Privacy Policy for the SirPrep Mobile App

Last updated: July 2026

This Privacy Policy explains how personal data is processed when you use the SirPrep mobile application.

1. Data Controller

The controller responsible for the processing of your personal data within the meaning of the GDPR is:

Viktoriia Hrodetska
Heidenheimer Strasse 24
85748 Garching bei Muenchen
Germany
Email: info.foodb@gmail.com

You can contact the controller at any time if you have questions about this Privacy Policy or wish to exercise your data protection rights.

2. Overview

SirPrep is a meal-planning app. The app helps you create weekly meal plans, shopping lists, recipe steps, and meal preferences.

SirPrep is designed to minimize personal data collection:

• The current iOS app does not require a user account.
• Most app data is stored locally on your device using Apple's local app storage.
• SirPrep does not use third-party advertising networks.
• SirPrep does not use general-purpose third-party analytics or advertising tracking SDKs in the current iOS app. Subscription-related events may be processed by RevenueCat as described in Section 6.
• SirPrep does not request location, camera, photo library, contacts, microphone, or push notification permissions in the current iOS app.

Some features require external services, especially subscription management and AI meal generation. These are described below.

3. Data Processed Locally on Your Device

SirPrep stores the following types of data locally on your device:

• Planning profile: country or market, preferred store, weekly budget, preferred locale, household size, meals per day, planning days, kitchen equipment, and weekly planning context.
• Diet and nutrition preferences: selected diet preferences, disliked ingredients, ingredients to avoid, nutrition intent, calorie targets, protein targets, and fiber targets.
• Meal plans and shopping data: generated weekly plans, meal options, estimated prices, recipes, ingredients, grocery lists, and checked-off grocery items.
• Meal feedback: liked or avoided meals, ingredient names, tags, generated recipe steps, and feedback dates.
• Local AI quota data: a local counter of generated meals used to display and manage free AI usage.
• App identifiers required for operation: a pseudonymous per-install or subscription user identifier used to connect subscription status and AI usage quota to the app installation.

Purpose: to provide the core meal-planning, recipe, grocery list, preference, subscription, and quota features requested by you.

Legal basis:

• Art. 6(1)(b) GDPR, where processing is necessary to provide the app features you request.
• Art. 6(1)(a) GDPR and, where applicable, Art. 9(2)(a) GDPR, where you voluntarily enter optional information that may reveal special-category data, as described in Section 4.
• Art. 6(1)(f) GDPR, where processing is necessary for app security, fraud prevention, troubleshooting, or maintaining reliable app functionality.

Retention: local app data remains on your device until you delete it, reset app data in SirPrep, or uninstall the app. The "Reset app data" feature deletes locally stored preferences, saved plans, meal feedback, and local AI usage data from the device. Data included in device or iCloud backups is controlled by your Apple/iOS backup settings.

4. Optional Special-Category Data

Some information you choose to enter in SirPrep may reveal special categories of personal data under Art. 9 GDPR. This may include:

• Health-related information, such as diabetes-friendly preferences, low-FODMAP preferences, nutrition targets, calorie targets, protein targets, fiber targets, weight-related goals, allergies, intolerances, or medical diet needs.
• Religious or philosophical information, such as halal, kosher, vegan, or similar dietary choices, depending on context.

SirPrep does not require you to enter this information. If you choose to use these fields, the data is processed only to personalize your meal plans, grocery lists, and recipe suggestions. Where such information qualifies as special-category data, processing is based on your explicit consent under Art. 9(2)(a) GDPR together with Art. 6(1)(a) GDPR. You may withdraw that consent at any time by deleting the relevant information, resetting app data, uninstalling the app, or contacting the controller.

SirPrep is not a medical device and does not provide medical diagnosis, medical treatment, or professional dietary advice. Meal and nutrition suggestions are informational only.

5. AI Meal and Recipe Generation

When you ask SirPrep to generate a meal plan or recipe steps with AI, the app sends the request through a Supabase Edge Function proxy to Google's Vertex AI / Gemini service.

