Privacy Policy

With this privacy policy we inform you, in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the Austrian Data Protection Act (DSG), about which personal data we process, for what purpose and on what legal basis. You will also learn which rights you have. The policy applies jointly to our website and our mobile app, as both access the same backend.

1. Controller and contact

The controller within the meaning of the GDPR is:

Name

Michael Wagner (sole trader)

Address

Hans Handl-Gasse 4/18, 3100 St. Pölten, Austria

Email

office@royal-food-club.com

Phone

+43 665 672 352 78

There is no statutory obligation to appoint a data protection officer; given the scope of the processing, none has therefore been designated. For all questions about data protection you can reach us at the email address given above. Further details can be found in the legal notice.

2. Overview and scope

This privacy policy applies to the processing of personal data via:

• the website royal-food-club.com,
• the Royal Food Club app for iOS and Android,
• the shared backend/API (api.royal-food-club.com), which processes the data of both systems.

Where the processing differs between website and app, we point this out separately. Many features (browsing recipes, viewing profiles) can be used without an account; an account is only required for your own contributions, ratings, comments and the download of recipe PDFs.

3. Legal bases

We process your data only if at least one of the following legal bases applies:

• Consent (Art. 6(1)(a) GDPR) – e.g. for audience measurement on our website (Matomo), for usage analytics in the app (TelemetryDeck) and for optional features such as push notifications or playing embedded YouTube videos.
• Performance of a contract (Art. 6(1)(b) GDPR) – to provide your account and the community features.
• Legal obligation (Art. 6(1)(c) GDPR) – e.g. statutory retention obligations and obligations to provide evidence under the Digital Services Act.
• Legitimate interest (Art. 6(1)(f) GDPR) – e.g. for operational security, error analysis and protecting the platform against misuse.

The Terms of Use are not consent. By registering, you enter into a user agreement with us; we process what is necessary for its performance on that basis. However, your acceptance of the Terms of Use is not consent under data protection law, and we do not make use of the platform conditional on consent to processing that is not necessary for the contract (Art. 7(4) GDPR). Where we rely on consent, we ask for it separately, and you can withdraw it at any time with effect for the future. This privacy policy itself is information pursuant to Art. 13 and 14 GDPR – you do not have to "agree" to it.

4. What data we process

Depending on use, we process in particular the following categories of data:

• Account data: username, your handle (public, unique name with @) including former handles (see section 8), email address including its confirmation status, password (stored exclusively in hashed form) and profile picture; optionally first and last name (visible only to you), gender, diet, "About me" text, quote and links to your social media profiles; in addition, the time of registration and of the last sign-in, and the time and edition in which you accepted the Terms of Use and took note of this privacy policy.
• Sign-in data from third-party providers: when logging in via Google/Apple, the provider identifier, name and email address transmitted by them and – in the case of Google – your profile picture there.
• Content data: recipes, ingredients, comments, ratings, Food Snaps and personal notes created by you.
• Settings: your app settings including the visibility and privacy switches (see Section 9).
• Status and progress data: rank achieved, badges awarded, counts relating to recipes, likes and followers, and the status of an active subscription.
• Usage data: which recipes you have seen in the feed, opened or cooked, and the likes you have given. For each recipe and event type, at most one entry per 20 minutes is recorded (see Section 11).
• Authentication data: long-lived access tokens to keep you signed in, each with the name of the device or application and the time of last use.
• Technical data: to a limited and partly anonymised extent, IP address, device/browser information, time of use, error and crash data.
• Moderation data: reports received and measures taken by us, including the reasons (see Section 10).
• Subscription data: for a Royal Sparkle Upgrade, the store, the product identifier, the store's transaction or purchase identifier, status and expiry date (see Section 22). We do not receive payment data.
• Communication data: messages you send us via the contact form, the beta form or by email (see Section 30), and your beta feedback in the app.
• Advertising statistics: aggregated totals of impressions and taps on advertising placements and a pseudonymous reach count (see Section 15). We do not process advertising or tracking identifiers.

Diet. In the app you can voluntarily choose a diet (e.g. vegetarian or vegan). It serves exclusively to restrict the feed to suitable recipes. We do not use it for advertising, we do not pass it on, and we draw no conclusions from it about health, religion or philosophical beliefs. You can change or remove this information at any time.

5. Registration and user account

For an account, we process the account data you provide. The purpose is the provision and administration of your account and the use of the community features. The legal basis is Art. 6(1)(b) GDPR (contract). Your password is never stored in plain text. You can have your account deleted at any time via the app or via the page Delete account (in German).

Required and voluntary information. For an account we need a username and either an email address with a password or sign-in via Google or Apple; without this information no account can be created. All other information – profile picture, profile texts, gender, name, diet, social media links – is voluntary. Large parts of the platform can also be used entirely without an account.

When the app is first started, we additionally create an anonymous device account, which permits read-only access and contains no information provided by you. It serves to make the app usable without signing in and at the same time serves as the starting identity after signing out. The legal basis is Art. 6(1)(f) GDPR (provision of access without sign-in).

This anonymous device account also collects usage data to the extent described above – the likes given (20 at most) and the information about which recipes were seen in the feed, opened or cooked. If you register or sign in, we transfer this data to the account you sign in to; the anonymous device account retains none of it, and a recipe that both accounts have liked remains a single like. This happens on every sign-in, not only on the first registration, and without a separate prompt; the app points this out at the moment it reports the anonymous account's like limit. The purpose is that use begun without signing in is not lost; the legal basis is Art. 6(1)(b) GDPR. As the transfer is tied to the device and not to a person, usage data also ends up on your account in this way if another person previously browsed on the same device without signing in.

