Privacy Policy

This privacy policy applies to the two mobile apps SwapVeg and Smartes Kochbuch as well as to the website swapveg.de. In accordance with Art. 13/14 GDPR, it informs you about which personal data we process, for what purpose and on which legal basis.

How to read this document: Both apps come from the same provider and work largely in the same way. Everything stated here without a special marking therefore applies to both apps. Where the apps differ, the paragraph is specifically labelled — with “Applies only to SwapVeg” or “Applies only to Smartes Kochbuch”. In the table in Section 5, the assignment is shown in the column Applies to.

Separate data sets: Each app has its own database and its own server. An account in one app is not an account in the other; recipes, profiles and favourites are not exchanged between the apps. Requests for access and erasure therefore always refer to the app you name.

1. Controller

Daniel Drotleff
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen, Germany
Email: info@swapveg.de

2. Which data we process

a) On registration & sign-in

• Email address (login, password reset)
• Password (stored exclusively in encrypted/hashed form with our authentication service provider — we never see it in plain text)
• Username (chosen by you, publicly visible in your profile)
• Time of your consent to data processing
• Status flag of your account for additional features (test/premium status, where applicable with an expiry date) — serves exclusively to control the range of features (e.g. scan quota); there are no payment functions

Providing an email address, password and username is required to create an account; without them you cannot create an account or use the community features. All other details (Section 2b) are voluntary — not providing them has no disadvantages.

b) Profile (voluntary)

• Full name, biography — only if you provide them
• Profile picture (avatar), if you upload one
• Design/theme preference

c) Content you create

• Recipes (title, description, ingredients, preparation steps, tags, personal notes)
• Recipe photos, if you take or select them
• Ratings (1–5 stars) that you submit
• Favourites (which recipes you have saved)
• Follow relationships (whom you follow, who follows you)
• Number of recipe scans you have performed (for the weekly quota)
• Reports you submit about content or users (reported target, reason for the report, optional comment, time) — for review and moderation in accordance with our community rules (Art. 6(1)(b) and (f) GDPR)

Note on the recipe scan: Please do not photograph documents containing sensitive information (e.g. handwritten notes about health, allergies or intolerances) — the photo is transmitted to Google (USA) for analysis.

d) Technical data

• IP address — briefly, to prevent abuse (rate limiting) and in server access logs
• Time and type of server requests (access logs, retained for approx. 7 days)

When you visit the website swapveg.de, our hosting provider STRATO AG (Germany) automatically processes the IP address of your device, the date and time of access, the page requested and the browser identifier in server log files. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable delivery of the website); the log files are deleted after 7 days at the latest.

We create no device identifiers, no location tracking and no advertising profiles.

e) Contact form on the website

• Name and email address that you enter in the form
• Content of your message
• Time of sending

We process this information exclusively to handle your enquiry and to reply to you. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering enquiries); if your enquiry concerns a contract or the steps leading to one, Art. 6(1)(b) GDPR applies in addition. The information is voluntary — without a name and email address, however, we cannot reply to you.

The message is delivered as an email to our mailbox at STRATO AG (Germany); beyond that we do not pass it on. We delete it as soon as your enquiry has been conclusively resolved and no statutory retention obligations stand in the way. The form sets no cookies and does not embed any third-party services.

3. Camera and photo access

Both apps request permission for the camera and photo gallery — exclusively when you photograph a recipe or select an image. A captured photo is transmitted to our server and analysed there with the help of AI; the text recognition and digitisation of the recipe is carried out by Google Gemini (see Section 5). The app makes no image or sound recordings without your active triggering and does not access the camera in the background.

What happens with the recognised recipe afterwards differs depending on the app:

Artificially generated images

The large image on the start screen of both apps was created with artificial intelligence. We point this out because the European AI Act requires transparency for artificially generated content from 2 August 2026. The photos you take or select yourself are not artificially generated. Text and nutritional values that arise when scanning a recipe, on the other hand, are generated by artificial intelligence — see Section 5.

