Privacy Policy

Last updated: October 7, 2026 · Effective date: October 7, 2026

1. Introduction

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the MyChef mobile application ("App", "MyChef", "we"). This text has the same content as the privacy policy shown inside the app. By using the App you accept the practices described in this policy.

We value your privacy and only collect the data needed to provide the service.

2. Data Controller

Under Turkey's Law on the Protection of Personal Data (KVKK) and, where applicable, the GDPR, the data controller responsible for processing your personal data is İsmail Uzun, the individual who operates the MyChef application. For any privacy question or request, contact us at:

• Name: İsmail Uzun
• Address: Cevizli Mah. Bağdat Cad. No:599/601 A Blok, Red Dragos Apt. Daire:5, 34846 Maltepe/İstanbul, Türkiye
• Email: support@mycheff.net
• Web: www.mycheff.net

3. Data We Collect

3.1 Data you provide to us directly

• Account information: email address, password (stored only encrypted/hashed), name, and username.
• Profile information: optional profile photo (avatar), your gender and age if you give them, and your preferences.
• User content: your favorite recipes, the collections you create, shopping lists, and your weekly meal plan.
• Family (shared plan): if you create or join a family, we record which family you are in, your role (the person who manages the family, or a member) and when you joined. We also record the invitations you send and receive: invitations by username, or single-use invitation links that are valid for 7 days. The invitation link itself is not stored on our servers; only a one-way hash is kept to check it. On the shared shopping list we record who ticked an item and who last changed the list.
• Notification token: when you allow notifications, your phone's notification token (the push token issued by Apple on iPhone or Google on Android), your time zone and the app version are stored with your account. We use them to send family notifications (e.g. "Ayşe added Mantı for Friday") to the right phone and outside your quiet hours. They are deleted when you sign out, turn notifications off, or after 120 days without renewal. Family notifications waiting to be sent are kept for at most 2 days.
• Health data (only with your explicit consent): your allergens, diet and intolerance choices, height and weight, activity level, health goals (calorie/macro/weight targets) and meal records. See Section 5 for how consent is asked for and withdrawn.
• AI interactions: the messages you write to the chef assistant and the food photos you upload for calorie/recipe analysis.
• Voice input: when you use voice search or voice ingredient entry, your speech is processed by your device's speech-recognition service (Apple/Google) to convert it to text. MyChef does not store your audio recording on its servers; only the resulting text is used to fulfil your request.
• Contact: information you share when you contact us for support.

3.2 Data collected automatically

• Motion & activity data (optional): if you grant motion permission, your daily step count is read from your device's pedometer sensor and shown in the Health tab. Your step count, and the active-calorie estimate based on it, is saved to your account only if you have given your health data consent (see Section 5). You can withdraw motion permission at any time from your device settings.
• Device identifier: a random identifier (UUID) generated the first time you open the app. We use it to personalize content even without an account (guest mode), to remember what you viewed in that mode, and to manage your session securely; it is not an advertising ID or a hardware identifier. On iOS it is stored in your device's secure keychain (iOS Keychain), so deleting and reinstalling the app does not normally erase it — it is removed when you reset the device. On Android it is stored on your device, encrypted with the Android Keystore, and removed when you uninstall the app or clear its data in your device settings.
• Usage records: only if you have allowed it (in the app under Profile → Usage data). When you are signed in, the app then automatically records with your account: when you open the app and how long it stays open (each visit and the time the app was in front); which screens you open and for how long (the name of the screen — never its address or the item shown on it); and which features you use (e.g. opening or saving a recipe, adding a meal to the plan, running a search — only how many results it found, not what you typed —, starting or finishing a purchase, your answer to the notification permission request). For a recipe or cookbook of MyChef's own catalogue, its number is recorded. Each record also holds its time, the platform (iOS/Android) and the app version. Never written into usage records: text you type, health data, photos, location, contacts, your e-mail or IP address, or an advertising identifier. Without an internet connection, records wait on your phone and are sent once you are back online. Nothing is recorded in guest mode or while usage data is switched off. The records are kept with your account in our own database; our team may look at overall figures and at the records of individual accounts. MyChef does not use a separate advertising or analytics tracking SDK. You can switch the permission off in the same place at any time: recording stops at once and the usage records of your account are deleted; the app works the same either way.
• Error reports: only if you have allowed "Usage data". If the app runs into an error, it automatically sends us a technical report: the kind of error, its name and message, where in the code it happened, the name of the screen it happened on, the platform (iOS/Android) and the app version. Before a report is sent, parts such as e-mail addresses, sign-in tokens and long numbers are removed. A report contains no account and no device identifier, and it is not stored with your account. We use reports only to find and fix errors.
• Device & server logs: device type, OS version, language setting, app version, and server access logs kept for security and troubleshooting.
• Sign-in records: when you sign in and when your session is renewed, your IP address, device identifier and device/app information (User-Agent, e.g. app and operating-system version) are stored with the session record. We use them to keep your account secure (managing sessions, detecting abuse); they are deleted when you delete your account.
• Subscription status: your purchase/subscription status (we do not store your payment card details; payments are processed by Apple/Google).

