PREP & COOK
Privacy policy
Last updated: 10 November 2026
This policy covers the Prep & Cook Android app and its website. The data controller is Adam Horvath (Kócsag utca 4/b, 2330 Dunaharaszti, Hungary). For privacy questions, exercising your rights and deletion requests, contact dev.prepandcook@gmail.com.
Adam Horvath · Kócsag utca 4/b, 2330 Dunaharaszti, Hungary · dev.prepandcook@gmail.com
What data we process
Accounts can use Google sign-in or email and password. For email accounts we process the name, email address and Firebase account identifier; Firebase manages password hashes, email verification and password-reset messages. We never receive your plaintext password. Account: Google sign-in provides an account identifier, name, email address and, when available, profile picture. App data: your profile, cooking habits, kitchen equipment, pantry quantities and expiry dates, menus and menu drafts, shopping lists, favourites and cooking feedback. Dietary requirements and allergies: only after your separate, explicit consent (see below). Reports: your message and technical app/device details. Signups: email, optional name, language, interests and consent status and time. Technical data: request logs and short-lived, pseudonymised anti-abuse counters. Subscription: from Google Play purchase data, the plan, trial, expiry and a pseudonymised key of the purchase token; we never see card or payment details.
Purposes and legal bases
We process account data, sync, planning, pantry and shopping features, suggestions and report handling to provide the service (GDPR Art. 6(1)(b)). Without sign-in data the cloud features cannot be used; everything else you enter is optional. Dietary requirements and allergies are processed with your explicit consent (Art. 6(1)(a) and 9(2)(a)); newsletters and notices, and app and website analytics, with your consent (Art. 6(1)(a)). Anti-abuse counters and technical logs are based on our legitimate interest (Art. 6(1)(f)) in protecting the service and its users from overload, spam and abuse, which is why only short-lived, pseudonymised data is used. Correspondence on rights and deletion requests is kept to meet a legal obligation (Art. 6(1)(c)). You can withdraw consent at any time without affecting earlier lawful processing. We make no solely automated decisions with legal or similarly significant effects: suggestions are personalised proposals. We do not sell personal data or use it for advertising. Verifying subscriptions and Pro access also serves to provide the service (Art. 6(1)(b)).
Dietary requirements and allergies
Dietary requirements (for example gluten-free or lactose-free) and free-text allergies may count as health data. The app only lets you enter them after you tick the consent box in your habits; we record the time of consent in your profile. They are used on our servers to filter recipes and are not sent to Google Gemini. Unticking the box withdraws consent and deletes this data. Filtering is not a medical service: with a severe allergy, always check ingredients before cooking.
Processors and recipients
Google (Google Ireland Ltd. and its affiliates) acts as our processor. Firebase provides authentication, the Firestore database and backend functions (Frankfurt, europe-west3) and website hosting. Google Analytics and Firebase Analytics provide statistics. The Gemini API runs on the paid tier: the cooking preferences, pantry and planning data and recipe-step context needed for the requested result are sent (dietary requirements and allergies are not); Google does not use them to improve its products and may log them for a limited time to detect abuse. Confirmation and notification emails are sent through Gmail; operator notifications about new signups and reports go to the ahorvath1021@gmail.com mailbox. Do not enter unrelated personal information in free-text fields. Google Play handles purchases, payment and trials as an independent controller under its own terms. Recipe photos are loaded directly from Wikimedia Commons (Wikimedia Foundation, Inc., United States): when a photo is shown, your device sends Wikimedia its IP address, the app name and version and standard request data, as with any website visit; no account or profile data is sent. Wikimedia processes this as an independent controller under its own privacy policy; we use it to show recipe photos as part of the service (GDPR Art. 6(1)(b)). When you scan a product barcode in the app, the barcode number is sent to Open Food Facts (Open Food Facts association, France), an open product database, to look the product up; as with any website visit, your device also sends its IP address, the app name and version and standard request data, but no account, profile or pantry data (GDPR Art. 6(1)(b)). Text recognition and the document scanner run on your device with Google ML Kit (Google Play services); ML Kit may send Google technical diagnostics and usage metrics (for example device model, app and SDK version and performance data), but not your photos or the recognised text. Google processes these under the ML Kit terms; our legal basis is our legitimate interest in reliable on-device recognition (GDPR Art. 6(1)(f)).
