Legal

Privacy policy

Version 4.14 · as of 8 October 2026 · Effective from 8 October 2026

The German version is legally binding. This English version is a translation provided for information.

Binding version

The German version is authoritative; the English version is a translation provided for information. Version 4.14, effective from 8 October 2026.

In brief

Tellersonne is a cooking and recipe app. We process only the data the app needs and never pass it on for advertising. There are no advertising IDs, no tracking components and no profile across apps or websites. You can read recipes without an account. You can export your data at any time and delete your account in the app.

Controller

The controller for the processing of your personal data is Tim Hauke (brand: Tellersonne), Albert-Schweitzer-Ring 42, 25524 Itzehoe, Deutschland. Legal form: sole proprietorship. Owner: Tim Hauke. You can reach us by e-mail at support@tellersonne.app, by phone at 015751578216. All provider details are in the legal notice: https://tellersonne.app/en/imprint.

Contact for data protection matters

Please send questions about data protection and requests for access, rectification or erasure to privacy@tellersonne.app. Postal mail to the address above works just as well. We answer as quickly as we can and within one month at the latest (Art. 12 (3) GDPR); in exceptional cases we may extend that period by two months and will tell you so with reasons.

Data protection officer

We have not appointed a data protection officer because we are not required to: we do not have at least 20 people permanently occupied with the automated processing of personal data (Section 38 (1) of the German Federal Data Protection Act), our core activity consists neither of regular and systematic monitoring on a large scale nor of large-scale processing of special categories of personal data (Art. 37 (1) GDPR), and we carry out no processing that mandatorily requires a data protection impact assessment. We answer your data protection questions directly at privacy@tellersonne.app.

How this policy is organised

For every purpose we tell you which data we process, on which legal basis, how long we keep it and who receives it besides us. Wherever we ask for your consent, you can withdraw it at any time with effect for the future, as easily as you gave it. Processing that took place before the withdrawal remains lawful.

Do you have to give us data?

You are not obliged to give us personal data; there is neither a statutory nor a contractual requirement to do so. Without certain details, however, certain parts do not work: without an e-mail address we cannot create an account or sign you in, without a display name you cannot publish anything in the community, and without consent to process your allergy details the allergy filter stays off. You can read, search, cook and plan recipes in guest mode without providing anything at all (Art. 13 (2) (e) GDPR).

Account and sign-in

For an account we process your e-mail address, your display name, the sign-in method, the platform you registered on, your confirmation of the minimum age, the versions of the legal texts you accepted and the time of your last visit. If you sign in with a password we store only a hash, never the password itself. Every session carries a session token, the IP address and the identifier of your device or browser (user agent); this lets us show you your signed-in devices and trace misuse. The legal basis is the performance of our contract with you (Art. 6 (1) (b) GDPR) and, for the session data, our legitimate interest in secure sign-ins (Art. 6 (1) (f) GDPR). Sessions expire after 60 days at the latest, and account data is deleted together with your account.

Sign-in by code or magic link

If you sign in with a six-digit code or a magic link, we create a short-lived confirmation value and send it to your e-mail address. It is valid for a few minutes only and is deleted afterwards. The legal basis is Art. 6 (1) (b) GDPR. The e-mail is sent by our e-mail provider (see "Processors and other recipients").

Sign in with Apple or Google

If you use Sign in with Apple or sign in with Google, we receive a stable user identifier, your e-mail address (with Apple optionally as an anonymised relay address) and, if you agree, your name. We receive nothing else. Apple and Google are themselves responsible for their own sign-in services, where their privacy policies apply. The legal basis for the processing on our side is Art. 6 (1) (b) GDPR. Apple also sends us events about your Apple account (revoking the sign-in, deleting the Apple account, switching the relay address on and off); we store the identifier of such an event for 90 days so that the same event is not processed twice. When you delete your account we also revoke the Apple token so the link ends on Apple's side as well.

Without an account (guest mode)

You can read, search, cook and plan recipes without signing in. Your settings then stay on your device. For filtering we send details such as your diet or allergens only as search parameters to our server; we do not store them there.

Profile and onboarding

During onboarding we ask about your diet, dislikes, usual number of servings, time budget, cooking experience and display preferences. You can skip every question. With an account we store your answers in your profile so the app can show you suitable recipes and convert quantities correctly. The legal basis is Art. 6 (1) (b) GDPR. We delete the answers as soon as you reset them, and with your account at the latest.

