Privacy Policy

The controller responsible for processing personal data on this site within the meaning of the GDPR is:

Michael Wegener, Kühlwetterstr. 3, 40239 Düsseldorf, Deutschland. Email: mw@michaelwegener.de

No data protection officer has been appointed, as the thresholds of Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG) are not met.

We process the following categories of personal data:

• Account data — your email address and password. Passwords are stored only as a salted hash by our authentication provider and are never visible to us in plain text.
• Profile data — your handle, display name, avatar image, and language preferences.
• Content — the recipes, foods, favourites, and photos you create or upload.
• Invite data — which account issued the invite code you used, and the email address that redeemed it.
• Technical data — server logs containing your IP address, browser user agent, and the time of each request.
• Cookies and local storage — described in detail in our cookie notice.

We process personal data for the following purposes, relying on the legal bases in Art. 6(1) GDPR:

• To create and administer your account and provide the recipe-management service you requested — Art. 6(1)(b) GDPR (performance of a contract).
• To keep the service secure, prevent abuse, and investigate technical faults, including through server logs — Art. 6(1)(f) GDPR (legitimate interest in a secure and reliable service).
• To comply with statutory retention obligations, where applicable — Art. 6(1)(c) GDPR.

Where we ever rely on your consent for a specific, separately described purpose, the legal basis is Art. 6(1)(a) GDPR, and you may withdraw that consent at any time with future effect.

This app lets you publish recipes and maintain a public profile. Once you publish a recipe or set a handle, that content — including your handle, display name, avatar, and published recipes — is visible to other users and, depending on configuration, to anyone with the link. Do not publish personal data about yourself or others that you do not want to be publicly visible.

We use the following processors under Art. 28 GDPR data processing agreements:

• Supabase — hosts our database, handles authentication, and stores uploaded images in cloud storage.
• Vercel — hosts and serves the application and processes technical request logs.
• Resend — delivers system emails (e.g. account and notification emails) on our behalf.

We do not sell personal data, and we do not use advertising or analytics services.

Our processors may process data outside the European Economic Area. Where this occurs, we rely on the safeguards recognised by the GDPR, such as the EU Standard Contractual Clauses or, where applicable, the EU-US Data Privacy Framework. Contact us using the details above for further information about the safeguards in place for a specific transfer.

We retain account and profile data for as long as your account exists. Content you create is retained until you delete it or close your account. When you delete your account, we delete or anonymise your personal data without undue delay, except where we are required to retain it for longer to comply with a legal obligation. Residual copies may persist briefly in backups until they are overwritten on their normal rotation schedule.

Under the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15);
• request that inaccurate data be corrected (Art. 16);
• request erasure of your data (Art. 17);
• request that processing be restricted (Art. 18);
• receive a copy of your data in a portable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21); and
• withdraw any consent you have given, at any time (Art. 7(3)).

To exercise any of these rights, contact us at mw@michaelwegener.de.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Providing your email address and password is neither a statutory nor a contractual requirement, but it is necessary to create an account — without it, we cannot provide the service to you.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

We may update this privacy policy from time to time, for example to reflect changes to the service or to legal requirements. The date at the bottom of this page shows when it was last revised.