Privacy Policy of Cookara

Welcome to the privacy policy of Cookara. This policy explains how we process Personal Data in our mobile application specialized in recipe management and recipe-related calculations.

Latest update: October 10, 2026

Owner and Data Controller: Pavlo Stepura, sole proprietorship registered in the Polish Central Registration and Information on Business (CEIDG), ul. Św. Wincentego 128/29, Warsaw, Mazovian Voivodeship, Poland · NIP 5223034576 · REGON 523587470

Owner contact email:[email protected]

Summary

Data we collect automatically

We automatically collect data from you, for example when you use the Cookara mobile application.

Trackers
Usage Data
Device information
Number of sessions
Session duration
Operating systems
Universally unique identifier (UUID) — your Cookara account identifier
Crash data
Advertising identifier (Apple IDFA or Google Advertising ID) — only with your consent
Device attestation data (app integrity checks)

Trusted third parties help us process this data, including Google Ireland Limited, Google LLC, RevenueCat, Inc., Meta Platforms Ireland Limited and, on our website, TikTok Technology Limited.

We use this data for infrastructure monitoring (crash reporting and abuse prevention, which are always on) and, only with your consent, for product analytics and advertising measurement.

The app asks you once whether you allow usage data to be collected — on iOS through Apple's App Tracking Transparency prompt, on Android through an in-app dialog. The Usage data & ad measurement switch in the app's Settings turns both product analytics and advertising measurement off at any time.

Analytics events are pseudonymous, not anonymous: they are keyed to your account identifier and record which screens and features you use, what you create, how you move through onboarding and the subscription screens, and whether AI imports succeed. We use them only to improve the app and to evaluate product experiments; we do not sell them.

Data you give to us

We collect the data you give to us, for example when you create an account on Cookara.

Email address
Password
Google account data (name, email address, profile image)
Apple account data (name and email address, where provided by Apple)
Account profile and preferences: display name, profile photo, app language, country, currency, measurement units, number format, time zone, sign-in method and, if you switch it on, your VAT status and default VAT rates
User-created recipes, ingredients, supplies, custom units, price history, production plans, groceries, and tiered cake designs
Customer orders, clients (your customers' names, email addresses, phone numbers, delivery addresses, messaging links and notes), products, and product categories you create to manage your work
Recipe documents submitted for AI import (images, PDFs, or text)
Receipts and invoices submitted for AI price import (images or PDFs)
Messages you type to the Ask Cookara assistant, including anything you choose to put in them (for example a customer's name or an order's details)
Photos attached to recipes, ingredients, products, production plans and orders; PDF files attached to recipes
Messages you send through the in-app feedback form

This content is treated as user intellectual data. It remains private to your account, is not shared with other users through the app, and is used only to provide your personal Cookara experience.

You can use Cookara without registering. In that case Firebase Authentication creates an anonymous guest account identifier and your data is stored under it in the same way (see Registration and authentication).

Passwords are handled by Firebase Authentication. Cookara does not store plaintext passwords.

We may use your email address to notify you about updates to our Terms and Conditions and this Privacy Policy.

Owner and Data Controller

Pavlo Stepura (sole proprietorship, CEIDG), ul. Św. Wincentego 128/29, Warsaw, Mazovian Voivodeship, Poland · NIP 5223034576 · REGON 523587470

Owner contact email: [email protected]

Types of Data we collect

Among the types of Personal Data that this Application collects, by itself or through third parties, there are:

Trackers
Usage Data
Device information
Number of sessions
Session duration
Operating systems
Universally unique identifier (UUID) — your Cookara account identifier
Crash data
Advertising identifier (Apple IDFA or Google Advertising ID), only with your consent
Device attestation data (app integrity checks)
Email address
Password
Google account data (name, email address, profile image)
Apple account data (name and email address, where provided by Apple)
Account profile and preferences (display name, profile photo, language, country, currency, units, number format, time zone, sign-in method, VAT status and default VAT rates)
User-created recipes, ingredients, supplies, custom units, price history, production plans, groceries, and tiered cake designs
Customer orders, clients (your customers' contact details), products, and product categories you create to manage your work
Recipe documents submitted for AI import (images, PDFs, or text)
Receipts and invoices submitted for AI price import (images or PDFs)
Messages you type to the Ask Cookara assistant
Photos attached to recipes, ingredients, products, production plans and orders; PDF files attached to recipes
Feedback messages

Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using this Application.