6. Confirmation of the email address

After a registration with an email address, we send a confirmation link to that address. In doing so, we process your email address, a signed confirmation link that is valid for a limited time, and the time of confirmation. The purposes are:

• ensuring that the address provided actually belongs to you,
• the protection of third parties whose address was entered by mistake or deliberately – until confirmation we send no further messages to the address other than the confirmation email itself,
• avoiding permanently stored data on accounts whose address was never confirmed (principle of storage limitation, Art. 5(1)(e) GDPR).

The confirmation link is valid for 48 hours; you can request a new one at any time. Before the deadline expires, we expressly point out the impending deletion to you in the app three times – seven days, three days and one day beforehand. If you change your email address, the new address only takes effect once it has been confirmed; until then the previous address remains the relevant one for sign-in and for sending messages.

On anonymisation, your name, your email address and all other information about you are irrevocably replaced by placeholder values; all access tokens are revoked. The process runs automatically. It does not involve automated individual decision-making within the meaning of Art. 22 GDPR, as the only thing evaluated is whether your confirmation has failed to arrive.

The legal basis for the processing until deletion is Art. 6(1)(b) GDPR (performance of the user agreement) and Art. 6(1)(f) GDPR (protection against misuse and protection of uninvolved third parties); the reason for the deletion is the principle of storage limitation under Art. 5(1)(e) GDPR. The details of the deadline are set out in point 4 of the Terms of Use.

7. Signing in via Google and Apple

Alternatively, you can sign in via your Google or Apple account ("social login"). In doing so, the respective provider transmits to us a unique identifier and – depending on your selection – name and email address. The provider also tells us whether the email address held with it has already been verified by it; in that case a separate confirmation by us is not required (see Section 6). If Apple provides you with a relay address ("Hide My Email"), we process exclusively that address; your actual address does not become known to us. If you sign in via Google, we adopt your profile picture there as your avatar the first time; you can replace or delete it at any time.

We handle the sign-in directly with the respective provider; no intermediary sign-in service is involved. Our server verifies the authenticity of the sign-in using the public keys of Google or Apple and stores the association of your account with the provider; a refresh token issued by Apple is stored in encrypted form so that we can revoke the authorisation when an account is deleted. The legal basis is Art. 6(1)(b) GDPR. The providers are:

• Google (Google Ireland Ltd. / Google LLC, USA) – Privacy policy
• Apple (Apple Distribution International Ltd. / Apple Inc., USA) – Privacy policy

On the website, the pages for signing in and registering as well as the confirmation steps when changing the email address and when deleting the account embed the sign-in scripts of Google (accounts.google.com) and Apple (appleid.cdn-apple.com) so that these providers' buttons work. As a result, your IP address is transmitted to Google or Apple as soon as these pages are opened – even if you do not use the buttons; in the process, the providers can access sign-ins existing with them in your browser. On all other pages of the website these scripts are not loaded. The legal basis is Art. 6(1)(b) GDPR insofar as you sign in via one of these providers, and otherwise our legitimate interest in offering these sign-in methods (Art. 6(1)(f) GDPR).

If you delete your account, we remove the stored association with the respective provider and – insofar as we hold a corresponding token – revoke the authorisation granted at Apple. With Google, the revocation of the access granted is to be carried out in your Google account; the app assists you in doing so. For transfers to the USA, see the section Data transfers to third countries.

8. User-generated content

Content created by you (recipes, photos, ingredients, comments, ratings) is stored on our systems and – depending on the feature – displayed to other users. Please note that publicly visible content (e.g. published recipes, profile information, comments) can be viewed by other people. Images are delivered via our content delivery network (see Hosting). The legal basis is Art. 6(1)(b) GDPR. You will find the rules on content in the Terms of Use.

Public name (@handle) and recipe address. Every registered account has a unique, public handle – a name preceded by @ – which appears on your profile and can form the address of your profile. Likewise, every recipe has a unique address derived from its title. If you change your handle or the address of a recipe, the old name keeps leading to your account or the recipe and is locked for others for 30 days; we keep this redirect for at most two years. The legal basis is Art. 6(1)(b) GDPR.

Mentions. In comments, in the note on a recipe and in the preparation steps you can name people with @handle and recipes with #address. People mentioned and the owners of recipes mentioned are notified. The name is part of the text as it was written; we do not alter text written by other people. If you delete your account, your handle is removed and locked for others for 30 days; mentions of your handle in other people's texts remain but no longer lead to your profile (see Retention periods). If you want such a mention removed, write to us.

Personal notes on preparation steps are intended exclusively for you: they are delivered only if the request is made with your own access token, and they appear neither on public pages nor in PDF output for other people.

Importing and exporting recipes. On the page Import & Export (in German) you can upload an archive from the recipe manager Mealie in order to bring your recipes across, or export your recipes for Mealie. We process the archive exclusively on our own systems in order to create recipes in your account from it; we do not establish a connection to any Mealie server. The uploaded archive, the export file generated and the associated report are automatically deleted after 7 days. The legal basis is Art. 6(1)(b) GDPR.

