form (consent checkbox) or by signing in with Google or Apple (the consent notice under the sign-in buttons) — you accept this Policy; consent as a separate legal basis is taken where it is required (nutrition data, push notifications).

2. What data we collect

Account: email address, password (stored only as an irreversible hash — we do not know and cannot recover your password), display name, avatar, language, theme, profile address.
Sign-in log: time, country (e.g. "Ukraine") and the browser and system family ("Chrome · Windows"). We do not store your IP address at all — neither full nor shortened. The log is visible to you under "Security" and to the Administrator; it is there so you can spot a sign-in that wasn't you.
Your content: recipes, photos, pantry, shopping lists, menus, groups, comments, reports and feedback messages.
Nutrition data (optional): birth year, sex, weight, dietary preferences, allergies. These fields are optional and are processed only under a separate consent in your settings, which you can withdraw in the same place. This is a special category of data (health data): it is used only for meal planning, allergen warnings and for a nutritionist you appoint, and within those limits it is sent to the AI provider (Google, USA).
Apple Health and Health Connect (optional, apps only): if you turn on "Update from Apple Health / Health Connect", the app only reads your weight, height, birth year, sex and average weekly active calories from there and stores them in the same profile fields, to calculate your daily calorie and macro targets. The same separate health-data consent applies. We write nothing to Apple Health or Health Connect, never use this data for advertising or marketing, and never share it with third parties for such purposes. You can turn it off in the same place; system access is revoked in your phone settings.
Payments: the fact, amount, currency, plan, status and time of a payment, the invoice identifier, and for stores the purchase token. We never see or store card details.
Referral source: on your first visit we remember where you came from — only the name of the referring site (not the address of the specific page) or link tags such as utm_source — and store it with your account when you register. This is aggregate statistics like "from Telegram" or "from search"; it does not track you across sites.
Technical data: a session cookie (signed, sign-in only), saved preferences, AI usage records (request and token counts — for cost limits) and, if you turned notifications on, a device token for push. If you connected a widget or Siri, there is also a device pass — see section 6.

We do not use third-party analytics, ad trackers, tracking pixels or fingerprinting.

3. What we use it for

providing the App's features (recipes, pantry, menus, groups);
signing you in and protecting your account (verification codes, sign-in log, attempt limits);
taking out and running your subscription, refunds, and accounting for payments;
emails with verification and password-reset codes — no marketing emails;
meal planning and allergen warnings — if you filled in nutrition data;
notifications on your device — if you turned them on yourself;
protection against bots and abuse (Turnstile, rate limits, automatic photo checks);
aggregate statistics on where users come from.

4. Who data is shared with

We do not sell or share data with third parties for their own purposes. Certain operations are performed by third-party processors:

Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; data centre in Nuremberg, Germany, EU) — hosting of the server on which the App runs and the database is stored (account, recipe, nutrition data, etc.). Hetzner processes the data only on our instructions under a data processing agreement pursuant to Art. 28 GDPR.
Google Gemini (USA) — our only AI provider: every AI feature in the App runs through this single service, and we use no other models and no other AI vendors. Only what you hand over for analysis is sent: your prompt, pasted text or a video transcript, images (a photo of a dish, a screenshot of a recipe, a photo of a receipt) and, when a meal plan is built, your nutrition profile; the automatic photo check goes the same way. The key runs on a paid tier of the Gemini API, and under Google's terms for paid services ("Gemini API Additional Terms of Service", last updated 2026-04-28, section Paid Services → How Google Uses Your Data) Google does not use your prompts — including files such as images, videos or documents — or responses to improve its products, i.e. it does not train its models on them, and processes them as a data processor under its own data processing addendum. To be straight about the exception: the same terms state that Google logs prompts and responses for a limited period of time, solely to detect and prevent violations of its Prohibited Use Policy and for any legally required disclosures. So "not used for training" does not mean "not stored at all". Do not enter confidential information into AI features.
Cloudflare — proxies all traffic, stores images (R2) and provides bot protection (Turnstile). Cloudflare sees the IP addresses of all requests; during a bot check Turnstile separately receives your IP and browser data.
Resend — sends code emails (sees your email address).
Sentry (Functional Software, Inc., USA) — native iOS/Android apps only: catches the shell itself crashing (so we can fix it) while you're using it. It receives technical crash data (error type, call stack, device model and OS version) — no email, name, IP or the content of your recipes or nutrition data: automatic collection of IP and similar identifiers is turned off by a dedicated setting. It only fires when the shell crashes; normal use of the app sends it nothing.
Google / Apple (sign-in) — only if you sign in with Google or Apple: we receive your email and name from them; the fact of signing in is shared with them. The sign-in and registration pages load Google Identity Services; when that script loads, Google sees your IP and browser type.
Apple (APNs) — delivery of notifications to the iPhone app: Apple receives the device token and a generic notification text with no message content (for example, "new message from {nickname}"). The same channel carries silent notifications you never see: they contain no text and none of your data — only an instruction to the app to "refresh the widgets" or "show the timer countdown".
Google (Firebase Cloud Messaging) — delivery of notifications to the Android app from Google Play: Google receives the device registration token and the same generic text with no message content as Apple does, plus the same silent notifications with no text — the instruction to refresh the widgets or show the timer countdown. Firebase Analytics is disabled and not bundled; no advertising identifier is collected.
Web push services (Google, Mozilla, Apple — depending on your browser) — delivery of browser notifications. The payload is encrypted; the service sees only the subscription address and the fact of delivery.
App Store and Google Play — if the subscription was taken out inside a store app: the store is the seller, processes the payment, and passes us the purchase token and subscription status. Card details stay with the store.
monobank — if you pay for a subscription on the website or support the project with a donation: the payment is processed by the bank; we never see or store card details — only the fact, amount and status of the payment. For an auto-renewing subscription the bank stores your card and gives us a token that can only charge in our favour; when you cancel, we delete that token.
Silpo — only if you connect your own store account: we store an access token, and the store receives your shopping-list items and — when you arrange delivery — the address and delivery method.
Open Food Facts, USDA, Zakaz — reference lookups of products by barcode or name; no personal data is sent.
YouTube and Vimeo — the player loads only after you click the video in a recipe. From that moment Google or Vimeo receive your IP and browser type and may set their own cookies under their own policies.
GitHub — if you submit a bug report or suggestion, your display name, account number, the text and any attached screenshot go to the project's private issue tracker.
Telegram — service alerts to the Administrator (reports, failures, payment events). What goes there is your display name, account number and the text of the message or complaint — and nothing else: photos and screenshots are not sent to Telegram, the Administrator views them only in the admin panel. Your email appears in an alert only when you typed it into the public feedback form yourself so that we can reply.
Home Assistant — only if you connect your own webhook.