Transfers outside the EEA
Google may process data outside the European Economic Area, including in the United States. Safeguards are Google LLC’s participation in the EU–US Data Privacy Framework and the standard contractual clauses in Google’s data processing terms. You can request a copy at the address above. Wikimedia is based in the United States and is not covered by an adequacy decision; the request goes there directly from your device, only to show the photo you open (GDPR Art. 49(1)(b)).
App integrity and abuse prevention
Firebase App Check and Google Play Integrity verify that requests originate from the genuine app. Google processes app metadata (package, version and signing certificate), Play licensing status, device attestation information and security tokens for this purpose. Our legal basis is our legitimate interest in protecting the service and users against abuse and unauthorized access (GDPR Article 6(1)(f)). This check is independent of optional usage analytics. We do not use it to track individual users or devices. App Check does not retain attestation material; its tokens expire after one hour. Google Play handles its own processing and retention under its terms.
App and website analytics
In the app, Usage analytics is off by default; you can turn it on or withdraw it in Settings. When on, Firebase Analytics measures screen views, feature events, recipe identifiers, performance/error categories and technical app/device details; we do not collect the advertising ID, and our events never include names, email addresses or report text. Withdrawing also deletes measurement data stored on the device. Website Google Analytics loads only after cookie consent, which you can withdraw through Statistics cookies in the footer. Cookies and your choice are kept in your browser for up to 180 days, and advertising signals are disabled. Language and appearance choices are stored in browser storage.
Website and signups
Newsletter, launch and test notices use double opt-in: the confirmation link is valid for 2 days, after which unconfirmed signups are deleted. Data is stored in Firebase. Each list is a separate subscription. Unsubscribing stops all notices but does not delete your app account.
Data on your device
Cooking timers, cooking progress and short-lived home checks are device data. Flyer images, receipt and product-label photos and imported PDF receipts are recognised on your device; these files and the recognised text are not sent to our servers or Gemini. Temporary files created by the app are deleted when recognition finishes, on cancellation or at the next app start. Confirmed items become pantry data; your product-name corrections are remembered only on this device. Exported backups and shared lists are under your control and can remain after account deletion. Uninstalling removes the app’s own data on that device; delete exported copies separately.
Retention periods
Account and app data: until account deletion; menu drafts for 30 days after the last change. Dietary requirements: until you withdraw consent or delete the account. Reports: until account deletion or your erasure request. Anti-abuse counters: up to 2 days. Newsletter: until you unsubscribe; afterwards we keep the withdrawn status and time to prove withdrawal, and erase it on request. Analytics: Google Analytics and Firebase Analytics keep events for up to 14 months. Server logs: 30 days under Google Cloud’s default. We make no scheduled database backups; Google removes deleted data from its systems and backups within about 180 days under Google Cloud’s data deletion practice. Rights and deletion correspondence: 5 years after the case is closed, to prove completion. Subscription data: until account deletion; Google keeps its own Google Play purchase records.
Your rights and remedies
You can request access, correction, erasure, restriction, a copy and portability, and withdraw consent. You can object at any time to processing based on legitimate interest. Write to dev.prepandcook@gmail.com: we verify ownership but never ask for your password or Google verification codes. We respond without undue delay and within one month, and explain any lawful extension. You can complain to Hungary’s National Authority for Data Protection and Freedom of Information (NAIH, Falk Miksa utca 9–11, 1055 Budapest, www.naih.hu) or your local supervisory authority, and you can go to court. Network traffic uses HTTPS; account data is protected through authentication and server access rules.
Age, account deletion and changes
The app and newsletter are intended for people aged 16 and over; under 16, consent-based processing (dietary data, analytics, newsletter) requires the consent of a parent or guardian. Delete your account in the app under Profile → Delete account, or through the web deletion page linked below without installing the app. Deleting your account does not cancel a Google Play subscription: cancel it first in Google Play, otherwise Google Play keeps charging you. We update this policy when data practices change; the date is shown above.
Recipe image hosting and provenance
Some recipe images are served from our Firebase Hosting, operated by Google, which may process technical request data such as IP addresses. Images previously loaded directly from GitHub are being moved to our hosting; older app versions and cached recipes may still contact GitHub (GitHub, Inc.), sending IP addresses and standard request metadata under GitHub’s own privacy policy. Original authors and licences are preserved. AI illustrations are labelled; 17 illustrations supplied by the operator were created with Google Flow. No app users’ personal data was used to create these images.
Contact the developer
dev.prepandcook@gmail.com · Google · Firebase · Gemini API · Open Food Facts · GitHub · Google Play subscriptions · Google Play refunds · NAIH