Privacy Policy

1. Data controller

Data controller: András Pálinkás, sole proprietor (egyéni vállalkozó)

Registered address: Petőfi utca 6, 7668 Keszü, Hungary

VAT number: 55597096-1-22

Contact: support@buildsnap.dev

Domain: gosimplechef.com

2. What data we collect

Depending on how you use the service, we may process the following personal data:

• On registration: email address, password (stored as a one-way hash), registration date, sign-up method (email or Google).
• Provided by you during use: profile picture (optional), birthdate (optional), your own recipes, saved recipes, weekly menus, shopping lists, and the kitchen profile of the Menu planner (how many of you eat: the number of adults and children).
• Nickname (optional): if you provide one, your public recipes are shown under this name as the author, and, if you turn it on, on your public profile.
• Public profile: whether it is turned on and when you turned it on; the profile's random identifier (the profile address), which is created when you first turn it on and stays after you turn it off, so that the address is the same if you turn it on again; your bio text, if you write one.
• Following: whom you follow and since when. Who follows you: we process this, and you see only the number.
• Following page: when you last opened it (for the new-recipes signal), whether you turned off the default following of SimpleChef Kitchen, and whether you closed the first-visit notice.
• Automatically collected: IP address, browser type and version, operating system, page-view stats, anonymous recipe-view counter.
• Cookie-based data: see the Cookie Policy.
• Removal log: if we remove a recipe of yours, we record the recipe's title and identifier, your account identifier, the reason for the removal, its time, the identifier of the administrator who decided, and whether the notification email to you was sent.
• Sharing: your shares (what you shared, when, the link identifier, whether it was revoked), content shared with you, your notification setting and the users you have blocked (for sharing and following). We do not store the email address you enter when sharing; if the address belongs to an account, the notification is sent to that account's address.
• We knowingly process no data of persons under 16. If it turns out that an account belongs to a person under 16, we sign it out, lock it and delete it after 30 days.

You can change the household size at any time. We do not store allergens, "free-from" settings, body weight or calorie goals in your profile.

3. Purpose and legal basis

We process your personal data based on the following legal grounds (GDPR Article 6):

