Reel GustoPrivacy Policy
Last updated: insert DD/MM/YYYY
Reel Gusto stores recipes so they are available on all your devices and can be shared with people you invite. Everything processed for that is listed here — including the parts we are not thrilled about.
1. Controller
The controller under the General Data Protection Regulation (GDPR) is:
Name or company
Street and number
Postcode and city
Germany
Email: info@reelgusto.de
We have not appointed a data protection officer; the conditions of § 38 BDSG are not met.
2. What we process
Account
Signing up requires an email address and a password. The password is never stored in plain text, only as a cryptographic hash — we cannot read it either. In addition: a display name (pre-filled from the part before the @ when you register, changeable at any time), optionally a profile picture, and the time of registration.
The email address must be confirmed before the account can be used. We send a single message containing an activation link for that.
Recipes and everything attached to them
For every recipe we store the title, ingredients, preparation steps, its categories (keywords such as “pasta” or “vegetarian”), an image and — for imported recipes — the source URL and the author details published by the network in question (username, display name, profile link). Those details stay with the recipe so its origin remains visible.
We also temporarily store the original text of the post and, where produced, a transcript of the audio. They exist solely so a failed recipe can be re-analysed without fetching the post again, and are deleted automatically after 90 days (see Retention).
Beyond that: your weekly plan, your favourites and any photos you take or pick to illustrate a recipe.
Links between cookbooks
If you share your cookbook with someone, we store the link between the two accounts as well as the invitation code created for it, its expiry time and who redeemed it.
Imports and subscription
We count how many imports your account has used and store whether a subscription exists and until when. We do not process payment data — the purchase runs entirely through Google Play or the App Store (see Recipients).
Technical data
Accessing our servers produces the usual connection data (IP address, timestamp, endpoint called, status code). It serves operation and troubleshooting. We use no analytics or tracking tools, there is no advertising, and we do not build usage profiles.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and running the account, sign-in, confirmation email | Art. 6(1)(b) GDPR (performance of a contract) |
| Storing, syncing and sharing recipes; weekly plan and favourites | Art. 6(1)(b) GDPR |
| Fetching a post and turning it into a recipe | Art. 6(1)(b) GDPR |
| Counting free imports, checking the subscription | Art. 6(1)(b) GDPR |
| Caching posts already fetched, to avoid cost and load | Art. 6(1)(f) GDPR (legitimate interest in running the service sustainably) |
| Operation, security, abuse prevention, troubleshooting | Art. 6(1)(f) GDPR |
Providing the data is voluntary but necessary to use the app: without an account there is no access to the recipes, because they live on our server rather than on the device.
4. Recipients and processors
We do not pass data on for advertising and we sell nothing. To run the service we do however use providers acting on our behalf (processors under Art. 28 GDPR):
| Service | Purpose | What it receives |
|---|---|---|
| Supabase Supabase Inc.; servers in the EU (Ireland, eu-west-1) |
Database, authentication, image storage, server functions | all data listed above |
| Apify Apify Technologies s.r.o., Czechia |
Fetching the publicly available post behind the link | the post URL only — no reference to your account |
| Google Google Ireland Ltd. / Google LLC (USA) |
Language model (Gemini) that writes out title, ingredients and cooking steps from the text and translates foreign-language recipes | the post text or transcript, with no account reference |
| RevenueCat RevenueCat Inc., USA |
Managing the subscription across devices | your account ID (a random identifier) and subscription status |
| Brevo Sendinblue SAS, France |
Sending confirmation and password emails | email address |
| Google Workspace Google Ireland Ltd. / Google LLC (USA) |
Our mailbox info@reelgusto.de — when you write to us |
your email address and the content of your message |
Google Play and Apple are not processors but independent controllers: the subscription contract is concluded with them, they handle payment and remit VAT. Their own privacy notices apply to that processing. We only learn that a subscription exists — not how it was paid for.
What reaches the language model. The text of the post — and the transcript, if one was produced — goes through our server to Google's language model Gemini (see section 9). Nothing that points to you travels with it: no account, no address, no identifier. We deliberately use the paid tier, under which Google is not permitted to train its models on the submitted content.
5. Transfers outside the EU
The database and images are held in the EU (Supabase, Ireland) — no transfer to a third country takes place there.
Google (language model and mailbox) and RevenueCat, by contrast, are based or host servers in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. Despite those safeguards, access by US authorities cannot be ruled out.
6. Retention
| What | How long |
|---|---|
| Account, recipes, images, weekly plan, favourites | until you delete your account |
| Original text and transcript of a post | 90 days, then removed automatically |
| Cache of fetched posts | 90 days, then deleted automatically |
| Invitation codes | 7 days, then invalid |
| Server connection data | short-term, for troubleshooting |
If you delete your account, recipes, weekly plan, favourites and all images are removed immediately and permanently — we cannot restore them either. Cookbooks you were linked to remain with their owners; only the link is removed.
7. Shared cookbooks
When someone redeems your invitation code, both sides can see each other's recipes and as well as the other's display name and profile picture. The weekly plan is kept jointly. Favourites stay private and are never shared.
Other people's recipes can be viewed and cooked, but not edited or deleted. You can undo the link at any time in the settings; the other side's recipes then disappear from your view.
8. Third-party content from TikTok and Instagram
When you import a link, we fetch the publicly available post and store recipe details, a preview image and the post's author information from it. This may involve personal data of third parties — for example the name of the person who published the post. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is keeping a recipe traceable to its source.
Preview images are not publicly accessible. They are held in closed storage and served only to signed-in accounts allowed to see the recipe in question.
If you are the author of a post and do not want its content processed in Reel Gusto, write to info@reelgusto.de — we will remove it and block the source from future imports.
9. The language model and what stays on your device
Preparation runs in the cloud. From the text of a post, a language model writes out title, ingredients and cooking steps and, where needed, translates them into your device language. For that the text goes through our server to Google's Gemini — with no account reference and no identifier, just the text itself (see section 4). The same happens when you choose Re-analyse in the app; that works at most three times a day per recipe.
Your device holds a copy of your recipes so the app starts without waiting. It is erased when you sign out.
10. Your rights
You have the right to:
- access the data we process (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR) — in the app under Settings → Profile → Delete account, or here without the app
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
An informal message to info@reelgusto.de is enough.
You may also lodge a complaint with a supervisory authority (Art. 77 GDPR), either where you live or where we are established: insert competent authority.
11. This website
These pages are static and served through GitHub Pages (GitHub Inc., USA). On access, GitHub processes the usual connection data including the IP address; we have no influence over that.
We set no cookies, embed no third-party fonts, maps or analytics, and measure nothing. The typeface is served from our own site so that merely opening a page sends no data to third parties.
12. Changes
When what the app does changes, this policy changes with it. The version in force is always the one at this address; the date at the top states its status.
This is a translation. In case of doubt, the German version prevails.