Privacy policy

This policy explains what personal data we process when you use the Sabrosia app and the sabrosia.app website, what we use it for and how you can control it, under the General Data Protection Regulation (GDPR) and Spain’s data protection law (LOPDGDD).

The short version

• Your allergies, intolerances and diet are specially protected data: we only store them with your explicit consent.
• Nomi, our AI chef, only receives your messages and cooking profile if you agree to it in the app first.
• We don’t sell your data, we don’t show ads and we don’t track you for advertising.
• You can delete your account and all your data from inside the app.

Who is responsible for your data

The data controller is [pending: ownerName], tax ID (NIF) [pending: ownerTaxId], with an address at [pending: ownerAddress]. For anything related to your data, write to hello@sabrosia.app.

What we collect and why

Your account

You sign in with Apple, with Google, or with an email address and password. We store your email, the identifier Apple or Google gives your account and, if they share it, your name. Your password is stored encrypted and we never see it.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Your cooking profile

Your name, gender and age (both with a “prefer not to say” option), your goals, the meals you eat each day, your skill level, how much time you usually have, the cuisines you enjoy and what you don’t like. We use this to greet you by name, get the grammar right in Spanish and rank recipes for you. We only use your age in aggregate, to understand who Sabrosia is useful for.

Legal basis: performance of the contract; for your age, which is optional, our legitimate interest (Art. 6(1)(f) GDPR). Your allergies, intolerances and diet have their own section below.

Your kitchen

Favourites, private notes on recipes, your diary of what you’ve cooked (date, meal, rating and whether you’d make it again) and, if you like, a photo of your dish, kept in private storage that only you can access. Your diary also helps us vary the recipes we suggest.

Legal basis: performance of the contract.

Conversations with Nomi

Your messages, typed or dictated; Nomi’s answers; the recipes she writes or adapts for you, which are private; your ratings and reports of her answers; and a daily count of messages and their technical cost, used to apply the daily limit.

Legal basis: your explicit consent (Arts. 6(1)(a) and 9(2)(a) GDPR) to send your data to the AI provider; performance of the contract to keep your history; and our legitimate interest in reviewing reported answers to make Nomi safer.

Your subscription

Apple or Google handle the purchase, so we never see your card. Through RevenueCat we receive your plan, its status and dates, the store, your country and the technical data needed to validate the purchase.

Legal basis: performance of the contract and our accounting and tax obligations (Art. 6(1)(c) GDPR).

Phone permissions

• Camera and photos: only when you add a photo to your diary.
• Microphone and speech recognition: so you can dictate to Nomi. Dictation is handled by your phone’s own speech service (Apple or Google, under their terms); Sabrosia never receives or stores the audio, only the text you send.
• Notifications: timer alerts are scheduled on your phone. We don’t use push notifications.

Errors, usage and security

• Crash reports (Sentry): when the app crashes, a technical report (phone model, versions and what was happening) is sent so we can fix it. Legal basis: our legitimate interest in keeping the app working.
• Usage analytics (PostHog): which screens are opened and which buttons are tapped, under a pseudonymous identifier. Only if you agree, and you can change your mind at any time in Profile. Legal basis: your consent.
• Technical logs: data such as the IP address and time of each request. Legal basis: our legitimate interest in protecting the service.

Neither crash reports nor analytics include your allergies, your diet or the content of your conversations.

Support

If you write to us, we use your email address and whatever you tell us to reply. Legal basis: performance of the contract, or our legitimate interest in helping you.

The website

sabrosia.app uses no cookies and doesn’t ask for personal data. If you choose a language, it remembers it in your browser’s storage so it doesn’t have to ask again; that never leaves your device and you can clear it at any time in your browser settings. We count visits with cookieless analytics that don’t identify you (Cloudflare Web Analytics), and our hosting provider processes your IP address to serve the site and protect it. Legal basis: our legitimate interest.

Your allergies and diet

Allergies and intolerances, and a vegetarian, vegan or pescatarian diet, can reveal information about your health or your beliefs. The GDPR gives this kind of data special protection (Art. 9), so we only process it with your explicit consent, which the app asks for before saving it.

We use it for one thing only: never suggesting a recipe you can’t or don’t want to eat. The filter is applied by our database, based on each recipe’s ingredients, and never by AI.

