ReciReel Privacy Policy

Last updated: August 21, 2026

Effective date: August 21, 2026

1. Who We Are

ReciReel is developed and operated by Justin Burkard (“we,” “us,” “our”).

Data Controller: Justin Burkard Email: support@recireel.com Website: https://recireel.com

We are the data controller responsible for your personal data under applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (collectively, “CCPA”).

We do not currently have a Data Protection Officer. For any data protection inquiries, contact us at support@recireel.com.

2. What This Policy Covers

This privacy policy explains what personal information ReciReel collects, the legal basis for processing it, how we use it, who we share it with, how long we keep it, and what rights you have. It applies to all users of the ReciReel iOS app.

3. Information We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Usage Analytics

To make ReciReel better, we record what happens in the app. This is our own system running on our own servers. No outside analytics company is involved, and nothing here is used for advertising.

What we record. Actions, not content. For example: opening the app; which screens you visit; starting an import and whether it finished, failed, or you stopped waiting; opening, cooking, or deleting a recipe; which features you use; which errors you see; and which subscription screens you see. Each action is stored as a short code from a fixed list, together with the app version, your iOS version, and whether you got the app from the App Store or from TestFlight.

What we never record. We never record your name, your email address, your account number, your device identifier, an advertising identifier, your location, your age or any other demographic detail, or any of your content — no recipe titles, no recipe text, no notes, no photos, and none of the links you import. Analytics records have no free-text field at all, so your personal content cannot end up inside one.

How it is connected to you. Each record is tied to your account by a one-way code that our server calculates from your account using a secret key we keep. Your real account number is never stored in an analytics record, and the code cannot be turned back into your identity by anyone who does not hold that key. Before you sign in, no account code is attached at all.

What we use it for. Only to run and improve ReciReel: finding the imports that fail, the screens that confuse people, the errors people run into, and the features worth building next. We do not sell this information, we do not share it, we do not use it for advertising or ad targeting, and it is never sent to an outside analytics service. If you are in Europe or the UK, the legal basis for this is our legitimate interest in improving the app (Section 4), and you may object at any time (Section 11.2).

How long we keep it. Individual records are deleted after 13 months. Counts and summaries built from them — for example, how many imports succeeded in a given week — no longer point to any individual record and are kept indefinitely. When you delete your account, your analytics records are deleted with it.

Your choice. ReciReel does not have a separate analytics switch to turn off, because these records are how we keep the app working and fix what breaks. If you do not want us to hold them, you can delete your account at any time in Profile → Privacy & Data → Delete Account, which deletes them along with the rest of your data, or you can write to support@recireel.com to object or ask questions. This policy is where we tell you what is collected; account deletion is how you withdraw it.

Coming later: crash and performance reports. A future version of ReciReel will use Apple’s built-in MetricKit to send us a report when the app crashes, freezes, or runs slowly. This is not active today. We will name the app version in this policy, and update our App Store privacy details, before it ships. Those reports will be sent without your account code, your account, or any other identifier attached, so they will not be connected to you.

3.4 Information We Do NOT Collect

We want to be explicit about what we do not touch:

• No location data. We never request or access your location.
• No third-party tracking or advertising analytics. We do not use third-party analytics SDKs in the iOS app, ad networks, data brokers, cross-app behavioral tracking, or session replay. ReciReel’s usage analytics (Section 3.3) are first-party: our own code, our own servers, and no outside analytics company. Our backend uses Sentry only for privacy-minimized error diagnostics as described in Section 7.4.
• No content, identifiers, or demographics inside analytics. Our usage analytics never include your name, email address, account number, device or advertising identifier, location, demographic details, or any recipe title, recipe text, note, photo, or imported link. Every recorded value comes from a fixed list of codes.
• No advertising identifiers. We do not collect the IDFA or any advertising identifier.
• No contacts or address book. We never access your phone’s contact list.
• No photos or camera. We do not access your camera or photo library.
• No browsing history. We only process the specific recipe URLs you choose to paste into the app. We have no visibility into your general web browsing.
• No cookies or web tracking technologies. The app does not use cookies, web beacons, pixels, or similar tracking technologies.

