Privacy policy

The controller under the GDPR is the provider named in the legal notice. For any question about data protection and to exercise your rights, an email to the address given there is enough.

The application and database run on a dedicated server of Hetzner Online GmbH in Falkenstein (Germany), which works for us as a processor under Art. 28 GDPR. When a page is requested, the web server in front logs the IP address, time, requested address, status code and browser identifier (user agent). These logs are capped in size and continuously overwritten, so they reach back a few days at most. The application itself logs requests without the IP address.

To find errors and bottlenecks we record what happens inside the application – the requested address including its parameters (such as a search term), duration and status code, without the IP address – and collect operating metrics. Both run on the same server; the records are deleted after 14 days, the metrics after 15 days. To prevent abuse such as requesting sign-in codes en masse, we count sign-in attempts per IP address for one minute at a time.

The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in secure and stable operation.

Photos, PDFs and other files you upload are kept in object storage from Cloudflare (R2) with data stored in the EU. When you upload, your browser sends the file there directly, so Cloudflare sees your IP address. Images are displayed through our own image server, not from Cloudflare. The daily database backups are kept in the same EU storage (see "Retention"). Cloudflare, Inc. is based in the USA and acts as a processor under Art. 28 GDPR; for the transfer, see "Transfers to third countries". The legal basis is Art. 6(1)(b) GDPR, and for the backups point (f) (protection against data loss).

To sign in, an email address is enough (see "Sign-in with an email code") or, if you like, your Google account (in the iOS app also your Apple account). You can also set a password; it is stored only as a hash. We also store your display name, language setting, time zone and the household you belong to.

As long as you are signed in, there is a session. With it we store the IP address and browser identifier to protect your account and detect abuse. A session expires seven days after it was last used and is then deleted.

Without an email address we cannot create an account; without an account you can at most try the app as a guest (see "Trying without an account"). The legal basis is Art. 6(1)(b) GDPR, and for the session's IP address and browser identifier point (f) (protecting your account).

As long as we offer it, you can try Wochenmahl without an account. For that we create a guest access – without an email address and without a name; it is simply called "Gast" (guest). What you create along the way is stored in a household of its own, as with an account: how many you cook for and how you eat, which recipes you swipe, your shortlist, your favourites, your meal plan and your shopping list. Added to that is the session with its IP address and browser identifier (see "Account and sign-in"). To prevent abuse, we count new guest accesses per IP address; the counter expires after one hour. We never send email to a guest access. Household invitations, AI features, importing recipes, push notifications and sharing need an account.

A guest access depends solely on the session in your browser: if it expires – seven days after it was last used – or you delete your cookies, its data can no longer be reached. That is why we automatically delete a guest access that has not been used for 30 days, together with everything that belongs to it.

If you create an account as a guest, everything you created as a guest moves to your account: the household with its meal plan and shopping list, your shortlist, favourites, swiped recipes, own recipes, collections and settings. If you sign in instead to an account that is already set up or has its own plan, list or other household members, it keeps its household: we take over only your favourites and delete the rest of the guest access. Either way, the guest access ends there and is deleted.

The legal basis is Art. 6(1)(b) GDPR, and for the session's IP address and browser identifier and the counter per IP address point (f) (preventing abuse).

When you sign in with your email address, we send you an email with a six-digit code and a button that signs you in directly. The code is valid for 10 minutes and only once; after that it is worthless. We send it through the email provider Resend (Resend, Inc., USA) as a processor under Art. 28 GDPR; it processes the data in its Ireland (EU) region and receives your email address and the content of the email. For the transfer, see "Transfers to third countries". The legal basis is Art. 6(1)(b) GDPR.

Signing in with Google is optional. You are only sent to Google once you tap "Continue with Google"; before that, the page loads nothing from Google. After you agree at Google, we receive your name, email address, profile picture and Google account ID, plus the sign-in tokens Google issues for this. We use them only to sign you in and create your account; if an account with the same email address already exists, Google is linked to it. Of your profile picture we store only its address at Google: wherever it is shown – to you and your household members – the browser loads it directly from Google, which sees the IP address of that device. Google LLC is based in the USA; the transfer relies on the adequacy decision for the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR. You can unlink Google again under Settings → Security.

Signing in with Apple is optional and only available in the iOS app. After you agree at Apple, we receive your Apple ID identifier, your name and your email address – or, if you choose, an address relayed by Apple that hides your real one. We use them only to sign you in and create your account; if an account with the same email address already exists, Apple is linked to it. We also store the sign-in token Apple issues, so that we can revoke access at Apple when you delete your account. Apple Inc. is based in the USA; the transfer relies on the adequacy decision for the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR.