4. Automatic processing during use

While you use the app, some processing takes place automatically — this happens only while the app is open; there is no tracking and no data collection in the background while the app is closed:

• Analysis of a scanned recipe (AI analysis of the photo) after you have triggered the scan — for the scope per app, see Section 3
• Reconciliation of content you created offline with the server as soon as a connection is available again (synchronisation)
• Regular connection check (approx. every 30 seconds) to detect offline/online status
• Local storage of your content on the device (see Section 9)

In addition, both apps estimate the nutritional values of a recipe per serving from its ingredients — when scanning and, if they are still missing, when opening the “Nutrition” tab in the recipe. The estimate is produced by Google Gemini; the ingredient list, the title and the number of servings of the recipe are transmitted for this purpose, no account data. For public recipes, the result is cached with the recipe so that the same estimate is not incurred more than once. The values are estimated guide values, not a nutrition declaration within the meaning of Regulation (EU) No 1169/2011.

5. Recipients / processors

To provide the apps, we use carefully selected service providers with whom data processing agreements (Art. 28 GDPR) are in place. The column Applies to states which app uses the respective service:

Server error diagnostics: In addition, in the event of technical errors, our app server automatically transmits error reports to Sentry (EU region): technical error data and request metadata, no recipe content and no extended personal data. The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR).

Transfer to third countries: With Google and Expo, data is processed in the USA. The app servers of both apps are located at Render in Frankfurt — SwapVeg’s since 28 July 2026, Smartes Kochbuch’s since it was set up; the server log data is stored there within the EU. However, since Render Services, Inc. is a US company, administrative access from the USA cannot be completely ruled out. Google, Expo and Render are certified under the EU-U.S. Data Privacy Framework; transfers are therefore based on the adequacy decision of the EU Commission (Art. 45 GDPR). In addition, the data processing agreements concluded with them contain the EU standard contractual clauses (Art. 46(2)(c) GDPR). Despite these bases, a residual risk of access by US authorities remains. You can request a copy of the standard contractual clauses at any time at info@swapveg.de; the model text of the EU Commission is available at eur-lex.europa.eu.

6. Legal bases

• Art. 6(1)(b) GDPR (performance of a contract): account, profile, creating/saving/sharing recipes, scan function, synchronisation — everything that is necessary for the operation of the apps. For Smartes Kochbuch additionally the nutrition goals, because they are part of the agreed range of features.
• Art. 6(1)(a) GDPR (consent): crash diagnostics (Sentry) and usage statistics (PostHog). Both are disabled by default and only active after your active agreement in the consent dialog. You can withdraw your consent at any time in the app settings. Also consent-based: push notifications — your push token is only transmitted to Expo and Google FCM after you have actively granted the app the notification permission.
• Art. 6(1)(f) GDPR (legitimate interest): brief storage of the IP address to prevent abuse (rate limiting) and to ensure operation, automatic error reports from our app server to Sentry (see Section 5), and the server log files when visiting the website (see Section 2d).

7. Consent & withdrawal

When you first start the app, you are asked whether you agree to the optional crash diagnostics and/or the anonymous usage statistics. Without your agreement, these services are not activated. You can change your decision at any time under Profile → Privacy. The withdrawal takes effect for the future. You can disable push notifications at any time in the system settings of your device — then no more notifications will be shown to you. When you sign out of the app and when you delete your account, your push token is deleted from our server.

8. Storage period

We store account and content data for as long as your account exists. When you delete your account (in the app under Profile → Delete account), all associated data is removed immediately and completely. Server access logs are deleted automatically after approx. 7 days.