3.5 Health Data

ReciReel does not request, read, write, collect, store, or transmit data from health apps at launch. Nutrition information shown in the app is an estimate for cooking convenience and is not medical advice.

If we add any health-data integration in the future, we will update this policy and App Store privacy details before shipping it, and the feature will require separate permission.

4. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases as defined by Article 6(1) of the GDPR:

Where we rely on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing performed before the withdrawal.

Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interests at any time by contacting us.

5. How We Use Your Information

We use your information solely to provide and operate the ReciReel service:

• Account management: Your email, name, and provider-specific identifier identify your account and allow us to authenticate you. Apple and Google sign-in do not require a ReciReel password; email sign-in uses a time-limited verification code delivered to your email address.
• Recipe extraction: The content you submit for an import — the source URL, page text and captions, and, for video imports, the source video file and frames extracted from it — is sent to our backend, which uses Google Gemini AI to extract and structure recipe content. See Section 7.1 for details.
• Source attribution: When available, ReciReel stores and displays source URLs, source platform, creator names, and creator handles so imported recipes preserve credit and can be traced back to the original source.
• Discover catalog: An eligible AI-generated structured recipe card may become available to signed-in users in ReciReel’s Discover catalog, independently of who imported it. The public card credits the original creator and platform and never identifies, or retains a way to identify, the ReciReel user who imported the source. Your notes, favorites, pantry, cooking history, and private import evidence are never published.
• Entitlement management: Subscription status determines which features you can access.
• Nutrition estimates: Recipe nutrition estimates are shown for cooking convenience only and are not medical advice.
• Product improvement: Coded records of what you do in the app (Section 3.3) tell us which imports fail, which screens confuse people, which errors people hit, and which features are worth building. They are used for this and nothing else.

We do not:

• Sell your personal information to anyone.
• Use your information for advertising or ad targeting.
• Share your information with data brokers.
• Use your information for profiling for purposes unrelated to the service.

6. Automated Decision-Making

ReciReel uses Google Gemini AI to extract and structure recipe content from the items you submit. This involves automated processing of the content you submit — the source URL, page text and captions, and, for video imports, the source video file and frames extracted from it — to generate structured recipe data (ingredients, steps, nutrition estimates).

This automated processing:

• Applies only to the specific items you choose to import.
• Does not make decisions that produce legal effects or similarly significant effects on you.
• Produces recipe data that you can review and delete within the app.

Nutrition estimates generated by AI are approximations. They should not be relied upon for medical-grade dietary decisions.

7. Third-Party Services

7.1 Third-Party AI Processing (Google Gemini)

Third-Party AI Processing (Google Gemini). When you import a recipe from a link or shared video, ReciReel transmits the content you submit — the source URL, page text and captions, and, for video imports, the source video file and frames extracted from it — to Google’s Gemini AI to extract and structure a recipe (ingredients, steps, timing, and nutrition estimates). Google acts as our data processor for this task under a data processing agreement that includes Standard Contractual Clauses for international transfers, and we do not permit Google to use this content to train its AI models. We send only the content for the specific item you choose to import; we do not send your account profile, saved library, notes, or purchase data. Any source video temporarily fetched to process your import is held only in temporary working storage for the duration of processing and is deleted immediately after the recipe is generated — ReciReel does not maintain a permanent archive of source videos. ReciReel may retain a derived food-image hero frame with the saved recipe until that recipe or account is deleted; that image is separate from the deleted source-video bytes. We do not sell or rent your content or personal information to anyone, and we do not use it for advertising. You can review and delete every AI-generated recipe within the app at any time.

Source attribution is separate from AI processing. ReciReel may show the original source URL, source platform, creator name, or creator handle when available so users know where an imported recipe came from and creators can request review or removal if needed.