Besides sign-in codes we send emails that are part of the service: links to confirm your address, reset your password, change your email address and delete your account, a welcome email after signing up, a message to the household's owner when someone joins, replies to your support requests and messages about reports and the moderation of your published recipes. These also go through Resend. We send promotional emails only with your consent (see "News by email and push"). The legal basis is Art. 6(1)(b) GDPR.

We store recipes, meal plans, shopping lists, pantry, collections, shortlists, what you cooked and uploaded photos so the app can do its job. Within a household, the plan, shopping list and pantry are visible to all members – that is the point of a shared household; members also see each other's names and profile pictures. Recipes are private by default; you decide per recipe whether one becomes visible to the household or public. A public recipe can be opened by anyone at a fixed address, is indexed by search engines and can be copied by others into their own collection.

We also provide some households with recipe catalogues that we put together and hold the rights to. They contain no data of other users. Recipe collections we read from websites for our own use appear only in our team's households, and copies of them cannot be published. The legal basis is Art. 6(1)(b) GDPR.

We store the diet (such as vegetarian or vegan), whether you cook gluten-free or lactose-free, the number of people, weekday cooking time, ingredients you don't like and your weekly grocery budget, including whether it also covers what you usually buy besides the planned meals, per household. All members see and change them. We use them only to tailor suggestions, search, the meal plan and cost estimates, and we don't pass them on. Everything is optional, and we treat these as preferences, not health data: we don't ask why you avoid something. Because a choice like "gluten-free" can still hint at an intolerance, leave it out if you prefer – Wochenmahl works without it.

A nutrition goal (Plus) is yours alone: how many calories a day and how they split into protein, carbohydrates and fat. The other members of your household don't see it; the meal plan measures each main meal against it for you only. If you let the app suggest a starting point, it works it out on your device from your age, height, weight, activity and, if you give it, your sex. These figures don't leave your device; we store only the result. We treat the goal as a preference too, not as health data. It is optional, you can delete it at any time, and it is deleted with your account. The legal basis is Art. 6(1)(b) GDPR.

In Discover we store which recipes you swipe right (like) or left (not now) and which were shown to you, so the deck doesn't show you anything twice. What you swipe left comes back after 60 days. The other members of your household see which recipes you liked – that is how shared matches come about – but never what you swiped away. The legal basis is Art. 6(1)(b) GDPR.

When you share a shopping list, an address with a random token is created. Anyone who knows this address sees the list – without signing in. That is intended, so it can be passed on to someone else. You can deactivate the link at any time in the share dialog. Likewise, an invite link to your household contains a code: anyone who knows it can join until the link expires or is used up. The legal basis is Art. 6(1)(b) GDPR.

Whoever invites someone to their household by email gives us the address of a person who does not have an account yet. We use it exactly once, to send the invitation, and do not store it in our database; the sending job is deleted one day after delivery, or 14 days after a failure. The invitation names the inviting person and the household. To prevent abuse, invitations are limited per person and household. The legal basis is Art. 6(1)(f) GDPR: our and your legitimate interest in bringing housemates in easily.

You can photograph receipts, upload them as PDFs, share them from another app or forward e-receipts to an email address of your household's own. Resend receives forwarded emails for us; we keep only the attached PDF files, not the text of the email. Any household member can replace the address with a new one at any time; the old one then stops working.

From the receipt we read the store, date, receipt number, items and prices; we never store payment or loyalty card details. Receipt images are read by an OpenAI model, so the image is sent to OpenAI (see "AI features"). An image can also show details we do not store, such as loyalty card numbers or cashier names. We remember the prices for your household. How an item name on the receipt (such as "BIO HAFERDRINK") maps to an ingredient becomes usable for all households once three households have confirmed the same mapping – without any link to you.

In the household settings you can enter a postal code; we store it with your household and derive the price region from it (the first two digits). Prices from receipts may feed community prices anonymously and only in aggregate, from five households upwards and never per store or person. This is on by default; you can object at any time with “Share prices anonymously with the community” in the same place, and any household member can do so. The legal basis is our legitimate interest in realistic prices for everyone (Art. 6(1)(f) GDPR).

Purchases can reveal a lot about a household, such as items from the drugstore. Adding them is optional. We delete receipts with their lines and files two years after the purchase date, and receipts that could not be read two years after upload. The legal basis for recording and reading receipts is Art. 6(1)(b) GDPR.