Allergies and intolerances

We treat information about allergies and intolerances as health data within the meaning of Art. 9 GDPR. We process it solely on the basis of your explicit consent (Art. 9 (2) (a) in conjunction with Art. 6 (1) (a) GDPR) and for one purpose only: to filter and flag recipes containing those ingredients. We do not analyse it further, do not pass it on and never use it for advertising. We ask for this consent separately before you store the information; without it our server does not accept any allergens at all. You can withdraw it at any time in the app under Profile - the withdrawal deletes the information immediately and switches the profile filter off. Without this consent you can use Tellersonne in full; only the allergy filter stays off, and you suffer no other disadvantage. Without an account the information stays on your device. We only share your allergies with your household if you additionally and separately allow it explicitly (Art. 9 (2) (a) GDPR): the other members of your current household then see them, and their meal plan warns when a planned recipe contains one of them. This consent only applies to the household you give it for. It ends automatically when you leave the household, are removed or someone new joins - we then ask you again - and also when you withdraw your consent to storing allergies. You can withdraw it at any time in the household or under Profile, Privacy; without it only your own meal plan warns you. We record the grant and the withdrawal with the time, the source, the version of this policy and the household concerned. Our team never sees your allergies, only whether the consent exists.

Evidence of your consents

We record every consent and every withdrawal in a running log together with the kind of consent, the time, the source (app, web) and the version of the legal text concerned. Art. 7 (1) GDPR requires this of us - we have to be able to demonstrate that consent was given. The legal basis is Art. 6 (1) (c) GDPR. The log is part of your data export in full and is deleted with your account.

Saved recipes, collections, weekly plan and shopping list

We store which recipes you saved, which collections you create, your weekly plan, your shopping lists, your notes, your cooking history and your saved search filters. For the household we also store the ingredients you mark as "always at home" and your shops with the order of their aisles. This data is private: our team cannot see it in the admin area. The legal basis is Art. 6 (1) (b) GDPR. We keep it until you delete it or delete your account. Changes you make without a connection are queued briefly, and the stored response is deleted after seven days.

Household and live sync

If you start a household or join one through an invitation link, all members can see the shared weekly plan, the shopping lists and the display names of the members. Changes are pushed to all devices in the household over a live connection, together with the display name of the person who made the change. The legal basis is Art. 6 (1) (b) GDPR. You can leave the household at any time; data created jointly stays with the household. Invitation links expire and can be withdrawn.

Sharing a shopping list by link

You can share a shopping list through a link, for example with someone who does the shopping for you. The link contains a random key that cannot be guessed and only works for as long as you choose (1 to 14 days); you can end it earlier at any time. Anyone with the link sees only this one list with its items, amounts and aisles in their browser and can tick items off - without an account and without the app. Names, the household, the meal plan and other lists are not visible through it. Ticks made through the link show up for you right away, without a name. To prevent misuse we limit the requests per IP address (see "Security, limits and logs"). The legal basis is Art. 6 (1) (b) GDPR; you decide who gets the link. We delete expired links by the following day at the latest.

Subscribing to the meal plan in your calendar

If you want, the app creates a personal calendar link that you subscribe to in your calendar app. Your calendar then shows the recipes of your meal plan - two weeks back to eight weeks ahead - as all-day events with servings and a link to the recipe. This is read-only: Tellersonne gets no access to your calendar, and no names from the household are included. The link contains a random key that cannot be guessed. Your calendar provider (for example Apple, Google or Microsoft) fetches it regularly and receives these events in doing so; it is responsible for its own processing. The legal basis is Art. 6 (1) (b) GDPR. You can replace the link with a new one or end it at any time; while your account is locked, during the deletion period and after deletion it delivers nothing.

Your own recipes and your own photos

Your own recipes and their photos are private unless you share them within your household. When you upload a picture we remove the capture metadata (EXIF), for example location, time and camera details. The legal basis is Art. 6 (1) (b) GDPR. Uploaded images that you do not attach to a recipe are deleted automatically after 24 hours; everything else goes with the recipe or with your account. If you share an own recipe with your household, its photo is checked automatically first (see "Automatic checking of photos and texts").

Community: ratings, comments and cooked photos

When you rate, comment or share a cooked photo, your display name, your contribution, the time and, for photos, the caption and the image description are publicly visible under the recipe, including on our public recipe pages on the web. That means these details can be retrieved worldwide and picked up by search engines. You decide what you show and under which name; there are no public profile pages. The legal basis is Art. 6 (1) (b) GDPR. Contributions stay visible until you delete them; what happens to them after an account deletion is described further down. Our community rules apply in addition: https://tellersonne.app/en/community-guidelines.

Ratings: authenticity and order

Only people with an account who are signed in can give a star rating; exactly one rating per account and recipe counts, and you can change it at any time. We do not buy, commission, alter or suppress ratings, and we never hide negative ones. We do not, however, verify that a person actually cooked a recipe - the average shown therefore rests solely on the fact that each rating comes from exactly one signed-in account. The order of search results is determined by matches in the title, the ingredients and the tags and by the sorting you choose (relevance, newest, quickest, popular, rating); there are no paid placements. The legal basis for showing them is Art. 6 (1) (b) GDPR and, for this transparency statement, Art. 6 (1) (c) GDPR in conjunction with Section 5b of the German Act against Unfair Competition.