Unless specified otherwise, all Data requested by this Application is mandatory and failure to provide this Data may make it impossible for this Application to provide its services.

In cases where this Application specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or functioning of the Service.

Users who are uncertain about which data is mandatory are welcome to contact the Owner.

This Application uses mobile app tracking technologies (for example SDK identifiers and similar tools) used by this Application and third-party services to provide the Service required by the User, in addition to other purposes described in this document.

This Application does not provide social feeds, public profiles, messaging, or other in-app user-to-user interaction features. User content is not shared between users through the app.

Mode and place of processing the Data

Methods of processing

The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of Data.

Data processing is carried out using computers and IT-enabled tools, following organizational procedures and modes strictly related to the purposes indicated.

As Cookara is operated by an individual developer, access to Personal Data is primarily limited to the Owner for app operation and support. Where needed, Data may also be processed by external third-party service providers (for example hosting, infrastructure, analytics, authentication, storage, subscription management, and support tools) acting as Data Processors on behalf of the Owner.

The updated list of these parties may be requested from the Owner at any time.

Place

Data is processed at the Owner's operating offices and in other places where the parties involved in processing are located. Depending on your location, Data transfers may involve transfer to another country.

International data transfers

Some providers used by Cookara process Data outside the EU/EEA, including in the United States. Where required by applicable law, such transfers are carried out using appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures implemented by the provider.

Examples of providers that may involve international transfers include Google services (Firebase, Crashlytics, Analytics, and Vertex AI, whose global endpoint may process AI requests outside the EU/EEA), RevenueCat, Meta, and TikTok (website pixel).

Retention time

Personal Data is processed and stored for as long as required by the purpose it was collected for. Unless a longer period is required by law, Cookara applies the following retention approach:

Account and authentication data: retained while the account is active. When you delete your account in the app, an automated process removes your account data, content and files from our active systems immediately; backup copies expire within 30 days. Deletion requests sent by email are processed within 30 days.
User-created content (recipes, ingredients, supplies, units, price history, plans, groceries, tiered cake designs, orders, clients, products, uploaded photos, PDF attachments): an item you delete disappears from your account immediately and is permanently erased together with the account. Content is otherwise retained until account deletion, as above.
Guest (anonymous) accounts: retained until you choose Delete account in the app. Uninstalling the app does not delete a guest account or its data. We may delete anonymous accounts that have shown no activity for an extended period.
Crash and technical diagnostics data: typically retained up to 90 days for troubleshooting and service reliability.
Analytics data: retained up to 14 months, where analytics is enabled.
Subscription and transaction records: retained as required for legal, tax, and accounting obligations (typically up to 10 years). The billing record held by RevenueCat (your account identifier, purchase and subscription history) is therefore kept after account deletion so that purchases can be restored and refund and tax obligations honoured.
AI features: documents you submit for recipe import, receipt price import or price estimates, and messages you type to the Ask Cookara assistant, are processed in real time and are not retained by the AI service; we may keep a request and its result in our AI monitoring logs for a limited time to find and fix errors. A conversation with the assistant is kept on your device only while the assistant screen is open; if you send feedback from the assistant, the recent conversation is stored with your feedback message. A PDF you import as a recipe is attached to that recipe and kept with it. Receipt line texts you confirm are stored with the matching ingredient or supply, price history records where each price came from, and monthly usage counters are kept with the account.
Photos and PDF attachments: retained until removed by you or until the associated item or your account is deleted.
Feedback messages: retained for as long as needed to act on them, and deleted on request.