• Performance of contract: providing the service (recipe storage, menus, shopping lists).
• Nickname: showing the author of public recipes; legal basis: performance of contract (Article 6(1)(b)), because you choose it and it is shown as part of the service.
• Public profile. Purpose: showing the profile page. Legal basis: performance of a contract (Article 6(1)(b) GDPR), because you turn it on. As long as it is on, anyone can see, even without logging in: your nickname, your monogram, your bio text (if you wrote one), your public recipes and their number. Do not put contact details or health information in your bio text. Your email address, your date of birth or age, your profile picture, your menus, your shopping lists, and a recipe that you shared only by link or to an address but did not make public are not shown. Only an account with a confirmed age can turn it on; for a locked account the profile becomes unavailable immediately. We do not use it for advertising or marketing profiling.
• Following and blocking. Purpose: managing who you follow, and making sure a blocked user cannot follow you or send you shares, and that their earlier shares stay hidden. Legal basis: performance of a contract (Article 6(1)(b) GDPR), because you ask for it. Nobody else sees your list of who you follow; the person you follow sees only their number of followers, and only they see it. We do not use it for advertising or marketing profiling.
• Following page. Purpose: showing the new recipes of the profiles you follow and signalling new recipes. Legal basis: performance of a contract (Article 6(1)(b) GDPR), because you ask for it. We do not personalise: the order of the suggested profiles follows the same rule for everyone. We do not use it for advertising or marketing profiling.
• Menu planner: we handle your kitchen profile (household size) so that we can tailor the servings of the menu suggestion and the shopping list to your circumstances; legal basis: performance of a contract (Article 6(1)(b) GDPR), because you set it and it is needed to provide the Menu planner. We do not use it for advertising or marketing profiling.
• Recipe image: displaying the image you upload, its description, AI label and source. Legal basis: performance of a contract (Article 6(1)(b) GDPR). Retention: until you delete the image or your account, plus the time it remains in backups.
• Consent: optional features (e.g. profile picture upload, AI-generated recipe ideas).
• Legitimate interest: service security, fraud prevention, anonymous analytics for product improvement.
• Legal obligation: any retention required by law (e.g. accounting records, where applicable).
• Handling of reports. If you report a recipe, image or profile (including its nickname and bio text), we process your name and email address (if you give them) to investigate the report and to tell you our decision. Purpose: carrying out the reporting procedure. Legal basis: Article 6(1)(c) GDPR, a legal obligation under Article 16 of Regulation (EU) 2022/2065 (DSA). If you ask for removal because a minor's personality rights were violated, we process the data needed to identify the requester (the data in the request and in the attached document) to decide on the request. Legal basis: Article 6(1)(c) GDPR, a legal obligation under section 13(13) and (14) of the Hungarian E-Commerce Act (Ekertv.). Retention: for 1 year after the report is closed.
• Profile moderation. If we hide your profile or your bio text, or reset your nickname, we process the decision, its time and the text of the statement of reasons, linked to your account, so that we can show you the reasons in your Account (Article 17 DSA). Legal basis: Article 6(1)(c) GDPR. Retention: while the decision is in force, or until a newer decision overwrites it, at the latest until you delete your account. We process the number of times your bio text was hidden and the blocking of editing it to deal with repeated breaches, on the basis of our legitimate interest (Article 6(1)(f) GDPR), until the block is lifted, at the latest until you delete your account.
• Removal log. If we remove a recipe of yours, we log the fact of the removal and its reason. Purpose: proving the removal and that the statement of reasons was communicated, in case of a complaint or dispute. Legal basis: legitimate interest (Article 6(1)(f) GDPR): being able to show our decision and that the reasons were communicated. Retention: for 1 year after the removal, even if you delete your account in the meantime. You can object to this processing on the Contact page.
• We process the declaration you made when uploading an image (its text and the time) to defend against legal claims, on the basis of our legitimate interest (Article 6(1)(f) GDPR). If you delete your account, we keep the declaration and the moderation decisions about the image, detached from your account, for up to 5 years.
• Sharing. Purpose: making your recipe, menu or shopping list available to whoever you give the link to or name, and managing the “Shared with me” list. If the address you enter belongs to an account, we send a notification email showing the sharer's display name (nickname, otherwise “A SimpleChef user”); the recipient never sees your email address, and it does not appear on the shared page. The email is a service message, contains no advertising, and can be switched off in your settings. Legal basis: performance of a contract (Article 6(1)(b) GDPR), because you ask for the sharing. We do not use it for advertising or marketing profiling. A shared recipe also appears among the recipient's own recipes, and as long as the sharing is active they also see your later changes; a list or a menu is a snapshot. If someone shares something to your email address and you open the “Shared with me” list or accept their invitation, they can see that you received it: your nickname (or “A SimpleChef user” if you have none). They cannot see any other data of yours.

4. Who has access to your data

We do not sell your data. The following processors have access strictly as needed for the service to operate:

• Vercel Inc. (USA): hosting, file storage (uploaded recipe images) and visitor measurement (Vercel Web Analytics, cookie-free: page views and the number of clicks on a few buttons; it tells visitors apart by an identifier derived from the browser's request, discarded after 24 hours, and we only see totals). We keep recipe images in storage located in the European Union (Vercel Blob, Frankfurt); Vercel's backups are replicated worldwide. Transfer to the USA: under the EU-US Data Privacy Framework (Vercel's certification) and the standard contractual clauses in Vercel's data processing agreement (Commission Implementing Decision (EU) 2021/914).
• MongoDB Atlas (MongoDB Inc., Ireland/EU): database service.
• Anthropic, PBC (USA): for AI-powered recipe generation, your prompt (ingredients) is forwarded anonymously. Details: https://anthropic.com/legal
• Google LLC (USA): Google sign-in.
• Cloudflare, Inc. (USA): Turnstile bot protection on sign-up, sign-in, the sign-in link, password reset, AI recipe requests and reporting. Data processed: IP address, browser identification data (TLS fingerprint, User-Agent). Purpose: filtering out abuse and bot traffic. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Cloudflare accesses this data as a processor, and for improving Turnstile as an independent controller, based on its own legitimate interest (Cloudflare Turnstile Privacy Addendum). Transfer to the USA: EU-US Data Privacy Framework, and the standard contractual clauses under Commission Implementing Decision (EU) 2021/914.
• Upstash Inc. (USA): rate limiting and counting your recipe requests. It processes the IP address temporarily; the recipe-request counter is identified by a pseudonymised code derived from your email address (the address itself is not stored). The counter is deleted automatically after 2 days (daily allowance) or 40 days (monthly allowance). When you request a recipe without signing in (as a guest), we store a code derived from your IP address with a new random key each day for up to 26 hours, to enforce the limit of one request a day. We do not store the IP address itself, and the daily key is deleted at the latest one hour after the end of the day, so requests from two days cannot be linked. Legal basis: legitimate interest in limiting misuse and cost (GDPR Article 6(1)(f)).
• Resend, Inc. (USA): sending transactional emails (account verification, password reset, sign-in link, sharing notification). It processes the recipient's email address to deliver them. Data is transferred to the USA on the basis of the European Commission's standard contractual clauses (SCC). Privacy policy: https://resend.com/legal/privacy-policy

