Privacy Policy

Who we are

Mi Recipes (“we”, “us”, “our”) is operated by Viet Phan, based in Helsinki, Finland. Viet Phan is the sole owner of Codepuro Oy, a Finnish limited company registered at the Finnish Trade Register under Business ID 3336034-4; Codepuro Oy is the related Finnish entity behind the Mi Recipes brand.

During the v1.0 launch period, Viet Phan is the data controller for personal data processed through the Mi Recipes app and website, and is the publisher of record on the Apple App Store and Google Play. If you have questions about this policy or how we handle your data, email contact@vietphan.info (or contact@codepuro.com). We can also provide a postal address on request.

What data we collect

We collect only the data we need to run the service. Specifically:

• Account information — your email address, display name, and a hashed password (stored by our auth provider, Supabase).
• Device information — an anonymous device ID, platform (iOS, Android, or web), operating system version, app version, and device model. Used for security and diagnostics.
• Usage data — the recipes you save or create, URLs you submit for AI extraction, your AI Chef chat history, shopping list items, favorites, language and locale preferences.
• Subscription status — your Premium tier and purchase history as reported by Apple or Google. We never see or store your payment card details.
• Technical data — IP address (for security and rate limiting), request logs, and error reports.
• Voluntary content — any photos or notes you choose to add to your recipes.

Why we collect it

We use your data for the following purposes:

• To provide the service (sign you in, save your recipes, sync across devices).
• To personalize AI Chef suggestions and search results.
• To keep the service reliable and secure (error tracking, fraud prevention, rate limiting).
• To process your Premium subscription through Apple or Google.
• To contact you about service updates, security notices, or changes to these terms.

We do not sell your data to third parties. We do not use your data for advertising profiling.

Legal basis (GDPR)

Under the EU General Data Protection Regulation (GDPR), our legal bases are:

• Contract performance (Art. 6(1)(b)) — for creating your account, saving recipes, and delivering the core service.
• Legitimate interest (Art. 6(1)(f)) — for security, fraud prevention, and aggregated analytics that help us improve the product.
• Consent (Art. 6(1)(a)) — where we ask for it (for example, any future marketing emails). You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — for tax and bookkeeping records related to Premium subscriptions.

Who we share your data with

We work with a small number of trusted service providers who process data on our behalf under written data-processing agreements. They may access data only to perform the service they provide to us.

• Supabase (hosted in the European Union) — authentication, database, and file storage.
• OpenAI (USA) — AI recipe extraction, AI Chef chat, and translation. OpenAI does not use our API inputs or outputs to train their models.
• Anthropic (USA) — fallback AI provider used during OpenAI outages.
• Apple, Google, and RevenueCat — Premium subscription processing and entitlement verification.
• Firebase Analytics (Google, USA) — anonymous usage analytics tied to an app-install ID, not to your account.
• Sentry (USA) — crash and error reporting.
• Resend (USA) — transactional email (sign-up confirmation, password reset, etc.).
• Vercel, Railway, and Upstash — web hosting, API hosting, and caching.

International data transfers

Some of our processors are based in the United States. When your personal data is transferred outside the European Economic Area, we rely on the following safeguards:

• The EU–US Data Privacy Framework, under which OpenAI, Anthropic, Google, and other US processors we use are certified.
• Standard Contractual Clauses (SCCs) approved by the European Commission, as a fallback safeguard.

You can request a copy of the specific safeguards that apply to any transfer.

How long we keep data

• Active account data — while your account is active.
• Deleted accounts — permanently erased from our systems within 30 days after deletion. Encrypted backups may take up to 90 days to cycle out.
• AI chat logs — up to 12 months, then deleted.
• Audit logs — up to 24 months.
• Error and request logs — up to 90 days.
• Billing records — retained as long as required by Finnish accounting law (currently 6 years).

How to delete your Mi Recipes account

You can delete your Mi Recipes account at any time. Deletion is self-service and removes your personal data from our systems on the timeline below.

Delete from inside the app (recommended)

1. Open the Mi Recipes app on iOS or Android.
2. Sign in with your registered email and password.
3. Tap the profile icon in the top-right corner to open Settings.
4. Scroll to the bottom of the Settings screen and tap Delete account.
5. Confirm both prompts. Your account is deactivated immediately and permanently removed on the schedule below.