These services operate under their own privacy policies; some of them store data outside Ukraine and the EU (primarily in the USA) — see section 9 for the transfer safeguards.

5. Cookies, local storage and bot protection

We use strictly necessary and functional cookies only — not a single advertising or analytics one — so there is nothing to accept or reject: on your first visit the App shows a short informational notice about this (not a consent banner — there is no "accept"/"reject" choice, only "Got it"):

session — a signed session cookie that keeps you signed in. 14 days, with the HttpOnly, Secure and SameSite=Lax flags. Strictly necessary.
google_native — a marker that a Google sign-in started from the native app shell; it lives 10 minutes, exactly as long as the sign-in itself.
apple_state — a one-off state value for Apple sign-in (protection against request forgery on the way back from Apple). Lives 10 minutes.
tz — your browser's time zone, so dates and times in the App match yours. 1 year. Functional.
locale_checked — a marker that the interface language has already been determined and need not be asked again. 1 year. Functional.
smk_src — the source tag of your first visit (the channel name from the link, e.g. utm_source, plus the campaign name), so we know where people find us. 30 days, never overwritten, HttpOnly. No IP, no specific page addresses, no user profile; it does not follow you across sites.

Your browser's local storage (localStorage) holds interface state only: form drafts, collapsed sections, chosen list layouts, the offline cache. That data never leaves your device and is not sent to us.

Cloudflare Turnstile checks the registration and public feedback forms for bots. During the check Cloudflare receives your IP and technical browser data. This is abuse protection, not tracking: no user profile is built from it.

6. What the apps keep on your device

The iPhone and Android apps are not just a window onto the site. So that system search, widgets and Siri keep working while the app is closed (or with no network at all), part of the data is kept on the device itself. These copies go nowhere: only the App and its widgets can read them, and neither Apple nor Google receives their contents.

On-device search (Spotlight, iPhone). The app puts into the iPhone's system search the titles and short descriptions (up to 120 characters) of the recipes you gathered yourself: your own, those of groups you belong to, saved ones, and those in your Recipe Book. That is exactly what you already see in the App; photos are not indexed, and there are no drafts and nothing private that belongs to someone else. The list is replaced in full when you open the App — no more often than once every 6 hours — so a recipe you deleted, unsaved or lost together with a group disappears from search on its own; a recipe you have just added appears there immediately. The index is cleared when you sign out and goes away with the App if you delete it.
Home-screen widgets (iPhone and Android). So that a widget draws instantly and without a network, the app keeps a copy of your "today" data on the device: the meals in the day's plan, how many items are in your shopping list and pantry plus a few names from the list, the calories eaten and targeted for the day, and a few products with the nearest expiry dates. On iPhone that copy lives in storage shared by the App and its widgets, on Android in the App's private storage. It is refreshed from the server and disappears when you sign out, revoke the device or delete the App.
Device pass (widgets and Siri). A widget and Siri work outside the App's window, so a separate pass is issued for them — not your password and not your session. All it can do is read the day's plan, the pantry and shopping counters and your timers, and add a line to the shopping list; it cannot change your account, password or payments. It lives for a year; we store only its irreversible hash and the time it was last used, so that you can tell a live widget from one left on a phone you sold. You can revoke it at any time in your account, under "Devices and widgets"; it is deleted together with your account.

