Privacy Policy

1. Who is responsible

The data controller is Luiz Gabriel Rebelatto, developer of Cozziny. For any privacy matter, including exercising your rights, contact us at lbrebelatto@gmail.com. This is also our channel for data subjects.

2. Summary

• To use the app, you sign in with Apple or Google. Your recipes, folders, recipe photos and preferences are kept on your device and in your account, so you don’t lose them when you change devices.
• The artificial intelligence (OpenAI) features require a Cozziny Pro subscription. Photos, links, ingredients and preferences are sent to it only after you allow it, and only when you ask for a recipe, for a photo to be read or for a link to be imported.
• The subscription is paid through the App Store or Google Play: we never receive your card details. RevenueCat, our subscription management provider, records whether it is active.
• We don’t sell data, show ads or track you across apps or websites.
• You can delete the account and everything in it at any time inside the app.

3. Data we process

a) Data stored on your device:

• the name or nickname you enter (optional);
• ingredients, meal preferences, allergies and dietary restrictions (such as lactose, gluten, peanuts or shellfish, and other foods you type in), servings, measurement units and language;
• generated or scanned recipes, folders and the photos of scanned recipes you save.

b) Account data (signing in with Apple or Google is required): account identifier, email and name, depending on what Apple or Google sends. Google also sends your profile photo address, which is recorded with the account but not used by the app. With Apple, you can hide your email, in which case we receive an Apple relay address. With an account we also keep your library in our database (Supabase): recipes, folders, recipe photos, name, servings, units, meal preferences, dietary restrictions and your choice about using the AI. The app language stays on the device only.

c) Data sent to build and import recipes, only when you use these features and after you allow it: the photos you choose (of ingredients or of recipes on paper), the recipe links and text you import or share with the app (and, when a video’s caption doesn’t include the recipe, that video’s audio, which our server downloads from the link to transcribe it), the ingredient list and amounts, preferences, dietary restrictions, number of servings, units, language and the titles of earlier suggestions, so dishes aren’t repeated. Your name and email are not sent.

d) Subscription data: your account identifier in the app, the plan you subscribed to, the start, free trial, renewal, cancellation and expiration dates, the purchase history and receipts sent by the store, country, currency and price, plus device data such as model, operating system, app version and IP address. RevenueCat processes this data to unlock Cozziny Pro, restore purchases and prevent fraud. Payment is handled by Apple or Google: we never receive card numbers or bank details.

e) Technical data: when the app talks to our servers, the hosting and authentication providers automatically log data such as IP address, date and time and device type, for security and operation.

Allergies and dietary restrictions may reveal information about your health. They are used only to adapt recipes, with your consent, and you decide whether to provide them.

4. Why we use the data and on what legal basis

• Building recipes, recognizing ingredients in photos and transcribing recipes: based on your consent, requested on first use.
• Creating and keeping your account, letting you sign in and keeping your library in it: to provide the service you asked for.
• Managing the subscription and the free trial, unlocking Cozziny Pro features and restoring purchases: to perform the subscription contract.
• Security, abuse prevention and bug fixing: based on our legitimate interest, using technical data only.
• Complying with legal obligations, when applicable.

We don’t use your data for advertising, marketing profiles or to train artificial intelligence models.

5. Who we share data with

We share data only with the providers the app needs to work, each for its own purpose:

• OpenAI (artificial intelligence): receives the data in 3(c) to build the recipe or read the photo. We configure requests so responses are not stored at OpenAI. Under OpenAI’s business policies, data sent through the API is not used to train models by default and may be kept for a limited period to monitor abuse. Policy: https://openai.com/policies/privacy-policy
• Supabase (authentication, database and photo storage): keeps the account data and the library in 3(b). Policy: https://supabase.com/privacy
• Render (hosting of the app’s server): forwards requests to OpenAI and Supabase without storing photos, audio or ingredients, and logs the technical data in 3(e). Policy: https://render.com/privacy
• RevenueCat (subscription management): receives the data in 3(d) to know whether Cozziny Pro is active and to restore purchases. Policy: https://www.revenuecat.com/privacy
• Apple: processes sign-in data and, on iPhone, the subscription payment through the App Store, under its own policy, which you accept when using your Apple account. Policy: https://www.apple.com/legal/privacy/
• Google: processes sign-in data, if you sign in with Google, and, on Android, the subscription payment through Google Play, under its own policy, which you accept when using your Google account. Policy: https://policies.google.com/privacy

We may also share data if required by law or by an order from a competent authority. We don’t sell or rent personal data.

6. International transfers

OpenAI, Supabase, Render and RevenueCat may process data on servers outside Brazil, mainly in the United States. These transfers follow article 33 of the LGPD and are made to providers that adopt contractual clauses and security measures consistent with the law.

7. Device permissions

• Camera: used only when you tap to photograph ingredients or scan a recipe.
• Photos: we only access the image you pick from your library.

The app doesn’t use the microphone, location, contacts or advertising identifiers. You can change permissions at any time in your device settings.

8. How long we keep data

• Data on the device: until you delete it, use "Delete account" in Profile, sign out or uninstall the app.
• Library in your account (recipes, folders, photos and preferences): until you delete each item in the app or delete the account.
• Account: while it exists. When you delete your account in the app, it is removed together with the stored library and photos, and the access granted through Apple is revoked. If you signed in with Google, you can also remove Cozziny’s access at myaccount.google.com, under Security → Third-party apps and services.
• Data sent to the AI: not kept on our servers. At OpenAI it follows the limited period described in section 5.
• Subscription data: for as long as needed to manage the subscription and meet legal and tax obligations. To ask for its deletion, contact us as described in section 1.
• Technical data: for the period set by the providers for security and as required by law.

9. Your rights

Under the LGPD you can ask for confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about who we share it with, and withdraw your consent. Inside the app you can already:

• turn off sending data to the AI in Profile → "Use OpenAI’s AI";
• delete your account in Profile → "Delete account";
• see and manage your subscription in Profile → "Manage subscription";
• edit or delete recipes, folders, ingredients and preferences.

For other requests, write to us at lbrebelatto@gmail.com. We reply within 15 days. You may also complain to Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd, or to the authority in your country.

10. Children and teenagers

Cozziny is not directed to children under 13 and does not knowingly collect their data. Teenagers should use the app with their guardians’ knowledge. If you believe a child has sent us data, contact us and we will delete it.

11. Security

All communication with our servers is encrypted (HTTPS). The OpenAI access key stays on the server, never inside the app. Each account can only read and change its own data, and photos are kept in private storage, reachable only through temporary links. Your sign-in session is stored on the device and refreshed automatically. No system is completely immune to failure: if a relevant security incident happens, we will notify you and the ANPD as the law requires.

12. Changes to this policy

We may update this policy when the app changes. The date at the top shows the version in force. If a change is significant, such as a new type of data or a new provider, we will tell you in the app and, when the law requires, ask for your consent again.