PRIVACY POLICY

Last updated August 27, 2026

This Privacy Notice explains how Factureal GmbH ("we", "us", "our") processes personal data when you use Schmaus, including:

• our website at https://schmaus.app and public pages linked from it
• the Schmaus mobile app
• related support, legal, and invite pages

If you have questions about this notice or want to exercise your privacy rights, contact us at [email protected].

The Services are intended for users who are at least 16 years of age. If you are under 16, you may not use the Services.

---

1. Controller

The controller for the processing described in this notice is:

Factureal GmbH
Werner-Warsinsky-Str. 9
44534 Lünen
Germany

Email: [email protected] Phone: +4973192702966

We have currently not appointed a data protection officer because we are, at present, not legally required to do so. If this changes, we will update this notice.

---

2. What Data We Process

Depending on how you use Schmaus, we process the following categories of personal data.

Data you provide directly

• phone number, if you sign in via WhatsApp/SMS OTP
• username / display name
• email address, if you sign in via Apple or Google where those sign-in methods are enabled, or otherwise provide one
• recipe content that you create or upload, including text, images, and edits
• audio recordings that you submit for voice-based recipe creation or AI-assisted editing
• dietary preferences and restrictions (for example, allergies, intolerances, or diets), if you choose to provide them during registration or in your profile
• messages you send to the in-app AI chat assistant ("Sous-Chef"), including photos of food or your fridge that you submit for ingredient detection
• content reports you submit, including the selected reason, optional details, the reported content or account reference, and a snapshot of the reported content where needed to investigate the report; for a reported chat assistant reply this snapshot contains the reply and the recent chat messages your device submits with the report as context
• user-block relationships and moderation decisions associated with your account or content
• support and feedback messages, including an optional reply email address and basic app context such as platform, app version, and language
• other communications you send to us

Data we receive from third parties

If you choose a third-party login provider and that provider is enabled for the service, we receive data from that provider. This may include:

• Apple Sign-In data such as Apple user ID, email address, and display name data you choose to share
• Google Sign-In data such as Google user ID, email address, display name, and profile data made available by Google for the sign-in flow

If you purchase a Schmaus Pro subscription, we receive purchase and subscription status information from Apple's App Store or Google Play via our subscription-management provider RevenueCat. This may include product identifier, purchase and expiry dates, subscription status (e.g. trial, active, expired, cancelled), store, and pseudonymous transaction identifiers. We do not receive your payment details (such as credit card numbers) - payments are processed entirely by the app stores.

On Android, Google Play may provide the app with an Install Referrer after installation. We accept only a Schmaus creator-campaign or friend-referral code in the expected format and ignore unrelated referrer values. If present before registration, the code may be used once for best-effort signup attribution. We do not use an advertising identifier or device fingerprint for this purpose. On iOS, Schmaus does not read your clipboard for install attribution and does not use deferred creator attribution to connect an App Store install to your Schmaus account.

If you create a recipe from a URL, we may also retrieve publicly available metadata, captions, subtitles, transcripts, images, or similar text from the linked source or via our service provider Apify Technologies s.r.o. This can include content from videos, image or social-media posts, and regular websites (for example, YouTube, TikTok, Instagram, or Facebook links as well as recipe websites) that you submit for recipe creation.

If you open or use a group invite, we may also process:

• the invite code
• the group name
• the inviter's username, which is shown to the invited user

If you share a recipe via link or open a recipe share link, we may also process:

• a unique share token that identifies the shared recipe
• recipe content displayed in the preview (title, subtitle, category, images)
• the group name associated with the recipe

Data generated while you use the service

• account identifiers and authentication metadata
• refresh token records and login/provider metadata
• group memberships, ownership, and invite metadata
• push notification token and platform
• error, crash, and performance diagnostics (stack traces, request timings, in-app navigation)
• masked session recordings (Session Replay)
• subscription status mirror (product, status, expiry) and credit balance (remaining weekly and non-expiring credits, reset time, credit transactions)
• creator-campaign signup attribution (which campaign code was available when your account was registered, platform, and attribution time)
• referral-program data (your personal referral code, which account invited you, whether the one-time claim was used, and the status of referral rewards)
• temporary recipe-creation job metadata
• recipe version history, including earlier recipe snapshots and revision metadata such as the editing account, change time and source, changed fields, and restore origin
• security and anti-abuse data such as IP address, request metadata, and rate-limit information

Data stored locally on your device

The app stores some data locally on the device to make the service work properly and improve usability. This may include:

• authentication tokens in device storage
• app cache for user, recipe, and group data
• shopping list data, which is stored locally and is not synced to the server
• your recent conversation history with the AI chat assistant
• a temporary creator-campaign or friend-referral code received before registration, until a registration or login consumes it

If we provide a browser-based preview or web version, browser storage may be used instead of secure device storage where technically necessary.