7.2 Apple (App Store and StoreKit)

• App Store and StoreKit: Your subscription and payment information is handled by Apple through the App Store. ReciReel receives only the product, transaction, and entitlement information needed to verify feature access. ReciReel never receives or stores your payment card details, billing address, Apple Account password, or device passcode. Apple’s Privacy Policy governs Apple’s handling of this data.
• Sign in with Apple: Apple provides ReciReel a provider-specific account identifier and a short-lived authorization code. ReciReel exchanges that code with Apple and, when Apple issues one, stores the resulting refresh token using server-side envelope encryption solely so ReciReel can revoke its Sign in with Apple authorization when you delete your account. The refresh token is never sent back to the app and is deleted with the account.
• Legacy or unavailable revocation: If an older ReciReel account has no usable Apple refresh token, or Apple’s revocation service is temporarily unavailable, ReciReel still completes deletion of the ReciReel account and data. The app then directs you to Settings → your name → Sign-In & Security → Sign in with Apple → ReciReel for manual cleanup. Apple authorization cleanup does not delay or block deletion of ReciReel account data.

7.3 Notifications and Import Live Activities

ReciReel schedules cook-timer reminders locally on your device. When an import Live Activity is available and enabled, iOS also generates an ActivityKit push token for that one import. ReciReel sends that token to its backend and uses Apple Push Notification service (APNs) only to keep the import’s Lock Screen or Dynamic Island status current while processing continues. The token is not an advertising identifier and is not used for tracking, marketing, or cross-app profiling. It is retained only while that import is active and is removed when the import reaches a completed or failed state, or when the account is deleted, whichever happens first.

7.4 Backend Error Monitoring (Sentry)

ReciReel uses Sentry on its backend service to detect software errors and maintain service reliability. This is error monitoring, not product analytics, advertising, tracking, session replay, or user profiling. ReciReel does not include the Sentry SDK in the iOS app.

Before an error event is sent, ReciReel removes request bodies, headers, cookies, query strings, IP addresses, user context, email addresses, authentication tokens, recipe content, prompts, source URLs, and transaction identifiers. Retained diagnostics are limited to technical information such as the error type, sanitized stack trace, backend release and environment, and timestamp. Sentry processes this limited diagnostic information on our behalf and may not use it for advertising or tracking. Sentry does not receive ReciReel’s usage analytics (Section 3.3); those records stay on ReciReel’s own servers.

7.5 Passwordless Email Delivery (Brevo)

When you request an email sign-in code, ReciReel uses Brevo to deliver that transactional message. Brevo receives the destination email address, the one-time verification-code message, and technical delivery metadata needed to send and troubleshoot the email. ReciReel does not send Brevo your recipes, saved library, notes, source URLs, purchase data, or imported media. We use this service only for authentication email delivery, not advertising or marketing.

7.6 No Other Third Parties

Other than the service providers specifically identified above, we do not use third-party analytics services, advertising networks, crash-reporting services, or social-media SDKs. We do not embed third-party tracking code in the app.

8. Paid Shopping Links

The app may include clearly marked paid links for ingredients, optional ingredients, grocery items, or kitchen equipment mentioned in recipes. If you use those links, ReciReel may earn a small commission at no extra cost to you. When you tap a paid link, the destination website’s own privacy policy applies to your interaction with that site.

• Paid links are visually distinguished and disclosed near the shopping action.
• Paid-link relationships never influence which recipes are recommended to you, how they are ranked, or how they are displayed.
• We do not receive personally identifiable information from affiliate partners about your purchases.

9. International Data Transfers

ReciReel is operated from the United States. If you are located outside the United States (including in the European Economic Area, United Kingdom, or Switzerland), your personal data will be transferred to and processed in the United States.

For transfers of personal data from the EEA/UK/Switzerland to the United States, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• The EU-U.S. Data Privacy Framework, to the extent our processors (such as Google) are certified under it.

By using ReciReel, you acknowledge that your data will be processed in the United States, which may have different data protection standards than your country of residence. We take reasonable measures to ensure your data receives an adequate level of protection.

10. Data Retention

After account deletion: ReciReel blocks new sessions and writes for the account, completes or safely cancels active account work, removes the account and its authentication identities, sessions, recipes, imports, pantry, grocery, meal-plan, quota, entitlement, source, media, AI-processing sidecar, cache, and temporary-file data from live systems, and clears app-owned local account state. The action is irreversible. Encrypted backups use a 30-day lifecycle expiration policy; the storage provider may complete physical object removal shortly after an object’s expiration time. The minimal non-content deletion receipt described above remains through that lifecycle window plus seven days so a restored snapshot cannot silently resurrect deleted data.

