Privacy Notice

Privacy Policy for Recipe Catch

Effective Date: August 4, 2026 · Last Updated: August 10, 2026

David Perez, trading as miraiapps.de ("we," "our," or "us"), built Recipe Catch as an offline-first recipe-collection app with an encrypted backup of your collection to your own private account. This Privacy Policy explains what information Recipe Catch collects, how it's used, and the choices and rights you have — wherever in the world you use the app, including the European Union.

By using Recipe Catch, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the app.

1. The Short Version

Recipe Catch keeps your recipes on your device and backs them up to an account only you can read:

• You sign in with Apple or with your email address. That account exists for one reason: so your recipes come back if you reinstall the app, reset your phone, or switch to a new one.
• Your recipes, photos, and notes are stored on your device and backed up to your private account, hosted for us by Supabase on servers in the European Union. They are encrypted in transit and at rest, and access is restricted at the database level so that only your own signed-in account can read your rows.
• We do not read your recipes and do not use them for analytics, advertising, training, or any purpose other than storing and returning them to you.
• You can delete everything at any time, from Settings → Account → Delete Account. That removes your account and all of its content from our systems.
• Four optional features send text to an AI provider, and only when you tap the button that starts them — making a recipe healthier, translating a recipe, using AI to tidy up a scan the app couldn't sort out on its own, and reading the recipe out of a TikTok, Instagram, YouTube or Pinterest post you asked us to import. Nothing is sent in the background, no photo is ever sent, and your name, email, and account identifier are not sent. See Section 2.8.
• We use five narrowly-scoped third-party services — Supabase (account and backup), Resend (sending your sign-in email), RevenueCat (subscriptions), TelemetryDeck (anonymous usage analytics), and Anthropic (the four optional AI features above). Importing a social post additionally asks the platform it is on — TikTok, YouTube, Instagram or Pinterest — for that one post. All are described in full in Section 4.

The rest of this document exists to satisfy legal disclosure requirements (particularly the EU's GDPR) in more formal detail.

2. Information We Collect

2.1 Account Information

To create your account, Recipe Catch collects:

• Your email address. If you sign in with Apple and choose "Hide My Email," we only ever receive Apple's private relay address, not your real one.
• An account identifier generated when your account is created.

We do not ask for your name, and we do not collect a password — signing in uses Apple's own flow or a one-time code sent to your email.

2.2 Content You Create

Recipe titles, ingredients, instructions, tags, personal notes, and photos you add are stored in local storage on your device (Apple's SwiftData framework) and backed up to your account so they survive reinstalling the app or changing phones. This content:

• Is stored on Supabase infrastructure in the European Union (Frankfurt, Germany), encrypted in transit (TLS) and at rest
• Is protected by row-level security rules enforced by the database itself, so a request carrying anyone else's credentials cannot read your rows
• Is not read, analyzed, mined, sold, or used to train any model by us
• Is deleted from our systems when you delete a recipe, or entirely when you delete your account
• Is also included in an iCloud/device backup if you have enabled Apple's own device backup — a feature of iOS, not of Recipe Catch, and one we have no visibility into

We can technically access the stored content in the course of operating and maintaining the service (for example, restoring from a backup or investigating a fault). We restrict such access to what is necessary for those purposes.

If you use the "Paste Link" import feature, the web address you enter is sent directly from your device to the website you specify, exactly as if you'd opened that link in a browser — Recipe Catch fetches the page directly and does not relay it through any server of ours. That website's own privacy practices apply to that request; we have no visibility into what it or your network path logs.

2.3 Camera and Photo Library

If you grant camera permission, Recipe Catch can photograph a recipe card or handwritten note. To import a picture from your photo library instead, the app uses Apple's system photo picker, which runs in a separate, sandboxed process — Recipe Catch never requests or receives photo library access, and only sees the specific photo you pick. Text recognition ("Scan a card or handwritten note") runs entirely on your device using Apple's on-device Vision framework — the photo itself is never uploaded for this or any other feature, and the recognized text is not sent anywhere either, unless you afterwards tap the optional "Improve with AI" button described in Section 2.8.

2.4 Purchases and Subscriptions

Recipe Catch offers an optional Premium subscription, processed by Apple and managed through RevenueCat, our subscription-management provider. See Section 4 for what RevenueCat receives.