For meal-plan generation, the data sent may include:

• Planning days and meal slots.
• Household size and meals per day.
• Weekly budget.
• Preferred meal styles.
• Kitchen equipment.
• Saved ingredient exclusions and one-time exclusions.
• Weekly context options.
• Freeform notes you enter.
• A pseudonymous app or subscription user identifier for quota and entitlement checks.

For recipe-step generation, the data sent may include:

• Selected meal title.
• Cook time.
• Ingredients and amounts.

You should not include names, addresses, contact details, or other direct identifiers in freeform notes unless strictly necessary.

Purpose:

• Generating personalized meal plans and recipe steps.
• Enforcing AI usage quotas.
• Checking whether a Pro subscription removes or increases usage limits.
• Troubleshooting failed or incomplete generation requests.

Legal basis:

• Art. 6(1)(b) GDPR, because AI generation is part of the app functionality you request.
• Art. 6(1)(f) GDPR for quota enforcement, fraud prevention, system security, and troubleshooting.
• Art. 6(1)(a) GDPR and Art. 9(2)(a) GDPR where your prompt includes optional special-category information such as health, religious, or philosophical dietary preferences.

Google's AI output is used only to provide meal and recipe suggestions. SirPrep does not use AI to make legally binding decisions about you, and it does not carry out automated decision-making within the meaning of Art. 22 GDPR that produces legal or similarly significant effects.

6. Subscriptions, Payments, and Purchase Validation

SirPrep offers paid subscription features through Apple's App Store and RevenueCat.

Apple App Store

Payments are handled by Apple through your Apple ID. SirPrep does not receive or store your full payment card details. Apple may process Apple account data, purchase history, device information, payment information, and fraud-prevention information under Apple's own privacy terms.

Provider: Apple Distribution International Ltd., Ireland, and Apple group companies.

Purpose: app distribution, in-app purchases, subscriptions, refunds, and fraud prevention.

Legal basis for SirPrep's related processing: Art. 6(1)(b) GDPR for subscription access and Art. 6(1)(c) GDPR where legal retention obligations apply.

RevenueCat

SirPrep uses RevenueCat to manage subscriptions, validate App Store receipts, restore purchases, display paywalls, and determine whether you have an active SirPrep Pro entitlement.

Provider: RevenueCat, Inc., USA.

Data processed may include:

• Pseudonymous app user ID.
• App Store receipt and transaction information.
• Product identifiers.
• Subscription status and entitlement status.
• Restore-purchase events.
• Technical device and app information needed for subscription management.

Purpose: subscription management, purchase validation, entitlement verification, restore purchases, customer center functionality, and fraud prevention.

Legal basis: Art. 6(1)(b) GDPR for subscription functionality and Art. 6(1)(f) GDPR for fraud prevention and reliable operation of subscription features.

7. Server-Side Quota and Backend Processing

SirPrep uses Supabase for backend infrastructure, specifically an Edge Function proxy and server-side AI usage quota records.

Provider: Supabase, Inc., USA.

Data processed may include:

• Pseudonymous app user ID.
• Date of AI generation.
• Number of generated meals reserved, used, or refunded.
• Request metadata processed by the Edge Function to route AI generation requests.
• Technical logs needed to operate, secure, and troubleshoot the backend.

Purpose: protecting the AI API key, routing AI requests, enforcing free-plan AI quotas, checking Pro entitlement status, preventing abuse, and maintaining service reliability.

Legal basis: Art. 6(1)(b) GDPR for providing requested AI and subscription-related functionality and Art. 6(1)(f) GDPR for security, quota enforcement, abuse prevention, and troubleshooting.

Retention: server-side AI quota data is retained for as long as needed to provide the app, enforce current usage limits, prevent abuse, troubleshoot issues, handle legal claims, and comply with legal obligations. Where data is no longer needed, it is deleted or anonymized. You may request deletion of server-side data associated with your pseudonymous app user ID by contacting the controller.

8. Email and Support Requests

If you contact the controller by email or another support channel, we process the contact details and message content you provide.

Purpose: responding to your request, providing support, handling rights requests, and documenting the communication where necessary.