On iOS, you can choose to export your shopping list to the Apple Reminders app. This creates a new list with your ingredients (and the affected recipe names in the list title) in the Reminders app on your device. From then on, those entries are managed by Apple's Reminders app and your device settings; if you have enabled iCloud sync for Reminders, Apple may sync them to iCloud and your other devices.

Permissions

Depending on the features you use, we may ask for access to:

• camera
• photo library
• microphone
• push notifications
• reminders (iOS only, used solely when you export your shopping list to the Apple Reminders app)

These permissions are optional. If you deny them, the affected feature may not work, but the rest of the service can still remain usable.

---

3. Why We Process Your Data and Our Legal Bases

Under the GDPR, we must tell you the purposes of processing and the relevant legal basis.

Where we rely on legitimate interests under Art. 6(1)(f) GDPR, our legitimate interests are maintaining the security, stability, abuse resistance, and technical reliability of Schmaus, enabling a recognizable invite flow for shared groups, and measuring the effectiveness of our own acquisition campaigns without advertising identifiers or fingerprinting.

We do not use your personal data for targeted advertising, sell personal data, or run advertising networks in the service at this time.

---

4. Artificial Intelligence Features

Schmaus offers AI-supported recipe features, including recipe creation from text, files, speech, or public URLs, AI-assisted recipe editing, image analysis, image generation, and an in-app AI chat assistant ("Sous-Chef") that can answer cooking-related questions, suggest dishes based on photos of your ingredients, create recipes for you, and propose edits to your recipes.

If you use supported public URLs to create a recipe (for example, videos, image or social-media posts, or regular websites), we may first retrieve publicly available text, images, or metadata from the linked content in order to prepare the recipe creation. Depending on the source, our server may contact the linked source directly (for example, Instagram, TikTok, Facebook, or the operator of a recipe website) and/or use our service provider Apify Technologies s.r.o. for this retrieval.

To provide these features, we may send the content you submit for the feature to our AI provider, OpenAI (for us as an EEA customer, contracted via OpenAI Ireland Ltd.). OpenAI processes this data according to the access method used and the data controls that apply to it. When we use the OpenAI API, submitted data is not used to train or improve OpenAI's models by default unless a customer explicitly opts in; other OpenAI services may be governed by their account-level data controls. This can include:

• recipe text
• uploaded files and images
• audio recordings you submit for transcription
• short context or prompt text you enter for the requested AI feature
• messages you send to the chat assistant, together with your recent conversation history and, where needed to answer your request, recipe content, shopping list contents, and group names
• photos of food or your fridge that you submit in the chat for ingredient detection
• dietary preferences and restrictions you have saved in your profile, so that recipe-creation, editing, and chat results can take them into account

Providing dietary preferences and restrictions is optional. If you save them, this information can include health-related data (for example, allergies); we process it solely to tailor the features described here, based on your explicit consent (Art. 9(2)(a) GDPR), and you can edit or remove it in your profile at any time.

To detect and prevent abuse of the AI interfaces, we send a pseudonymous (hashed) user identifier to OpenAI. This does not allow OpenAI to identify you directly, but enables provider-side detection and mitigation of abuse. Beyond that, we do not deliberately inject plaintext account identifiers such as your username or phone number into prompts. However, the content you upload, dictate, or type may itself contain personal data or other sensitive information. Please avoid submitting unnecessary personal data in files, recordings, or prompt text.

Depending on the feature, access method, and applicable data controls, OpenAI may retain submitted requests and responses for a limited period. For the stored Responses API calls currently in use, that period is normally 30 days; different settings may apply to other OpenAI services. We delete files uploaded to the provider after processing where the interface supports this.