Video links and embedded YouTube videos. Authorised users can add to a recipe a link to a video on YouTube, Instagram or TikTok. The link is stored with the recipe; in the app, an icon opens it in the provider's app or in the browser, where that provider's privacy terms apply. A YouTube video can additionally be played within the app. For this we use a two-click solution: until you tap "Play", no connection to YouTube is established and no preview image is loaded from there. Only upon tapping does the app load the player from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode (youtube-nocookie.com); in doing so, the app establishes connections to Google servers, and in particular your IP address, device information and the identifier of the video are transmitted to Google, including to the USA (see Data transfers to third countries), and YouTube may store data on your device. The legal basis is your consent given by tapping "Play" (Art. 6(1)(a) GDPR, Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021)); it applies to the respective video.

9. Visibility and privacy settings

You control for yourself how visible you and your content are. You will find the following switches in the app under Settings → Privacy. They affect not only the display but already the output of our API – the information concerned is therefore not delivered to other applications in the first place:

• Not discoverable in search. Your profile no longer appears in search results. It otherwise remains public and reachable via its link.
• Do not show whom I follow. Your follow lists are no longer output.
• No avatar on the recipe PDF. No profile picture is shown on PDF output of your recipes.
• Do not take part in "King of the Week". Your recipes are excluded from the weekly award and are not featured on our social media channels. Details on this are set out in Section 21.
• Private recipes and ingredients. Private recipes are neither discoverable nor publicly retrievable, do not appear in other people's cookbook collections and do not count towards public counts.

The purpose is the exercise of your choice over the visibility of your data; the legal basis is Art. 6(1)(b) GDPR. A revocation is possible at any time by flipping the respective switch back. Please note that a restriction only takes effect for the future: content that was previously public may already have been indexed by search engines or copied by other people – we have no influence over that.

10. Deactivation of the account and moderation

Deactivation by you

You can deactivate your account without deleting it. A deactivated account is output by our API only in reduced form: profile picture and username are no longer delivered (in their place it says "Deactivated user"; in German: "Deaktivierter Benutzer"), the profile can no longer be retrieved, it does not appear in search, and your comments are no longer displayed. Your ratings remain in place without picture and name; public counts remain visible.

Deactivation is not deletion. Your data remains stored, because precisely that is the prerequisite for you being able to fully restore the previous state via the "Reactivate account" button. The legal basis is Art. 6(1)(b) GDPR. If, by contrast, you want your data to be actually removed, use deletion (see Your rights).

Moderation measures

If content violates the Terms of Use or applicable law, we can deactivate it: ratings, comments and Food Snaps are then no longer displayed, recipes are set to private and locked in that state, and ingredients are removed from the selection list. An account can be forcibly deactivated; in that case the reactivation button is not available to you.

Deactivated content is not deleted but continues to be stored. This is necessary in order to be able to substantiate the measure, examine a complaint against it and comply with the documentation and statement-of-reasons obligations of the Digital Services Act (Regulation (EU) 2022/2065). The legal basis is Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legal defence and protection of the platform and its users). We inform you of every such measure affecting your content or your account, stating the reasons (Art. 17 Digital Services Act) – in the app, as a push notification if you allow them, and by email if your address is confirmed and you have not switched off notification emails. The reasons are documented together with the measure. The procedure is described in point 13 of the Terms of Use.

11. Ranks, badges and evaluation of your activity

To award royal ranks and badges, we evaluate counts relating to your account at regular intervals – in particular your experience points account, which is formed from your interactions and other users' interactions with your recipes and your profile (stored are the source, amount, time and occasion of each event, for instance the recipe concerned and the account involved), and further activity figures such as comments, cookbooks, Food Snaps or follower numbers. Your interactions are also recorded in the experience points account of the person whose recipe or profile you interact with. The result is a rank and a set of badges that are assigned to your profile and publicly displayed there. Entries in other persons' experience points accounts that name your account as their occasion remain after the deletion of your account as a mere identifier without personal reference.

This is an evaluation of counts and points entries. It does not involve automated individual decision-making with legal effect under Art. 22 GDPR: the rank solely controls which additional features of the platform are open to you. The purpose is to provide the contractually owed features and to protect the ratings against misuse; the legal basis is Art. 6(1)(b) GDPR. What each level means is set out on the page Royal Ranks (in German).

Independently of this, we evaluate which recipes you have seen in the feed, opened or cooked; for each recipe and event type, at most one entry per 20 minutes counts. The evaluation runs once a night. It determines the order in which recipes are suggested to you in the feed and, beyond that, feeds into the general assessment of how well a recipe is received. It does not feed into your rank or your badges, and it is not shown to other users in personally identifiable form. The purpose is to provide a feed tailored to your interests as a contractually owed feature; the legal basis is Art. 6(1)(b) GDPR. How this data passes from an anonymous device account to a user account is set out in Section 5. The determination of the "King of the Week" additionally takes into account how often a recipe was liked, marked as cooked, rated and – by registered accounts – opened by others; on this and on your right to object, see Section 21.

12. Hosting and infrastructure

For operations, we use carefully selected processors (Art. 28 GDPR) with whom data processing agreements are in place:

• Hetzner (Hetzner Online GmbH, Germany/EU) – hosting of the production environment.
• ALL-INKL.COM (neue medien münnich, Germany/EU) – fallback and development system as well as mail server for sending our transactional emails.
• BunnyCDN (BunnyWay d.o.o., Slovenia/EU; configured for Europe) – storage (storage region Germany) and delivery of images and static content as well as retention of the daily database backups.
• Laravel Forge (Laravel Holdings, Inc., USA) – provisioning, configuration and deployment of our servers. Forge is purely a management layer: in normal operation no user content is processed there, but access to the managed systems is technically not ruled out. For the transfer to the USA, see Third countries.