7. Who else sees your data inside the App

Members of your groups — shared recipes, pantry, lists and menus.
Anyone — your public recipes, display name, avatar and public profile. A newly created recipe is private by default.
A nutritionist you appoint — nutrition data (see Terms, section 8).
The Administrator and moderators — within report handling and support.

8. How long data is kept

Account data and content — for as long as the account exists; they go when the account goes.
Sign-in log — 90 days, then deleted automatically.
Payment records (fact, amount, plan, status) — 3 years (1095 days) after the payment, including after the account is deleted: Article 44 of the Tax Code of Ukraine requires this. Those records are de-identified as far as accounting allows.
Support messages and reports — the text remains, but after account deletion the email is stripped from it and the link to the account is broken.
Database backups — encrypted, taken every hour and rotated: cloud storage keeps the hourly copies of at least the last 7 days plus one copy per day for the last 30 days, and the server keeps only the last day's copies. No copy is kept longer than 30 days, so deleted data is gone from the backups within 30 days at most.
Server service logs — a short rolling tail that overwrites itself; the server keeps no history of the pages you visited.

9. For users in the EU/EEA

If you are in the European Union or the EEA, the GDPR applies to the processing of your data. The controller is the Administrator (section 1).

Purpose and legal basis:

Account, sign-in, running the app, subscription and payment — Art. 6(1)(b): processing is necessary to perform the contract with you (the Terms of Use).
Keeping payment records for 1095 days — Art. 6(1)(c): compliance with a tax obligation.
Account security, sign-in log, rate limits, bot protection, service alerts to the Administrator — Art. 6(1)(f): our legitimate interest in keeping the service working and free of abuse. You can object to this processing (see rights below).
Push notifications — Art. 6(1)(a): your consent, given when you turn notifications on and withdrawn when you turn them off.
Nutrition data (weight, height, sex, allergies, dietary restrictions) — a special category of data under Art. 9. The basis is Art. 9(2)(a): explicit consent, which you give through a separate consent in your settings and can withdraw in the same place along with clearing the fields. Withdrawal does not affect the lawfulness of processing before it.

Transfers outside the EU/EEA. The server and the database are located in the EU (Hetzner, Germany). Some of our other processors are located in the USA: Google (Gemini, sign-in, web push, Google Play), Cloudflare, Apple (sign-in, APNs, App Store), Resend and Sentry (native app crash reports only). Transfers are made on the basis of the European Commission's standard contractual clauses and/or the provider's participation in the EU–US Data Privacy Framework. The Google Gemini key runs on a paid tier — under Google's terms for paid services, prompts and responses are not used to train models and are processed by Google as a processor; limited abuse-detection logging remains — see section 4 for the detail.

Your GDPR rights: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection to processing based on legitimate interest (21), and withdrawal of consent at any time (7(3)). There is no automated decision-making with legal effects for you (Art. 22): the automatic photo check only temporarily blocks new photo uploads, and a human reviews the decision.

Complaints. You have the right to lodge a complaint with the data protection supervisory authority of your country of residence, your place of work, or the place of the alleged infringement.

10. Your rights

Access and a copy: the account page has a one-file export of all your data ("Download my data").
Correction: email, display name, nutrition data and the rest can be changed at any time; nutrition data can also be fully cleared.
Deletion: you can delete your account yourself ("Delete account"; step by step on the account deletion page), confirmed by a code sent to your email; no password is required, so accounts that sign in with Google or Apple can be deleted too. Your personal data — pantry, shopping lists, favorites, follows, menus, chats, nutrition data and photos — is deleted with it. You choose what happens to the recipes you added at deletion time: leave them in the App without a link to your account, or delete them along with it (see Terms, section 17). Backups age out on rotation; payment records remain for the period given in section 8.
Withdrawing consent: the nutrition-data consent in your settings, the notification consent by turning notifications off; any processing can be stopped by deleting your account.
You may lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, or — if you are in the EU/EEA — with the supervisory authority of your country of residence (section 9).

11. Security

Passwords are stored only as bcrypt hashes; verification codes as HMAC hashes; nutritionist chats are encrypted in the database; sessions live in signed cookies sent over HTTPS only; backups are encrypted. Only the Administrator has database access. That said, no system guarantees absolute security — see "Service availability" in the Terms.

12. Children

The App is intended for people aged 16 and over. We do not knowingly collect data of younger children; if such an account is found, it will be deleted.

13. Changes to this Policy

This Policy may be updated; the date of the current version is shown at the top. We will announce substantial changes with a banner in the App. Continued use after changes means you accept the new version.