Reporting, blocking and moderation

You can report contributions and block individual accounts. For a report we store the reported contribution, the reason, your optional explanation and your account so that we can ask questions and tell you the outcome. A block is private: it only appears in your own list, the other person is not told about it, and we hide their contributions from you. For every restriction of a contribution we store a statement of reasons so you can read it and lodge a complaint; the procedure is described at https://tellersonne.app/en/dsa. The legal bases are Art. 6 (1) (c) GDPR (obligations under the Digital Services Act) and Art. 6 (1) (f) GDPR (legitimate interest in a safe community). We keep reports, statements of reasons and complaints as evidence of our decisions for 365 days after the case is closed and delete or anonymise them afterwards; after an account deletion they are kept without any link to you until then.

Reports without an account and protection against misuse

Anyone can report illegal content on our recipe pages on the web, with or without an account. We then process your explanation, the location of the content, your name and your e-mail address, and the declaration that your statements are accurate to the best of your knowledge. The legal basis is Art. 6 (1) (c) GDPR (Article 16 of the Digital Services Act). To keep machines from misusing the form we count reports per IP address and use Cloudflare Turnstile, which transmits a verification value together with your IP address to Cloudflare. Turnstile sets no advertising cookies and builds no profile across websites. We delete the reply address of a resolved report 90 days after the decision and keep the report itself without the address for our statistics.

Automatic checking of photos and texts

Every photo you post to the community or share with your household is checked automatically before it is published. To do so we send the image to a vision model at Cloudflare (Workers AI) and, if that is unavailable or the result is unclear, to our external AI provider. All that comes back are categories such as "not safe for work", "violence" or "not food" plus a confidence value. If the result is clearly harmless your photo appears; if it is clearly not permitted we do not publish it and send you a statement of reasons; in every other case a person from our team decides, and until then only you can see the photo. Comments additionally pass a pre-filter made of fixed rules without any AI (for example advertising and insults); it can only hide a contribution provisionally until a person has decided. The providers do not use your photos and texts to train their models. The legal bases are Art. 6 (1) (c) GDPR (Articles 16 and 17 of the Digital Services Act, protection of minors) and Art. 6 (1) (f) GDPR (protecting the community from illegal content). We store the result of the check with the contribution; more about this is in the AI transparency notice: https://tellersonne.app/en/ai-transparency.

Automatic translation of your texts

So that comments, captions, image descriptions, shared collection and household names, free-text shopping list entries, support messages, reports and complaints can be read in both app languages, we translate them automatically where needed. The text is then sent to our external AI provider or to Cloudflare (Workers AI). Translation only happens when somebody reads the text in the other language, not when you write it. Before the call we replace e-mail addresses, links and token-like strings with placeholders. We determine the language of a text first with a simple method that uses no AI; if it stays unclear and the text is long enough, we ask our external AI provider for that as well. We cache translations for up to 90 days so the same text is not translated twice and delete them afterwards. The providers do not use the texts to train their models. Your original is kept and can be opened with "Show original"; machine translations are labelled as such. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a community that is understandable in both languages); the basis for displaying your contribution remains Art. 6 (1) (b) GDPR.

Read-aloud and voice control in cooking mode

In cooking mode the app can read the current step aloud and react to spoken commands such as "next", "back" or "timer". Reading aloud is done by the speech output of your operating system. For voice control the app asks beforehand for your permission to use the microphone and speech recognition; without that permission the feature stays off and you operate cooking mode with buttons as usual. Speech recognition itself runs through Apple or Google - depending on the device, the language and the device settings either on the device or on their servers. Apple and Google act as independent controllers for this, and their privacy terms apply. Neither audio recordings nor full texts reach Tellersonne: the app only checks whether a recognised word matches one of the few cooking commands and discards everything else immediately. We store none of it and send nothing to our servers. The legal basis for using the feature is Art. 6 (1) (b) GDPR, and for access to the microphone and speech recognition your permission on the device (Art. 6 (1) (a) GDPR).

Voice input for the shopping list

You can also say shopping list items, for example "milk, eggs and butter". As in cooking mode, the app first asks for permission to use the microphone and speech recognition, and Apple or Google handle the recognition as independent controllers. No audio recordings reach Tellersonne, only the recognised text: the app splits it into items on your device and shows them to you before anything goes on the list. With a connection it sends only the names of these items to our server so we can match them to ingredients in our database; we do not store this request. Whatever you add becomes an ordinary list item. The legal bases are the same as in cooking mode.