Upon access, technically necessary access data (e.g. IP address, time) is processed in order to ensure delivery and security. The legal basis is Art. 6(1)(f) GDPR (secure, stable operation).

Protection against misuse. Our API limits the number of requests per period. If such a limit is exceeded or a protective check fails during registration, we log the IP address, any existing account identifier and a hash value of the email address concerned. These logs are deleted after 30 days. The legal basis is Art. 6(1)(f) GDPR (defence against misuse and attacks).

13. Sending of emails

We send two kinds of emails and for this purpose process your email address and the content of the respective message:

• Account emails: confirmation of your email address including a reminder of it, password reset, as well as the confirmation and the notification of a changed email address. They are necessary for operating the account and cannot be unsubscribed from.
• Notification emails: a copy of the notifications that you also receive in the app – for instance about new followers, comments, mentions, ratings and Food Snaps on your recipes, a new rank or a new badge, the "King of the Week", a completed data export, moderation decisions or our reply to a report. They go only to confirmed addresses and can be switched off via the unsubscribe link in each of these emails or in the settings.

They are sent via the mail server of our hosting provider ALL-INKL.COM (neue medien münnich, Germany/EU), with which a data processing agreement is in place (see Hosting and infrastructure). The data remains within the EU; no transfer to third countries takes place. We do not send advertising newsletters, and opening and click behaviour in our emails is not evaluated. The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement) or Art. 6(1)(f) GDPR (secure operation).

14. Translation of content (DeepL)

To provide content in several languages, we use the translation service DeepL (DeepL SE, Germany/EU) as a processor. Texts that are visible to others or addressed to others are transmitted for translation: titles, notes and preparation steps of public recipes, comments and rating texts, your "About me" text and your quote, names and descriptions of cookbooks, as well as reports and our replies to them. Your name, your email address or your account identifier are not sent along.

Not transmitted are private recipes and content from accounts whose email address has not yet been confirmed. According to its own assurances, DeepL does not process the transmitted texts for its own purposes and does not store them permanently. The legal basis is Art. 6(1)(b) GDPR (multilingual provision of your content as part of the service) and Art. 6(1)(f) GDPR (multilingual offering).

15. Advertising placements by curated partners

Our service is free of charge for you. It is financed from the voluntary Royal Sparkle Upgrade and from a small number of clearly labelled advertising placements by curated partners on the website and in the app. We deliver these placements exclusively from our own infrastructure. No advertising network is integrated.

In concrete terms, this means:

• No advertising cookies and no advertising identifiers (e.g. IDFA, Advertising ID).
• No profiling and no cross-device or cross-website tracking.
• No personalisation: Which placement you see depends on the content of the page and on the country of the request – not on you as a person, your account or your previous behaviour; the country of the request only feeds into the partner reports as a total per campaign and day, never as an attribute of your account. In the app's feed, a placement is based on the recipe it stands next to – not on your diet or your settings.
• No transmission of usage data to advertisers. Partners receive from us exclusively totals: impressions and taps per day and space, as well as the number of accounts reached and the average frequency per account and month. For this reach count we store, per campaign and calendar month, a pseudonymous value (a monthly salted hash of the account ID) that neither leads back to your account nor can be linked across months, and that is deleted after 13 months. It is not combined with account data.

If you click on a partner offer, you leave our service. From that moment the privacy policy of the respective partner applies, over whose processing we have no influence. We do not transmit personal data in the process. The legal basis for delivery and aggregated performance measurement is Art. 6(1)(f) GDPR (financing of a free-of-charge service). With an active Royal Sparkle Upgrade, the feed is automatically free of partner placements (see Section 22). You will find the rules on labelling in the Terms of Use.

Country determination for partner placements. A campaign can be limited by a partner to certain countries. For this purpose we assign your IP address to a country at the moment of the request — using the database MaxMind GeoLite2, which is located on our own infrastructure; no transmission of your IP address to MaxMind takes place. Only the country determined is stored, aggregated per campaign and calendar day as part of the advertising statistics described above. If no country can be determined (e.g. in the case of a private or unassignable IP address), it is treated as unknown, and a country-limited campaign is then not delivered. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in delivery based on content and location rather than on the person).

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

16. Website: audience measurement (Matomo)

On our website we use the self-hosted open-source analytics tool Matomo. The data is processed exclusively on our own infrastructure in Europe; it is not passed on to third parties. We have configured Matomo to be particularly data-minimising:

• Your IP address is anonymised by the last 2 bytes before it is stored.
• Query parameters are removed from referrer URLs.
• No cross-device tracking and no merging with other data sources takes place.

In addition to page views, we record how the website is used. Specifically, this is:

• Interactions: which buttons and links are activated, which entries of the frequently asked questions are expanded, as well as the submission of the contact and beta forms and whether it was successful. We do not evaluate the content of your entries in the process.
• Search terms: the terms you enter into the website's search, together with the number of hits found. This lets us see what is being searched for and what could not be found.
• Reading progress: on longer information pages, how far the page was read (in quarters of the page length).

The purpose is the statistical evaluation of website use in order to improve our service. Matomo is only loaded after you have actively agreed in the consent banner. If you decline or make no decision, no analytics script is loaded and no data for audience measurement is collected. The legal basis is therefore your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deleting the stored decision in your browser's local storage (entry rfc_consent) – the banner then appears again – or by writing to us at office@royal-food-club.com.

