Privacy policy
How we process personal data on coovi.app and in the COOVI app — transparently and as sparingly as possible.
Last updated: 15 October 20261. Controller
The controller responsible for data processing on this website and in the “COOVI” app (iOS and Android) within the meaning of the General Data Protection Regulation (GDPR) is:
Valentin Keller
Pennsylvaniastr. 10
66482 Zweibrücken
Germany
Email: support@coovi.app
For any questions about data protection or to exercise your rights, contact us at support@coovi.app.
2. Overview
We only process personal data where this is necessary to provide the website and the app, to answer your requests and to handle COOVI+, or where you have given your consent. This website uses no cookies, no analytics or tracking tools and no advertising. Fonts, scripts and 3D graphics are loaded exclusively from our own server; no third-party content (such as Google Fonts, CDNs, social media plugins or video platforms) is embedded.
3. Website hosting and server log files
This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you visit the website, the server automatically processes data transmitted by your browser (server log files):
- IP address of the requesting device
- date and time of access
- requested page or file, amount of data transferred and HTTP status code
- referrer URL (previously visited page), if transmitted
- browser type and version, operating system
This processing serves the technical delivery of the website, its stability and security, and the defence against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and functional website. Log files are only stored for as long as necessary for these purposes and are then deleted or anonymised. We have concluded a data processing agreement with IONOS pursuant to Art. 28 GDPR.
4. Contact form and email
When you contact us via the contact form or by email, we process the information you provide: email address, topic and message, and — voluntarily — your name, app version and device or operating system. To prevent spam and abuse, a non-reversible hash is generated from your IP address and browser identifier; it is stored only briefly (ten-minute window) and then deleted automatically, in order to limit the number of requests.
Your message is delivered to our support mailbox via the mail servers of our host IONOS. We use this data solely to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to the use of COOVI or a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete your request once it has been fully resolved, unless statutory retention obligations apply.
5. The COOVI app
5.1 User account and sign-in
To use COOVI you create a user account. We process your email address, an encrypted password or the identifier of your sign-in provider, an internal user ID and the profile data you provide (e.g. display name, username, profile picture). Alternatively, you can sign in with “Sign in with Apple” (Apple Distribution International Ltd., Ireland) or “Google Sign-In” (Google Ireland Limited, Ireland). The respective provider then sends us an identifier and — depending on your choice — your email address and name; we never receive your Apple or Google password. The legal basis is Art. 6(1)(b) GDPR (provision of the app under our terms of use).
5.2 Content and features
We process the data generated when you use the app’s features in order to provide them (Art. 6(1)(b) GDPR): saved, created and imported recipes, cookbooks, pantry, shopping lists, meal plans, private cooking notes, reviews, badges and cooking activity, as well as your preferences (e.g. cooking skill, typical cooking time, budget, language and units).
5.3 Diet, allergies and nutrition goals
Information about your diet, allergies and intolerances as well as optional nutrition goals is voluntary. Where this information allows conclusions about your health, we process it exclusively on the basis of your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR), which you give by entering it in the app. You can withdraw your consent at any time with effect for the future by removing the information in the app. We only use this data to tailor recipe suggestions and hints to you.
5.4 Shared features and community
When you connect with friends, take part in Cook Matches, Swipe Together or shared cookbooks, or send cooking invitations, the respective participants can see your display name, profile picture and the content and decisions you create together. Public reviews and cooking results you share in the COOVI Community are visible to other users together with your display name. Private notes are visible only to you. The legal basis is Art. 6(1)(b) GDPR.
5.5 Recipe import
When you import a recipe via a link, our server retrieves the page of the supported provider and reads the structured recipe data. Imported recipes are stored privately in your account by default; source attributions are retained. The legal basis is Art. 6(1)(b) GDPR.
5.6 COOVI Chef / Chef AI
For the AI-powered features of COOVI+, we transmit your request and the context needed for the answer (e.g. selected ingredients, recipe or preferences) via a secured server endpoint to an AI service provider that generates the response and acts as our processor. Your requests are not used for advertising. Please do not enter sensitive personal data in free-text input. AI answers may be inaccurate; always check ingredients, allergens and food safety yourself. The legal basis is Art. 6(1)(b) GDPR.
5.7 Purchases and COOVI+
You purchase COOVI+ via the Apple App Store (Apple Distribution International Ltd., Ireland) or Google Play (Google Ireland Limited, Ireland). Payment and billing are handled exclusively by these providers; we do not receive any payment data. To manage your entitlements we use RevenueCat (RevenueCat, Inc., USA), which processes your app user ID, product and transaction identifiers, purchase and subscription status, and technical information about platform and app version. The legal basis is Art. 6(1)(b) GDPR.
5.8 Push notifications
If you allow notifications, your device generates a push token that we store in order to send you, for example, cooking invitations or match results. Notifications are delivered via the push service of Expo (650 Industries, Inc., USA) and the Apple Push Notification Service or Google’s Firebase Cloud Messaging. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time in your device or app settings.
5.9 Error and crash reporting
To detect and fix crashes and errors quickly, we use Sentry (Functional Software, Inc., USA). When an error occurs, technical information such as the error message, time, app version, device model, operating system and a pseudonymous identifier is transmitted. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a stable and secure app. Access to the device information required for this is permitted under § 25(2) no. 2 TDDDG, as it is strictly necessary to provide the service you requested.
5.10 Backend and data storage
We store account data and app content with Supabase (Supabase, Inc., USA), which provides our database, authentication, file storage, realtime features and server-side functions. Access to your data is protected by database-level access rules (row level security), and all data is transmitted in encrypted form.
6. Recipients and processors
We only share personal data where this is necessary for the purposes described. We have concluded agreements pursuant to Art. 28 GDPR with all service providers that process data on our behalf.
| Provider | Purpose |
|---|---|
| IONOS SE, Germany | Website hosting, email |
| Supabase, Inc., USA | Backend, database, authentication, storage |
| RevenueCat, Inc., USA | Management of in-app purchases and subscriptions |
| 650 Industries, Inc. (Expo), USA | Delivery of push notifications |
| Functional Software, Inc. (Sentry), USA | Error and crash reporting |
| AI service provider | Generating answers for COOVI Chef / Chef AI |
| Apple, Google (independent controllers) | Sign-in, app distribution, payments, push services |
7. Transfers to third countries
Some service providers are based in the USA or may process data there. Where the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR); otherwise it is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) including supplementary safeguards. You can request a copy of these safeguards from us.
8. Retention
We only store personal data for as long as necessary for the respective purpose. We store account data and app content for as long as your account exists. If you delete your account, your data is deleted or fully anonymised; backups are overwritten in the regular backup cycle. Data subject to statutory retention obligations is restricted until the respective period expires. Learn how to delete your account on our account deletion page.
9. Obligation to provide data
To use the app, you need to provide an email address or sign in with Apple or Google. All other information is voluntary; without it, some features may not be available or only to a limited extent. There is no automated decision-making with legal effect within the meaning of Art. 22 GDPR; personalised recipe suggestions are purely for your inspiration.
10. Your rights
Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). Simply contact support@coovi.app.
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.
11. Children
COOVI is not directed at children under the age of 16. We do not knowingly process personal data of children under 16 without the consent of their parents or guardians.
12. Security
We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Data is transmitted between your device, our website and our servers in encrypted form via TLS.
13. Changes to this policy
We update this privacy policy when our services or the legal situation change. The version published on this page applies.