Account deletion also irreversibly severs the private relationship between your account and any recipe card independently published to ReciReel’s signed-in Discover catalog. The importer-anonymous public card credits only the original creator and platform — never you — and neither the public catalog nor support tooling retains a way to identify your deleted account as the importer.

Messages you previously sent directly to support are not stored in your ReciReel account and follow the separate support-communication schedule above. You may ask us to delete those messages sooner unless we must keep them for security or legal reasons.

Subscription cancellation vs. account deletion: Canceling your subscription through the App Store does not delete your account or data. Deleting your account does not cancel an Apple-billed subscription or stop Apple’s future billing. Before deletion, Plus users can open Apple’s native Manage Subscriptions sheet from ReciReel, but they may continue with immediate account deletion whether or not they cancel. Subscription management and ReciReel data deletion are separate actions.

11. Your Rights

11.1 Rights for All Users

Regardless of where you are located, you can:

• Export your data. Save the account data ReciReel stores for you as a JSON file at any time from the Profile tab.
• Delete your account. In ReciReel, open Profile → Privacy & Data → Delete Account. The app explains what is removed, subscription handling, and irreversibility before two confirmation steps. ReciReel clears local signed-in state only after the backend confirms completed deletion and shows a visible success result. This action is irreversible.
• Manage notifications and Live Activities. Enable or disable ReciReel notifications and Live Activities through iPhone Settings.
• Object to usage analytics. ReciReel has no separate analytics switch. Deleting your account deletes your analytics records along with everything else, and you can contact support@recireel.com to object or ask what is held.

11.2 Additional Rights Under GDPR (EEA, UK, Switzerland Residents)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following additional rights under the GDPR:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your personal data (“right to be forgotten”).
• Right to restrict processing (Art. 18): Request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (JSON export).
• Right to object (Art. 21): Object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.

To exercise any of these rights, contact us at support@recireel.com. We will respond within 30 days (or sooner as required by applicable law). We may ask you to verify your identity before processing your request.

11.3 Additional Rights Under CCPA/CPRA (California Residents)

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA provides you with the following rights:

• Right to know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it. This right is not limited to a 12-month look-back period for data retained longer than 12 months.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to correct: You may request that we correct inaccurate personal information.
• Right to opt out of sale or sharing: We do not sell or share your personal information as defined by the CCPA. We do not sell personal information to third parties for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information: We only use sensitive personal information (your email address) as necessary to provide the service.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

Categories of Personal Information Collected (CCPA Disclosure):

Automated Decision-Making Technology (ADMT): We use Google Gemini AI to extract recipe content from the items you submit to import. This processing does not make significant decisions about you. You can review and delete all AI-generated recipe content within the app.

To exercise your CCPA rights, contact us at support@recireel.com. We will verify your identity and respond within 45 days.

12. Children’s Privacy

ReciReel is not designed for, directed at, or intended for use by children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has created an account, please contact us at support@recireel.com and we will promptly delete the account and all associated data.

In the United States, we comply with the Children’s Online Privacy Protection Act (COPPA), which applies to children under 13. Our age threshold of 16 exceeds COPPA requirements and aligns with GDPR standards.

13. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission (TLS/HTTPS) for all communications between the app and our servers.
• Encrypted data storage at rest on our servers.
• Access controls limiting who can access personal data.
• Regular security reviews of our systems.

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

14. Changes to This Policy

If we make material changes to this privacy policy, we will notify you through the app before the changes take effect and update the “Last updated” date at the top of this document. Your continued use of ReciReel after the effective date of the revised policy constitutes acceptance of the changes.

Minor clarifications, formatting changes, or updates that do not materially affect your rights will be updated without separate notice.

We encourage you to review this policy periodically.

15. Contact Us

If you have questions about this privacy policy, your data, or wish to exercise any of your rights, contact us at:

Justin Burkard Email: support@recireel.com Website: https://recireel.com

For GDPR-related inquiries, you may also contact your local data protection supervisory authority.