3.3 Data we receive from third-party sign-in

If you choose to sign in with your Google or Apple account, we receive only the information needed to verify your identity from that provider: name, email address, and the provider's account identifier. Your social-media password is never shared with us, and we do not access your contacts or posts.

4. How We Use Data and Legal Bases

• To create your account, verify your identity, and manage your session.
• To provide the app's core features (recipe suggestions, ingredient search, favorites, shopping list, allergen flagging).
• To run features such as the AI assistant and photo analysis.
• To activate and manage premium subscriptions.
• To send password-reset and other important service emails.
• To improve the app, fix bugs, and maintain security (abuse/fraud prevention).
• To comply with legal obligations.

We process your personal data on the following legal bases (KVKK Art. 5–6; GDPR Art. 6 and 9):

• Performance of a contract: providing the service you requested (account, recipes, favorites, subscription).
• Explicit consent: health data such as allergens, diet and intolerance choices, height and weight, activity level and health goals, meal records, and step data (see Section 5), and optional device permissions (camera, microphone, motion sensor); and sending content to Google Gemini for the AI features and for the automatic check of profile and recipe cover photos (see Section 6); and the usage records we keep to measure how much each feature is used and improve the app, and the error reports the app sends so that we can find and fix errors (only if you have allowed "Usage data"; see Section 3.2).
• Legitimate interest: keeping the service secure, fixing bugs and preventing abuse.
• Legal obligation: retention and notification duties arising from applicable law.

5. Health-Related Data & Explicit Consent

The following information relates to your health and counts as "special category personal data" under KVKK and the GDPR:

• Allergens and diet choices — the allergens, diet type and food intolerances you select,
• Height, weight and activity level — what you enter at sign-up or in your profile,
• Health goals — your goal, daily calorie/macro targets and weight target,
• Meal records — the meals you add or scan and save, with their calories and nutrients (including meals copied into your food diary from the weekly plan),
• Step and activity records — the daily step count read from your device's step counter and saved to your account, and the active-calorie estimate based on it.

How we ask for consent: before any of this data is saved to your account for the first time, the app shows a separate explicit-consent dialog that lists the data types above: before the health steps at sign-up, when you first open the Health tab, or when you save allergens, diet, health goals, height/weight or a meal. The date you consented and the version of the consent text are stored with your account; if the text changes, we ask again.

If you don't consent: this data is not saved, and our servers also refuse health data sent without consent. You can keep using the rest of the app (recipes, search, favorites, shopping list, etc.).

Withdrawing consent: you can withdraw consent at any time in Profile → Health data consent. From then on no new health data is saved, and your stored data is no longer used for recipe suggestions or allergen warnings. You are then asked whether to delete the health data saved so far: "Delete" permanently removes your meal and step records, health goals, height/weight, allergens and diet choices from your account; "Keep" leaves these records in your account, shown only to you, until you delete your account or ask us to delete them. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

We use your health data only to provide these features to you (allergen warnings in recipes, recipe suggestions that fit your diet, your calorie target, and nutrition/activity tracking); we do not use it for advertising or marketing, and we do not sell it to third parties. You can also turn off motion (step counter) permission in your device settings.

6. AI & Photo Processing

When you write a message to the chef assistant, or upload a food photo for calorie/recipe analysis, that content is sent to our AI infrastructure provider (Google Gemini API, Google LLC) solely to generate a response to your request. This is only sent after you give explicit consent in the app; you can withdraw it at any time from Profile → AI data sharing. We use the paid Gemini API service; Google does not use this content for advertising or to train its own models. Account details such as your name and email are not sent.

• Photos are processed for analysis purposes; after analysis completes they are not permanently retained tied to your profile (they are kept only as long as needed for processing).
• AI outputs are estimates; calorie and nutrition values are for informational purposes only and do not replace medical or nutritional advice. See the Terms of Use — Health Notice for details.
• Please avoid entering sensitive personal or health information into the AI assistant.

Checking profile and recipe cover photos: when you upload a profile photo or a recipe cover photo, the photo is sent to the Google Gemini API (Google LLC) to be checked automatically for nudity, violence or hateful content before other users can see it. This happens only after you give separate explicit consent in the app before your first upload; you can withdraw it at any time from Profile → Photo check consent. If you don't consent, or withdraw consent, you can't upload a new profile or cover photo; your existing photos stay and you can keep using the rest of the app. Google processes the photo only for this check and does not use it for advertising or to train its own models. Account details such as your name and email are not sent with the photo. A photo that passes the check is stored so it can be shown on your profile or recipe; a photo that fails the check is not saved.

