Privacy Policy

Draft notice. This document is a starting template for a globally distributed consumer mobile app. Items in [BRACKETS] need to be completed before publication. Have this reviewed by qualified legal counsel in your primary jurisdiction (Netherlands / EU) before launch.

1. Who we are

Fork&Spoon ("Fork&Spoon", "we", "us", "our") is a recipe-management and AI-cooking-assistant mobile application operated by Arjan Schoof, a natural person established in the Netherlands, acting as a sole trader:

• Name: Arjan Schoof
• Address: Voorstraat 44, [POSTCODE] Velddriel
• Country: Netherlands
• Chamber of Commerce (KvK), if registered: [KVK NUMBER, or "not applicable"]
• VAT (BTW), if applicable: [BTW NUMBER, or "not applicable"]
• Privacy contact: privacy@forkandspoon.app

For the purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, Arjan Schoof is the data controller for the personal data described in this Policy.

2. Scope

This Policy describes how we collect, use, share and protect personal data when you:

• download, install or use the Fork&Spoon mobile application (the "App");
• visit forkandspoon.app or any of our marketing or share-link pages (the "Website");
• communicate with us (support, feedback, e-mail invitations to share recipes or cookbooks).

Together, the App and Website are referred to as the "Service". This Policy does not cover third-party services you may reach through links in the Service.

3. The data we collect

3.1 Data you provide directly

3.2 Data collected automatically

• Device & technical data — device model, OS, App version, language, timezone, crash logs, network type.
• Usage data — features used, screens viewed, AI actions performed, credits consumed, errors, session duration.
• Identifiers — pseudonymous app-install identifier, Supabase user ID, RevenueCat user ID.
• Approximate location — derived from IP at country/region level. We do not collect GPS or precise location.

3.3 Data from third parties

• Sign in with Apple — e-mail (or private relay), name (first time only).
• Google Sign-In — e-mail, name, profile picture.
• RevenueCat — subscription status, entitlements, trial state, renewal events.
• Apple App Store / Google Play — purchase receipts and subscription events (via RevenueCat).
• Spoonacular — recipe data you choose to import.

3.4 What we do not collect

• No precise GPS location.
• No access to contacts, calendar, microphone, SMS or photos library beyond images you explicitly pick to upload.
• Biometric authentication is processed by your OS on your device — we only receive a yes/no result.
• We do not knowingly collect data from children (see §11).

4. How we use your data

Under the GDPR we must have a legal basis for each processing purpose: (a) performance of a contract, (b) legitimate interests, (c) consent, (d) legal obligation.

You have the right to object to processing based on legitimate interest at any time (see §10).

4.1 AI processing specifics

When you use AI features, the minimum necessary content is sent to our AI provider(s) — currently routed via OpenRouter (see §6) — to generate a response. We do not use your content to train third-party foundation models; our API contracts with the provider(s) prohibit using your prompts and outputs for model training.

AI outputs may be inaccurate or unsuitable. You remain responsible for verifying recipes — especially for allergens, dietary restrictions or health-related claims — before relying on them.

5. Cookies and similar technologies

The mobile App does not use browser cookies. It does use local storage (SharedPreferences, on-device SQLite) and identifiers to keep you signed in, cache content for offline use, remember preferences, and meter AI usage.

The Website uses essential cookies (session, security) and — only with your consent where required — analytics cookies. A cookie banner explains the choices.

6. Service providers (sub-processors)

A current list of sub-processors will be maintained at [forkandspoon.app/legal/subprocessors]. We do not sell or rent your personal data, and we do not share it with advertisers.

7. International transfers

Some sub-processors are located outside the EEA, in particular in the United States. We rely on appropriate safeguards:

• EU Standard Contractual Clauses (Commission Decision 2021/914) with supplementary measures where necessary;
• UK International Data Transfer Addendum for transfers under the UK GDPR;
• EU-US Data Privacy Framework for participating US providers, where applicable.

You can request a copy of the safeguards by writing to privacy@forkandspoon.app.

8. How long we keep your data

9. Security

• TLS encryption in transit;
• Encryption at rest for databases and object storage;
• Row-level security so users can only access their own data (and content explicitly shared with them);
• Server-side validation of in-app purchase receipts via RevenueCat;
• AI requests proxied through an authenticated edge function — the client never holds AI provider keys;
• Principle of least privilege for engineering access, with audit logging;
• Routine dependency and vulnerability monitoring.

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and inform you without undue delay where the law requires it.

10. Your rights

10.1 EU / EEA / UK / Switzerland

You have the rights of access, rectification, erasure, restriction, portability, objection, and to withdraw consent at any time. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

10.2 California (CCPA / CPRA)

California residents have the right to know, access, delete, correct, limit use of sensitive information, and to opt out of "sale" or "sharing" — we do not sell or share personal information as defined by the CCPA. You will not be discriminated against for exercising these rights.

10.3 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other applicable states have analogous rights, including access, deletion, correction, portability and opt-out of targeted advertising, sale or profiling. We engage in none of these activities.

10.4 Brazil, Canada, Australia and others

We honour equivalent rights of access, correction and deletion under applicable local law.

10.5 How to exercise your rights

Most rights can be exercised directly inside the App (Profile → Settings → Manage my data / Delete my account). You can also write to privacy@forkandspoon.app. We will respond within the time limit set by applicable law (in the EU: within one month, extendable by two months for complex requests).

11. Children

The Service is not directed to children under 13 (or under 16 in the EEA/UK, or the equivalent age under your local law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@forkandspoon.app and we will delete it.

12. Automated decision-making

We do not use your personal data for automated decisions that produce legal or similarly significant effects on you. AI recipe suggestions, weekmenus and chat responses are content-generation features; they do not score, profile or rank you as an individual.

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will:

• update the "Last updated" date at the top;
• notify you in the App and, where appropriate, by e-mail at least 14 days before the change takes effect;
• where the law requires it, ask you to consent again.

14. Contact

Arjan Schoof
Voorstraat 44, [POSTCODE] Velddriel, Netherlands
privacy@forkandspoon.app