17. App: usage analytics (TelemetryDeck)

In the app we use TelemetryDeck (TelemetryDeck GmbH, Germany/EU) for privacy-friendly usage analytics – exclusively if you have consented. The app asks you about this during setup or after a few launches; without your consent nothing is sent to TelemetryDeck. The default setting is "off".

If you have consented, the app transmits:

• a pseudonymous value – for signed-in accounts a hash value of the account identifier, otherwise the hash value of a random identifier that is stored only on your device,
• a random identifier of the respective session,
• app version, platform, version and language of the operating system, as well as the language selected in the app,
• which features of the app are used,
• how often and how long the app is used – on how many days and in how many sessions it was used, the date of first use and how long the sessions lasted – and, once, that the app was newly installed.

The app derives these counts from a record of the days of use and sessions that it keeps on your device for this purpose – only for as long as you have consented.

Not transmitted are your name, your email address, search terms or advertising identifiers; no data is passed on to advertising networks. The purpose is to understand app usage in order to improve the product. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). You can withdraw it at any time in the app under Settings → Privacy; the identifier and the usage record stored on the device are then deleted.

After your account is deleted, the data already transmitted remains with TelemetryDeck until the end of its retention period. It carries only the hash value of the account identifier; that identifier stays with the anonymised account, which no longer holds any information about you, so the data can no longer be attributed to you afterwards. TelemetryDeck offers no deletion of an individual person's data.

18. App: error and crash analysis (Sentry)

To ensure stability, we use Sentry (Functional Software, Inc., USA) in the app. In the event of an error or crash, technical diagnostic data is transmitted: error message and program flow at the point of the error, time, device and operating system information, app version and – for signed-in accounts – the account identifier, so that we can attribute a reported error. In addition, the app measures loading times for a sample of around one fifth of operations. Screenshots, screen recordings, your name or your email address are not transmitted.

The data is stored in Sentry's EU region (Germany). As the provider is based in the USA, access from there – for instance in support cases – cannot be ruled out; see the section Data transfers to third countries. The legal basis is Art. 6(1)(f) GDPR (operational security and error correction); you can object to this processing under Art. 21 GDPR (see Your rights). Sentry runs exclusively in the app; the monitoring of our backend is described in the section Operational monitoring.

You can also object directly in the app: the switch “Absturzberichte senden” (send crash reports) under Settings → Privacy is switched on by default, because the processing is based on legitimate interest. If you switch it off, Sentry is shut down and no longer started – neither error and crash reports nor loading-time measurements are transmitted any more; this takes effect immediately. The switch applies to the device in question and can be switched back on at any time.

19. Backend: operational monitoring (Laravel Nightwatch)

For monitoring our API (api.royal-food-club.com) we use Laravel Nightwatch (Laravel Holdings, Inc., USA). The service runs exclusively in the backend – it is integrated neither into this website nor into the app. Operational data is processed, such as endpoints called, response times, errors and exceptions including technical context, log entries from the level "warning" upwards, background jobs and database queries. A sample of around one tenth of requests is recorded; errors are recorded in full. A recorded request includes the IP address and – for signed-in accounts – the account identifier; we do not transmit your name or email address. The contents of your requests (such as recipe texts or passwords) are not recorded. The purpose is secure and stable operation as well as detecting and fixing errors; the legal basis is Art. 6(1)(f) GDPR. For the transfer to the USA, see the section Data transfers to third countries.

20. App: push notifications

For push notifications we use Pusher Beams (Pusher Ltd., United Kingdom; an adequacy decision of the EU Commission is in place for the United Kingdom), which uses the system services Firebase Cloud Messaging (FCM, Google) on Android and the Apple Push Notification service (APNs, Apple) on iOS. What is processed is a device token, your account identifier and the title and text of the respective notification – these may contain usernames of other people and recipe titles. Push notifications are only sent if you have enabled them on your device or in the app; before that the service is not started. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the device settings. If you delete your account, we unregister it from delivery at the same time. FCM and APNs are operated by providers in the USA (see Third countries).

21. "King of the Week" and our social media channels

Once a week we honour a particularly successful recipe as "King of the Week". The award is given fully automatically – every Saturday at 10:00 (time zone Europe/Vienna) by a program run, without editorial selection and without the involvement of any person on our side.

How the winner is determined

Only activity figures are evaluated – as a rule those of the preceding seven days. For each eligible recipe we form a score from them. What is counted is how many other people, in this period,

• have liked the recipe,
• have marked it as cooked,
• have rated it – a rating earns more points the more stars it awards; ratings of one or two stars earn no points and deduct none either, and ratings hidden by moderation do not count,
• have opened it – here only registered accounts count, and only up to a cap, so that merely opening a recipe does not decide a ranking.

Each person counts at most once per recipe and kind; whatever the owner of the recipe contributes never counts. Each kind enters the total with a fixed point value. The recipe with the highest score wins; in the event of a tie, the older recipe wins. If no recipe achieves a score above zero, there is no award for that week. A recipe is only eligible if it is public, carries an image, is not locked by a moderation measure and the associated account is neither deactivated nor deleted. Each recipe can win at most once. For this purpose we keep a permanent winners' history; it contains the recipe, the account, the calendar week, the kind of crowning, the counts and the score.

Classic. On the last Saturday of a month – from 31 October 2026 – a "classic" is crowned instead of the weekly ranking: what is then evaluated is not one week but the entire lifetime of a recipe so far, and only recipes that are at least eight weeks old can take part. The weekly ranking on the Saturday after that covers two weeks, so that the week of the classic is not lost for new recipes.