Conversations with the chat assistant are not stored as conversations on our servers. Your recent chat history is kept locally on your device and is sent along with your next message so the assistant can keep context. If you report a chat assistant reply, your device submits the reported reply and the messages immediately preceding it, and we store them server-side as part of the content report (see the user-safety sections of this notice). Photos and files from the chat are stored on our server only temporarily and are deleted after the chat turn or a background job started from it. Recipe edit proposals are automatically deleted after currently up to 24 hours - even if you have already applied or discarded them before then.

---

5. Recipients and Categories of Recipients

We share personal data only where necessary to operate the service or where required by law. Recipients may include:

• OpenAI for AI-assisted recipe creation, transcription, analysis, editing, image generation, and the AI chat assistant
• Apify Technologies s.r.o., Prague, Czech Republic, for retrieving publicly available captions, subtitles, transcripts, images, metadata, and similar text from supported URLs (for example, YouTube, TikTok, Instagram, Facebook, or regular websites) that you submit for recipe creation
• the operator of a source you submit for recipe creation (for example, Meta (Instagram/Facebook), ByteDance/TikTok, YouTube, or the operator of a recipe website), which our server may contact directly to retrieve publicly available content and metadata for your requested recipe creation
• Twilio for OTP delivery; where WhatsApp is used, this may involve Meta / WhatsApp as part of the delivery chain; if SMS fallback is used, telecom carriers may also be involved
• Apple and Google for sign-in, push delivery, app distribution, and related platform functionality where applicable; sign-in provider processing applies only if the relevant login method is enabled and used; on iOS, if you choose to export your shopping list to the Apple Reminders app, the exported entries (ingredients and recipe names) are afterwards handled by Apple's Reminders app under your device and iCloud settings
• Telegram and Prowl for operational alerts to our administrator, including alerts about new content reports or feedback submissions and provider-erasure tasks that need review. These alerts contain only an opaque case or job reference and limited routing or status information such as task type, target type, priority, and retry state - not your provider identifier, report text, feedback message, name, recipe title, image, email address, or share token
• RevenueCat, Inc., San Francisco, USA, for subscription management: validating purchases, tracking subscription status across devices/platforms, and delivering subscription events to our server; RevenueCat receives your app user ID (our internal account identifier), store purchase metadata, and technical device metadata transmitted automatically by the SDK (e.g. platform, app version, language/region for price display), but no payment details
• Expo / EAS for push notification delivery and over-the-air update infrastructure
• Sentry (Functional Software, Inc., EU instance de.sentry.io) for crash reporting, diagnostics, performance monitoring (distributed tracing between the app and our server) and Session Replay. Current app versions send a dedicated random diagnostic identifier for the account instead of our internal account identifier; we delete the mapping when the account is deleted. Older app versions may have sent the internal account identifier, which can remain on already-stored diagnostic events until those events reach the provider-retention limit
• Hetzner Online GmbH, Gunzenhausen, Germany, for server hosting, infrastructure, and database services
• OVH GmbH, Cologne, Germany, for server hosting, infrastructure, and database services
• Cloudflare, Inc., San Francisco, USA, for DDoS protection, network security, and traffic management; Cloudflare is certified under the EU-U.S. Data Privacy Framework
• authorities, courts, advisors, or other recipients where we are legally required to disclose data or where disclosure is necessary to establish, exercise, or defend legal claims

Within groups, other group members can see data that is necessary for the shared functionality, in particular usernames and shared recipe content. This includes the version history of shared recipes: earlier recipe states and images, the username associated with a change, the change time and source, and the fields changed. Current group members can restore an earlier version. If you leave a group, versions already recorded there and their association with your username remain visible to the remaining group members until those versions expire or are otherwise removed. If you delete your account, the account and username attribution is removed.

Public invite pages may display the group name and inviter username to the invited person.

When you share a recipe via link, anyone with that link can view a preview of the recipe and copy the full recipe (including all ingredients, steps, images, and nutrition data) into their own group. A web preview page may also display recipe metadata to recipients who do not have the app installed. When a recipe link is shared via messaging apps, those apps may fetch metadata (title, description, preview image) from our servers to generate a link preview. We set noindex headers to prevent search engine indexing of these pages.