Notifications and push messages

We send push messages only if you allow them on your device. For that we store a push token, a random device identifier, the platform and the time the device last checked in. We distinguish two kinds: service notifications concern your account and your use of the app, for example reminders about the weekly plan, timers, replies from support or statements of reasons for moderation decisions. Promotional notifications, for example news about new themes or offers, are only sent with your separate consent, which is not given by default. Without an account your device stays out of promotional campaigns unless it says otherwise. You can switch both on and off individually in the app under Profile and Notifications. So that daily notifications arrive at the time you chose and nights stay quiet, the app stores your device's time zone with your account (for example Europe/Berlin); without an account we store the time zone with the device's push token, together with whether you want the recipe of the day. When you sign in, we remove the time zone from the token again and the one of your account applies. The legal basis is Art. 6 (1) (b) GDPR for service notifications and Art. 6 (1) (a) GDPR for promotional ones. Sending is handled by Expo; delivery runs through Apple (APNs) and Google (Firebase Cloud Messaging). Without an account we store your answer about promotional notifications, with the time and the version of this policy, with the push token of your device; it disappears together with the token. We delete delivery logs after 35 days and push tokens after 270 days without a sign of life from the device.

Inbox in the app

We also place important messages in your inbox inside the app: replies from support and to your comments, statements of reasons for moderation decisions, notices about your account, changes in your household and announcements. That way you find them even if you have not allowed push messages. The legal basis is Art. 6 (1) (b) GDPR and, for mandatory notices, Art. 6 (1) (c) GDPR.

Support, feedback and error reports

If you write to us through the app or by e-mail, we process your message, your display name or the label "guest", your contact address, the recipe concerned and technical details about the app version and device in order to reply. If you write without an account, you can choose to give an e-mail address for the reply; we use it only for that and delete it 30 days after your request is closed. With an account, the reply reaches you in the inbox of the app. The legal basis is Art. 6 (1) (b) GDPR and, for enquiries without an account, Art. 6 (1) (f) GDPR (legitimate interest in looking after you properly). We delete or anonymise closed cases 365 days after your request is closed. Help and contact details are at https://tellersonne.app/en/help or support@tellersonne.app.

Crash reports from the app

Only with your consent do we send crash and error reports from the app to Sentry (Functional Software, Inc.); we use the EU region (de.sentry.io) for this. A report contains the error trace, the app version and channel, the device model and operating system version, the screens opened last and, if you are signed in, your internal account identifier. With the same consent we measure, for a share of app starts and screen changes, how long the start, the screens and the requests to our API take and whether the display stutters (performance data: timings, the names of the screens and the addresses of our API without parameters). We do not send e-mail addresses, names, IP addresses, screenshots or session recordings; detected tokens, addresses and inputs are removed before sending. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Consent is not given by default; you give or refuse it in the app and can change it at any time under Profile, Privacy, "Send crash reports". Without consent, error reporting does not even start. Because we store your answer with your account, it applies on all of your devices. Sentry deletes the reports after the retention period agreed with us.

Error logs of our servers

Independently of that, our own systems - the API, the recipe pages on the web and the admin panel - log unexpected errors, and for a share of the calls they measure how long a request or a page view takes and whether it succeeds (performance data). This data also runs at Sentry in the EU region, in three projects separate from the app. It contains timings, the pattern of the address called (such as "/recipe/:slug" instead of the actual address) and the outcome, but no cookies, no request bodies and no values from address bars; e-mail addresses and token-like strings are replaced before sending. If you are signed in, your requests to our API also carry a pseudonymous identifier: a checksum of your account identifier formed with a secret key, from which neither your account nor your e-mail address can be read. It only serves to count how many people are affected by errors. Visits to the website carry no identifier: the website sets no cookies for this and loads no script from Sentry. Because these are logs of our own operations and not access to your device, we need no consent for them. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a service that runs, is fast and is secure).

Anonymous statistics without cookies

We count in aggregate which recipes are opened and which terms are searched for, and how many days an account was active (for 35 days at most). On the public recipe pages we count page views without cookies: from the IP address and a secret addition we build a hash that lives for only 30 minutes and serves solely to avoid counting twice. We do not combine these numbers with your account. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in knowing which content is needed). You can object to this processing under Art. 21 GDPR; please write to privacy@tellersonne.app.

Security, limits and logs

To fend off misuse, spam and automated attacks we count requests per account or IP address. We do not store these in clear text but as a salted hash that we delete as soon as its counting window has ended – after 25 hours at the latest. Our host Cloudflare processes the technically necessary connection data while delivering each request. In the admin area we log every change made by our team with person, time and action and keep this log for 1095 days (the regular limitation period of Section 195 of the German Civil Code). The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure and stable service) and, for the logs, Art. 6 (1) (c) in conjunction with Art. 5 (2) GDPR. You can object to this processing as well under Art. 21 GDPR. Please report security vulnerabilities to security@tellersonne.app; how to do so is described at https://tellersonne.app/.well-known/security.txt.