When you import a recipe from a link, our server fetches the page; the page sees our server, not you. If the page forbids automated fetching in its robots.txt, we don't import. For links to TikTok or Instagram posts we ask the respective provider for the post's public caption; it receives only the link. If our server finds no structured recipe data, or you import a photo, a PDF or a screenshot, an OpenAI model reads the recipe; cooking videos are read by Google Gemini (see "AI features"). For importing through the Shortcuts app on iPhone and iPad you can create a personal key; we store it only as a hash. The legal basis is Art. 6(1)(b) GDPR.

Some features use artificial intelligence from OpenAI (OpenAI API) and Google (Gemini API). OpenAI reads recipes from web pages, photos and PDFs, reads receipts and photos of shopping lists, suggests meal plans, tags recipes, reads the method steps for cook mode and understands what you search for by mood or in your own words. Google reads cooking videos, matches your search to recipes, finds similar recipes, runs the optional AI Actions (such as adapting recipes, substituting ingredients, suggesting sides and shopping items) and creates recipe photos on request. Each receives only what the feature needs: the page content, the photo or file, your wish or search text, for meal plan suggestions the free days, your weekday time limit and the titles, tags and last cooked dates of the candidate recipes, and for cook mode and recipe AI Actions the recipe's ingredients and steps. We do not send your name or email address.

Tagging and reading the steps run on their own whenever a recipe is saved, private recipes included; OpenAI receives only the recipe's text for them. What the AI finds in the steps – which ingredient is used in what amount and which times can be set as timers – we store with the recipe so cook mode can show it.

AI Actions are available once the person who owns your household has switched them on in the household settings.

We use the paid OpenAI API and the paid Gemini API. OpenAI and Google process the content as processors and, under their terms, do not use it to train their models; we tell OpenAI not to store the responses. OpenAI, L.L.C. and Google LLC are based in the USA; for the transfer, see "Transfers to third countries". Tagging recipes can instead be done by the Jev service of TypeSafe AI, Inc. (USA); it then receives only the content of the recipe. If the owner of your household has switched AI Actions on, Jev also puts items on your shopping list that we cannot place in a supermarket section into one; for that, Jev receives only the item's name.

What the AI suggests is marked, and you can check and change it; allergen information is an estimate without guarantee. Apart from tagging and reading the steps, all of these features are optional. The legal basis is Art. 6(1)(b) GDPR.

When you write to us from the app, we store your message, its category, a screenshot if you attach one, and details of the situation: the open page, app version, language, browser identifier and window size. You see our replies in the app and get them by email. We delete support requests with their replies and screenshots two years after the last activity on them, or with your account if that comes first. The legal basis is Art. 6(1)(b) GDPR, and for the details of the situation point (f) (tracing errors).

If a published recipe breaks the law or our rules, it can be reported. If you report without an account, we store the name, email address, language and explanation you give. If you report with an account, we link the report to it and write to your account's email address; if you report as a guest, we also store the name, email address and language you give. We do not store your IP address with the report. To prevent mass reports, we count reports per IP address; the counter expires after one hour (Art. 6(1)(f) GDPR). We review every report ourselves and tell the person who reported it our decision. If we take a recipe out of public view, the person who published it learns by email why and how to challenge the decision. We delete decided reports after two years. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 of the Digital Services Act (Regulation (EU) 2022/2065).

We show notices and "What's new" in the app; for that we only store which ones you closed or read. We send news and offers by email or push only with your consent (Art. 6(1)(a) GDPR, § 7 UWG). For email you confirm it through a link (double opt-in); we store the time of the request and of the confirmation as well as the IP address. We delete unconfirmed sign-ups after 30 days. You can withdraw your consent at any time in the settings or through the link in every email. We store which news we sent to whom, so nobody gets an email twice.

Push notifications are optional. If you allow them in the browser, we store the delivery address your browser creates for them, the keys that go with it, the browser identifier and when something was last delivered. Delivery goes through the push service of your browser's maker (such as Google for Chrome, Mozilla for Firefox, Apple for Safari); it receives the delivery address and the message only in encrypted form and cannot read its content.

In the app we instead store your installation's device token (issued by Apple or Google), its platform and when it was last used, and send through Apple's push service (APNs) or Google's (Firebase Cloud Messaging), which receive the token and the text of the notification.

If you turn push off or delete your account, the entry is deleted, and also when the push service reports it as invalid. The legal basis is Art. 6(1)(a) GDPR.