7. Data Sharing

We do not sell your data. We share your data only with the trusted service providers below, and only to the extent necessary to provide the service:

• Supabase (servers: EU — Frankfurt) — database and file-hosting infrastructure.
• Google (Gemini API) — AI chef assistant, photo/calorie analysis, and the inappropriate-content check of uploaded profile and recipe cover photos.
• RevenueCat — subscription validation and management.
• Resend — sending password-reset and other transactional emails.
• Apple & Google — app distribution, processing in-app purchases (subscriptions), and sign-in with Apple/Google if you choose to use it.
• Apple/Google speech-recognition services — only if you use voice input, to convert speech to text.
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) — to deliver family notifications to your phone: your notification token and the notification text (the family member's name, the dish and the day), to Apple on iPhone and to Google on Android. Notifications never contain health data.

Our contracts with these providers require them to process your data only on our instructions and for the stated purposes, and to apply protections at least equivalent to the ones we commit to in this policy. We may also share data with competent authorities where legally required, such as to comply with a legal obligation or to prevent unlawful activity. In the event of a business transfer (merger, acquisition), your data may be transferred to the acquiring party subject to compliance with this policy; we will notify you in that case.

8. Content Visibility, Messages and Reports

• Your name, username, profile photo, who you follow/who follows you, and the recipes you add are visible to other users of the app.
• The comments you write on recipes and the ratings you give are visible, together with your name, username and profile photo, to everyone who uses the app — including people without an account (guest mode).
• The content of direct messages you send to other users is stored on our servers so we can deliver them and review abuse when needed.
• When you report a piece of content or a user, a copy of the reported content is retained together with the report so we can review the complaint and meet our legal obligations.
• Recipes you view in guest mode (without an account) are saved in association with your device identifier to personalize suggestions (see Section 3.2).
• Family members see each other's name, username and profile photo. The weekly plan and shopping list of the person who manages the family are shown to its members. Members can only view the plan; on the list they tick what they buy, and everyone in the family sees who ticked what. Your health data, messages, AI chats and your own cookbooks are not shared with the family. You can leave the family at any time. After you leave, you no longer see the plan and list, and your name is removed from the items you ticked.

9. Retention & Deletion

We retain your personal data for as long as your account is active or as needed to provide the service. You can delete your account at any time:

• From within the app: Profile tab → the "Permanently Delete Account" option at the bottom of the Account Settings section. This permanently deletes your account and all associated data.
• By web request: the Account & Data Deletion page.
• Only your health data: when you withdraw consent in Profile → Health data consent, you can choose to delete your saved health data while keeping your account (see Section 5).

After deletion, your data is removed from our systems, subject to legal retention obligations. Copies remaining in backups are purged within the normal backup cycle (within 30 days). Server access/error logs are kept for a reasonable period for security purposes (up to 90 days). Usage records are deleted automatically: screen visits after 90 days, all other usage records after 13 months; when you switch usage data off, all of them are deleted at once. Daily totals that no longer relate to any account are kept for 25 months. An error report is deleted 90 days after the error last occurred. If you delete your account, your family membership is deleted too. If you manage a family, it passes to the member who has been in it the longest; if nobody else is in it, the family is deleted. Report/moderation records may be retained separately for legal and safety purposes even after account deletion (see Section 8).

10. Your Rights

Depending on your country (KVKK Art. 11, GDPR Art. 15–22, etc.), you have the following rights:

• Access your data and request a copy,
• Request correction of inaccurate data,
• Request erasure of your data ("right to be forgotten"),
• Object to or restrict processing,
• Request data portability,
• Withdraw any consent you have given,
• Object to a decision based solely on automated processing that produces an adverse effect on you.

To exercise these rights, write to support@mycheff.net. You can withdraw your consent to usage records at any time in the app under Profile → Usage data: recording stops at once and the usage records of your account are deleted; withdrawing does not affect the lawfulness of processing that took place before. We respond as soon as possible and in any case within applicable legal deadlines (no later than 30 days under KVKK). If your request is rejected or you find the response insufficient, you have the right to complain to the Turkish Personal Data Protection Board (KVKK Board, kvkk.gov.tr) or, if you are based in the EU, your national data protection authority.

11. Security

We apply industry-standard measures to protect your data: TLS/HTTPS encryption in transit, hashed password storage, secure on-device key storage (iOS Keychain / Android Keystore), access controls, and rate limiting. No system is 100% secure, but we make every reasonable effort to protect your data.

12. Children's Privacy

MyChef is not directed at persons under 18, and we do not knowingly collect data from that age group. If we become aware that a child has provided us with data, we delete it.

13. International Data Transfers

Our primary database and application server are hosted in the European Union (Germany — Frankfurt). Some of our service providers (e.g. Google Gemini, RevenueCat, Resend) may process data on servers in other countries, including the United States. Where such transfers occur, we seek appropriate legal safeguards such as standard contractual clauses (SCCs), adequacy decisions, and the conditions under KVKK Art. 9.

14. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes within the app or by email. The current version is always published on this page, and the "Last updated" date changes accordingly.

15. Contact

For any privacy-related question:

• Email: support@mycheff.net
• Web: www.mycheff.net