Who is responsible (the controller)
Receta Ime is operated by its owner, a sole proprietor based in Albania. The controller of your personal data is the operator of tryrecetaime.com and the Receta Ime app. Requests reach the operator through the form on the Contact page, which works today. Send sensitive information only through that form, not to an address you cannot verify.
What we collect, and why
Waitlist: your email address, phone platform preference (Android/iPhone/both) and optional consent to launch updates, plus an irreversible HMAC hash of your IP address and browser user agent (for abuse prevention and rate limiting — never the raw address), and coarse campaign tags (utm_*) if you arrived via a link. Lawful basis: your consent (GDPR Art. 6(1)(a); Albanian Law No. 124/2024).
App accounts (iPhone app and this website): your email, display name, password (stored only as an Argon2id hash), language preference, and the consent record (terms version accepted and the time of acceptance, plus age confirmation). Lawful basis: performance of a contract (Art. 6(1)(b)). The Android build creates no account and sends no profile to us.
Recipes and saved content: the recipes you save (ingredients, steps, times, nutrition estimates you chose to keep) and cookbooks. On the Android build these live only in your device storage. On an account, they live on our server until you delete them. Lawful basis: performance of a contract; showing a post you publish on this site to other people rests on your choice to publish it.
Source links you submit (e.g. a TikTok URL): processed to fetch, cache and credit the source. We keep a link, the creator handle when visible, and the extracted recipe — never the video itself. Videos are processed in memory and discarded; nothing is stored or re-served.
Screenshots you submit for extraction: transmitted to our analysis provider for the purpose of reading them into a recipe; not retained after processing. Lawful basis: performance of a contract.
Social posts on this site: any video and poster image published to the social pages is stored on our server, handed to signed-in viewers as a short-lived signed URL, and kept until the post or the account is deleted. Deleting a post removes its files.
Security and operations: keyed hashes of IP addresses and user agents stored on the waitlist row and the request row (never the raw address), and bucketed rate-limit counters the server clears within two days. Aggregated daily AI-usage counters (units per day, no personal data) enforce a global spend cap. Lawful basis for both: legitimate interest (Art. 6(1)(f)).
We do not collect precise location, contacts, camera or microphone recordings, advertising identifiers, or health data, and the Android build asks for none of those permissions. Nutrition figures are estimates, not medical data.
Who receives it (processors and transfers)
Web hosting and database: Hostinger International Limited, and the server this site and its database actually run on is in Frankfurt am Main, Germany (EU). They store the waitlist, accounts and your saved recipes under their own data processing terms.
AI analysis: Kilo Gateway (ai-gateway.kilo.ai), which routes the content you submit for analysis (caption text, screenshots, or the video behind a link) to an AI model to produce the recipe. We send the recipe content and nothing that identifies you — no name, email or device id. Model versions are pinned in server configuration. Their own processing terms govern what they retain on their side, and, for US-based processing, the Standard Contractual Clauses cover the transfer.
Email: no marketing mail, no newsletter, no purchased or rented lists. Outbound email is switched off on this deployment — the waitlist stores your address and the queue is read directly, which is why sign-up and password reset work without a confirmation message. The only automatic mail we send is an internal alert to ourselves when the AI spend cap is hit. If we ever turn sending on, it is for the one thing you asked for: your download link, and it will carry a way to stop it.
DNS and content delivery: the domain resolves through Hostinger’s DNS and its hcdn edge network, which is what answers in front of this site. There is no separate analytics, advertising or social pixel provider in the path. Fonts, styles, scripts and images on this site are served from the site itself; nothing loads from a third party.
Crash and error reporting: none. No Sentry, Crashlytics or similar SDK ships in either app.
No selling, renting or sharing of personal data with advertisers. No cross-context behavioural advertising.
Hosting and transfers outside Albania/EEA
Your account, waitlist row and saved recipes sit on our hosting server in Frankfurt, Germany — inside the EU. Albania has no adequacy decision for the EU, so if you use the service from Albania the same protections apply by our own policy rather than by geography. The one transfer outside the EU is the analysis request: content goes to our US-based AI gateway provider, covered by that provider’s processing terms and, where required, Standard Contractual Clauses. You have the right to object to transfers and to ask for a copy of the safeguards through the form on the Contact page.
How long we keep it (retention)
Waitlist records: until you ask us to delete them. The request form on this site deletes the row on request, and any email we send from this list carries a way to stop it.
Accounts and saved recipes: until you delete the account (iPhone app: Account → Delete account, which clears the account, its recipes, sessions and tokens on our server) or until you ask us and we confirm it is you.
Android libraries: never on our server. The Android build keeps its recipes in your phone and creates no account, so removing the app removes the data.
Demo profiles: stop working 24 hours after they are created, and the row is cleared on the next server pass.
Source videos: never stored (processed in memory and discarded). Social posts on this site: until you delete the post or the account. Captions and screenshots: passed to the analysis provider during processing and not kept by us afterwards; the recipe we extract from a source is cached for up to 7 days so the same video is not re-analysed on repeat requests, then deleted with the cache.
Rate-limit counters: the server clears them within two days. Global AI-usage counters (aggregate counts only, no personal data) stay while we monitor spend. Backups: we take encrypted database dumps for disaster recovery only; a deleted row is gone from the live database at once and we do not use a backup to put it back.
Your rights
Under Albanian Law No. 124/2024 and, where applicable, the GDPR, you have the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent at any time (withdrawal does not affect earlier processing). Automated individual decision-making is not used to affect you.
Erasure: iPhone users delete the account themselves in Account → Delete account, and it is immediate — no waiting, no explanation. Everyone else uses the request form below: we carry out a deletion as soon as we read it. Portability: the same form, choosing "Send me a copy of my data" — we build one JSON file of everything we hold against your email — account, recipes, cookbooks, posts, sessions, the consents you gave, your waitlist entry and requests — and get it to you, by reply or through a link we set up for you. Both routes are free and answered within one month, which is the legal deadline.
You may lodge a complaint with the Albanian Information and Data Protection Commissioner (www.idp.al, Madrasa Nasuf 2, Tirana), or with your local EU supervisory authority if you live in the EU/EEA (the app is aimed at Albania and the Albanian/Italian/Greek/German diaspora — if you are EU-resident, GDPR applies directly to you).
Children
Receta Ime is not intended for children. The minimum age is 13, or 16 where the age of digital consent is 16 (including most of the EU/UK). We do not knowingly collect personal data from children; if we learn we did, we delete it.
Security
Passwords are hashed with Argon2id; sessions use short-lived tokens with rotation; transport is TLS-only; IP addresses are stored only as keyed hashes; uploads are size- and type-limited — a video sent for analysis is processed in memory and discarded, and a video published as a social post is written outside the web root under an opaque key and reachable only through a signed URL. Secrets stay server-side and are never shipped inside the apps. No system is perfectly secure; we will notify you and the Commissioner within 72 hours of a breach affecting you, as required.
Changes to this notice
We update this page when our practices change; the date at the top always reflects the current version. If a change is material, accounts are asked to accept the new version in the app before they carry on, and every version we publish stays in the site's source history.
Contact
The form below reaches our queue directly and gives you a reference code you can check any time — that is the route that works today, and the one we answer fastest. The addresses support@tryrecetaime.com and privacy@tryrecetaime.com are printed here for completeness, but the domain has no mail records switched on yet, so a message sent there can bounce. If yours does not arrive, send the same thing through the form; it is the same queue.
Exercising rights is always free of charge. If something feels wrong, tell us.