The app shows the same application as the website and stores the same data. Instead of a cookie, a session token keeps you signed in; it is kept in your device's Keychain (iOS) or Keystore (Android). The app uses the camera and photo library only when you take or pick a photo or scan a barcode; it does not access any other photos. It writes to your calendar only when you add meals from the plan there; it reads no events, and nothing from your calendar reaches our servers. The barcode scan runs on the device; to look up the product, our server sends only the number to Open Food Facts, without naming you. For push notifications, see above. The legal basis is Art. 6(1)(b) GDPR. The app contains no ads, no tracking or analytics software, sends no crash reports to third parties and does not read an advertising ID.

Wochenmahl sets only cookies and stores only data in the browser that are needed for it to work or that you request yourself (§ 25(2) no. 2 TDDDG). None of it serves advertising or tracking, and none of it comes from third parties; that is why no consent banner is needed. The language is part of the address, not a cookie. Visitor statistics (see "Visitor statistics and running the AI") store nothing in the browser either.

Cookies: the session cookie that keeps you signed in, also as a guest (seven days, extended when used), with a copy of the session data for five minutes; a cookie that remembers your last sign-in method to highlight it next time (30 days); a cookie that keeps for one hour what you started before signing in – such as joining a household or saving a recipe; and one that remembers whether the sidebar is collapsed on large screens (seven days).

In the browser's local storage: whether you prefer light or dark, drafts of the recipes you are editing, your recent searches in the recipe collection, view settings (such as grid or list), which hints you have seen or closed, when you last looked at the household activity and, if you allow push, the device's push token; in the app also the chosen language. Only until you close the tab: whether you hid a banner, which items you skipped while shopping and, while you create an account as a guest, which household belongs to your guest access.

So the shopping list works offline, a copy of it, together with changes not yet sent, is kept in your browser's database (IndexedDB); it is deleted when you sign out. The service worker caches the app's files and icons so they load faster and offline, and keeps files you share with Wochenmahl only until they have been processed.

On the public pages – home page, recipes, legal pages – we count page views with PostHog, but not in the app after signing in, on invitation and shared links, or in the iOS and Android app. We set no cookies and store nothing in your browser for this. What is recorded: the address visited, the page you came from, browser, operating system, screen size and language. The request goes through our own server, which removes cookies and passes on your IP address. From it and the browser identifier, PostHog forms a hash with a key that changes daily, to group the visits of one day, and does not store the IP address. PostHog therefore cannot link a visit to another day or to your account.

For the AI features, our servers send PostHog, for each call to an AI model, the feature, the model, the number of tokens, the cost, the duration and whether it failed, and for calls from your account also its internal ID. We do not send content – recipes, photos, your requests or the AI's answers. The servers also tell PostHog when they start and stop.

PostHog Inc. works for us as a processor; the data is stored in the EU (Frankfurt). The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in understanding how the public pages are found and in keeping an eye on the cost and reliability of the AI features.

All fonts are served from our own server. There is no connection to Google Fonts or any other CDN. We copy the images of imported recipes to our storage when importing; they are not loaded from the original site. The only exception are profile pictures of Google accounts, which your browser loads directly from Google (see "Sign-in with Google").

We pass personal data only to the following parties, and only as far as the feature in question requires. Whoever processes data on our behalf is bound to our instructions by a contract under Art. 28 GDPR. We do not sell data or pass it on for advertising. Authorities receive data only where we are legally required to provide it.

Some of the companies named are based in the USA or can access data from there: Google, OpenAI, Apple, Cloudflare, PostHog, Resend and TypeSafe. Where a company is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR); otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which are part of our contracts with these providers.

In general, your data stays as long as your account exists. When you delete your account, your profile, recipes, photos, shortlist and support requests are deleted with it. Shared household data – a plan entry you created or an item you checked off – stays with the household, but without any link to you. Some data we delete earlier:

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21, see below). You can withdraw consent at any time with effect for the future (Art. 7(3)). Two rights don't need a request: you find export and deletion directly in the app under Settings → Profile. For anything else, an email to the address in the legal notice is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the alleged infringement.

We do not make automated individual decisions, including profiling, within the meaning of Art. 22 GDPR. Suggestions for recipes and meal plans are recommendations you can accept, change or ignore.

The connection is encrypted throughout. Access to the database is secured row by row (row level security): which row you may read is decided by the database based on your session, not by the application in front of it. We store passwords and the keys for imports through Shortcuts only as hashes.

We update this policy when features or the law change. The version published here applies; when it was last changed is shown at the top.