Tellersonne Plus and purchases

Tellersonne Plus cannot currently be purchased, and for as long as that is the case we process no purchase data. Once we switch Plus on, the following applies: Apple or Google handle the purchase; we receive no payment data and no card numbers. We use RevenueCat to manage subscriptions. It holds your internal account identifier, the purchase receipt, the product, country and currency, the status and the expiry date. We do not pass on device identifiers, and the component's diagnostics feature is switched off. On our side we store only your entitlement status and the events of the service; we delete the latter after 90 days. The legal basis is Art. 6 (1) (b) GDPR and, for tax records, Art. 6 (1) (c) GDPR in conjunction with Section 147 of the German Fiscal Code. If you delete your account we also delete your customer record at RevenueCat; purchase receipts held by Apple and Google are subject to their retention periods. We answer billing questions at billing@tellersonne.app.

Sending e-mail

Sign-in codes, magic links, confirmations, support replies and mandatory notices are sent through Cloudflare Email Service (Cloudflare, Inc.). Your e-mail address and the content of the message are processed in the course of this. Only if sending through Cloudflare fails - for example during an outage or once a sending limit is reached - do we send the same e-mail through Resend (Plus Five Five, Inc., USA) instead; Resend then processes the same details. Addresses that Cloudflare or our suppression list refuse are never passed on to Resend. System e-mails come from no-reply@tellersonne.app, replies from our team from the address that fits your request (such as support@tellersonne.app, privacy@tellersonne.app or accessibility@tellersonne.app). If you reply to one of our e-mails, your reply reaches that address, for system e-mails support@tellersonne.app. So that no e-mail is lost or arrives twice, we keep a sending log with the address, type, sender, status and times; we delete the content from it as soon as Cloudflare or Resend has accepted the e-mail, and note which of the two services took it. Cloudflare then tells us whether the e-mail was delivered, delayed, rejected or reported as spam, and we note this in the sending log. Cloudflare itself logs every e-mail sent (sender, recipient, subject, delivery status) and keeps its own suppression list for undeliverable addresses and spam reports; for us Cloudflare stores no preview with the content of the e-mails. Resend likewise logs the e-mails it sent for us (sender, recipient, subject, delivery status); we do not evaluate delivery reports from Resend. If an address is permanently undeliverable or one of our e-mails was reported as spam, we put it on a suppression list - stored as a checksum of the address with a shortened hint (such as j***@example.org), never in clear text. We then send nothing more to an undeliverable address and tell you so when you sign in; after a spam report only e-mails that are not necessary stop. We lift the suppression at your request after a check. We do not record whether or when you open an e-mail or click a link in it. The legal basis is Art. 6 (1) (b) GDPR, for mandatory notices Art. 6 (1) (c) GDPR, and for delivery reports and the suppression list Art. 6 (1) (f) GDPR (legitimate interest in reliable delivery and in not sending unwanted e-mail). We send promotional e-mail only as the newsletter and only with your consent (next section).

Newsletter "Recipe of the week"

If you order the newsletter - on the web or in the app - we send you one recipe from our editorial team by e-mail once a week. For this we process your e-mail address and the language you chose. We use the double opt-in procedure: after signing up you receive an e-mail with a confirmation link, and you only get the newsletter once you open it. As evidence of your consent (Art. 7 (1) GDPR, Section 7 (2) UWG) we store the time of the sign-up and of the confirmation, the version of the consent wording and of this policy, whether you signed up on the web or in the app, and a checksum of your IP address at sign-up and at confirmation, never the IP address itself. The legal basis is your consent (Art. 6 (1) (a) GDPR), for the evidence Art. 6 (1) (c) GDPR. You can withdraw your consent at any time: with the unsubscribe link in every issue (one click is enough), in the app under Profile, Settings, Notifications, or by e-mail to privacy@tellersonne.app. Sending works through Cloudflare Email Service as described above; we do not record opens or clicks for the newsletter either. To keep machines from misusing the sign-up form on the web we use Cloudflare Turnstile there, which transmits a verification value together with your IP address to Cloudflare. We delete a sign-up that is not confirmed after seven days. After you unsubscribe we keep the address and the evidence for three years so that we can show that the earlier issues were wanted, and then delete them. The subscription belongs to the address, not to the account: if you delete your account, the newsletter continues until you unsubscribe.

Beta test

For test rounds before the launch you can sign up as a beta tester on our website. We then process your e-mail address, the platform you want to test on, optionally your name for addressing you and a short note, the language of the form and the times of sign-up, confirmation and decision. A sign-up you never confirm through the link in our e-mail is deleted 7 days after the link expired. If we accept you, we enter your address as a tester at Apple (TestFlight) or Google Play, where their privacy policies apply. Against misuse we count sign-ups per IP address as a hash and use Cloudflare Turnstile. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you give in the form and can withdraw at any time by e-mail to privacy@tellersonne.app; we then delete your sign-up straight away. Otherwise we delete it 90 days after the test round has ended.