The purposes of processing

Data concerning the User is collected to provide the Service, comply with legal obligations, respond to enforcement requests, protect rights and interests, detect malicious or fraudulent activity, and for the following purposes:

Analytics
Advertising performance measurement
Infrastructure monitoring
Registration and authentication
User content management and sync
Customer order, client, and product management
Server-side logic and API operations
File storage for user-uploaded images
Subscription and purchase management
Freemium plan-limit enforcement and premium entitlement checks
Service communications about legal and policy updates
AI-assisted recipe import and ingredient matching
AI-assisted price import from receipts and invoices, and AI price estimates
Ask Cookara: understanding a request you type and opening the matching tool, calculation or help article
Photo and PDF attachment storage
Storing your customers' details on your behalf (Orders module)
Abuse prevention and app integrity checks
Handling feedback you send us

Detailed information on the processing of Personal Data

Analytics

These services allow the Owner to monitor and analyze in-app usage and track User behavior inside the mobile application.

Analytics is enabled only after your consent in the app (the one-time prompt after your first recipe, or the Usage data & ad measurement switch in Settings) and can be withdrawn at any time with the same switch. While it is off, no analytics events leave your device.

Service: Google Analytics for Firebase (for apps)
Company: Google Ireland Limited
Place of processing: Ireland and the United States (Google infrastructure)
Personal Data processed: Device and app information, an app-instance identifier, your Cookara account identifier (used as the analytics user id), and usage events: sign-in and sign-up method; creation of recipes, ingredients, plans, orders, units and categories; screens viewed; AI import started, completed, failed or saved; onboarding steps and the product-experiment variant you were shown; subscription events (plans viewed, purchase started or completed, purchases restored); and user properties describing your subscription tier and status
Legal basis (EU/EEA): Consent, which can be withdrawn at any time

Website analytics and cookies (cookara.app)

Our public website at cookara.app uses Google Analytics 4 to understand how visitors find and use the site — for example, which website or campaign referred you and which features attract interest — so that we can improve it.

When you first visit the website, a cookie banner lets you accept or reject analytics cookies. We use Google Consent Mode: until you accept, analytics runs in a privacy-preserving, cookieless mode that does not store identifiers on your device; if you accept, analytics cookies (such as the _ga cookie) are stored so that returning visits can be measured more accurately. You can change or withdraw your choice at any time using the "Cookie settings" link in the website footer.

Service: Google Analytics 4 (Google Analytics for Firebase, web)
Company: Google Ireland Limited
Place of processing: Ireland
Personal Data processed: Pages viewed, referring website and campaign parameters (traffic source), approximate location derived from IP address, and device and browser type, processed in aggregate for traffic analysis and service improvement
Legal basis (EU/EEA): Consent for analytics cookies; before consent, only aggregated, non-identifying measurement is used

Advertising measurement (website)

On the Cookara website (cookara.app) we use advertising pixels to measure and optimize the advertising campaigns we run on Meta platforms (Facebook and Instagram), TikTok and Google Ads — for example to understand how visitors who arrive from an ad interact with the page and proceed to download the app. We may switch individual pixels on or off as our campaigns change; all of them work the same way.

Advertising pixels are marketing technologies that use cookies and similar identifiers. They are loaded only after you give consent through the website cookie banner, and you can withdraw that consent at any time using the "Cookie settings" link in the website footer. If you do not consent, no advertising pixel is loaded and nothing is sent to these providers.

Services: Meta Pixel; TikTok Pixel; Google Ads conversion tracking (Google tag)
Companies: Meta Platforms Ireland Limited; TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited; Google Ireland Limited
Place of processing: Ireland and the United Kingdom, with potential international transfer to the United States and, for TikTok, other countries where TikTok operates, under the Standard Contractual Clauses
Personal Data processed: Cookies and similar identifiers, IP address and device and browser information, pages viewed, referring campaign parameters, and clicks on the App Store and Google Play download buttons
Legal basis (EU/EEA): Consent (Art. 6(1)(a) GDPR), requested via the website cookie banner and withdrawable at any time
More information:Meta Privacy Policy, TikTok Privacy Policy, Google Privacy Policy

Advertising measurement (app)

To measure how well the advertising campaigns we run on Meta platforms (such as Facebook and Instagram) bring new users to Cookara, the mobile app uses Meta's app advertising tools (the Facebook SDK for app events). This lets us attribute an app install or a subscription purchase to the campaign that referred a new user, so we can understand which campaigns are effective.

