Cookiza!
EN
Cookiza!

Privacy Policy

This is a translation. In case of doubt, the German version applies.

This policy applies to the website cookiza.de (Part A) and to the app Cookiza! for iPhone, iPad and Mac (Part B).

Part A: Website · Part B: App · Your rights

Controller

ITnovis – Software Solutions, owner Andre Sendowski
Am Herbeder Sportplatz 13, 58456 Witten, Germany
Email: info@cookiza.de · Phone: +49 2302 39 85 909

Part A: Website

A.1 Visiting the website

When you visit the website, our server processes technically necessary data transmitted by your browser: IP address, date and time, page requested, amount of data transferred, referrer URL, and browser and operating system. We need this data to deliver the website and keep it secure, for example to detect attacks. The legal basis is Art. 6(1)(f) GDPR. Server log files are deleted after 14 days at the latest.

The website and the app server run on a server in the EU. Where a service provider may have access to data, this is based on a data processing agreement under Art. 28 GDPR.

A.2 No cookies, no tracking

The website does not set cookies and does not use any analytics or advertising services. Fonts and images are loaded from our own server.

A.3 Links to the App Store and social networks

The website contains simple links to Apple’s App Store and to Instagram and Facebook. The respective provider’s service is only accessed once you click a link; its privacy policy then applies.

Part B: Cookiza! app

The app connects to our server (connect.cookiza.de). Which data is stored there depends on the features you use.

B.1 User account

For an account, we store your username, email address, an encrypted password (only as a hash, never in plain text), your chosen language and the date of registration. After registration, we send you an email to confirm your address. Optionally, you can provide an author name that appears on your published recipes and comments instead of your username.

Sign in with Apple: If you use “Sign in with Apple”, Apple provides us with a unique identifier and the email address you choose to share. This may also be a relay address generated by Apple. We do not receive your Apple password.

To sign you in to the app, we use time-limited access keys (tokens) that are stored on your device.

The legal basis is Art. 6(1)(b) GDPR (providing the app’s features). We store account data until you have your account deleted.

B.2 Recipes, photos and shopping list

Recipes you create (name, ingredients, preparation, notes, categories, photos) are stored on our server so that you can use them on all your devices. The same applies to your shopping list, which is synced between your devices. This content remains private unless you publish it.

Photos are re-saved on upload and scaled down to a maximum of 2400 pixels. Embedded metadata (EXIF), such as location or camera data, is removed in the process.

The legal basis is Art. 6(1)(b) GDPR. We remove deleted recipes and entries from the server; all your private content is deleted at the latest when your account is deleted.

B.3 Community: published recipes, comments, ratings

When you publish a recipe, write a comment or rate a recipe, the content is visible to other users of the app; recipes and comments are shown together with your username or author name. Ratings are only displayed in aggregate.

Review of uploaded photos: To keep unlawful or inappropriate images out of the app, our server emails every newly uploaded recipe photo to an internal review mailbox. The email contains the photo, the related recipe and your user account. We can block the photo from there. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a safe and lawful community. We delete the review emails as soon as they are no longer needed for the review.

B.4 AI features: recipe import, nutrition facts and recipe ideas

Some features of the app use artificial intelligence. For these, we use the Claude API by Anthropic (Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, USA). Data is only sent to Anthropic when you use one of these features yourself:

We do not send any account data such as your name or email address to Anthropic. Anthropic processes the content and photos as a processor under Art. 28 GDPR solely to generate the result and, under its API terms, does not use them to train its models. The transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For these features, please photograph only the recipe or the food, not people.

The legal basis is Art. 6(1)(b) GDPR, because you start the feature yourself.

B.5 Cookiza! Pro (subscription)

Subscriptions are purchased and paid for exclusively through Apple’s App Store. We do not receive any payment data. To unlock Pro features, the app sends Apple’s purchase confirmation to our server. We verify it with Apple and store the product, the term and the transaction ID with your account. The legal basis is Art. 6(1)(b) GDPR; we store the data for the lifetime of the account and beyond only where tax or commercial retention obligations apply.

B.6 Devices and notifications

When you are signed in, the app registers your device with our server: a random device ID, device name and model, operating system and version, app version, the IP address at registration, and the time of first and last use. This lets us assign your data to the right devices and narrow down errors.

If you allow notifications, we additionally store Apple’s push token and send notifications via the Apple Push Notification service. You can turn off notifications at any time in your device settings. The legal basis is Art. 6(1)(b) GDPR, and for notifications your consent under Art. 6(1)(a) GDPR. Device data is deleted when your account is deleted.

B.7 Server logs

Every time the app connects to our server, the same technical data is generated as when visiting the website (see A.1). It is deleted after 14 days at the latest. Error logs of the server application may in individual cases contain an email address or user ID; they are used solely for troubleshooting and are deleted regularly.

B.8 Apple

The app is distributed through Apple’s App Store. Apple is additionally responsible for downloads, purchases, “Sign in with Apple” and notifications (Apple Distribution International Ltd., Cork, Ireland). Apple’s privacy policy applies.

B.9 Deleting your account

You can request the deletion of your account at any time by emailing info@cookiza.de, preferably from your account’s email address. We will then delete your account, your private recipes, photos, your shopping list and your device data. Published recipes and comments are also deleted or, if you wish, anonymized so that they can no longer be linked to you.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). You can withdraw any consent you have given at any time with effect for the future. Just contact info@cookiza.de.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Contact by email

If you email us, we process your details to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns the use of the app, otherwise Art. 6(1)(f) GDPR. We delete the data as soon as it is no longer needed and no statutory retention obligations apply.

Last updated: 5 October 2026