• Crash reports (Sentry): automatic deletion after 90 days at the latest
• Usage statistics events (PostHog): stored for a maximum of 12 months
• Photos taken for the scan: are transmitted only for the duration of processing and are not permanently stored on our server; on your device they remain until you delete them
• Push tokens: are deleted when you sign out of the app or delete your account
• Reports about content: are stored for the duration of the review and to prevent abuse, and are removed at the latest when the reporting account is deleted
• Nutrition goals (Smartes Kochbuch only): remain stored for as long as your account exists and are deleted together with it

9. Local storage on your device

Both apps store data locally on your device so that they also work offline: sign-in tokens, your recipes and recipe images, your shopping list, on request your meal plan, caches and a queue for changes not yet synchronised. This data leaves your device only if you actively synchronise or publish content — or if you trigger a function that processes it, such as the nutrition estimate from the ingredient list (Section 4; for processing only, without storing your local recipes on the server). The website swapveg.de sets no tracking cookies.

10. Your rights (Art. 15–22 GDPR)

• Access to the data stored about you
• Rectification of inaccurate data (usually possible directly in your profile)
• Erasure — in the app under Profile → Delete account, via our page for account and data deletion (also without the app installed) or by email to info@swapveg.de. Please state which app you are referring to — the accounts of the two apps are held separately; on the deletion page we ask for this.
• Restriction of processing (Art. 18 GDPR) — e.g. while the accuracy of your data is being verified or if you request a restriction instead of erasure
• Data portability — export of your data as JSON on request to info@swapveg.de
• Withdrawal of consent given (see Section 7)
• Complaint to a data protection supervisory authority (e.g. the state data protection commissioner responsible for your place of residence)

Right to object (Art. 21 GDPR): You have the right, on grounds relating to your particular situation, to object at any time to the processing of your data that is carried out on the basis of Art. 6(1)(f) GDPR (in particular: brief storage of the IP address to prevent abuse, server log files, server error reports and the processing of reports about content, see Section 6). To do so, please contact info@swapveg.de.

11. Minors

Both apps are not directed at children under 16 years of age. We do not knowingly collect data from persons under 16 years of age without the consent of their legal guardians.

12. Additional information for users in Canada

If you use the app in Canada, the Canadian federal law PIPEDA (Personal Information Protection and Electronic Documents Act) and — in Quebec — Law 25 (Loi 25, Act respecting the protection of personal information in the private sector) additionally apply to you. All statements in this policy apply unchanged; in addition:

• Person in charge of the protection of personal information (Law 25, s. 3.1): Daniel Drotleff, reachable at info@swapveg.de. For the postal address, see Section 1.
• Processing outside Canada (Law 25, s. 17): Your data is processed on servers in the European Union (Frankfurt am Main, Germany). During the recipe scan and the nutrition estimate, the data described in Sections 3 and 4 goes to Google in the USA. We assessed these transfers before they began: EU data protection law offers protection equivalent to that of Canada (conversely, the European Commission has recognised Canada as adequate since 2001); for Google in the USA we rely on its certification under the EU-US Data Privacy Framework.
• Your rights: access and rectification, withdrawal of consent given, erasure, cessation of dissemination, and portability of your data in a structured, commonly used format. To exercise them, contact info@swapveg.de or use the functions in the app (Section 10). We respond within 30 days.
• Complaint: to the Office of the Privacy Commissioner of Canada (priv.gc.ca) and, in Quebec, to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).
• No geolocation, no profiling (Law 25, s. 8.1): The app uses no technology that identifies, locates or profiles you. The optional diagnostics and statistics functions (Section 7) are switched off by default and run only if you switch them on.
• No automated decisions (Law 25, s. 12.1): The AI conversion of recipes and the nutrition estimate process recipe content but make no decision about you as a person.
• Minors: Law 25 requires parental consent for persons under 14 years of age; the app is in any case not directed at persons under 16 (Section 11).
• Privacy incidents: In the event of an incident presenting a risk of serious injury, we notify the competent authority and the persons concerned (PIPEDA section 10.1; Law 25, s. 3.5).

13. Changes to this policy

We adapt this privacy policy when the data processing changes. The current version is always available here.