This measurement is enabled only with your consent: on iOS it requires your permission through Apple's App Tracking Transparency prompt, and on Android it requires the equivalent in-app consent. The same consent covers product analytics (above) and advertising measurement; the Usage data & ad measurement switch in the app's Settings withdraws both at any time and turns this measurement off. It applies only to users who created their account on or after the date the feature was introduced; earlier accounts are never included.

Events sent to Meta are: account created, subscription screen opened, subscription purchased (amount, currency, plan), first recipe created, first customer order created, and a milestone when several recipes exist. On Android the Google Advertising ID accompanies these events; on iOS the IDFA is shared only when you allowed tracking. No events are sent before you consent.

Service: Meta app advertising tools (Facebook SDK for app events)
Company: Meta Platforms Ireland Limited (for users in the EU/EEA) and Meta Platforms, Inc.
Place of processing: Ireland and the United States (with potential international transfer)
Personal Data processed: Advertising identifier (Apple IDFA on iOS or Google Advertising ID on Android, where available and permitted), app events such as app installs and subscription purchases, and related device and technical information
Legal basis (EU/EEA): Consent, which can be withdrawn at any time
More information: See Meta's Privacy Policy

User content management and sync

This service area stores and synchronizes user-created content required for core app functionality.

Service: Cloud Firestore and Firebase Storage (Google Ireland Limited)
Place of processing: European Union (Firebase Storage in the Warsaw region)
Data processed: User recipes, ingredients, supplies, custom units, price history, production plans, groceries, tiered cake designs, customer orders, clients, products, product categories, and related metadata
Data ownership note: This content is user intellectual data provided and controlled by the User
Visibility: This data is private to each user account and is not shared with other users through the app. Your device keeps an offline copy of it so the app works without a connection; the copy is removed when you log out or clear the cache

Your customers' data (Orders module)

The Orders module lets you record your own customers — their names, email addresses, phone numbers, delivery addresses, messaging links and notes — together with their orders. Cookara stores this information on your behalf and on your instructions, solely to provide the Service to you; we do not use it for any other purpose, and it is deleted with your account. You decide what to enter and you are responsible for it: for having a lawful basis to keep your customers' details, for informing them as the law that applies to you requires, and for answering their requests. When you use the call, message, or map actions on a client or order, the app hands the phone number or address to the app you choose (for example your phone, messaging or maps app), which is governed by that app's own terms.

Infrastructure monitoring

These services allow the Application to monitor use and behavior of components so that performance, maintenance and troubleshooting can be improved.

Service: Crashlytics
Company: Google LLC
Place of processing: United States
Personal Data processed: Crash reports and non-fatal error reports, device and operating-system information, and your Cookara account identifier so that a report can be linked to a support request. Crash reporting is always on and does not depend on the analytics consent
Legal basis (EU/EEA): Legitimate interest in keeping the app reliable

Abuse prevention and app integrity checks

To make sure requests to our backend come from a genuine copy of the Cookara app, the app obtains an attestation from the device platform before talking to our services.

Service: Firebase App Check, using Google Play Integrity (Android) and Apple App Attest / DeviceCheck (iOS)
Company: Google Ireland Limited, Google LLC, Apple Inc.
Personal Data processed: Device and app integrity signals, an app-instance identifier, and related technical data. No account or content data is included
Legal basis (EU/EEA): Legitimate interest in preventing abuse and protecting the Service

Registration and authentication

By registering or authenticating, Users allow this Application to identify them and provide access to dedicated services.

Service: Firebase Authentication
Company: Google Ireland Limited
Place of processing: Ireland
Personal Data processed: Email address, password (where applicable), and related authentication data
Supported sign-in methods: Email and password, Google Sign-In, Sign in with Apple
Additional social sign-in data: Name, email address, and profile image (where provided by the identity provider)
Apple Sign In note: Apple may provide a private relay email address instead of a personal email, and may not provide the user's name after initial authorization.
Guest mode (anonymous authentication): If you continue without an account, Firebase Authentication creates an anonymous account identifier on your device and your data is stored and synchronised under it, with the same protections. If you later sign in with an email address, Google or Apple, the identifier is kept and your data is preserved. Guest accounts cannot purchase a subscription. A guest account is deleted only when you choose Delete account in the app; uninstalling the app does not delete it.
Service emails: Firebase Authentication sends the email-verification, password-reset and email-change messages on our behalf.
Profile photo: When you sign in with Google or Apple, the profile photo the provider supplies is copied into your Cookara profile; you can change or remove it in the app.