---

6. International Transfers

Some of our service providers may process data outside the European Union or European Economic Area, including in the United States or other third countries.

Where this happens, we rely on appropriate safeguards under applicable law, such as:

• European Commission Standard Contractual Clauses (SCCs)
• adequacy decisions where available
• the EU-U.S. Data Privacy Framework (DPF) where the provider is certified
• other legally recognized transfer mechanisms, where applicable

Specific safeguards per provider include: OpenAI (SCCs via DPA), RevenueCat (SCCs via DPA, as described in RevenueCat's data processing terms), Twilio (Binding Corporate Rules, and contractual safeguards such as SCCs where applicable), Sentry (DPF and SCCs, where used), Google (DPF and SCCs where required), Expo (DPF and SCCs or other appropriate legal mechanisms, as described in Expo's privacy terms), and Apple (Standard Contractual Clauses / Model Contractual Clauses, as described in Apple's privacy terms). Apify Technologies s.r.o. is based in the Czech Republic, an EU member state; if Apify or its subprocessors transfer data outside the EU/EEA in a specific case, we rely on the safeguards described in the applicable DPA and transfer terms. Hetzner Online GmbH is based in Germany and processes data within the EU; no third-country transfer applies. OVH GmbH is based in Germany. If OVH or an authorized subprocessor processes data outside the EU/EEA in a specific case, we rely on an adequacy decision or the safeguards described in the applicable DPA and transfer terms, such as SCCs.

You can contact us if you want more information about the safeguards used for a particular transfer.

---

7. How Long We Keep Data

We keep personal data only for as long as necessary for the purposes described above, unless a longer retention period is required by law.

Typical retention periods or criteria include:

• Account data, profile data, group memberships, and recipes: for as long as your account exists, unless deleted earlier
• Recipe version history: the current version remains for as long as the recipe exists. For each recipe, we retain at most 20 older versions. An older version is scheduled for deletion once 90 days have passed since it was replaced by a newer version and may be removed earlier when the 20-version limit is exceeded. Version history is deleted with the recipe or group and is reset when a recipe is moved to a different group. Text and images removed from the current recipe can remain in an older version until that version is deleted. Recurring cleanup normally enforces these limits; technical failures can delay deletion
• Public invite codes: until the associated group or the inviting user's account is deleted; invite codes do not expire
• Recipe share tokens: until the associated recipe is deleted or the sharing user's account is deleted; share tokens do not expire
• Pending social registration data: currently up to 15 minutes unless completed earlier
• OTP data: until verification, expiry, or no longer needed for security purposes; the current OTP validity is up to 90 minutes
• Refresh token records: until expiry, revocation, or account deletion; current server configuration allows up to 360 days
• URL-based recipe-creation data: only for as long as necessary to process the requested recipe creation and any resulting job or recipe data
• Chat assistant conversations: not stored as conversations on our servers; your recent chat history is stored locally on your device. If you report a chat assistant reply, the reported reply and the preceding messages submitted with the report are retained as part of the content report (see below)
• Content reports and moderation records: for as long as needed to investigate and document the case, enforce our Terms, prevent repeated abuse, and establish or defend legal claims. If an account or reported item is deleted, direct relational links to the live account or item are removed; the case file may still retain the report snapshot (including identifiers, names, or content captured when the report was submitted), case notes, audit records, and a keyed pseudonymous identifier used to recognize repeated submission attempts for those purposes
• User blocks: until you unblock the account, either account is deleted, or the relationship is otherwise no longer required to provide the safety feature
• Support and feedback submissions: until the request has been handled and for as long afterwards as reasonably necessary for follow-up, service improvement, or legal record-keeping. If the account is deleted, the direct relational link to the live account is removed; the submission itself - including its message, any reply email address you provided, app context, and a keyed pseudonymous identifier used to recognize repeated submission attempts - may remain subject to this retention criterion
• Chat edit proposals: automatically deleted after currently up to 24 hours (applying or discarding a proposal does not delete it immediately); deleted earlier if you delete your account
• Temporary chat/recipe-creation uploads and related temporary artifacts: deleted after processing, the associated background job, or the recurring cleanup process; technical failures can delay deletion
• Crash, diagnostic, and performance data: subject to Sentry's configured provider retention, currently up to 90 days. Current app versions attach a dedicated random diagnostic identifier instead of our internal account identifier. When the account is deleted, we delete our mapping to that identifier; already-stored non-Replay events then remain only until provider retention expires. Diagnostic events sent by older app versions may still contain the former internal account identifier for the remainder of that same retention period
• Session Replay recordings: up to 90 days at Sentry unless a consent-withdrawal or account-deletion request removes them earlier. We keep retrying failed provider deletion requests and make a second pass after an in-progress recording can finish; provider outages can delay removal until a later retry
• RevenueCat merge lineage: if you merge Schmaus accounts, we retain the former internal App User IDs linked only to the surviving account until that account is deleted or an earlier provider-confirmed cleanup makes them unnecessary. We do not use these IDs to delete a RevenueCat customer during the merge. On account deletion, we move them into the durable provider-erasure queue and remove the lineage rows
• Provider-erasure jobs: the durable Sentry and RevenueCat deletion queues retain only the provider identifier and minimum job state needed to complete deletion. The row is removed after the provider work succeeds. If RevenueCat deletion remains open for seven days, we send an operational alert and continue retrying until deletion is confirmed
• Starter-credit fraud-prevention hashes: keyed hashes of your phone number and social sign-in identifiers, generally retained for 24 months from the last time they were seen and then deleted through recurring cleanup; technical failures may delay deletion until a later cleanup run
• Creator-campaign signup attribution and referral account links: until the attributed or invited account is deleted; referral reward records may remain without the deleted account identifier where needed for reward-cap accounting
• Locally stored app data: until you log out, delete app data, uninstall the app, or the app clears the data