You can withdraw your consent at any time by removing them in Profile › Your preferences, or by deleting your account. If you do, Sabrosia can no longer take them into account when suggesting recipes. Withdrawing consent doesn’t affect anything processed before.

Nomi and the AI provider

Nomi runs on an AI model from an external provider: the one named in the app before you first use her. The first time you open Nomi, the app explains what will be sent and asks for your permission. Without it, nothing is sent.

If you agree, each message sends the provider:

• your message and the recent messages in that conversation;
• your cooking profile: name, allergies, diet, dislikes, goals, skill level, usual cooking time and favourite cuisines (not your gender or age);
• the recipe you’re talking about, if there is one.

The provider acts as our processor and uses this data only to generate the answer. We only work with providers that commit by contract not to use it to train their models; they may keep it for a limited time for security and abuse prevention. Please don’t share anything in the chat that you don’t need for cooking.

You can withdraw your permission in Profile › Nomi › AI permission, and nothing more will be sent. You can also delete a conversation by pressing and holding it, or all of them in Profile › Nomi.

Nomi can make mistakes, and her answers are not medical or nutritional advice.

Who we share your data with

We don’t sell your data or share it for advertising. We only share it with the providers we need to run the service, who process it on our instructions and under contract:

Provider	What for	Where
Supabase	Accounts, database, private photos and server functions	European Union
RevenueCat	Subscription status	United States
Nomi’s AI provider (named in the app)	Nomi’s answers and recipes	May be outside the EU
Sentry	Crash reports	European Union
PostHog	Usage analytics, if you agree	European Union
Cloudflare	Website hosting, security and cookieless analytics	Global network

We also use an email delivery service for account emails, such as password resets.

When you sign in with Apple or Google, buy through their stores or use their dictation, Apple and Google process your data as independent controllers under their own privacy policies. We may also have to share data with the authorities when the law requires it.

Transfers outside the European Union

Some providers, such as RevenueCat or the AI provider, and sometimes the parent companies of the others, may process data outside the European Economic Area, for example in the United States. Those transfers rely on the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. You can ask us for details of these safeguards.

How long we keep your data

• Account, profile, kitchen and conversations: for as long as you have an account. Anything you delete in the app, such as a conversation or a Nomi recipe, is deleted straight away.
• If you delete your account: we delete everything from our database and storage straight away; backups are overwritten within 30 days.
• Inactive accounts: after 2 years without signing in and without an active subscription, we’ll delete the account, emailing you first.
• Purchases: what the law requires us to keep for accounting and tax purposes, with restricted access, for the legal period (up to 6 years).
• Crash reports and technical logs: up to 90 days. Analytics: up to 12 months.
• Support: up to one year after your request is resolved.

Your rights

You can ask us at any time to access your data and get a copy, correct it, delete it, object to processing based on our legitimate interest, restrict its processing, receive the data you gave us in a structured format (portability), and withdraw your consent, without affecting anything processed before.

You can do much of this yourself in the app: edit your profile and allergies in Profile, delete conversations and withdraw the AI permission in Profile › Nomi, and delete your account. For anything else, write to hello@sabrosia.app from your account’s email address. We’ll reply within one month and, if we have reasonable doubts about your identity, we may ask you to confirm it.

If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority where you live in the EU.

Deleting your account

In the app: Profile › Account › Delete account. This deletes your account, profile, allergies, favourites, notes, diary and photos, conversations and Nomi recipes. If you signed in with Apple, we also revoke Sabrosia’s access to your Apple account.

If you can’t get into the app, write to hello@sabrosia.app from your account’s email address. The steps are on Delete your account.

Deleting your account doesn’t cancel your subscription: cancel it in your App Store or Google Play settings.

Security

Your data is encrypted in transit and, on our servers, each person can only access their own. On your phone, your session and the data saved for offline use, including your allergies, are stored encrypted.

Automated decisions

The app filters and ranks recipes with automatic rules based on your answers, without making decisions that have legal effects on you or affect you in a similarly significant way.

Minimum age

Sabrosia is for people aged 16 and over. We don’t knowingly process data from anyone younger; if you believe a minor has given us their data, write to us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top. If the change is significant, we’ll let you know in the app before it applies and, where needed, ask for your consent again.