Server-side logic and API operations

These services execute backend application logic required to deliver features and process requests securely.

Service: Firebase Functions
Company: Google Ireland Limited
Place of processing: European Union (Warsaw region)
Personal Data processed: Usage Data, device information, identifiers, subscription events forwarded by RevenueCat, and data submitted in requests as required to provide the Service

File storage for user-uploaded images

These services store and serve files uploaded by Users: your profile photo and the photos you attach to recipes, ingredients, products, production plans and orders.

Service: Firebase Storage
Company: Google Ireland Limited
Place of processing: European Union (Warsaw region)
Personal Data processed: User-uploaded files (including images), file metadata, and technical usage data
Local caching: Downloaded images are cached on your device for faster display; the cache is cleared when you log out or clear the cache in Settings

AI-assisted features (recipe import, receipt price import, price estimates, Ask Cookara)

Cookara offers four optional AI-assisted features. Each runs only when you start it:

Recipe import: the Application processes a recipe document you submit (photos, PDF pages, or pasted text) to extract structured recipe data (ingredients, instructions, yield) and to match the extracted ingredient names against your personal ingredient list.
Receipt price import: the Application processes a shopping receipt or supplier invoice you submit (photos or PDF pages) to read the product lines, quantities, prices and VAT rates, and to match them against your ingredients and supplies.
Price estimates: for ingredients and supplies that have no price, the Application asks the AI for a typical retail price in your market.
Ask Cookara: an in-app assistant that reads a message you type and opens one of the Application's own tools, calculations or help articles with the details filled in (for example a cake size, an order draft or an addition to your shopping list), or asks a question back when something is unclear. It does not write advice or recipes of its own.

AI is used as a utility tool — it performs optical character recognition (OCR), structured data extraction, semantic name matching, price estimation and, for Ask Cookara, the recognition of which of the Application's own functions a message asks for and with which values. It does not generate creative content, make autonomous decisions, or profile Users.

Service: Firebase AI Logic with Vertex AI (Gemini models)
Company: Google Ireland Limited (Google Cloud)
Place of processing: Google's global Vertex AI endpoint. Requests may be processed in Google data centres outside the EU/EEA, including the United States, under Google Cloud's data-processing terms and the Standard Contractual Clauses
Personal Data processed for recipe import: The recipe document you submit, the text extracted from it, and a list of your ingredient names (names only, no identifiers or prices)
Personal Data processed for receipt price import: The receipt or invoice document you submit — which may show the store, the date, and any loyalty-card or partially masked payment-card numbers printed on it — the product lines read from it, and a list of your ingredient and supply names with their producer or brand
Personal Data processed for price estimates: The names, producer or brand and purchase unit of the ingredients and supplies to be priced, your currency, your app language and the country set in your preferences (to pick the right market)
Personal Data processed for Ask Cookara: The message you type and anything you choose to put in it, the last few messages of the same conversation (so that a follow-up can be understood), your app language, measurement units and the current date; a photo, PDF or text you attach to a message is processed as a recipe import or a receipt price import. Your recipes, ingredients, prices, orders and customers are not sent: the assistant matches the names in your message against your data on your device
Data not sent: Authentication credentials, email addresses, your account identifier, your customers' data (unless you type it into a message to Ask Cookara yourself), or any data unrelated to the request

Automated decision-making: The AI features assist you by suggesting structured data, matches and prices. All results are presented to you for review and editing before anything is saved. No fully automated decisions with legal or similarly significant effects are made.

