Privacy Policy

Last Updated: February 23, 2026

Welcome to CookStreak! This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our mobile application and related services (collectively, the "Service"). This policy is compliant with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

2. Information We Collect

2.1 Personal Data You Provide

• Account Information: Name, email address, password (encrypted)
• Profile Information: Dietary preferences, allergies, food restrictions, cooking skill level, favorite cuisines
• User-Generated Content: Meal plans, grocery lists, recipe favorites, cooking notes
• Authentication Data: Google Sign-In credentials (if you choose to sign in with Google)

2.2 Automatically Collected Data

• Usage Data: Cooking streak statistics, recipe views, search queries, feature interactions
• Device Information: Device type, operating system, unique device identifiers, mobile network information
• Analytics Data: App performance metrics, crash reports, user engagement statistics
• Location Data: Approximate location (only if you grant permission) for local grocery store recommendations

2.3 Cookies and Similar Technologies

We use cookies and similar tracking technologies to track activity on our Service and store certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

3. Legal Basis for Processing (GDPR)

We process your personal data on the following legal grounds:

• Consent: You have given explicit consent for processing your personal data for specific purposes (e.g., personalized recipe recommendations)
• Contract Performance: Processing is necessary to perform our contract with you (providing the Service)
• Legitimate Interests: Processing is necessary for our legitimate interests (e.g., improving our Service, fraud prevention)
• Legal Obligation: Processing is necessary to comply with legal obligations

4. How We Use Your Information

• Service Provision: To create and manage your account, provide personalized recipe recommendations
• AI-Powered Features: To generate personalized meal plans based on your preferences and cooking history
• Communication: To send you cooking reminders, streak notifications, meal prep alerts, and important service updates
• Analytics & Improvement: To analyze usage patterns, improve our algorithms, and enhance user experience
• Support: To respond to your inquiries and provide customer support
• Security: To detect, prevent, and address technical issues and fraudulent activities
• Compliance: To comply with legal obligations and enforce our Terms of Service

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers

We share your data with trusted third-party service providers who assist us in operating our Service:

• Firebase (Google): Authentication, cloud storage, analytics, push notifications
• Cloud Infrastructure: Google Cloud Platform for hosting and database services
• Analytics Providers: To understand user behavior and improve our Service

5.2 Data Transfer Outside EEA

Your information may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission
• Privacy Shield frameworks (where applicable)

5.3 Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities.

5.4 We Never Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Active Accounts: Data is retained while your account is active
• After Account Deletion: Most data is deleted within 30 days; some data may be retained for legal compliance (up to 7 years)
• Analytics Data: Anonymized analytics data may be retained indefinitely
• Backup Data: Deleted data in backups is purged within 90 days

7. Your GDPR Rights

If you are a resident of the EEA, you have the following data protection rights:

7.1 Right to Access

You can request a copy of all personal data we hold about you.

7.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data when there is no compelling reason for its continued processing.

7.4 Right to Restrict Processing

You can request that we limit how we use your personal data in certain circumstances.

7.5 Right to Data Portability

You can request to receive your personal data in a structured, commonly used, machine-readable format and transfer it to another controller.

7.6 Right to Object

You can object to processing of your personal data based on legitimate interests or direct marketing.

7.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw your consent at any time.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption of data in transit (TLS/SSL) and at rest
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Secure cloud infrastructure with Google Cloud Platform
• Regular backups and disaster recovery procedures
• Employee training on data protection and privacy

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Children's Privacy

Our Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us, and we will delete such information promptly.

10. Automated Decision-Making and Profiling

We use automated decision-making and profiling to provide personalized recipe recommendations based on your preferences, cooking history, and dietary requirements. You have the right to:

• Obtain human intervention
• Express your point of view
• Contest the decision

11. Push Notifications

We may send you push notifications for:

• Cooking streak reminders
• Meal planning notifications
• Ingredient expiration alerts
• New recipe recommendations

You can disable push notifications at any time through your device settings.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending you an email notification (for significant changes)
• Displaying an in-app notification

You are advised to review this Privacy Policy periodically for any changes.

13. International Users

CookStreak is operated from Europe. If you are accessing our Service from outside the EEA, please be aware that your information may be transferred to, stored, and processed in the EEA and other countries where we operate.

14. Contact Us

15. Supervisory Authority

If you are located in the EEA and have concerns about our data processing that we have not addressed satisfactorily, you have the right to lodge a complaint with your local Data Protection Authority.

---

© 2026 CookStreak. All rights reserved.