Privacy Policy

This Privacy Policy explains how RecipeMatch ("we," "us," or "our") collects, uses, discloses, and protects information when you use the RecipeMatch mobile application (the "App"). It also describes the rights available to users in the European Economic Area, UK, and Switzerland ("GDPR") and California ("CCPA/CPRA").

Who We Are

RecipeMatch is operated by OÜ Karmas Solutions, registered in Estonia. For the purposes of GDPR, OÜ Karmas Solutions is the data controller responsible for your personal information.

Information We Collect

Account information

When you create an account: your email address, password (hashed and managed by Firebase Authentication — we never see or store it in plain text), and display name.

Pantry and recipe data

The ingredients in your pantry, recipes you save or dismiss, and related preferences are stored locally on your device, not uploaded to our servers in bulk. Specific pieces are sent to third-party services only as needed to power a feature (see "How We Share Your Information").

Subscription information

If you subscribe to RecipeMatch Premium, we store your subscription tier, status, and expiration date. We never collect or store payment card details — purchases are processed entirely by the Apple App Store or Google Play, and we only receive a token confirming the purchase is valid.

Camera

Used only for barcode scanning. Camera frames are processed entirely on-device and never stored or transmitted — only the decoded barcode number is sent to a third-party product database.

Automatically collected information

Firebase Analytics and Firebase Crashlytics automatically collect standard usage and diagnostic information (app interactions, device model, OS version, crash logs and stack traces) to help us understand usage and fix bugs.

Categories we do not collect

We do not collect your precise or approximate geolocation, contacts, biometric data, health data, financial account information, or any government-issued ID. We do not use advertising identifiers and RecipeMatch does not serve third-party ads.

How We Use Your Information

• Create and maintain your account
• Save and sync your pantry, saved recipes, and preferences
• Match your pantry ingredients against available recipes
• Look up product information from scanned barcodes
• Verify and manage your subscription
• Diagnose crashes and improve stability and performance
• Communicate with you about your account when necessary
• Comply with legal obligations (e.g., financial records related to subscription payments, where applicable)

We do not sell your personal information, and we do not use it for third-party advertising or cross-app/cross-site tracking.

Legal Basis for Processing (GDPR)

How We Share Your Information

We share limited information with the following third parties, only as needed to provide the App's features. We do not sell or share this information for monetary or other valuable consideration beyond what's described here.

Each provider processes data under its own privacy policy. We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (with notice to affected users where required by law).

Sensitive Personal Information

We do not collect or process sensitive personal information as defined under GDPR (Art. 9) or CCPA (racial/ethnic origin, health, sex life or orientation, precise geolocation, biometric or genetic data, religious beliefs, etc.).

Automated Decision-Making

Recipe suggestions are generated by straightforward ingredient-matching logic based on your pantry, not by profiling that produces legal or similarly significant effects on you. We do not engage in automated decision-making as defined under GDPR Art. 22.

Data Retention

We retain account information for as long as your account remains active. Locally cached data (pantry items, recipe results) remains on your device until you delete it or uninstall the App. We retain information only as long as necessary for the purposes described here, or as required by law (e.g., financial records for tax purposes).

Your Rights Under GDPR (EEA, UK, and Switzerland Users)

If GDPR applies to you, you have the right to:

• Access the personal information we hold about you
• Rectify inaccurate or incomplete information
• Erase your information ("right to be forgotten")
• Restrict or object to certain processing
• Data portability — receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection supervisory authority

You can exercise most of these rights directly in the App (Profile → Delete Account permanently erases your account and device data), by using our web-based account deletion form if you no longer have the App installed, or by contacting us at admin@recipematch.app. We will respond within one month, as required by GDPR Art. 12.

Your Rights Under CCPA/CPRA (California Users)

In the preceding 12 months, we have collected the following categories of personal information, as defined by the CCPA:

We do not sell or share personal information (as "share" is defined under CCPA/CPRA, including for cross-context behavioral advertising), so no opt-out mechanism is required.

California residents have the right to:

• Know what personal information we collect, use, and disclose
• Delete personal information we hold about you
• Correct inaccurate personal information
• Opt out of sale/sharing (not applicable — we don't sell or share)
• Limit use of sensitive personal information (not applicable — we don't collect any)
• Non-discrimination for exercising any of these rights

To exercise these rights, contact us at admin@recipematch.app, use Profile → Delete Account, or our web-based account deletion form. We will verify your request and respond within 45 days, as required by CCPA. You may designate an authorized agent to submit a request on your behalf.

Children's Privacy

RecipeMatch is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information promptly. If you believe we may have collected such information, contact us at admin@recipematch.app.

International Data Transfers

Our service providers (including Firebase/Google Cloud) may process and store information on servers located outside your country of residence, including in the United States. Where required, such transfers rely on appropriate safeguards, such as Standard Contractual Clauses.

Security and Breach Notification

We use reasonable technical and organizational measures — including Firebase's security infrastructure and access-controlled data rules — to protect your information. No method of transmission or storage is completely secure. In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.

Do Not Track

RecipeMatch does not track your activity across third-party apps or websites, so there is nothing to opt out of via "Do Not Track" signals. Our own analytics and crash reporting are limited to your use of this App.

Governing Law

This Privacy Policy is governed by the laws of Estonia and, where applicable, the European Union, without regard to conflict-of-law principles. This does not limit any protections you're entitled to under the mandatory laws of your country of residence.

Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Effective date" above when we do, and will notify you of material changes within the App.