Privacy Policy

This Privacy Policy explains how RecipeMatch ("we," "us," or "our") collects, uses, discloses, and protects information when you use the RecipeMatch mobile application (the "App"). It also describes the rights available to users in the European Economic Area, UK, and Switzerland ("GDPR") and California ("CCPA/CPRA").

You don't need an account to use RecipeMatch. Creating one is optional and is used only to back up your pantry and use it on your other devices.

Who We Are

RecipeMatch is operated by OÜ Karmas Solutions, registered in Estonia. For the purposes of GDPR, OÜ Karmas Solutions is the data controller responsible for your personal information.

Information We Collect

Account information (optional)

If you choose to create an account from the Profile screen: your email address, password (hashed and managed by Firebase Authentication — we never see or store it in plain text), and display name.

Anonymous guest identifier

If you use the App without an account, Firebase Authentication gives your installation a random anonymous identifier. It isn't linked to your name, email address, or any other personal details. We use it to secure requests to our servers and to apply a daily limit on recipe searches, for which we keep a count of searches made with that identifier. If you later create an account, the same identifier becomes your account ID.

Pantry and recipe data

The ingredients in your pantry, recipes you save or dismiss, recipes you write yourself, and related preferences are stored locally on your device. Specific pieces are sent to third-party services only as needed to power a feature (see "How We Share Your Information").

Pantry backup (accounts only): if you create an account or log in, your pantry — ingredient names and categories, any quantities and expiry dates you've entered, and when each item was last changed — is backed up to Firebase Cloud Firestore and kept in sync across the devices you're logged in on. Any pantry already on the device when you create an account or log in is added to the backup. Saved and self-written recipes are not backed up. If you use the App without an account, your pantry never leaves your device.

Subscription information

If you subscribe to RecipeMatch Premium, the purchase is processed entirely by the Apple App Store or Google Play. The App checks whether you have an active subscription directly with the store, on your device, and keeps the last result on your device so it keeps working offline. You don't need a RecipeMatch account to subscribe or to restore a purchase. We never collect or store payment card details.

Camera

Used only for barcode scanning. Camera frames are processed entirely on-device and never stored or transmitted — only the decoded barcode number is sent to a third-party product database.

Automatically collected information

Firebase Analytics and Firebase Crashlytics automatically collect standard usage and diagnostic information (app interactions, device model, OS version, crash logs and stack traces) to help us understand usage and fix bugs.

Categories we do not collect

We do not collect your precise or approximate geolocation, contacts, biometric data, health data, financial account information, or any government-issued ID. We do not use advertising identifiers and RecipeMatch does not serve third-party ads.

How We Use Your Information

• Create and maintain your account, if you choose to have one
• Back up your pantry and sync it across your devices, if you have an account
• Keep your pantry, saved recipes, and preferences on your device
• Secure requests to our servers and apply fair-use limits to recipe searches
• Match your pantry ingredients against available recipes
• Look up product information from scanned barcodes
• Check whether you have an active subscription
• Diagnose crashes and improve stability and performance
• Communicate with you about your account when necessary
• Comply with legal obligations (e.g., financial records related to subscription payments, where applicable)

We do not sell your personal information, and we do not use it for third-party advertising or cross-app/cross-site tracking.

Legal Basis for Processing (GDPR)

How We Share Your Information

We share limited information with the following third parties, only as needed to provide the App's features. We do not sell or share this information for monetary or other valuable consideration beyond what's described here.

Each provider processes data under its own privacy policy. We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (with notice to affected users where required by law).

Sensitive Personal Information

We do not collect or process sensitive personal information as defined under GDPR (Art. 9) or CCPA (racial/ethnic origin, health, sex life or orientation, precise geolocation, biometric or genetic data, religious beliefs, etc.).

Automated Decision-Making

Recipe suggestions are generated by straightforward ingredient-matching logic based on your pantry, not by profiling that produces legal or similarly significant effects on you. We do not engage in automated decision-making as defined under GDPR Art. 22.

Data Retention

We retain account information and your pantry backup for as long as your account exists; deleting your account deletes both. Signing out removes your pantry and other App data from that device, while the backup stays in your account until you delete it. The anonymous guest identifier and its search count are kept only as long as needed to secure the service and enforce daily limits. Locally stored data (pantry items, saved recipes, recipe results) remains on your device until you delete it, sign out, or uninstall the App. We retain information only as long as necessary for the purposes described here, or as required by law (e.g., financial records for tax purposes).

Your Rights Under GDPR (EEA, UK, and Switzerland Users)

If GDPR applies to you, you have the right to:

• Access the personal information we hold about you
• Rectify inaccurate or incomplete information
• Erase your information ("right to be forgotten")
• Restrict or object to certain processing
• Data portability — receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection supervisory authority

You can exercise most of these rights directly in the App (Profile → Delete Account permanently erases your account, your pantry backup, and the data on your device; without an account, uninstalling the App or clearing its data removes everything stored on your device), by using our web-based account deletion form if you no longer have the App installed, or by contacting us at admin@recipematch.app. We will respond within one month, as required by GDPR Art. 12.

Your Rights Under CCPA/CPRA (California Users)

In the preceding 12 months, we have collected the following categories of personal information, as defined by the CCPA:

We do not sell or share personal information (as "share" is defined under CCPA/CPRA, including for cross-context behavioral advertising), so no opt-out mechanism is required.

California residents have the right to:

• Know what personal information we collect, use, and disclose
• Delete personal information we hold about you
• Correct inaccurate personal information
• Opt out of sale/sharing (not applicable — we don't sell or share)
• Limit use of sensitive personal information (not applicable — we don't collect any)
• Non-discrimination for exercising any of these rights

To exercise these rights, contact us at admin@recipematch.app, use Profile → Delete Account, or our web-based account deletion form. We will verify your request and respond within 45 days, as required by CCPA. You may designate an authorized agent to submit a request on your behalf.

Children's Privacy

RecipeMatch is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information promptly. If you believe we may have collected such information, contact us at admin@recipematch.app.

International Data Transfers

Our service providers (including Firebase/Google Cloud) may process and store information on servers located outside your country of residence, including in the United States. Where required, such transfers rely on appropriate safeguards, such as Standard Contractual Clauses.

Security and Breach Notification

We use reasonable technical and organizational measures — including Firebase's security infrastructure and access-controlled data rules — to protect your information. No method of transmission or storage is completely secure. In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.

Do Not Track

RecipeMatch does not track your activity across third-party apps or websites, so there is nothing to opt out of via "Do Not Track" signals. Our own analytics and crash reporting are limited to your use of this App.

Governing Law

This Privacy Policy is governed by the laws of Estonia and, where applicable, the European Union, without regard to conflict-of-law principles. This does not limit any protections you're entitled to under the mandatory laws of your country of residence.

Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Effective date" above when we do, and will notify you of material changes within the App.