The nickname is public: anyone can see it on the recipe page and recipe card, and, if you turn on the public profile, on the profile page. Together with approved recipe pages, search engines may also index it. For the profile page, we tell search engines not to index it.

5. Retention period

• Active users: while the account exists. Deleting your account is immediate and permanent. Recipes of yours that another user has already saved or added to their menu stay with that user, detached from your account and without your name, even if you have since made them private; they can no longer be linked to you. We delete the rest of your recipes. We delete the images you uploaded to the kept recipes when you delete your account. If a kept recipe's text still identifies you (for example your name appears in it), we delete that on request too: email support@buildsnap.dev. The same applies to menus and shopping lists: anything another user has already saved to their own account stays with them, detached from your account and without your name. When you delete your account, your share links stop working. Exception: if we have removed a recipe of yours before, the removal log stays for 1 year after the removal even after you delete your account (see: Removal log).
• Share link: until you revoke it or delete the content or your account. After revocation the link stops working immediately. Invite link: valid for up to 7 days, then it expires.
• Nickname: until you change or delete it in your profile, at the latest until your account is deleted. When the account is deleted the nickname is deleted; the author of your recipes that remain with others is then shown as “SimpleChef user”.
• Public profile: the setting (on or off, and since when) and the profile identifier until you delete your account. The bio text until you rewrite or delete it, at the latest until you delete your account. When you turn the profile off, the profile page becomes unavailable immediately, but the identifier and the bio text stay in your account.
• Following: until you stop, or until either party deletes their account. If the person you follow turns off their profile, the following stays, hidden, and comes back when the profile is turned on again. The following of a locked account, or of an account found to belong to someone under 16, stops. Blocking: until you unblock, or until either party deletes their account.
• Following page: the time you last opened it, turning off the default following of the Kitchen and closing the notice until you delete your account.
• Kitchen profile (Menu planner): until you delete your account, or until you change it.
• Inactive users: may be auto-deleted after 24 months of inactivity.
• Anonymized statistics: kept indefinitely (no personal identification).
• Support tickets and emails: 24 months.
• Removal log: for 1 year after the removal. Deleting your account does not shorten this.

6. Your rights (GDPR)

Under the EU General Data Protection Regulation, you have the following rights:

• Right of access: request a copy of the data we hold on you.
• Right to rectification: ask us to correct inaccurate data.
• Right to erasure ("right to be forgotten"): request full deletion of your data.
• Right to restriction: ask us to limit how we process your data.
• Right to data portability: receive your data in a structured format. The data export also contains your shares, the list of content shared with you, your public profile setting and your bio text. The data export also contains your following (whom you follow), your number of followers and the users you have blocked. The data export also contains the settings of the Following page (when you last opened it and whether you turned off the default following of the Kitchen). The data export also contains the log entries about recipes of yours that were removed: the recipe's identifier and title, the reason, the time, the status of the removal, and whether a notification email was sent.
• Right to object: object to processing based on our legitimate interest.
• Right to withdraw consent: withdraw any consent at any time.

You can change or delete your nickname in your profile at any time, and your data export includes it.

To exercise any right, email us at support@buildsnap.dev. We respond within 30 days.

If you believe our processing violates the law, you may lodge a complaint with the supervisory authority in your country.

7. Data security

• Passwords are stored using one-way hashing (bcrypt), never as plain text.
• All communication uses HTTPS/TLS encryption.
• Sessions use JWT-based tokens.

8. Cookies

We use cookies for the service to function. See the Cookie Policy for details.

9. Changes to this policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes via email or on the website. The current version is always available at /privacy-policy.

10. Contact about privacy

For any privacy-related question, request, or complaint: support@buildsnap.dev

We aim to respond substantively to all requests within 30 days.