Skip to main content
Cove

Cove Privacy Policy

Last Updated: October 2026

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Patrick Böttge
Ferdinand-Rhode-Str. 5
04107 Leipzig
Email: [email protected]

2. Introduction

Welcome to our app. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, and protect your data when you use our mobile application, in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Data Collection & Storage

Our app is privacy-first. By default, your personal content (recipes, shopping lists, weekly plan, settings, and images) is stored locally on your device. As long as you do not create an account and do not use the AI features, this content does not leave your device.

In the following cases, data is transmitted to our servers (Supabase) or to AI service providers and processed or temporarily cached there:

  • Cloud sync: If you create an account and own a paid unlock (Collector or Chef), your content is stored on our servers to enable cross-device synchronization (see Section 4).

  • AI-powered features: When you use the AI features (recipe import), the respective inputs are transmitted to AI service providers and the results are cached (see Section 5).

  • Push notifications: If you allow notifications, a push token for your device is stored on our servers so we can let you know, for example, when a recipe import is ready or support has replied (see Section 7).

When the app connects to third-party services (see Section 7), technical data such as your IP address is also transmitted as part of the connection. This is necessary for the technical delivery of the service.

4. Accounts & Cloud Sync

Using the app is generally possible without a personal account. On first launch, the app signs you in anonymously; this generates only a random identifier that contains no personal data. It is technically required to secure server access and to provide the AI features.

Optionally, you can create an account to synchronize your content across devices. The following sign-in methods are available:

  • Email (magic link / one-time code)
  • Sign in with Apple (iOS only)
  • Sign in with Google

In this case we process your email address or the identifier provided by Apple or Google, along with an account identifier. Cloud synchronization of your content (recipes, shopping lists, weekly plan, categories, and more) occurs only when you are signed in and own a paid unlock (Collector or Chef). The data is then stored in our database (Supabase) so it can be reconciled across your devices. You can delete your account and the associated data at any time (see Section 11).

Legal basis: Art. 6(1)(b) GDPR (performance of contract).

5. AI-Powered Features

The app offers optional AI-powered features. These run only when you actively use them:

  • Recipe import: Content you provide (photos, PDF documents, text, or links to public social media posts) is analyzed to extract a structured recipe. For video/audio content, an audio transcription may additionally be performed.

To provide these features, we transmit the respective inputs to the following AI service providers:

  • OpenAI (USA): Language models (GPT) for recipe extraction, and Whisper for audio transcription.
  • Google (USA): Language models (Gemini) for recipe extraction.

Which provider is used in a given case depends on the feature and availability; if one provider fails, another may serve as a fallback. Only the content required for the respective feature is transmitted; other content stored locally is not transferred.

The transmitted content is processed to carry out the feature you requested. To improve efficiency and limit costs, we store the results for a limited time in a content-based cache (see Section 9) that is not associated with any user or account identifier. For cost control and abuse prevention, we record the volume of AI usage (e.g. timestamp, model used, and cost) in aggregated form that is not linked to your account. The named providers process the data for the purposes set out in their respective privacy policies; we recommend reviewing them.

Legal basis: Art. 6(1)(b) GDPR (performance of the feature you requested). For international transfers, see Section 8.

We process data on the following legal bases under Art. 6(1) GDPR:

  • Performance of contract (Art. 6(1)(b)): For processing in-app purchases via the respective app stores, for providing accounts and cross-device synchronization (see Section 4), for the AI features you initiate (see Section 5), and for push notifications you have allowed (see Section 7).

  • Consent (Art. 6(1)(a)): For diagnostics and crash reporting via Sentry, off by default and active only if you enable it; you can withdraw your consent at any time in the app settings.

  • Legitimate interest (Art. 6(1)(f)): For loading default data via Supabase (to provide core app functionality), and for the short-term caching of AI results (to optimize efficiency and cost). You may object to processing based on legitimate interest at any time (see Section 11).

7. Third-Party Services

To provide and improve the app, we use the following third-party services:

  • Supabase: Backend service for providing default ingredient and category data, for anonymous and account-based authentication, for the optional cloud synchronization of your content (only with an account and a paid unlock), for processing and logging the AI features, and for sending push notifications. Data is stored in the EU region (Frankfurt). Processes, among other things, account and device identifiers, push tokens, your IP address, your synchronized content where applicable, and technical processing data. Legal basis: Art. 6(1)(b) and (f) GDPR.