Our profiles on social networks

We have profiles on Pinterest, TikTok, YouTube and Facebook and may run a WhatsApp channel. On our website and in the app we link to them with plain links only: no content, scripts or cookies of these networks are loaded, and no data flows to them unless you tap one of the links. If you visit one of our profiles, follow it or interact with us there (for example with a comment, a reaction or a message), the operator of the network processes your data under its own terms and privacy policy, also for its own purposes such as advertising; we have no influence on that. We ourselves see what you share with us there (name or user name, profile picture, comments, reactions, messages to us), and the operators give us only aggregated statistics about the use of our profiles that we cannot link to any person. We use this to communicate with you and to improve our posts. The legal basis is our legitimate interest in presenting Tellersonne there and in exchanging with interested people (Art. 6 (1) (f) GDPR). What you write there publicly stays until you or we delete it or the profile is closed. For the statistics of our Facebook page (Page Insights) we are joint controllers with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (Art. 26 GDPR). Meta provides the agreement on this, the Page Insights Controller Addendum, at https://www.facebook.com/legal/terms/page_controller_addendum; under it Meta takes primary responsibility for the Insights data and for fulfilling your rights regarding it. You can address requests to Meta or to us; we forward them where necessary. The operators and their privacy notices: Pinterest Europe Ltd., Ireland (https://policy.pinterest.com/en/privacy-policy); TikTok Technology Limited, Ireland (https://www.tiktok.com/legal/privacy-policy-eea); Google Ireland Limited for YouTube (https://policies.google.com/privacy); Meta Platforms Ireland Limited for Facebook (https://www.facebook.com/privacy/policy); WhatsApp Ireland Limited for the WhatsApp channel (https://www.whatsapp.com/legal/privacy-policy-eea). They may also transfer data to third countries such as the United States. If you follow our WhatsApp channel, neither we nor other followers see your phone number. You can exercise your rights with us and with the operator concerned.

Backups and operational logs

So that nothing is lost after a fault, our database at Cloudflare can be reset to any point in time of the last 30 days. In addition we take encrypted backups (AES-256-GCM), of which we keep only the eight newest. What you delete, or what is deleted after a period, disappears from these copies only when they expire; until then we use them solely to restore the service after an outage, and after a restore we delete again everything that had been deleted since the state of the copy. Our servers log only the time, type, route, status and duration of each request, without the IP address and without the account; Cloudflare deletes these logs after 7 days. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a reliable service) in conjunction with Art. 32 (1) (c) GDPR.

Processors and other recipients

We pass data on only where it is necessary to run the service. With every provider that processes data for us we conclude a data processing agreement under Art. 28 GDPR. - Cloudflare, Inc. with Cloudflare Germany GmbH: hosting, database, media storage, sending and routing our e-mails, the Turnstile spam protection and the automatic image check and translation with Workers AI. The database and media storage are located in Western Europe. - Resend (Plus Five Five, Inc.): fallback route for sending e-mail, only if sending through Cloudflare fails (e-mail address and content of the message). - Expo (650 Industries, Inc.): building and updating the app and sending push messages (token and message text); an installation identifier is transmitted when the app checks for updates. - Apple (Apple Distribution International Ltd and Apple Inc.): Sign in with Apple, push delivery via APNs, speech recognition in cooking mode and for the shopping list, and purchases through the App Store. Apple acts as an independent controller here. - Google (Google Ireland Ltd and Google LLC): Firebase Cloud Messaging for push on Android, speech recognition in cooking mode and for the shopping list, purchases through Google Play and, where enabled, signing in with Google. Google acts as an independent controller here. - RevenueCat, Inc.: management of subscriptions. - Sentry (Functional Software, Inc.), EU region: crash reports and performance data from the app only with your consent, and error logs and performance data of our servers, there with a pseudonymous identifier at most. - OpenAI Ireland Ltd, Dublin, Ireland, with OpenAI OpCo, LLC in the United States as a sub-processor: our external AI provider for reviewing unclear photos, automatic translation, language detection and AI drafts for our editorial team. No models are trained with this data. - GitHub (GitHub, Inc.): development and deployment of our source code. No user data is stored there. Authorities and courts receive data only where we are legally obliged to provide it or a valid order exists. Data is never sold or passed on for advertising.

Transfers to third countries

Some providers are based in the United States or process there as sub-processors: Cloudflare (for worldwide delivery; the database and media storage stay in Western Europe), Expo, RevenueCat, Sentry, Resend (only as the fallback route for sending e-mail), GitHub, our external AI provider (sub-processing in the United States) as well as Apple and Google. We base these transfers on the adequacy decision of the European Commission for the EU-US Data Privacy Framework, where the recipient is certified under it, and additionally on the standard contractual clauses of the European Commission pursuant to Art. 46 (2) (c) GDPR together with supplementary safeguards. You can request a copy of the safeguards at privacy@tellersonne.app. Even with these safeguards it cannot be entirely ruled out that authorities in third countries access data, and you may have fewer remedies against that there than in the EU.