The underlying counts are described in Section 11. The evaluation does not constitute automated individual decision-making under Art. 22 GDPR: it neither produces legal effects concerning you nor similarly significantly affects you, but leads solely to an award.

What is published

The award-winning recipe receives a highlighted placement on the website and in the app for a little over a week – until the end of the Sunday after next – and we notify you of the award. In addition, we publish a post on our own social media channels. Only information that is publicly visible on the platform anyway is published:

• the recipe title and the recipe image,
• your username in the text of the post,
• how often the recipe was liked, rated and cooked in the evaluation period,
• a link to the recipe page on our website.

For the post, we generate from the recipe image two image cards in the aspect ratios required by the platforms. Besides the image, they show the recipe title and public details of the recipe – such as categories, preparation time, portions, difficulty, nutritional values and the number of likes and comments. These cards are held with our storage and delivery service provider (see Section 12) and are publicly retrievable via their address. Your profile picture is not shown on the cards, and no link to your profile is set. Private recipes and drafts, your email address, your real name and other account data are not published.

Our channels are operated by the following providers, which process the data arising there on their own responsibility in accordance with their own terms:

• Instagram and Facebook – Meta Platforms Ireland Ltd., Ireland – Privacy policy
• Pinterest – Pinterest Europe Ltd., Ireland – Privacy policy
• LinkedIn – LinkedIn Ireland Unlimited Company, Ireland – Privacy policy
• X – Twitter International Unlimited Company, Ireland – Privacy policy

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in honouring the community and promoting the platform; we have taken your interest in not being named into account by the fact that you can object to participation at any time and without giving reasons and that we only use information that is public anyway.

Your right to object (Art. 21 GDPR)

The switch takes effect for the future: it removes your recipes from all future determinations, but does not remove any posts already published. If you would like a post that has already been published to be removed, write to us – we will then delete it from our channels. Please note that we cannot undo further dissemination by third parties – such as shared posts or screenshots. After a withdrawal of the objection, your account takes part again; however, a recipe that has already received the award cannot win a second time.

If you visit our profiles on these platforms, their operators process data about your visit and provide us with aggregated reach statistics from it. To that extent, joint controllership under Art. 26 GDPR comes into consideration; we have no influence on the processing by the platforms themselves. The parent companies of the providers named are based in the USA (see Third countries).

22. Paid services ("Royal Sparkle Upgrade")

The supporter subscription Royal Sparkle Upgrade is billed via the Apple App Store or Google Play. Payment data such as credit card or bank account details is processed exclusively there – we receive no means of payment and no payment data.

In connection with a subscription we process:

• at purchase, a pseudonymous identifier derived from your account identifier, which the app passes to the store so that the purchase can be assigned to your account,
• to verify the purchase, the transaction identifier (Apple) or the purchase receipt (Google), with which our server asks the store directly whether the subscription exists,
• stored with your account, the store, the product identifier, this purchase identifier, the status (active, cancelled, expired, revoked), the expiry date and whether the subscription renews. The stores inform us automatically about changes – renewal, cancellation, refund.

The purpose is to unlock the features associated with the subscription and to display the marking of your username. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). The scope of services is described in point 10 of the Terms of Use.

Apple and Google respectively are independently responsible for the purchase processing itself; their privacy terms apply. Invoices and payment receipts are held exclusively by the respective store; the billing reports that the stores make available to us contain neither your name nor your means of payment. If the subscription ends, the features cease; we retain the record of the subscription for as long as it is required for clarifying refunds and chargebacks and for fulfilling retention obligations under tax law (see Retention periods).

23. Local storage on the device

Certain data is stored exclusively locally on your device and is not transmitted to us:

• App settings in the device's own settings storage (Shared Preferences) – for instance the selected language and your decision on usage analytics.
• Your sign-in token in an encrypted, secure device storage (Secure Storage).
• an offline copy of your favourites and your own recipes, recipe drafts you have started, as well as a cache of images already loaded.
• the random identifier for usage analytics and the record of the days of use and sessions – only for as long as you have consented to usage analytics (see Section 17).

On the website, your sign-in token is stored in the browser's local storage (localStorage) to keep you signed in; it is not a tracking cookie. In addition, we store there your decision on audience measurement (entry rfc_consent) so that the consent banner does not appear again on every page view. Likewise held only in your browser are remembered filter and display settings as well as a cache of content already loaded. You can remove this data by signing out or by deleting the app/browser data.

A single cookie is, in this context, also transmitted to our server: rfc_session. It contains exclusively the value "1" – that is, neither your sign-in token nor your user identifier, and no information whatsoever about you. It only tells our server that a sign-in exists in this browser. This is necessary so that the page of one of your non-public recipes can be loaded for you at all: our server pre-renders recipe pages without your sign-in and would otherwise answer a private recipe as "not found". The actual loading is then carried out by your browser with the sign-in token, which never leaves the local storage. The cookie is deleted on sign-out and serves neither analysis nor recognition across websites. The legal basis is Section 165(3) TKG 2021 (strictly necessary for the service expressly requested by you) in conjunction with Art. 6(1)(b) GDPR; consent is not required for this, and the consent banner relates exclusively to audience measurement (see Section 16).

