Privacy Policy

The controller responsible for the processing of your personal data on this Service is:

Account data. When you create an account we process your email address, a hashed password (or your Google account identifier if you sign in with Google), a display name, a handle, and optionally an avatar image, a bio and your default recipe visibility. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Recipes, collections and shopping lists. We store the recipes, collections, cooking history, shopping-list items and images you upload so we can show them back to you and, where you choose, share them. Legal basis: Art. 6(1)(b) GDPR.

Share links. When you share a recipe, collection or shopping list, we generate a random share token that allows anyone with the link to view (and, for collection co-editing, edit) that item. You can revoke a share at any time. Legal basis: Art. 6(1)(b) GDPR.

AI Search and voice input. When you use AI Search, we store your prompts and the assistant responses as part of your thread history so you can revisit past conversations. Voice recordings you submit are transcribed via our AI provider and are not retained beyond what is needed to produce the transcript. Legal bases: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (our legitimate interest in providing and improving the feature).

Technical logs. Our hosting layer processes technical data such as IP address, user agent and timestamps for security, abuse prevention and troubleshooting. Legal basis: Art. 6(1)(f) GDPR.

We use the following processors under Art. 28 GDPR data-processing agreements. We do not sell your data and we do not use it for advertising.

• Supabase — managed authentication, PostgreSQL database and file storage (recipe images and avatars). Region: European Union.
• Lovable — hosts the application on Cloudflare Workers and provides the Lovable AI Gateway that routes AI Search, voice transcription and recipe-related AI calls to third-party model providers. Lovable's default platform telemetry (e.g. request logs, aggregate usage analytics) is enabled.
• Cloudflare — edge hosting, TLS termination and DDoS protection for the Service (via Lovable).
• Google — only when you choose to sign in with Google (OAuth). Google receives the information required to complete the sign-in.

Some of the processors above (in particular Cloudflare, Lovable's AI model providers and Google) may process data outside the European Economic Area. Where this happens, we rely on the European Commission's Standard Contractual Clauses and, where applicable, additional safeguards required under Art. 46 GDPR.

We keep your account data and content for as long as your account exists. If you delete your account we delete or anonymise the associated personal data, unless we are required to keep it longer by law. Share tokens are stored until you revoke them or delete the underlying item. Technical logs are kept for a short period for security purposes and then deleted or rotated by the hosting layer.

You have the right, under the conditions set out in the GDPR, to:

• obtain information about the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• request erasure of your data (Art. 17);
• request restriction of processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on our legitimate interests (Art. 21);
• withdraw consent at any time, with effect for the future.

To exercise these rights, contact us at marvin.aiagent@gmail.com.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for the controller is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (Königstraße 10a, 70173 Stuttgart, Germany).

We use cookies and browser local storage that are strictly necessary to operate the Service — in particular to keep you signed in and to remember preferences such as your default recipe visibility. We do not use marketing or advertising cookies. Our hosting and AI providers (Lovable, Cloudflare) may set functional cookies required to route requests and protect the Service.

To understand which parts of Spoon Circle are actually useful, we record a small number of first-party product events — for example that a recipe import was started or completed, that a recipe was saved or shared, or that the “Cook and add to REWE shopping list (beta)” button was shown or pressed. Each event stores the action name, a timestamp, the page path, a randomly generated device identifier held in your browser’s local storage, a per-visit session identifier and, if you are signed in, your user ID.

We do not record the content of your recipes, notes or messages in these events, we do not store IP addresses or device fingerprints with them, and we do not share them with advertising networks or any third-party analytics provider — the data stays in our own database. The legal basis is our legitimate interest in operating and improving the Service (Art. 6(1)(f) GDPR). You can clear the device identifier at any time by clearing your browser storage, and you may object to this processing using the contact details below.

We may update this policy to reflect changes to the Service or to legal requirements. The date at the top of the page shows when it was last updated.

For any privacy-related question or request, contact us at marvin.aiagent@gmail.com.