Legal
Privacy Policy
Last updated: 29 August 2026
This Privacy Policy explains how Flavors ("we", "us", or "our"), based in Sweden, collects, uses, and protects your personal data when you use our mobile application and website (the "Service").
We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Swedish Data Protection Act (dataskyddslagen, 2018:218).
1. Data Controller
The data controller responsible for your personal data is:
Flavors
Sweden
Email: john@flavors.app
2. What Data We Collect
We collect the following categories of personal data:
2.1 Account Data
- Email address (when you create an account)
- Password (stored securely as a cryptographic hash; we never store or see your actual password)
- Display name and profile photo (if you choose to add them)
- Google account information (name, email, profile picture) if you sign in with Google
2.2 Content You Create
- Recipes (names, ingredients, directions, notes, images)
- Collections and tags
- Meal plans
- Grocery lists
- Ratings and cook history
- Preferences and settings
2.3 Technical Data
- Authentication session tokens
- Device and platform information necessary for app functionality
- Crash reports and anonymised usage diagnostics, if you opt in or where collected automatically to maintain service reliability
We follow the principle of data minimisation: we only collect what is necessary to provide and improve the Service. We do not sell data, serve advertising, or build user profiles for marketing purposes.
3. How We Use Your Data
We process your personal data for the following purposes:
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Providing the Service (storing and syncing your recipes, plans, groceries) | Performance of contract (Art. 6(1)(b)) |
| Account creation and authentication | Performance of contract (Art. 6(1)(b)) |
| Sending transactional emails (password reset, email verification) | Performance of contract (Art. 6(1)(b)) |
| Household sharing (sharing recipes with users you invite) | Performance of contract (Art. 6(1)(b)) |
| Publishing recipes you choose to make public | Consent (Art. 6(1)(a)) — you actively choose to publish |
| Improving and maintaining the Service (including diagnostics and analytics) | Legitimate interest (Art. 6(1)(f)) |
4. Data Sharing and Third Parties
We share your data only with the service providers necessary to operate Flavors:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Convex, Inc. | Backend infrastructure and database | All account and content data | United States |
| Google LLC | Social sign-in (optional) | OAuth tokens, name, email, profile picture | United States |
| Resend, Inc. | Transactional email delivery | Email address | United States |
This list reflects the providers we use at the time of writing. If we add new sub-processors, we will update this section and note the change date at the top of this policy. We do not sell, rent, or trade your personal data, and we do not share data with advertisers or data brokers.
5. International Data Transfers
Your data is processed in the United States by our infrastructure providers. These transfers are safeguarded by:
- The EU–U.S. Data Privacy Framework, where the provider is certified; and/or
- Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
You can request a copy of the relevant safeguards by contacting us at the address above.
6. Data Retention
We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account:
- All your content (recipes, collections, tags, meal plans, grocery lists, preferences) is permanently deleted from our servers.
- Uploaded images are deleted from storage.
- Your authentication records are removed.
- Deletion is performed promptly and typically completes within minutes.
You may export your data before deletion. The app offers a data export feature that saves all your content locally to your device.
7. Your Rights Under GDPR
As a data subject, you have the following rights under GDPR. You can exercise these rights by contacting us or through the account dashboard:
| Right | Description | How to Exercise |
|---|---|---|
| Access (Art. 15) | Obtain a copy of your personal data | Account dashboard or contact us |
| Rectification (Art. 16) | Correct inaccurate personal data | Edit your profile, or contact us |
| Erasure (Art. 17) | Request deletion of your personal data | Account dashboard or contact us |
| Restriction (Art. 18) | Restrict processing of your data | Contact us |
| Data Portability (Art. 20) | Receive your data in a structured, machine-readable format | App: Settings → Your data |
| Object (Art. 21) | Object to processing based on legitimate interest | Contact us |
| Withdraw Consent (Art. 7) | Withdraw consent where processing is based on consent | Unpublish recipes, or contact us |
We will respond to your request within one (1) month. If your request is complex, we may extend this by two additional months, and we will inform you of the reason.
8. Cookies and Local Storage
The Flavors website uses only the following storage mechanisms:
- Authentication cookies — necessary to keep you signed in. These are strictly necessary and do not require consent under GDPR/ePrivacy.
- Cookie consent preference — stored in your browser's local storage to remember your choice on the cookie banner.
If we introduce analytics or diagnostics cookies in the future, we will request your consent before setting them. The mobile app uses on-device secure storage for authentication tokens and does not set cookies.
9. Children's Privacy
The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us and we will take steps to remove that data.
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encrypted data transmission (HTTPS/TLS)
- Passwords stored as cryptographic hashes (never in plain text)
- Authentication tokens stored in secure, encrypted storage on your device
- Access controls limiting data access to authenticated users
No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
11. Guest Mode
You may use Flavors without creating an account ("guest mode"). In this mode, your data is stored only on your device and is not transmitted to our servers. No personal data is collected until you choose to create an account.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least thirty (30) days before the changes take effect. The "last updated" date at the top reflects the most recent revision.
13. Supervisory Authority
If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with a supervisory authority. The relevant authority in Sweden is:
Integritetsskyddsmyndigheten (IMY)
The Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
Website: www.imy.se
Email: imy@imy.se
If you reside in another EU/EEA country, you may also contact your local data protection authority.
14. Contact
For any questions, requests, or concerns regarding this Privacy Policy or your personal data, contact us at: john@flavors.app