Privacy policy

RecipeSync is run by Langport Digital, who is responsible for your personal data (the “controller” under UK data protection law). This policy explains what we collect when you use RecipeSync, why, and what you can do about it.

For any question about your data, or to use any of your rights, contact us.

UK data protection law asks us to give a lawful basis for each use of your data. Ours are shown with each item.

Your account

Your name, email address and password. We only ever store a scrambled (hashed) version of your password. If you turn on two-factor sign-in we store its secret and recovery codes, encrypted. If you add a passkey we store its public key, which can’t be used to sign in on its own.

Why: to create your account and sign you in. Basis: our contract with you.

What you save

Recipes and their photos, source links, notes, tags and nutrition details, plus your meal plans, shopping lists, cupboard staples and settings such as units, household size and appearance.

Why: this is the service. Basis: our contract with you.

Imports

The links you paste, the text you paste and the photos you upload to import a recipe, and what we read from them. Photos are stored privately and only shown to you.

Why: to turn them into a recipe for you to check. Basis: our contract with you.

Your AI connection

Only if you add one: the provider and model you chose, your API key (encrypted, and never shown again in full) and, for self-hosted servers, its address.

Why: to send your imports and nutrition estimates to the AI you chose. Basis: our contract with you.

Security records

Your IP address and browser details, saved with each signed-in session. Server logs, which can include IP addresses, the pages requested and error details. Counters that limit how often imports, AI requests and sign-in attempts can be made.

Why: to keep accounts secure, stop abuse and fix faults. Basis: our legitimate interest in running a safe, working service.

Donations

If you support us on Ko-fi, Ko-fi tells us your name, any message, the amount, whether you’re happy for your name and message to be shown, and a transaction reference. We don’t store your email address. Names and messages are shown on our support page that month only if you said they could be public.

Why: to record and thank supporters. Basis: our legitimate interest, and our legal duty to keep financial records.

Messages to us

If you use our contact form, your name, email address, the reason you chose and your message. If you’re signed in, we note which account sent it.

Why: to reply and keep a record of what was asked. Basis: our legitimate interest in answering you, or our legal duty when it’s a data request.

Emails

We only email you about your account, such as confirming your email address or resetting your password. There’s no newsletter and no marketing.

Basis: our contract with you.

• Sell, rent or trade your data.
• Show adverts, or use advertising, analytics or tracking scripts.
• Build a profile of you, or make automated decisions that affect you.
• Share your recipes with other users. There’s no public sharing.
• Use our own AI on your recipes, or use your recipes to train any AI.

A small number of companies handle data for us, under contracts that only let them use it to provide their service to us:

Hosting

Our servers, database and stored photos are hosted by IONOS.

Email delivery

A mail delivery service sends our account emails and passes contact form messages to our inbox, so it sees email addresses and the messages’ contents.

Some others receive data because you asked us to send it, and they handle it under their own privacy policies:

Your AI provider

If you connect an AI, the recipe text, page text or photos you import, and recipes you ask to estimate nutrition for, are sent from our server to the provider you chose (such as Anthropic, OpenAI or Google) using your own API key. Your agreement with that provider decides how they use it, so check their terms. Nothing is sent to an AI unless you set one up.

Recipe websites

When you import from a link, our server fetches the page and its photo. The website sees our server’s address, not yours.

Ko-fi

Donations are taken by Ko-fi, which is responsible for your payment details under its own privacy policy. We never see them.

We’ll only share anything else if the law requires us to, for example in response to a valid court order.

Your data is stored on servers in the United Kingdom. If any of it is moved outside the UK by a company working for us, we make sure it’s protected by safeguards the UK recognises, such as an adequacy decision or the UK’s International Data Transfer Agreement.

AI providers you connect may process data in other countries, including the United States. That happens because you chose that provider, under your own agreement with them.

Your account

Until you delete it. Deleting your account removes your details and everything you’ve saved, including photos, straight away.

Deleted recipes

Hidden from you straight away, but kept with your account so past meal plans and shopping lists still make sense. They’re removed for good when you delete your account.

Imports

Uploaded photos are deleted as soon as you save the recipe or discard the import. Unfinished imports are deleted after 30 days.

Sessions

Session records, with your IP address and browser details, expire after 120 minutes without activity and are then cleared.

Server logs

Deleted after 14 days.

Messages to us

Deleted 365 days after they were sent. Closing your account doesn’t delete them sooner, as a deletion request is itself a message we need to keep a record of.

Password resets

Reset links stop working after 60 minutes.

Donations

Kept as long as the law requires us to keep financial records. Public names and messages are only shown in the month the donation was made.

• Every connection is encrypted (HTTPS).
• Passwords are hashed, and API keys and two-factor secrets are encrypted in the database.
• Photos are kept on private storage and only shown to the account that owns them. We strip hidden details, such as location, from recipe photos.
• You can protect your account with two-factor sign-in or a passkey.

No system is perfectly secure. If a breach puts your data at risk, we’ll tell you, and the Information Commissioner’s Office where the law requires it.

Under UK data protection law you can:

• get a copy of the data we hold about you, in a format you can take elsewhere
• have anything that’s wrong corrected (most of it you can edit yourself)
• have your data deleted (you can do this yourself in Settings › Profile)
• object to, or ask us to restrict, how we use your data

To use any of these rights, send us a message through our contact form. We’ll reply within one month. It’s free.

If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

If we change this policy, we’ll update the date at the top. If a change affects how we use data you’ve already given us, we’ll tell you by email or in the app before it takes effect.

How we use cookies is explained in our cookie policy.