Data retention: Documents and messages are processed in real time by the Vertex AI API and are not stored by the AI service after processing; your data is not used to train Google's models. We may keep a request and its result in the AI monitoring logs of our Firebase project for a limited time, to find and fix errors; these logs are not used for any other purpose. The Application does not keep the photos you submit once the import is finished. A PDF you import as a recipe is attached to that recipe and kept with it (see PDF attachment storage). Receipt line texts you confirm are stored with the matching ingredient or supply so that the next receipt resolves without an AI call, and each price you apply is recorded in that ingredient's price history together with its source (typed in, from a receipt, or estimated). A conversation with Ask Cookara is kept on your device only while the assistant screen is open and is not stored in your account; if you send feedback from the assistant, the question and the recent conversation are stored with your feedback message (see Feedback). Google's data processing terms for Firebase AI Logic apply to data handled by the API.

Usage limits: Recipe import, receipt price import and price estimates share one monthly usage allowance that depends on your subscription tier; Ask Cookara has a monthly allowance of answers of its own. Usage counts are stored in your account.

Opt-in nature: These features are entirely optional. No data is sent to the AI service unless you start one of them or send a message to Ask Cookara.

PDF attachment storage

Users may optionally attach a PDF document to a recipe for personal reference (e.g., original recipe printouts, scanned cookbook pages). A PDF imported through the AI recipe import is attached automatically.

Service: Firebase Storage
Company: Google Ireland Limited
Place of processing: European Union (Warsaw region)
Personal Data processed: PDF files selected and uploaded by the User, file metadata (file name, file size), and associated recipe identifier
Storage: PDF files are stored in Firebase Storage under the User's account and are private to that account. Each recipe may have one attached PDF; the size limit for your plan is shown in the app

Data retention: PDF attachments are retained until the User removes them or deletes the associated recipe. When a recipe is deleted, its PDF attachment is also deleted. Upon account deletion, all attachments are removed with other user content.

Local caching: Downloaded PDFs are cached on the User's device for faster access. The cache is managed automatically and does not transmit data to third parties.

Subscription and purchase management

Cookara uses a freemium model: Users can use the app for free up to certain usage limits and can purchase a subscription to unlock higher limits or premium functionality.

These services help manage in-app subscriptions, purchases, plan-limit enforcement, and entitlement status through Apple App Store and Google Play billing systems.

Service: RevenueCat
Company: RevenueCat, Inc.
Place of processing: United States
Payment processors/platforms: Apple App Store and Google Play
Personal Data processed: Purchase events, subscription status, your Cookara account identifier (used as the RevenueCat app user id), store transaction identifiers and receipts/tokens, device information, and usage data related to billing and entitlement operations
Retention: The RevenueCat customer record is kept after account deletion as a billing record (see Retention time)

Feedback

Signed-in Users can send us a message from the Feedback screen in Settings, or from the Ask Cookara assistant; a message sent from there carries the question it is about and the recent conversation.

Service: Cloud Firestore (Google Ireland Limited)
Personal Data processed: Your account identifier, the text of your message, and the time it was sent
Purpose: Answering you where possible and improving the app

Device permissions and data kept on your device

Camera and photo library: used only when you choose to take or pick a photo for a recipe, ingredient, product, plan, order, receipt or your profile. Photos you pick are uploaded to your account; nothing else in your library is read
Notifications: used only for the production-plan reminders you set. Reminders are scheduled on the device and are not sent through any server
Tracking (iOS): Apple's App Tracking Transparency permission, which is how the app asks for the consent described under Analytics and Advertising measurement
On-device data: an offline copy of your account data, cached images and PDFs, the food-nutrition dictionary, and app preferences. All of it is removed when you log out, delete your account, or use Clear cache in Settings

Further Information for Users in the European Union

Legal basis of processing

The Owner may process Personal Data relating to Users if one of the following applies:

Provision of Data is necessary for the performance of an agreement with the User and/or pre-contractual obligations.
Processing is necessary for compliance with a legal obligation to which the Owner is subject.
Processing is necessary for the purposes of legitimate interests pursued by the Owner (including bug fixing, crash reporting, infrastructure monitoring, abuse prevention and app integrity checks, and service improvement).
Processing is based on User consent where consent is required by law (product analytics and advertising measurement).
Processing for the AI-assisted features (recipe import, receipt price import, price estimates) and for photo and PDF attachments is based on the User's explicit action of initiating the feature (contract performance / service delivery).
Your customers' details entered in the Orders module are processed on your instructions to provide the Service to you; you remain responsible for that data as described above.

