Privacy Policy

This Policy explains what personal data Cookmory processes, why it is processed, and how you can exercise your rights.

1. Data controller

Artur Mukhamatkhaev, Rua das Amoras 174, 2775-549 Cascais, Portugal. Contact: support@cookmory.com.

2. Data we process

Depending on how you use the service, we process the following categories:

• Account: email address, user identifier, display name, language and plan status.
• Content: recipes, ingredients, instructions, tags, folders, notes, meal plans, shopping lists and family-space data.
• Images: optimized images stored with recipes, subject to plan limits, up to 250 KiB each. We do not retain originals uploaded for recipe imports as import files.
• Support and security: problem reports, screenshots you choose to attach, information needed to rate-limit requests and investigate incidents.
• Technical monitoring: predefined error or health-check codes, timestamps, counts, application release and random request identifiers used to locate log entries; these monitoring events do not deliberately include recipe text.
• Optional analytics: after your consent, counts of visits and certain actions (such as guest PDF exports and extension launches), a random browser identifier and, when signed in, an account identifier; Google Analytics data where enabled.

3. Purposes and legal bases

• Providing the service and requested features: creating and managing accounts, saving recipes, sharing content when you request it and providing plan features. Legal basis: performance of a contract (GDPR Article 6(1)(b)).
• Security, abuse prevention and technical diagnostics: protecting accounts and infrastructure, preventing misuse and resolving incidents. Legal basis, where applicable: our legitimate interest in keeping the service secure and operational (GDPR Article 6(1)(f)).
• Handling requests and legal compliance: responding to legal requests and retaining information where the law requires it. Legal basis: compliance with legal obligations (GDPR Article 6(1)(c)) and, depending on the request, performance of the service or legitimate interests.
• Optional analytics: usage analysis involving non-essential identifiers or technologies, only after your consent (GDPR Article 6(1)(a)). You can withdraw that consent at any time through Cookie settings.

Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

4. Imports, OCR, PDFs and translations

Image text recognition (OCR), PDF reading and requested recipe translation run in your browser where supported by the feature and device. Your browser may download language resources for these functions. Cookmory does not store original import files, temporary translations or generated PDF exports. If you select “Save as a copy”, the translated copy becomes part of your saved recipes.

When you import a recipe from a URL, the server temporarily retrieves the specified public page to extract recipe information. When you press the Cookmory extension button, it sends the active tab's URL to Cookmory over HTTPS to start your requested import; the extension is not used to continuously monitor browsing, collect passwords or store browsing history.

If the optional Telegram recipe handoff is enabled, a separate Cookmory bot service sends a recipe URL or plain recipe text that you submitted in a private bot chat to Cookmory over HTTPS. Cookmory keeps this input encrypted in a private database record for up to 24 hours. A review link opens an editable draft in one browser session; no recipe is saved to your cookbook until you explicitly confirm Save. A scheduled database job deletes expired handoffs. Saving or discarding requests immediate removal of the server handoff payload; if that request fails, expiry still prevents access and the scheduled job removes it. The browser may keep an editable local draft for up to 24 hours to let you sign in before saving. Telegram and the bot host may retain their own chat data under their respective policies; deleting a Cookmory handoff does not delete Telegram messages. The optional direct-save feature links your numeric Telegram user ID to your Cookmory account only after you initiate linking on the website and separately confirm it in the bot. This link remains until you disconnect Telegram in account settings or delete your account. A direct import draft is held privately for up to 15 minutes; it is saved to your recipes only after your explicit Telegram confirmation. Cancelling, disconnecting or saving removes its temporary recipe payload immediately. Expired drafts and link challenges are removed by a scheduled cleanup job. A minimal save receipt (recipe ID and hashed retry key, without recipe text) is kept for up to 30 days to prevent duplicate saves. Telegram usernames, names, phone numbers and chat history are not stored as part of the link. You may decline to save or request deletion through the contact above.

Recipe images you choose to save are optimized as WebP, subject to the 250 KiB-per-image limit, and kept in private storage provided by Supabase.

5. Shared content and family spaces

Anyone with an active public link may view the data you shared through that link. You can revoke links, and some links may expire depending on the feature. Within family spaces, recipes, plans, notes, cooking activity and shopping lists are shared according to available features and permissions. The family owner can allow members to edit one another's recipes; only the creator may delete a recipe. Personal folders and tags do not automatically become shared.

6. Recipients and providers

We use OVHcloud for hosting and Supabase for authentication, databases and file storage. If we enable Google Analytics, Google may process analytics data, subject to the applicable consent. We may also need to disclose strictly relevant data to providers handling service communications or payments that you actually request, and to public authorities where legally required. We do not sell your recipes or personal data.

Providers may process data under their respective roles and data-protection obligations. If a processing activity involves transfers outside the European Economic Area, safeguards required by the GDPR will apply. You can request further information about a specific processing activity and the relevant safeguards using the contact details above.

7. Analytics and cookies

First-party analytics and Google Analytics, when configured, do not operate before consent. First-party analytics counts visits and certain usage actions without collecting recipe text, email addresses, full URLs or query parameters for that purpose. A browser identifier may link analytics events and, when you are signed in, may be associated with your account identifier. We therefore do not necessarily regard these identifiers as anonymous. You can change your choice in Cookie settings. See our Cookie Policy.

8. Retention and deletion

Information needed to maintain your account and its content is kept while you use the account, unless you delete it earlier or a legal obligation requires particular information to be retained. Recipes moved to the recycle bin can be recovered during the period displayed in the interface. Problem reports are retained for as long as needed to investigate them. Administrator monitoring events are retained for up to 30 days; separate technical logs follow their rotation cycles.

When account deletion is completed, the account-linked records and files are removed from the active application. Limited data may remain temporarily in independent security logs or backups for as long as needed for security, integrity, recovery or legal compliance. Such copies do not constitute an operational account you can sign back into. You may ask about retention of a particular category of data by email.

9. Security

We use access controls, private storage, Row Level Security policies, data validation and request rate limits. No internet-connected service can guarantee absolute security.

10. Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction or portability of your personal data, and object to certain processing. Where processing is based on consent, you may withdraw it. To exercise your rights, email support@cookmory.com. If you believe your rights have been infringed, you may lodge a complaint with Portugal's Comissão Nacional de Proteção de Dados (CNPD) at cnpd.pt, without prejudice to other competent authorities.

11. Children

Cookmory is not designed for independent use by children who cannot legally consent to processing of their personal data. Where required, use must involve a person with parental responsibility and comply with applicable law.

12. Changes to this Policy

Material changes will be communicated by updating this page and its date. If the law requires another form of notice or renewed consent, the relevant process will be followed.