  • OpenAI: Language models (GPT) and audio transcription (Whisper) for AI-powered recipe extraction and transcription. The inputs required for the respective feature are transmitted (see Section 5). Legal basis: Art. 6(1)(b) GDPR.

  • Google: Language models (Gemini) for AI-powered recipe extraction. The inputs required for the respective feature are transmitted (see Section 5). Legal basis: Art. 6(1)(b) GDPR.

  • Sentry: Used for error and crash reporting to improve app stability, and only active if you opt in (off by default; toggle in the app’s data settings). Collects technical data such as device type, operating system version, and crash logs; IP addresses are not collected and no personal content (recipes, images, etc.) is transmitted. Legal basis: Art. 6(1)(a) GDPR (consent).

  • Apple Push Notification service (iOS) / Google’s Firebase Cloud Messaging (Android): Delivers push notifications, only if you allow notifications. Your device’s push token and the text of the notification are transmitted. Legal basis: Art. 6(1)(b) GDPR.

  • Apple App Store / Google Play Store: Handles payment processing for in-app purchases. Subject to their respective privacy policies. Legal basis: Art. 6(1)(b) GDPR.

8. International Data Transfers

Some of the third-party services listed above (in particular OpenAI and Google for the AI features, Apple and Google for push notifications, and Sentry) are operated by companies based in or processing data in the United States. Supabase stores this app’s data in the EU region (Frankfurt); the company Supabase, Inc. is based in the United States. When data is transferred outside the EU/EEA, it is protected by the EU-US Data Privacy Framework adequacy decision (where the recipient is certified) or by EU Standard Contractual Clauses (SCCs). You may request a copy of the applicable safeguards by contacting us at [email protected].

9. Data Retention

Your personal content (recipes, shopping lists, images) is stored locally on your device and retained until you delete it or uninstall the app.

Stored on our servers:

  • Synchronized content (only with an account and a paid unlock): until you delete it or close your account.
  • Account and device identifiers: for the duration your account exists.
  • Push tokens: until they become invalid or your account is deleted.
  • AI feature results (cache): up to 7 days.
  • Technical processing and usage data for the AI features: retained on a limited basis for billing and abuse-prevention purposes.

Third-party services retain data according to their own policies:

  • Sentry: Crash reports are retained for 90 days.
  • Apple App Store / Google Play Store: Purchase data is retained according to Apple’s or Google’s policy.

We recommend reviewing the privacy policies of these services for detailed retention information.

10. Data Security

The security of your local data depends on the security of your mobile device. We recommend using device encryption and secure lock screens to protect your information. Data transmitted to third-party services is encrypted via HTTPS.

11. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): You may request information about whether and how your data is processed.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your data under certain conditions.
  • Right to restriction of processing (Art. 18 GDPR): You may request that processing be restricted.
  • Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR): You may object to processing based on legitimate interest at any time.
  • Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Your locally stored content can be exported, imported, or deleted at any time through the app settings. If you have created an account, you can delete it together with the data stored on our servers, either through the app or by contacting us at [email protected].

You also have the right to lodge a complaint with a supervisory authority. The responsible authority is:
Sächsische Datenschutz- und Transparenzbeauftragte (SDTB)
Devrientstraße 1, 01067 Dresden
https://www.sdtb.sachsen.de

12. No Tracking, No Advertising, No Data Selling

The app is ad-free and funded through one-time purchases. Accordingly:

  • We do not sell or rent your personal data to third parties.
  • We do not use advertising trackers and do not show personalized ads.
  • We do not build profiles for advertising or marketing purposes.
  • We do not use analytics services to track your usage behavior.

The processing described in this policy serves solely to provide and maintain the app and the features you use.

13. Minors

The app is not directed at children. We do not knowingly collect personal data from children under the age of 16. Where processing requires consent and you are under 16, the consent of your parent or guardian is required.

If we become aware that we have processed a child’s data without the required consent, we will delete it without undue delay. If you believe we hold such data, please contact us at [email protected].

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example when app features, the services we use, or legal requirements change. The current version available in the app applies; the date stated above indicates when it was last updated. We will notify you in an appropriate manner of any material changes. We recommend reviewing this policy periodically.

15. Contact Us

If you have any questions or suggestions about this Privacy Policy, do not hesitate to contact us at [email protected].