Storing and reading information on your device

The app stores information on your device and reads it again. Strictly necessary and therefore possible without consent under Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) are: the session token, your app settings, the offline store of recipes, the queue for changes made without a connection and - once you have allowed notifications - the push token. For crash reports we obtain your consent under Section 25 (1) TDDDG, because information about your device is read for them; your answer itself is kept in a small file on the device so that it is known before the first network call. When checking for app updates, Expo transmits an installation identifier of your device; it belongs to the delivery of the app and is not used to recognise you. Our public recipe pages set no cookies and load no third-party scripts or fonts. Only the forms for reporting content, for the beta sign-up and for the newsletter load the Cloudflare Turnstile spam check from Cloudflare (see the sections on these forms).

How long we keep what

We delete personal data as soon as its purpose no longer applies, following fixed periods: - Account, profile, collections, plans, lists, notes, own recipes: until you delete them, at the latest with the account. - Link of a shared shopping list: until the end you chose (14 days at most) or until you end it; we then delete it by the following day at the latest. - Calendar link of the meal plan: until you end or replace it, at the latest with the account. - Sessions: 60 days; sign-in codes and sign-in links: 15 minutes at most; stored responses of the offline queue: 7 days. - Push delivery logs: 35 days; push tokens without a sign of life: 270 days. - Usage counters for the anonymous statistics: 35 days at most; hashes for rate limits: until their counting window ends, 25 hours at most; hashes of the page count: 60 minutes at most. - Translation cache: 90 days without access. - Uploaded photos not attached to a recipe: 24 hours. - Reply address of a resolved report without an account: 90 days after the decision. - Reply address of a support message without an account: 30 days after the request is closed. - Sending log of e-mails (address, type, sender, status, delivery report, no content) and Cloudflare's delivery reports: 30 days; the sending log at Cloudflare: 31 days; the sending log at Resend for the e-mails Resend sent instead: according to the period of the Resend plan we use. - Suppression list for undeliverable addresses and spam reports (checksum and shortened hint): 365 days after the last event. - Newsletter: unconfirmed sign-ups 7 days; after unsubscribing, the address and the evidence of consent 1095 days (three years). - Events from Apple and RevenueCat: 90 days; completed clean-up tasks after an account deletion: 90 days. - Crash reports, error logs and performance data at Sentry: 30 days. - Beta sign-ups: if never confirmed, 7 days after the link expired, otherwise 90 days after the test round ended. - Account after a deletion request: 14 days, then final deletion. - Backups: restore points 30 days, of the encrypted copies only the eight newest; server logs: 7 days. - Reports, statements of reasons and complaints as evidence of our moderation decisions (DSA): 365 days after the case is closed. - Closed support requests and their replies: 365 days after the request is closed. - Our team's change log in the admin area: 1095 days. - Records of tax or commercial significance: for as long as the law requires (usually eight to ten years).

Minimum age

Tellersonne may only be used from the age of 16. You confirm your age when you register; we do not ask for any further proof of age. We do not address the app to children and do not advertise it to them. If we learn that an account belongs to a younger person, we lock and delete it. If you are a parent and suspect that your child has created an account, please write to privacy@tellersonne.app - we will check and delete the data.

Automated decisions and profiling

We use automated procedures in four places: checking uploaded photos, the rule-based pre-filter for comments, determining the language of a text and translating. In addition there are the suggestions under "For you": they assemble recipes from your profile settings (diet, allergens, dislikes, time budget, cooking experience), the recipes you saved most recently and the recipes you cooked in the last 14 days. These suggestions only change the order of the recipes shown; no price, access or right depends on them, and the app can show you under "Why?" which rules currently apply. We do not take automated decisions in individual cases producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR: warnings, comment bans, account locks and final removals are always decided by a person. The automatic photo check publishes a photo only on a clear result and holds one back only at high confidence; every other case goes to a human. You can lodge a complaint against an automatic rejection too and ask for a review by a person (https://tellersonne.app/en/dsa).

Where data about you comes from when it is not from you

Almost all data comes to us directly from you. In a few cases, details about you reach us from other people: from a report another person submits about your contribution (the contribution, the reason and the explanation), from an invitation to a household (your display name is shown to the members), from a complaint about one of our decisions, and from the events that Apple, Google or RevenueCat send us about your account. The categories and purposes are the same as described above; where a report leads to a measure, we inform you with the statement of reasons (Art. 14 GDPR).

Your rights

Under the GDPR you have the following rights: - Access to the data stored about you (Art. 15) - Rectification of inaccurate data (Art. 16) - Erasure (Art. 17) - Restriction of processing (Art. 18) - Data portability in a common, machine-readable format (Art. 20) - Objection to processing that we base on a legitimate interest (Art. 21) - Withdrawal of consent with effect for the future (Art. 7 (3)) Please contact privacy@tellersonne.app to exercise them. Access and portability are also available directly: the app offers a complete data export under Profile and Account. Exercising your rights is free of charge.

Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority at any time, in particular in the Member State of your residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the one of the federal state in which we are based (Itzehoe); as soon as it is settled we name it here by name and address. The addresses of all German supervisory authorities are published on the website of the Federal Commissioner for Data Protection and Freedom of Information. The courts remain open to you independently of that.