24. Data transfers to third countries

We process your data predominantly within the European Union. In individual cases, service providers based in the USA are involved:

• Google (Google LLC) – sign-in via Google, Firebase Cloud Messaging for push on Android and Google Play for the subscription
• Apple (Apple Inc.) – sign-in via Apple, APNs for push on iOS and the App Store for the subscription
• Google (YouTube – only when playing an embedded recipe video) – contractual partner in Ireland, parent company in the USA
• Sentry (Functional Software, Inc. – error and crash analysis in the app) – storage in the EU region (Germany), provider based in the USA
• Laravel Holdings, Inc. (Laravel Forge and Laravel Nightwatch) – USA
• Meta, Pinterest, LinkedIn and X (our social media channels) – contractual partners in Ireland/EU, parent companies in the USA

For the USA, an adequacy decision of the EU Commission has been in place since 10 July 2023 (EU-US Data Privacy Framework, Art. 45 GDPR). It applies to companies that have certified themselves under this framework; whether this applies to a recipient can be checked at dataprivacyframework.gov. Insofar as a recipient is not certified – and as a precaution in case the decision is annulled – we base the transfer on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards on request at office@royal-food-club.com.

Pusher Ltd. (push notifications) is based in the United Kingdom. The EU Commission has issued an adequacy decision for the United Kingdom (most recently extended until 27 December 2031); the transfer takes place on this basis. Insofar as Pusher uses sub-processors outside the EU and the United Kingdom in the process, the standard contractual clauses apply to this.

Despite these measures, a level of data protection comparable to that of the EU cannot be guaranteed in third countries in all cases; in particular, authorities there may access data under certain conditions. Wherever it was possible, we have therefore chosen European providers or European storage locations.

25. Retention periods

We store personal data only for as long as is necessary for the respective purposes or as statutory retention periods exist.

• Account data and content: for the duration of your account; after its deletion they are removed or anonymised, insofar as no statutory obligations stand in the way. Name, email address, profile texts and profile picture are deleted or replaced by placeholders, and access tokens and the link to Google or Apple are removed. Also deleted are your social media links, saved filters and diet, personal notes, cookbooks, notifications – including other people's notifications that name your username – and your settings; only the two switches "Not discoverable in search" and "Do not show whom I follow" remain, because they continue to apply to the remaining contributions. Published recipes remain in place without attribution to you as a person, unless you choose the option "Set my recipes to private" when deleting; likewise, your comments, ratings and Food Snaps remain in place under the designation "Deleted user" (in German: "Gelöschter Benutzer"), because they are part of other people's conversations and ratings. If you want individual contributions to be removed, delete them before the account or write to us. Your handle is removed and locked for others for 30 days. Mentions of your handle (@handle) in the text of other people's comments, recipes and preparation steps remain unchanged, because we do not edit other people's texts; the link to your profile is removed.
• Unconfirmed registrations: at most 14 days from registration; after that the account is anonymised automatically (see Section 6).
• Anonymous device accounts: are deleted when they have not been used for 90 days and hold no content.
• Deactivated accounts: until reactivation or deletion. Deactivation is not deletion.
• Deactivated content and moderation cases: for as long as is necessary for proving the measure, a complaint procedure and the fulfilment of the obligations under the Digital Services Act.
• Usage data: which recipes you have seen, opened, cooked or liked, for the duration of the account; the day-by-day count of your activity 400 days. After your account is deleted, this data is kept in pseudonymised form: it is then attached only to the identifier of the anonymised account, which no longer contains any information about you, and continues to feed counts and the ranking of recipes.
• Access tokens: until you sign out or the account is deleted; they do not expire on their own.
• Data export archive: 7 days from completion; after that the archive and the status entry are deleted automatically. You can delete the archive yourself at any time before then; when your account is deleted, it is removed in any case (see Section 26). The same applies to archives and reports of the recipe import and export.
• Deleted images: are permanently removed within 24 hours; images of deleted recipes and their Food Snaps after 14 days.
• Logs for defence against misuse: 30 days (see Section 12).
• Application logs of our interface: 14 days. Only two logs with a purpose of their own are kept longer: logs of subscription purchases (matching a store purchase to an account identifier; store references only as a hash) 30 days for clarifying incorrect charges, and logs of the "King of the Week" publications (identifier of the winner entry, platform, result) 90 days.
• Backups: We retain daily backups of the database for 30 days. Deleted data may still be contained in a backup for that long; it is no longer used and is overwritten together with the backup.
• Subscription records: for the duration of the account and beyond that, for as long as they are required for clarifying refunds and under the retention obligations of tax law (seven years, Section 132 of the Austrian Federal Fiscal Code (BAO)).
• Messages to us and business records: see Section 30 and Section 31.
• "King of the Week": we retain the winners' history (recipe, account, calendar week, counts and score) permanently, because it also ensures that a recipe is only honoured once. The image cards generated remain stored for as long as the associated post exists. Posts on our channels remain in place until they are deleted by us or at your request (see Section 21).
• Usage analytics as well as operational and error monitoring (Matomo, TelemetryDeck, Sentry, Laravel Nightwatch): only for the period required for evaluation, followed by deletion.
• Advertising statistics: aggregated totals without reference to individuals are retained permanently; the pseudonymous reach count (Section 15) is deleted after 13 months.

26. Your rights and data export

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) – among other things via Delete account (in German) or the app
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR) – in particular to being featured as "King of the Week" (see Section 21)
• Withdrawal of consents given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to office@royal-food-club.com is sufficient. We reply without undue delay, at the latest within one month of receipt of your request (Art. 12(3) GDPR). To protect your account, we may require proof of your identity for this – for instance a request from the email address held with us.