Further information about retention time

Unless specified otherwise in this document, Personal Data shall be processed and stored for as long as required by the purpose they have been collected for and may be retained for longer due to applicable legal obligation or based on Users' consent.

Personal Data collected for contract performance is retained until the contract has been fully performed.
Personal Data collected for legitimate interests is retained as long as needed to fulfill such purposes.
Where consent is used for optional features, Data may be retained until consent is withdrawn.
The Owner may retain Personal Data longer where required to fulfill a legal obligation or upon order of an authority.

Rights under GDPR

Users may exercise certain rights regarding their Data processed by the Owner. In particular, Users have the right to do the following, to the extent permitted by law:

Withdraw consent at any time.
Object to processing of their Data.
Access their Data.
Verify and seek rectification.
Restrict the processing of their Data.
Have their Personal Data deleted or otherwise removed.
Receive their Data and have it transferred to another controller.
Lodge a complaint.

Details about the right to object to processing

Where Personal Data is processed for legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation.

How to exercise these rights

Users can delete their account directly in the app (menu › Edit account › Delete account) or by emailing the Owner from the address linked to the account; email requests are processed within 30 days. Analytics and advertising consent is withdrawn with the Usage data & ad measurement switch in Settings. Any other requests to exercise User rights can be directed to the Owner through the contact details provided in this document. Such requests are free of charge and will be answered by the Owner as early as possible and always within one month, providing Users with the information required by law.

Additional information about Data collection and processing

Application scope

Cookara is a mobile application for recipe creation, recipe-related calculations, production planning, grocery management, tiered cake design, and customer order tracking. It is designed for individual use, including running your own small food business such as a home bakery, and does not include user-to-user interaction features.

Legal action

The User's Personal Data may be used for legal purposes by the Owner in court or in stages leading to possible legal action arising from improper use of this Application or related services.

Additional information about User's Personal Data

In addition to the information contained in this privacy policy, this Application may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, this Application and third-party services may collect files that record interaction with this Application and use other Personal Data, such as IP address.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

Children's privacy

Cookara is not directed to children. You must be at least 16 years old to use it, and we do not knowingly collect Personal Data from anyone younger. If we become aware that such data has been provided, we will delete it.

Where a higher minimum age applies under local law, Users must meet that age requirement or have valid parental authorization as required by law.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time by notifying Users on this page and, where technically and legally feasible, within the Application. When a change is material, the Application shows you a notice with links to the updated documents the next time you open it; continuing to use the Application after that notice constitutes acceptance of the updated documents.

Definitions and legal references

Personal Data: Any information that allows the identification or identifiability of a natural person.

Usage Data: Information collected automatically through this Application or third-party services used by this Application.

User: The individual using this Application.

Data Subject: The natural person to whom the Personal Data refers.

Data Processor: The natural or legal person processing Personal Data on behalf of the Controller.

Data Controller (Owner): The person or entity determining purposes and means of processing Personal Data.

This Application: The means by which the Personal Data of the User is collected and processed.

Service: The service provided by this Application.

EU: References include EU and EEA member states unless otherwise specified.

Tracker: Any technology used in a mobile application that enables analysis or monitoring of app usage.

Artificial Intelligence (AI): Technology used by this Application as a utility tool to extract structured data from user-submitted recipe documents, receipts and invoices, to match names against the User's own lists, and to estimate prices. AI is not used for profiling, autonomous decision-making, or content generation beyond these features.

Legal information: This privacy policy relates solely to this Application, if not stated otherwise within this document.

How can we help?

What you can do

Ask us to know and access the information we hold on you.
Ask us to correct information we hold on you.
Ask us to be forgotten (delete the information we hold on you).
Manage your privacy preferences.

In case of issues

While we strive to create a positive user experience, we understand that issues may occasionally arise between us and our users. If this is the case, please feel free to contact us.

Contact us

Cookara
Pavlo Stepura (sole proprietorship, CEIDG)
ul. Św. Wincentego 128/29, Warsaw, Mazovian Voivodeship, Poland
NIP 5223034576 · REGON 523587470
Owner contact email: [email protected]