Data export and deleting your account

Under Profile and Account the app offers an export of all data about you as a machine-readable file as well as account deletion; the route is also described at https://tellersonne.app/en/delete-account. Once you have requested deletion your account is locked immediately and finally deleted after 14 days. That period gives you the chance to stop a deletion triggered by accident or by someone else; afterwards nothing can be restored. You can also request deletion by e-mail to privacy@tellersonne.app. Deleting your account does not end a running subscription - cancel that in your store as well.

What happens to your contributions after deletion

Together with the account we delete your e-mail address, your name, your profile including the allergy details, your collections, plans, lists, notes, own recipes, ratings, likes, push tokens, your block list in both directions, your consents and the consent log. Comments and cooked photos remain in place anonymised as "Deleted account" so that the conversations under a recipe still make sense: the text and the caption stay readable, the link to you is removed. If you would rather not have that, delete your comments and photos individually beforehand - you can do so at any time in the app. Reports, statements of reasons and complaints are kept without a link to your account because they document our own decisions. We also revoke your Apple token and delete your customer record at RevenueCat.

No advertising, no tracking

We show no advertising, sell no data and embed no advertising or analytics networks. There are no advertising IDs (IDFA, AAID) and no cross-device recognition. That is why the app never asks for tracking permission.

How we protect your data

All connections are encrypted over HTTPS or WSS. Passwords are stored only as a hash, and secrets are held exclusively in protected stores. Particularly sensitive values - such as the Apple token and the payload of the clean-up tasks after an account deletion - are additionally encrypted with AES-256-GCM and deleted as soon as the task is done. The admin area requires sign-in with a second factor, is additionally protected by an upstream access service, logs every change and does not display private content at all. We check uploads for their actual file type and strip the capture metadata. We limit requests, set strict security headers and check our dependencies automatically for known vulnerabilities. Should a personal data breach occur nevertheless, we report it to the supervisory authority within 72 hours and inform you if there is a high risk for you.

Further texts

Our terms of use (https://tellersonne.app/en/terms), the community rules (https://tellersonne.app/en/community-guidelines), the Digital Services Act information (https://tellersonne.app/en/dsa), the AI transparency notice (https://tellersonne.app/en/ai-transparency), the withdrawal instructions (https://tellersonne.app/en/withdrawal), the accessibility statement (https://tellersonne.app/en/accessibility) and the licences and credits (https://tellersonne.app/en/licenses) apply in addition.

Changes to this policy

We adapt this policy when the app or the legal situation changes. The version in force is always available in the app under Profile and Legal and at https://tellersonne.app/en/privacy. Every version carries a version number and a date, and earlier versions remain visible in the version history. For material changes we point this out in the app the next time you start it and, where necessary, ask you to accept the new version.

Previous versions

Version 4.14 of 8 October 2026 – The newsletter section now names Cloudflare Turnstile in the sign-up form, and the policy says which forms on the website load Turnstile: the report form, the beta sign-up and the newsletter. Since 4.13: the list of recipients also names speech recognition for the shopping list at Apple and Google, as the section on voice input already described. Since 4.12: new section on our profiles on Pinterest, TikTok, YouTube and Facebook and on the WhatsApp channel: the website and the app only link to them without loading anything from there; for the statistics of the Facebook page we are joint controllers with Meta (Art. 26 GDPR). Since 4.11: Resend is the fallback route for sending e-mail
Version 4.10 of 28 September 2026 – Retention periods added (owner's decision of 28.09.2026): reports, statements of reasons and complaints 365 days after the case is closed, closed support requests 365 days after closing, the team's change log 1095 days
Version 4.9 of 26 September 2026 – Performance data at Sentry: our servers measure the duration of a share of calls (with the address pattern and, for signed-in requests, a pseudonymous identifier); in the app, the crash-report section now names the loading times measured under the same consent
Version 4.8 of 25 September 2026 – We now send e-mails through Cloudflare Email Service instead of Resend (Cloudflare was already a processor); replies from our team come from the matching role address, Cloudflare's sending log and its period added
Version 4.7 of 25 September 2026 – All retention periods from one source, sections on the beta test and on backups and operational logs added, periods for rate limits and sign-in codes made precise, evidence of the promotional answer without an account, Cloudflare named among the transfers to the United States
Version 4.6 of 25 September 2026 – Added the “Recipe of the week” newsletter: double opt-in, evidence of consent, one-click unsubscribe and retention periods
Version 4.0 of 18 September 2026 – Voice control in cooking mode, server error logs, Turnstile on the report form, proof of consent, authenticity of ratings, an overview of retention periods, Art. 14 sources and whether data has to be provided added; the AI provider is now named in one place only
Version 2.0 of 1 September 2026 – Added household, community and anonymous statistics
Version 1.0 of 1 July 2026 – First version