Privacy policy
The Chefie app (Kaj kuham in Slovenian) · effective 30 October 2026 · version 2026-10-30 · amended 1 November 2026 (optional age)
Chefie helps you cook something from what you have at home, for the people you cook for. To do that it needs some information about you and your family, including allergies. This page says which information, why, who else sees it, how long we keep it and what you can ask for.
1. Who is responsible
Rok Ivartnik, Leskovec 20E, 2331 Pragersko, Slovenia.
Email for privacy questions and requests: zasebnost@chefie.eu.
The app is run by an individual, not a company. We are not required to appoint a data protection officer and have not; write to the address above about anything.
2. What we process
| Data | Why | Legal basis |
|---|---|---|
| Account: email, name, password (stored only as a hash), language, when you confirmed your address | Signing in, codes by email, syncing between phones | Contract (Art. 6(1)(b) GDPR) |
| Allergies and dietary restrictions of you and the people you cook for (e.g. “allergy: nuts”, “doesn't eat pork”), children included | So that suggestions and recipes leave out what someone must not or does not eat | Your explicit consent (Art. 9(2)(a) GDPR) — this can be health data or reveal religious beliefs |
| Family and groups: people's names, whether someone is a child, optionally their age (we store an approximate month of birth), what someone dislikes | How many people and who you are cooking for | Contract |
| Calorie and protein goal, what you ate today, history of dishes you cooked | Adjusting your portion if you turned the goal on | Contract; insofar as it is health data, your explicit consent |
| Pantry (what you have at home) and your own recipes with photos | Suggestions from what you have; your recipe collection | Contract |
| Photos of your ingredients (fridge, pantry, counter, shopping bag), labels and dishes while cooking | Recognising ingredients, reading nutrition labels, help while cooking | Contract |
| Speech (when you press the microphone) and the text the assistant reads aloud | Voice input and spoken answers | Contract |
| Conversations with the assistant and reports of wrong answers | Answers while you cook; fixing errors and preventing abuse | Contract; legitimate interest (keeping the service safe) |
| Technical data: IP address, time of request, number of assistant calls per day | Running the server, limiting attempts and costs, preventing abuse | Legitimate interest (Art. 6(1)(f) GDPR) |
We use no ads, no analytics and no trackers, and we do not sell your data.
Information about other people and children
When you enter another person's allergies or restrictions (a partner, a child, a guest), you do it on their behalf. Only enter them if you are their parent or guardian or they have agreed, and only what is needed for cooking. For children we process nothing beyond the name, the “child” flag, their age if you enter it, and what you enter about food; we never give children calorie advice. Age is optional and only used to adjust portions, spiciness and bite size.
How photos and speech work
- Photos of your ingredients, labels and dishes pass through our server to the AI provider and are not stored by us — they stay in memory only until the answer arrives.
- Photos of your own recipes are stored on our server because you want to see them later; members of your family see them in the app.
- Speech goes from your phone straight to Soniox (the phone receives a key valid for 60 seconds). Our server never sees or stores the audio; we only get the text back.
3. Who else processes data (processors)
| Provider | What it receives | Where |
|---|---|---|
| Anthropic, PBC (the Claude model) | Photos, text you enter, your pantry, a description of the table (names, child yes/no, age in months or years — never a date of birth, allergies, what people don't eat or dislike), your calorie goal, the conversation with the assistant. It writes suggestions, recipes and answers from these. | USA |
| Soniox, Inc. | Audio while you speak (speech recognition) and the text of answers it reads aloud | USA |
| Cloudflare, Inc. (Workers AI) | Only a short English description of a suggested dish (e.g. “chicken rice with peppers”) to draw its picture. Nothing about you. | USA and global network |
| Neoserv d.o.o. | The server that runs the app's back end and database, backups, sending emails with codes | Slovenia |
A data processing agreement applies with each of them under their business terms. Under their terms, the AI providers do not use data sent through their API to train their models and keep it only for a limited time (for security and abuse prevention).
Transfers to the USA rely on the EU-US Data Privacy Framework where the provider participates in it, and otherwise on the European Commission's standard contractual clauses (Art. 46 GDPR).
You download the app from the App Store or Google Play. Apple and Google process data in doing so as independent controllers under their own policies; we receive nothing from them that identifies you.
4. How long we keep it
- Your account and everything in it (personal data, goal, history, reports of answers): until you delete the account.
- Household (pantry, people, groups, recipes and their photos): while it has at least one member. When you delete your account, we remove your own entry (name, allergies, restrictions) from a shared household; what the others entered stays theirs. When the last member leaves, we delete the household, photos included.
- Photos of your ingredients, labels and dishes, audio: not stored by us.
- Email codes: 30 minutes. Session on your phone: 90 days from last use.
- Server logs (IP address, time): up to 30 days.
- Database backups are encrypted and deleted automatically; deleted data disappears from them within 90 days at the latest.
5. Your rights
- Access and correction: you can see and edit most data in the app (Profile). We'll send you a copy of all your data on request.
- Erasure: Profile → Delete account. Deletion is immediate and final.
- Withdrawing consent for allergies and restrictions: Profile → Privacy. Withdrawal does not affect processing before it; we then delete the allergies and restrictions you entered.
- Portability, restriction of processing, objection to processing based on legitimate interest.
- Complaint to the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si, or the authority where you live. You are welcome to write to us first — we want to sort out every issue.
We answer requests within one month. There is no automated decision-making with legal effects (Art. 22 GDPR): suggestions and recipes are suggestions, and you decide.
6. Age
You must be at least 16 to open an account. Younger people may only use the app through a parent's account.
7. Security
Connections are encrypted (HTTPS). Passwords are stored only as a hash (bcrypt) and sessions as a hashed token. The AI providers' keys stay on the server. Attempts to sign in, reset a password or join a family are rate-limited.
8. Changes
If this policy changes materially (e.g. a new processor or a new purpose), we will tell you in the app before it takes effect, and ask for your consent about allergies again.