Privacy notice

Updated 5 October 2026 · Deutsch

Who is responsible?

develogic, Inhaber Fabio Cembran
Humerstraße 45, 4063 Hörsching, Austria
develogic.dev@gmail.com
Business information: Impressum.

This notice covers Recipisy and this website. Recipisy is intended for adults aged 18 and over. AI imports and illustrations are currently unavailable while their release configuration is completed. The AI sections below explain the selected services and what happens when you request those features after activation.

Your library and account

Local guest recipes, notes, collections and drafts remain on your device unless you import them into your cloud library or submit them for processing. Saving, searching and cooking do not send recipes to an AI service. Operating-system backups can include local app data.

The app creates an anonymous Google Firebase Authentication account for cloud access. Optional email/password, Google or Apple recovery credentials link to that account. We process its identifier, linked identity details, recipes, notes, collections, images and synchronization records to provide your library. An anonymous library may be unrecoverable after losing its device credentials; restoring a store purchase does not restore that library.

Google Firebase hosts the database, private files and processing functions in Frankfurt, Germany. Authentication and other Google service operations can also involve processing outside the EEA. Firebase App Check uses Apple or Google device/app attestation to protect access.

Purchases

Apple or Google manages checkout and payment information. RevenueCat processes your pseudonymous account ID, purchase/receipt records, subscription status and device information in the United States to validate access and restore purchases. It does not receive recipe text, notes or photos from Recipisy. These records remain while needed to manage your purchases; contact us to request their deletion. Apple and Google retain their own transaction records under their policies.

AI services you request

Photos: Google's paid Gemini API receives selected recipe-page images and extraction instructions. Each submission or charged retry requires the displayed consent. Google does not use paid-service inputs/responses to improve its products; safety monitoring can retain them for 55 days and involve authorized human review. Processing can occur outside the EEA. See Gemini terms and safety retention.

Public links: submitting a link requests its retrieval and recipe extraction. Apify retrieves public source material in the United States. Alibaba Model Studio Qwen processes the URL, caption, linked page, transcript, selected frames or bounded video/audio in Singapore. Temporary retrieval files are removed after processing, with retries on failure. Qwen's standard inference retention is up to 30 days, subject to legal/security exceptions; safety-flagged content can remain up to two years. We do not claim zero retention. See Apify data processing and Qwen retention.

Illustrations: after your separate consent, fal processes saved recipe title, ingredients and preparation to generate an illustration. Personal notes and source attribution are omitted. This can involve processing outside the EEA. Recipisy requests inline image output and disables stored request payloads; generated media must meet private-output requirements before it is saved to your library. Provider security/legal records have separate retention. See fal data processing and retention controls.

Photo and illustration consent is specific to the provider disclosure shown in the app; declining leaves manual recipe use available. Public-link processing provides the import you expressly request under our terms. Do not submit unrelated personal information, sensitive information or material you lack permission to use. Imported drafts and illustrations need your review; they do not make decisions with legal or similarly significant effects about you.

Purposes and legal bases

Under GDPR Article 6(1)(b), we process library/account data, purchase validation, requested public-link imports and support needed to provide the service. Optional photo/illustration processing uses your consent under Article 6(1)(a). Under Article 6(1)(f), our legitimate interests are secure operation, abuse prevention, delivery of this website and handling ordinary inquiries or disputes. Legal duties, including handling privacy rights, use Article 6(1)(c). Providing data needed for a feature is required to deliver that feature; optional processing can be declined. We do not sell personal data or use it for advertising.

How long information remains

• Saved library content: until you delete it or the account. Referenced source scans remain with their saved recipe.
• Finished import jobs/results: eligible for cleanup after 30 days; unreferenced scans after 7 days; orphan uploads/images after 24 hours. Cleanup is scheduled and failed removals are retried.
• Daily database backups and deleted cloud files: retained for 7 days. Historical database versions can remain for one hour. Restored data must have current deletion requests applied before access resumes.
• Minimal account deletion/status records remain to prevent deleted data returning. Minimal unresolved processing-charge records remain until settlement.
• Ordinary support correspondence: 90 days after resolution. A specific legal obligation or dispute can require longer retention, limited to that purpose.
• Infrastructure logs: ordinary Cloud Logging records 30 days; required audit records 400 days. Optional app diagnostics remain off; raw crash reports are not uploaded.
• Google Authentication: authentication details are retained until account deletion; Google's removal from its live/backup systems can take up to 180 days. Its logged IP addresses remain for a few weeks. App Check replay-protection token records can remain up to 30 days.

Deletion, exports and other copies

Use Settings → Delete account or the web deletion request. We verify ownership, block account access and retry cloud cleanup. Linked credentials may require recent authentication; linked Apple authorization must be revoked. An accepted request can still be processing, especially while charges are reconciled. Processor records are handled separately; support can help with RevenueCat and other provider records. Account deletion does not cancel a store subscription.

Account caches clear when other devices observe the account change; offline copies cannot be erased remotely. Local guest data, exported/shared files, camera-roll originals and operating-system backups remain under your or their recipients' control. JSON export contains saved recipe text and metadata, including notes and image references; it does not bundle image files.

This website and email

Cloudflare Pages delivers this static site and processes network/request information for hosting and security across its global network. We add no advertising, analytics scripts, tracking cookies, login or contact form. Emailing us sends your address and message through your email provider and our Gmail mailbox; Google can process that correspondence outside the EEA. Send only what is necessary, never passwords, verification codes, card details or recipe scans.

International transfers and recipients

Recipients include the services named above and their authorized subprocessors. Processing outside the EEA is subject to applicable adequacy decisions or contractual safeguards, including EU Standard Contractual Clauses in the providers' processing agreements. Google also publishes its EU–US Data Privacy Framework certification. Contact us for information or copies of applicable safeguards. Service operators and stores can separately retain records for their security or legal obligations.

Your rights and contact

Contact develogic.dev@gmail.com to request access, correction, deletion, restriction or portability where applicable. You can object to processing based on legitimate interests and withdraw optional AI consent for future processing; earlier lawful processing is unaffected. We normally respond within one month. If a permitted extension is needed, we explain it within that month.

You may complain to the Austrian Data Protection Authority or your competent supervisory authority. We update this notice when the service changes; material changes to optional AI processing require a new disclosure/consent where applicable.