Privacy policy

1. Controller

Email: david [at] tomschitz [dot] de

2. Overview

Nosh collects as little as it can while still doing its job. Using the app requires an account: your library is kept in that account on our server so that it reaches your other devices and the friends you share with. You sign in with Apple or Google, and no password ever reaches us. There is no advertising, no cross-service tracking, no profiling, and nothing is sold or passed on for other people's purposes.

3. This website

4. The iOS app: data on your device

Everything you create in Nosh — recipes, cookbooks, photos, shopping lists, cooking history — is written to your device first and remains usable without a connection. Your device holds a full copy of your library; the authoritative version is the one in your account, described in section 6.

5. Account and sign in

You sign in with Sign in with Apple or with Google. We never see your password. Our authentication service stores an internal user identifier, the email address the provider releases to us (with Apple this may be a relay address that hides your real one), which provider you used, and the times you signed in. Your handle, display name and profile picture are stored as well, because other people need them to find you and recognise you.

The legal basis is Art. 6(1)(b) GDPR, performance of the contract: without an account the app cannot keep or synchronise your library. You can delete the account at any time in the app under Settings → Account, which is described in section 15.

6. Your library on our server

Your recipes, cookbooks, shopping lists, cooking history and the images belonging to them are stored in our Supabase project. Supabase Inc. operates the database, the file storage and our server functions on our behalf as a processor, in the eu-west-1 region (Ireland). Images are kept in private buckets and are reachable only through short-lived signed links.

Which rows a request may read is enforced by the database itself, for every single row, so a request can only ever return what belongs to your account or what a friend has explicitly shared with you. This storage is what allows the app to work on more than one device and to share at all. The legal basis is Art. 6(1)(b) GDPR.

7. Friends and sharing

You can look someone up by their handle, send a friend request and accept requests sent to you. A request shows your handle, display name and profile picture to the person you asked. Once two accounts are friends, each can see the recipes and cookbooks the other has marked as visible to friends. Everything else stays private, including your favourites and how often you have cooked something.

Removing a friend ends that access immediately for both sides. The legal basis is Art. 6(1)(b) GDPR, because these features are part of what the app offers.

8. Push notifications

If you allow notifications, iOS issues a device token for Apple's Push Notification service, and we store that token with your account so we know where to deliver. We use it for two events: someone has sent you a friend request, and someone has accepted the request you sent. The notification is handed to Apple, which delivers it to your device. It carries the display name or handle of the person who acted, so the alert can say who it was, and no recipe content. The wording itself is assembled on your device from the app's own texts, so no message text is transmitted and no language preference is stored.

You can withdraw the permission at any time in the iOS settings, and the notifications stop. Signing out deletes that device's token, and deleting your account deletes every token belonging to it. The legal basis is Art. 6(1)(a) GDPR, the consent you give in the iOS permission prompt.

9. Recipe scan

When you actively use the scan feature, the photos you take are transmitted to our scan function, which runs in our Supabase project in the eu-west-1 region (Ireland). It stores neither the images nor the text extracted from them: processing happens in memory and ends with the response to your app. We do count how many scans an account has used, so that the included quota can be enforced; that counter holds no content.

For text recognition and structuring, the image is forwarded to Google's Gemini API. Processing outside the European Union, in particular in the United States, may take place in the course of this. The transfer occurs only when you trigger a scan yourself. The legal basis is Art. 6(1)(b) GDPR. Please do not photograph pages that contain personal data of other people.

10. Abuse prevention

So that our server functions cannot be abused by foreign programs, the app identifies itself as a genuine installation on every request, using Firebase App Check together with Apple App Attest. What is transmitted is a cryptographic attestation of your device that permits no conclusions about your identity. The legal basis is Art. 6(1)(f) GDPR.

11. Crash reports (can be switched off)

If the app crashes, Firebase Crashlytics transmits an error report to Google. It contains the device model, operating system version, app version, the technical call stack at the moment of the crash, and a pseudonymous installation identifier. Your recipes, photos and shopping lists are not included.

You can switch this transmission off at any time: Settings → Privacy → “Share crash reports”. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in a stable app; you exercise your right to object through exactly that switch.

12. Performance measurement and configuration

Firebase Performance Monitoring records technical measurements such as launch times and the duration of network requests, each together with device model and operating system version. Firebase Remote Config loads configuration values at launch and transmits a pseudonymous installation identifier as well as app and operating system version. Both serve the operation and improvement of the app. The legal basis is Art. 6(1)(f) GDPR.

13. Cooking timers

Timers in cook mode use your device's local notifications. They are created on the device and sent by it; nothing is transmitted to us or to third parties. They are unrelated to the push notifications in section 8, although iOS asks for the same permission for both.

14. Recipients and transfers to third countries

Recipients of personal data are Supabase Inc. as the operator of the database, the file storage and our server functions (hosted in the eu-west-1 region, Ireland), Apple (Sign in with Apple, App Attest, Push Notification service), Google (Sign in with Google, Firebase, Gemini API) and Vercel Inc. as the host of this website. Insofar as data is transferred to the United States, the transfer is based on the European Commission's standard contractual clauses and, where the recipients are certified, on the EU-US Data Privacy Framework.

15. Retention

Your library is kept until you delete it. Deleting a recipe removes it from your account and from your devices; an image that no longer belongs to anything is removed by an automatic sweep seven days later, a replaced profile picture after one day. Deleting your account under Settings → Account removes your profile, your library, your images, your friendships and your device tokens, and where you signed in with Apple it also revokes that connection.

Server log files of the website are deleted automatically after a short period. Crash and performance data are retained according to Firebase's rules, as a rule for 90 days. Images from the recipe scan are not stored at all.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to processing based on legitimate interests (Art. 21 GDPR). Please use the email address given above. Independently of this, you have the right to lodge a complaint with a data protection supervisory authority.

17. Changes to this policy

We update this privacy policy when the app, the website or the services used change. The version published here applies in each case.