2.5 Analytics

We use TelemetryDeck, a privacy-focused analytics provider, to understand anonymous, aggregate usage patterns — that the app was opened, how far through the first-run setup people get, which of the multiple-choice answers they pick on those setup questions, and whether they subscribe. This tells us where the app confuses people. It never includes your recipes, your email address, or your account identifier.

You can turn this off at any time at Settings → Share Anonymous Usage Data. Everything else in the app works exactly the same with it off. See Section 4 for details.

2.6 Notifications

If you allow notifications, Recipe Catch schedules reminders locally on your device using Apple's notification framework. No data about these reminders is sent to us or anyone else.

2.7 Information We Do NOT Collect

• We do not collect your name, and we do not collect or store a password.
• We do not collect precise or approximate location data.
• We do not access your contacts, microphone, or health data.
• We do not use advertising identifiers (IDFA) and do not show ads.
• We do not sell, rent, or share personal data with data brokers.

2.8 Optional AI Features

Four features in Recipe Catch work by sending text to an AI model operated by Anthropic. Each one runs only when you tap the button that starts it. None of them runs in the background, on a schedule, or across your collection.

What this means in practice:

• Only the recipe you are working on is sent. Your collection as a whole is never sent, and nothing is sent unless you press the button.
• No photographs are ever sent. The scan feature sends the text that on-device recognition produced, never the image it came from.
• Your identity is not sent. Your name, email address, Apple relay address, and account identifier are not included in the request. Anthropic receives recipe text and nothing that identifies you to them.
• The request is relayed by our server, not sent from your device. It passes through our Supabase infrastructure so that we can enforce a fair-use limit on how many of these calls each account may make. That limit is counted against your account identifier on our side; the identifier is not forwarded to Anthropic.
• Anthropic processes the request in the United States. See "International transfers" in Section 7.
• Anthropic does not use the content to train its models. This is the contractual default for the API we use; see Anthropic's privacy policy, linked in Section 4.
• We do not store what is sent. The recipe text passes through our function and is never written to our database. Our operational logs record the outcome of each call and its token counts — so that we can meter usage and control cost — not the recipe itself.
• For a social import, what is sent is the post's own public text — the caption or description its creator wrote — and not anything of yours. We fetch that text ourselves, as described next, and pass only it to Anthropic.
• Importing a social post asks that platform for it. To read a TikTok, Instagram, YouTube or Pinterest post, our server requests that one post from the platform using the link you pasted; for YouTube this is Google's public YouTube Data API. The request is made by our server rather than by your device, so the platform receives no IP address of yours, nothing that identifies you, and nothing about the rest of your collection.
• If you never press these buttons, no recipe content ever leaves our infrastructure. The rest of Recipe Catch — importing from an ordinary recipe website, scanning, editing, searching, syncing — involves no AI provider at all.

3. How We Use Information

We use the information described in Section 2 to:

• Store your recipe collection and return it to you when you sign in on a new or reinstalled device — the sole purpose of your account and of the content backup
• Identify you across devices and installs, using your email address or Apple relay address
• Validate and manage your Premium subscription entitlement
• Understand aggregate, anonymous usage of the app to guide what we build next
• Carry out an AI request you started — rewriting, translating, or tidying up the one recipe you asked us to, as described in Section 2.8, and returning the result to you
• Diagnose and fix technical problems

We do not use any information to build advertising profiles, sell data, train machine-learning models, or make automated decisions that affect you. Neither we nor Anthropic use your recipe content to train any model. We do not read your recipe content for any purpose other than operating the service and carrying out the AI requests you start.

4. Third-Party Services

Recipe Catch uses the following third-party services. Only Supabase, which hosts the backup on our behalf, stores your recipe content. Anthropic receives text — the single recipe you started an AI feature on, or the caption of a post you asked us to import — only at that moment, and does not store your collection. The four social platforms receive only a request for the one post whose link you pasted, made by our server. None of the remaining services receive your recipe content at all.

Apart from Sign in with Apple, we do not use advertising networks, other social logins, crash-reporting SDKs, or any service that shares data across apps for advertising purposes.