You can delete individual content yourself, without a request and without deleting your account: your recipes, comments, ratings, Food Snaps, personal notes and cookbooks can each be deleted in the app. What then happens to deleted images is set out under Retention periods.

Data export: your copy of your data for self-service collection

You do not have to write to us to obtain a copy of your data. In the app under Settings → Account → Data export and on the website under Import & Export (in German) you can at any time yourself request a complete download of all data stored for your account. We compile the archive in the background and notify you in the app – and by email, provided your address is confirmed – as soon as it is ready; you can then download it where you requested it. In this way you exercise your right of access (Art. 15 GDPR) and your right to data portability (Art. 20 GDPR) directly yourself.

The archive is a ZIP file with one JSON file per subject area – that is, in a structured, commonly used and machine-readable format. It contains:

• profile including handle and former handles, agreements given and account status, settings, linked sign-in services (Google, Apple) and saved filters,
• your recipes with address, preparation steps, ingredients, tags and nutritional values, your personal notes and your cookbooks,
• your comments, ratings, Food Snaps and likes,
• your usage history (recipes viewed, opened and cooked),
• who follows you and whom you follow – in each case only the public username,
• ingredients and units created by you, badges awarded and your rank,
• notifications, your reports and your beta feedback,
• a list of all images uploaded by you, with download links.

Images are provided as links, not as files in the archive – that keeps it small. Links to non-public images are signed and expire after about 60 days; so download these images within that period.

Not included are machine-generated translations of your texts (they are system data generated by us and do not originate from you), your password and your access tokens, the sign-in data from Apple or Google, rating metrics calculated internally by the platform, the identity of moderators, as well as data of other people beyond their public username. These restrictions follow Art. 15(4) GDPR and Recital 63: your right of access must not adversely affect the rights and freedoms of others.

The data export is available to registered accounts in the app and on the website. Anyone who uses the app without registration can take over the anonymous usage history by registering – it is then part of the export of the registered account (see Section 5). As long as an account is deactivated, the feature is suspended; reactivate it or contact us. For the same information, an email to the address given above is also sufficient at any time.

27. Right to lodge a complaint

If you are of the opinion that the processing of your data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Austria this is the:

Authority

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)

Address

Barichgasse 40–42, 1030 Vienna, Austria

Web

dsb.gv.at

28. Minors

Our service is not directed at children under 14. Persons under 14 may not create an account or transmit personal data without the consent of their legal guardians (Section 4(4) of the Austrian Data Protection Act (DSG)). If we become aware that data of a data subject below this age limit is being processed without the required consent, we delete it.

The app is also offered outside Austria. The age from which minors can themselves consent to data processing is set differently by the Member States of the European Union (between 13 and 16 years, Art. 8 GDPR). If the law of the state in which you have your habitual residence provides for an age higher than 14, you need, until that age, the consent of your legal guardians for all processing that we base on consent – such as usage analytics or push notifications. Legal guardians can contact office@royal-food-club.com at any time; we then delete the child's account.

29. Data security

We take appropriate technical and organisational measures to protect your data, in particular transport encryption (TLS/HTTPS), hashed storage of passwords, encrypted storage of the access tokens on your device, daily backups and an infrastructure oriented towards Europe.

Only the operator and persons whom the operator has entrusted with moderation or operations have access to personal data; they are bound to data secrecy (Section 6 DSG) and receive only the permissions their task requires. Advertising partners see, via their access, exclusively totals of their own campaigns and no data of individual users.

30. Contact form, beta sign-up and emails to us

If you write to us via the contact form (in German), via the form for beta sign-up or by email, we process the information you provide in doing so – name, email address, subject or device platform and your message – in order to deal with your enquiry. The forms store nothing in a database: your message is delivered as an email to our mailbox (mail server at ALL-INKL.COM, Germany/EU; see Section 12).

The legal basis is your consent, which you give when submitting the form (Art. 6(1)(a) GDPR), as well as Art. 6(1)(b) GDPR insofar as your enquiry is directed at a contract with us. If you write to us directly by email, we answer your message on the basis of our legitimate interest in doing so (Art. 6(1)(f) GDPR). You can withdraw your consent at any time; we then delete your message, insofar as no retention obligation stands in the way.

To ward off spam, the forms automatically check whether a submission comes from a human. In the case of a rejected submission we log the IP address. We delete your message as soon as your enquiry has been dealt with, at the latest after twelve months. We keep it longer only if it is needed for a contract or for the assertion or defence of legal claims, or if a statutory retention obligation exists.

31. Advertising partners, business contacts and accounting

Of contact persons at our advertising partners and other business partners, we process contact data (name, function, business email address and telephone number), the correspondence as well as contract and invoice data. If a partner receives access in order to view the key figures of its campaigns, we additionally process the data of that account. The purpose is the initiation and performance of the cooperation as well as billing. The legal basis is Art. 6(1)(b) GDPR, in the case of contact persons of a company our legitimate interest in the cooperation (Art. 6(1)(f) GDPR), and for retention Art. 6(1)(c) GDPR.

Recipients of this data are – insofar as necessary – our tax advisers, who are bound by statutory confidentiality, the tax authorities, and banks in payment transactions. We retain invoices and accounting records for seven years (Section 132 of the Austrian Federal Fiscal Code (BAO)); we delete other correspondence at the latest three years after the end of the cooperation.

32. Changes to this privacy policy

We adapt this privacy policy when our processing or the legal framework changes. The current version published on this page applies in each case. In the event of material changes, we will inform you in an appropriate manner.