Legal basis:

• Art. 6(1)(b) GDPR where the request relates to use of the app or a subscription.
• Art. 6(1)(f) GDPR for general support, documentation, and defense of legal claims.
• Art. 6(1)(c) GDPR where we must retain or process information to comply with a legal obligation.

Retention: support communications are retained for as long as needed to answer the request and, where necessary, for statutory limitation, accounting, or documentation periods.

9. Access to and Storage on Your Device under the TDDDG

SirPrep stores and reads information on your device, including local app data and a pseudonymous app or subscription user identifier. This storage is necessary to provide the app features you expressly request, such as saving preferences, restoring plans, managing subscriptions, and enforcing AI usage quotas.

To the extent the TDDDG applies, this strictly necessary local storage is based on Section 25(2) TDDDG and does not require separate consent. SirPrep does not currently use non-essential cookies, advertising identifiers, third-party tracking technologies, or analytics identifiers. If non-essential tracking or analytics technologies are added in the future, SirPrep will request any legally required consent before using them.

10. Third-Party Service Providers

SirPrep currently uses the following relevant third-party service providers:

These providers may engage subprocessors under their own data processing terms.

11. International Data Transfers

Some service providers or their subprocessors may process data outside the European Union or European Economic Area, including in the United States.

Where personal data is transferred to a country outside the EU/EEA, SirPrep relies on appropriate safeguards under Chapter V GDPR, such as:

• An adequacy decision under Art. 45 GDPR, including the EU-US Data Privacy Framework where the recipient is certified and the transfer falls within the certification.
• Standard Contractual Clauses under Art. 46 GDPR.
• Additional technical and organizational safeguards where required.

You may contact the controller to request more information about the safeguards used for international transfers.

12. Data Security

SirPrep uses technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures include:

• Local storage within the iOS app sandbox.
• TLS/HTTPS for network communication.
• Server-side handling of secret API keys, so sensitive AI keys are not embedded in the app binary.
• Pseudonymous identifiers instead of direct account identifiers where possible.
• Limiting third-party services to those needed for app functionality.

No method of electronic storage or transmission is completely secure, but we work to keep processing proportionate and protected.

13. Your Rights

Subject to the legal requirements and limitations of the GDPR, you have the following rights:

• Right of access under Art. 15 GDPR.
• Right to rectification under Art. 16 GDPR.
• Right to erasure under Art. 17 GDPR.
• Right to restriction of processing under Art. 18 GDPR.
• Right to data portability under Art. 20 GDPR.
• Right to object under Art. 21 GDPR.
• Right to withdraw consent at any time under Art. 7(3) GDPR, without affecting processing that occurred before withdrawal.
• Right not to be subject to qualifying automated individual decision-making under Art. 22 GDPR.
• Right to lodge a complaint with a supervisory authority under Art. 77 GDPR.

To exercise your rights, contact: info.foodb@gmail.com

Because SirPrep currently does not require accounts, the controller may need information that helps identify the relevant data, such as your pseudonymous app user ID, subscription transaction information, support email address, or other details you provide.

You may also contact the competent data protection supervisory authority. For a private controller established in Bavaria, this is generally:

Bayerisches Landesamt fuer Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: https://www.lda.bayern.de/

You may also lodge a complaint with any other competent data protection authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

14. Required or Optional Data

You are not legally required to provide personal data to use SirPrep. However, certain information is necessary for specific features:

• Without meal preferences, SirPrep cannot personalize meal plans.
• Without optional diet or nutrition details, SirPrep can still generate more general meal suggestions.
• Without AI prompt data, SirPrep cannot generate AI meal plans or AI recipe steps.
• Without subscription or purchase validation data, SirPrep cannot unlock or restore Pro features.

15. Children

SirPrep is not directed to children under 16. If you are under 16, you should use SirPrep only with consent from a parent or legal guardian. We do not knowingly collect personal data from children under 16 without appropriate consent. If you believe a child has provided personal data without appropriate consent, please contact the controller so the data can be deleted where required.

16. Changes to This Privacy Policy

This Privacy Policy may be updated when SirPrep changes its features, service providers, or data processing practices, or when legal requirements change. The latest version will be identified by the "Last updated" date above.