5. Data Retention

• Your recipes, photos, and notes: Retained in your account for as long as your account exists. Deleting a recipe in the app removes it from our systems on the next sync. Deleting your account removes your account and all of its content permanently. Deleting the app alone does not delete your account — that's the whole point of the backup.
• Your email address and account identifier: Retained for as long as your account exists, and deleted when you delete your account. Residual copies may persist in encrypted infrastructure backups for a limited period (up to 30 days) before being overwritten.
• Subscription data (via RevenueCat): Retained by RevenueCat for as long as needed to manage your subscription and for their own legal/accounting obligations.
• Analytics data (via TelemetryDeck): Retained in anonymized/aggregate form. Because this data cannot be tied back to you, we cannot look up, export, or delete an individual person's analytics history.

6. Data Security

On your device, your content is governed by your device's own security (passcode, Face ID/Touch ID, encryption at rest — all provided by iOS).

For the backed-up copy, we rely on:

• Encryption in transit (TLS/HTTPS) for every request between the app and our infrastructure, and encryption at rest for both the database and stored photos
• Row-level security enforced by the database, so authorization does not depend on the app behaving correctly: every query is checked against your signed-in identity, and a request that isn't yours returns nothing
• No password to steal — authentication goes through Apple or a one-time email code, so there is no password database to breach or reuse elsewhere
• Least-privilege keys in the app — the key shipped in the app grants no data access by itself; the privileged key that could bypass these rules is never included in the app

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

You can exercise most of these rights yourself, immediately, without contacting us: view and edit every recipe in the app; and delete individual recipes, or your entire account and all its content at Settings → Account → Delete Account. For data portability, ask us for a machine-readable copy of your account and recipe data using the contact details in Section 10 and we will send it to you within one month.

For Users in the European Economic Area, UK, and Switzerland (GDPR)

• Data controller: David Perez, trading as miraiapps.de — see Section 10 for contact and our Impressum for our full legal notice.
• Lawful basis: performance of a contract, Art. 6(1)(b) GDPR (creating and maintaining your account, storing your recipe collection and returning it to you across devices and reinstalls, and validating your subscription entitlement via RevenueCat); legitimate interest, Art. 6(1)(f) GDPR (anonymous, aggregate analytics via TelemetryDeck — you can object at any time by switching it off at Settings → Share Anonymous Usage Data). Carrying out an optional AI request (Section 2.8) rests on performance of a contract, Art. 6(1)(b) GDPR: each of those features runs only on your explicit instruction, on the single recipe you chose.
• Right to lodge a complaint: with your local data protection supervisory authority. In Germany, this is the authority of the state (Bundesland) in which David Perez is based (Bavaria).
• International transfers: your account and recipe content are stored within the EU (Frankfurt, Germany) and are not routinely transferred outside the EEA. TikTok, Google, Meta and Pinterest are asked for a post only when you import one of their links, and only for that post — the request carries the link you pasted and nothing about you, and it is made from our servers rather than from your device. Resend, which delivers your sign-in email, processes your email address and one-time code in the United States; your recipes are never part of that. Anthropic processes AI requests in the United States: when, and only when, you start one of the optional features in Section 2.8, the text of that one recipe leaves the EEA, without your name, email address, or account identifier. Where Resend or our other processors process data outside the EEA, they rely on appropriate safeguards such as Standard Contractual Clauses. TelemetryDeck is a Germany-based provider.
• Processors: we have Data Processing Agreements in place with Supabase, RevenueCat, and TelemetryDeck as required by Art. 28 GDPR.
• No automated decision-making or profiling with legal or similarly significant effects takes place.
• Data Protection Officer: given the size and nature of our processing, we are not required to appoint a DPO under Art. 37 GDPR / §38 BDSG.

For California Residents (CCPA/CPRA)

We do not sell or share personal information, and we do not use advertising identifiers. The personal information we collect is limited to your email address, an account identifier, and the recipe content you choose to save. You may exercise your rights to know, delete, and correct directly in the app, or by contacting us. We will not discriminate against you for exercising any privacy right.

For Users in Other Jurisdictions

Wherever you are, we apply the same practices: minimal data collection, EU-hosted storage, no use of your content beyond returning it to you and carrying out the optional AI requests you start, and narrowly-scoped third-party processors.

8. Children's Privacy

Recipe Catch is not directed at children under 16 and we do not knowingly collect personal information from children. Creating an account requires an Apple ID or an email address, and we do not knowingly create accounts for children under 16. If you believe a child has created an account, contact us and we will delete the account and its contents.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last Updated" date above and, where significant, announced in-app. The current version is always available at recipecatch.app/privacy.html and within the app under Settings → Privacy Notice.

10. Contact Us