Delete by email (alternative)

If you can’t access the app, email contact@vietphan.info from your registered email address with the subject line “Delete my Mi Recipes account”. We will verify the request and complete the deletion within 30 days at the latest.

What is deleted

• Account: email address, hashed password, display name
• Personal recipes, saved recipes, custom lists, weekly menu plan
• Photos you uploaded to recipes
• AI Chef chat history
• Device identifiers and push notification tokens

What is retained, and for how long

• Encrypted database backups — deleted accounts cycle out within 90 days as backups rotate.
• Anonymized analytics aggregates — retained without personal identifiers (no email, no user ID, no IP).
• Public recipes you authored that other users have saved or copied — your display name is removed (recipes become attributed to “Anonymous”); the recipe content remains in the libraries of the users who saved it.
• Audit logs — up to 24 months for security, abuse prevention, and regulatory compliance.
• Billing and tax records — retained as required by Finnish accounting law (currently 6 years).

For the full retention schedule across all data categories, see Section 7 — How long we keep data.

How to delete specific data (without deleting your account)

You don’t have to delete your whole Mi Recipes account to remove specific items. Most personal content is deletable directly in the app while you stay signed in:

What you can delete in the app

• Individual recipes — open the recipe → menu → Delete.
• Custom lists — open a list → menu → Delete; or remove individual recipes from a list.
• Weekly menu entries — long-press / swipe a day’s entry to clear it.
• Shopping list items — swipe to delete, or clear all checked / clear all.
• Recipe photos — edit the recipe and replace or remove the photo.
• Analytics opt-out — Settings → Privacy → Disable analytics; future events will not be collected (already-collected events stay subject to the retention schedule).

Data we’ll delete on email request

Some data isn’t directly exposed in the app (for example, your AI Chef chat history). To request deletion of those, email contact@vietphan.info from your registered email address with the subject line “Delete specific data”, and tell us which data you want removed. We respond within 30 days at the latest.

The retention schedule in Section 7 still applies (encrypted backups cycle out within 90 days; billing records are retained for the period required by Finnish accounting law).

Your rights

Under the GDPR, you have the following rights:

• Access (Art. 15) — ask for a copy of the data we hold about you.
• Rectification (Art. 16) — correct data that is wrong or out of date.
• Erasure (Art. 17) — ask us to delete your data. See How to delete your Mi Recipes account for step-by-step instructions and what is deleted vs retained.
• Restriction (Art. 18) — ask us to pause certain processing.
• Portability (Art. 20) — request your data in a machine-readable format.
• Objection (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent — wherever processing is based on your consent.
• Lodge a complaint — with the Finnish Data Protection Authority (Tietosuojavaltuutettu) at tietosuoja.fi, or with your local EU data protection authority.

To exercise any of these rights, email contact@vietphan.info. We will respond within 30 days.

Cookies and tracking

The Mi Recipes service is delivered as a mobile app on iOS and Android. We do not provide a user-facing web app at this time. The website at mi-recipes.com is used only for our privacy policy, terms of service, support page, and internal admin tools (admin tools require a separate authentication and are not accessible to end users).

Strictly necessary session cookies are used by the admin tools only. We do not use third-party advertising cookies, cross-site tracking, or analytics cookies on mi-recipes.com.

Analytics in the mobile app use a device-level anonymous identifier, not your account identity, and can be disabled from your device settings.

Children’s privacy

Mi Recipes is not intended for children under the age of 13. We do not knowingly collect personal data from anyone under 13.

If you are between 13 and 17, you should use the service only with the permission of a parent or legal guardian.

If you believe we have collected data from a child under 13, please contact us immediately at contact@vietphan.info and we will delete it promptly.

Changes to this policy

We may update this policy from time to time to reflect changes in our service, the law, or our processors. When we make material changes, we will notify you by email or an in-app notice before the changes take effect.

The effective date at the top of this page indicates when the current version took effect. Previous versions are available on request.

Contact us

For any privacy questions, data-subject requests, or concerns about how we handle your data:

Email: contact@vietphan.info (primary), contact@codepuro.com (alternate)
Operator: Viet Phan, Helsinki, Finland
Related entity: Codepuro Oy (Business ID 3336034-4) — sole owner: Viet Phan