Privacy Policy

What we process, and why

Account data — your email address, username and login sessions — so you can have an account. Processed by our authentication provider Clerk (USA) on our behalf. Legal basis: performing our contract with you.

Your content — recipes, meal plans, shopping lists, labels, saved places, reviews, photos and contribution points. This is the product itself; it lives on our own server. Recipes are private by default. Legal basis: contract.

AI input — when you use an AI feature (for example creating a recipe from text, a photo or a link), the text or image you submit is sent to OpenAI (USA) to produce the result. OpenAI does not use this data to train its models. Legal basis: contract (you invoked the feature).

Map usage — loading map tiles and searching addresses sends your IP address transiently to MapTiler (Switzerland). Legal basis: legitimate interest in showing you a map.

Usage statistics — we run our own analytics on our own server (Umami, self-hosted). It uses no cookies and stores no personal data: visitors are counted through a salted hash that changes every day and cannot be traced back to you. Legal basis: legitimate interest in understanding aggregate usage.

Push notifications — only if you turn them on; we store the subscription your browser gives us so we can send the reminders you asked for. Legal basis: consent (revocable in Settings).

Feedback — if you send feedback, we store the message and, for abuse protection, a short-lived record of the sending IP.

What we do not do

We do not sell or share your data for advertising. We run no ad trackers and no marketing pixels. We do not profile you. We collect nothing beyond what the features above need.

Cookies and local storage

We use only strictly necessary cookies: your login session (Clerk) and your language choice. Your theme preference is kept in your browser's local storage. Our analytics is cookieless. That is why Spis has no cookie banner: there is nothing to consent to.

Who processes data for us

Clerk (authentication, USA), OpenAI (AI features, USA), MapTiler (maps, Switzerland), Akamai/Linode (server hosting, UK/EU; photo storage in Frankfurt, Germany). Transfers to the US providers are covered by the EU–US Data Privacy Framework, with standard contractual clauses as fallback. Each processor is bound by a data processing agreement.

How long we keep things

Your account data and content: until you delete them or delete your account. Feedback: up to 24 months. Analytics: aggregate and non-personal, kept indefinitely. Server logs rotate within weeks.

Your rights

You can access, correct and delete your data. Deleting your account (Settings → Account & security) erases your account and content from our systems; reviews and photos are removed, and suggestions you submitted are anonymized. For a copy of your data (portability), or anything else, email spisdotai@gmail.com — we answer within 30 days. You may also complain to your data protection authority (in Norway: Datatilsynet).

Children

Spis is for users aged 13 and over. We do not knowingly process data of younger children.

Changes

If this policy changes in a way that matters, we say so in the app. The current version and date are shown below.