Privacy Policy

1. Introduction

Welcome to DishStack ("we," "us," "our," or "Company"). We are committed to protecting your privacy and ensuring you have a positive experience on our website and mobile application.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use DishStack — a personal recipe management, meal planning, and kitchen organization app. It applies to our web app at dishstack.me and any associated mobile apps.

By using DishStack, you agree to the practices described in this policy. If you do not agree, please discontinue use of the app.

2. Information We Collect

We collect the following categories of information:

• Account Information: Your name and email address when you register or sign in via Google, Microsoft, Facebook, or Apple.
• Recipe Data: Recipes you create, import, or save — including titles, ingredients, instructions, images, notes, cuisine tags, dietary labels, and allergen information.
• Meal Plan Data: Meals you schedule, cooking dates, and leftover expiry dates.
• Shared Recipe Data: When you share a recipe with another user, we store the recipient's email, your name, and an optional personal message.
• Google Calendar Data: If you choose to connect Google Calendar, we access your calendar events solely to sync meal plans and shopping lists. We do not store your calendar data beyond what is needed to create and manage those events.
• Push Notification Tokens: If you enable push notifications, we store your device's push subscription endpoint and encryption keys to send you reminders (e.g., leftover freshness alerts).
• Payment Information: If you subscribe to DishStack Ad-Free, payment is processed securely through Base44 Payments. We do not store your credit card details.
• Usage Data: Information about how you use the app (pages visited, features used) to improve our service.
• Device & Technical Data: Device type, operating system, browser type, and IP address.
• Cookies: We use cookies to maintain your session and analyze usage. See Section 9 for details.

3. How We Use Your Information

We use the information we collect to:

• Create and maintain your account and personal recipe collection
• Provide core features: recipe saving, import (from URLs, photos, text, social media), bulk import, meal planning, and shopping lists
• Power AI features such as recipe extraction, "What Can I Make?", fridge-life estimation, calorie estimation, and image generation
• Share recipes with other users you designate
• Sync meal plans and shopping lists to Google Calendar (only when you explicitly authorize this)
• Send push notifications for reminders (only if you opt in)
• Process subscription payments via Base44 Payments
• Apply promo codes and manage trial/subscription status
• Send transactional emails (e.g., shared recipe notifications, support replies)
• Improve the app through usage analytics
• Comply with legal obligations and prevent fraud

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract: Processing necessary to provide the DishStack service you signed up for.
• Consent: For optional features such as Google Calendar sync, push notifications, and marketing communications.
• Legitimate Interests: For analytics and improving our service, where these interests are not overridden by your rights.
• Legal Obligation: Where required by applicable law.

5. AI-Powered Features

DishStack uses AI (large language models and image generation models) to power several features, including:

• Extracting recipes from URLs, photos, text, and social media content
• "What Can I Make?" — generating recipe suggestions based on your ingredients
• Estimating fridge life, calories, cuisine, and dietary labels
• Generating recipe images when none are available
• Bulk recipe import and parsing

When you use these features, relevant content (such as recipe text, ingredient lists, or images) is sent to our AI provider for processing. This data is used only to fulfill your request and is not used to train AI models. We do not send personally identifiable information to AI providers beyond what is necessary for the feature.

6. Data Sharing

We do not sell, trade, or rent your personal information. We may share data with:

• Service Providers: Infrastructure, AI processing, payment processing, and email delivery partners who operate under data processing agreements.
• Google: If you connect Google Calendar, OAuth tokens are used to create and manage calendar events on your behalf. We do not share recipe data with Google beyond what is included in the calendar events you create.
• Other DishStack Users: When you explicitly share a recipe with another user by entering their email address.
• Legal Requirements: When required by law, court order, or to protect our legal rights.

7. Google Calendar Integration

DishStack offers optional Google Calendar integration. When you authorize this:

• We request access to create, update, and delete calendar events on your behalf.
• We only access your calendar to manage events created by DishStack (meal plans, shopping lists, leftover reminders).
• You can revoke access at any time from your Google Account settings or from within DishStack's Settings page.
• We comply with Google's API Services User Data Policy, including the Limited Use requirements.

8. Push Notifications

If you opt in to push notifications, we store your browser/device push subscription details (endpoint URL and encryption keys) to send you reminders such as leftover freshness alerts. You can revoke notification access at any time through your browser or device settings, or from within the DishStack app.

9. Cookies and Tracking

We use the following types of cookies:

• Essential Cookies: Required for authentication and core app functionality. These cannot be disabled.
• Analytics Cookies: Help us understand how users interact with the app to improve our service. You can opt out via our cookie consent banner.

You can manage cookie preferences through our cookie banner or your browser settings. We respect the Global Privacy Control (GPC) signal — if enabled, we automatically disable non-essential cookies.

10. Data Retention

We retain your data for as long as your account is active or as needed to provide our services. When you delete your account, your personal data and recipes are permanently deleted within 30 days. Some anonymized usage data may be retained for analytical purposes.

11. Security

We implement appropriate technical and organizational security measures to protect your personal data, including encrypted connections (HTTPS), secure authentication via OAuth providers, and access controls. However, no method of internet transmission is 100% secure, and we cannot guarantee absolute security.

12. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your account and data ("Right to be Forgotten").
• Portability: Export your recipe data using the Data Export feature in Settings.
• Restriction: Request that we limit how we process your data.
• Objection: Object to processing for marketing or analytics purposes.
• Withdraw Consent: Revoke consent for optional features (e.g., Google Calendar, push notifications) at any time.

To exercise these rights, contact us at support@dishstack.me or use the account management tools in the Settings page.

13. Children's Privacy

DishStack is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

15. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our features or legal requirements. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Continued use of DishStack after changes constitutes acceptance of the updated policy.