Session Replay (opt-in and withdrawal)

Session Replay records screen contents (layout, interactions) so we can reproduce and fix bugs in the actual usage context. Your personal and user-generated content - recipe titles, photos, ingredients and steps, as well as your name, phone number and email - is masked on your device before transmission. Non-personal interface elements (such as buttons, labels and navigation) may remain visible.

Off by default - requires your explicit opt-in. You can enable Session Replay at any time via the toggle "Session replay" under Account → Legal in the app, and disable it again from the same place. Toggling it on is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG; toggling it off withdraws that consent under Art. 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

When you turn the toggle off - and likewise when you delete your account - we place a durable request to delete all already-uploaded Session Replay sessions associated with your dedicated diagnostic identifier and the former internal identifier used by older app versions. A recording in progress on your device at that moment cannot be stopped programmatically (the mobile SDK exposes no runtime stop); it ends only when you restart the app, which the app prompts you to do after you turn the toggle off. No new recording starts after that restart. After a successful initial deletion, we make a second pass after 90 minutes to cover the recording that was still in progress. If you later opt in again, the withdrawal request covers only recordings that started no later than the withdrawal. Provider errors are stored and retried with capped delays; they can postpone deletion, but any remaining recording is still subject to Sentry's maximum 90-day retention. You can also request deletion via the contact address below.

How to delete your account

You can delete your account at any time directly within the App: open the app and tap your profile. Select "Legal". Tap "Delete account" and confirm the deletion. Alternatively, you can delete your account via our account deletion page.

Important note on account deletion

When you delete your account, we delete your account data from the live service and remove you from groups. In particular:

• groups without remaining members can be deleted together with their associated content
• if a group remains active and you were its owner, ownership may be transferred to another member
• recipes created by you in surviving groups are deleted
• version history belonging to recipes you created is deleted with those recipes. Versions that contain edits you contributed to another group member's recipe can remain as part of that recipe until they expire normally, but the link to your account and username is removed
• user-block relationships are deleted. Direct relational links from content reports, moderation records, and support or feedback submissions to your live account are removed. The case evidence and submissions described above may remain under the stated retention criteria, including report snapshots, messages, any reply email address you provided, pseudonymous retry identifiers, case notes, and audit records
• files and image references associated with deleted recipes are removed as part of our cleanup process where technically possible
• if another user previously copied one of your recipes into a separate recipe owned by that user, that copied recipe and its associated files may remain because they are part of that user's independent content
• we queue deletion for every RevenueCat customer identifier known for your current or previously merged Schmaus accounts and keep retrying until RevenueCat confirms it. A second pass checks for data that appeared while the first request was being processed. If a request is still open after seven days, our administrator receives an alert and the retries continue. The queue retains the current and former internal App User IDs only for these erasure tasks and deletes each job after completion
• deleting the RevenueCat customer profile does not cancel or refund an App Store or Google Play subscription. You must manage or cancel the subscription with the relevant store. If you later restore purchases or use the subscription with a new Schmaus account, the store and RevenueCat may provide the purchase record again and create or link a new customer profile
• for Sentry, we queue deletion of Session Replay recordings under both the current random diagnostic identifier and the identifier used by older app versions. For other crash, diagnostic, and performance events, we delete the local mapping between the random diagnostic identifier and your account; those already-stored events then expire under Sentry's retention period, currently no more than 90 days. Events submitted by older app versions can retain the former internal account identifier until that same retention period expires
• to prevent repeated collection of one-time free starter credits and referral bonuses through account re-creation, we generally retain a keyed cryptographic hash of your phone number and social sign-in identifiers for 24 months from the last time they were seen and then delete it through recurring cleanup; technical failures may delay deletion until a later cleanup run. The hash cannot be reversed into the original data
• some data may remain in encrypted backups for a limited period before final deletion

---

8. Is Providing Data Mandatory?

Some data is necessary to use certain features:

• if you choose phone-based login, your phone number is required for authentication
• if you choose Apple or Google login and that sign-in method is enabled, the relevant provider data is required for that sign-in method
• a username is required for account and group functionality
• recipe content, uploaded files, audio, and submitted URLs are required only when you actively use the corresponding recipe-creation or AI feature
• dietary preferences and restrictions are optional; you can edit or remove them in your profile at any time
• push notifications, camera, microphone, photo, and reminders access are optional

If you do not provide data that is necessary for a chosen feature, that feature may not work.

---

9. Cookies and Similar Technologies

The native app uses on-device storage such as secure storage and MMKV for functional purposes. This storage is strictly necessary for the provision of the service and does not require consent (§ 25(2) no. 2 TDDDG).

On our own website and public pages, we do not currently use advertising cookies or analytics cookies of our own. Creator links (schmaus.app/get?ref=...) and referral links (schmaus.app/r/...) set no cookies and use no fingerprinting: our server only increments an aggregate counter per link type, code, platform, and day, and does not store your IP address or user agent for this purpose. On Android, the app may additionally read the Google Play Install Referrer once as described above; it accepts only the recognized Schmaus campaign code and does not use an advertising identifier. Schmaus does not use clipboard-based or other deferred install attribution on iOS. If we add analytics, advertising, or similar tracking later, we will update this notice before using those tools where required.

---

10. Automated Decision-Making

We do not currently make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significant effects within the meaning of Art. 22 GDPR.

---

11. Your Rights

If you are in the EEA, UK, or another jurisdiction with similar rights, you may have the right to:

• access your personal data
• rectify inaccurate data
• erase data
• restrict processing
• receive your data in a portable format, where applicable
• object to processing based on legitimate interests, where applicable
• withdraw consent at any time for future processing where we rely on consent
• lodge a complaint with a supervisory authority

To exercise your rights, contact us at [email protected]. We will respond without undue delay and generally within one month of receiving your request (Art. 12(3) GDPR). Where legally permitted and necessary due to the complexity or number of requests, this period may be extended by up to two additional months; if so, we will inform you within the first month.

If you are in Germany, you may also complain to the competent supervisory authority. For our current establishment, this is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
https://www.ldi.nrw.de/

---

12. Security Measures

We use technical and organizational measures appropriate to the risk. These include, among other things:

• transport encryption
• token-based authentication
• server-side image re-encoding to remove embedded metadata from uploaded images where applicable
• PII scrubbing in crash reporting where technically implemented
• access controls and service-level security measures

No system can be completely secure, but we work to reduce risk and continuously improve our safeguards.

---

13. Changes to This Notice

We may update this notice from time to time. The latest version will always be published with the date shown at the top.

---

14. Contact

If you have questions or want to exercise your rights, contact:

Factureal GmbH
Werner-Warsinsky-Str. 9
44534 Lünen
Germany

Email: [email protected]