Who we are
ChefCart is operated by Michael Stadler (sole proprietor), Esterbergstraße 40, 81377 München, Germany — the data controller under Art. 4(7) GDPR. Email: contact@chefcart.com. This policy covers the chefcart.app website and the ChefCart mobile app on iOS and Android. We collect the minimum needed to run the service, never run ads, and never sell your data.
Information we collect
We collect four kinds of data — what you give us, what you scan or dictate, what's collected automatically, and what processors send us:
- Account data — email, display name, and authentication identifiers from Supabase when you sign in with email/password, Apple, Google, or Facebook. Household members on your plan.
- Your content — recipes, shopping lists, pantry items, meal plans. Recipes imported from a URL are stored as public by default; everything else — recipes you scan, enter manually, or paste as free text — is private to your household unless you choose to make it public.
- Scans & voice input — photos you scan (cookbook pages, recipe screenshots, till receipts) and items you dictate. We keep the text these produce and never the audio; the one exception is a cropped photo of the finished dish, saved only if your device spots one on the page and you choose to import the recipe. Scanning sends the image to an AI processor outside the EU — see Photo scanning & AI below.
- Device & usage data — app version, OS, language preference, and anonymous diagnostics. Analytics events are only collected if you've opted in.
- Subscription data — if you upgrade to Pro, RevenueCat sends us your purchase status. Payment is processed by Apple or Google; we never see your card details.
How we use it
Run the service (auth, sync, family sharing), read the photos you scan so we can turn them into recipes and pantry items, turn what you dictate into shopping-list entries, send transactional messages about your account or subscription, deliver push notifications you've subscribed to, improve the product through opt-in anonymous analytics, prevent abuse, and comply with our legal obligations. We do not show ads and do not engage in direct marketing.
Photo scanning & AI
ChefCart can read a photo for you — a cookbook page, a recipe screenshot, a handwritten card, or a till receipt — and turn it into a recipe or a set of pantry items. The reading is done by an AI model, Claude, provided by Anthropic. Here is exactly what happens to that photo.
- What we send, and when. — only the photo you have just taken or picked for a scan, at the moment you confirm it. There is no background scanning, and we never read your camera roll on our own.
- Who reads it. — the photo is sent over an encrypted connection to a ChefCart edge function running on Supabase, which forwards it to Anthropic's Claude and passes the extracted text back. The edge function exists so our API key stays on the server instead of inside the app, and so we can stop abuse. It holds the image in memory for the length of the request and writes it nowhere. Anthropic acts as our processor under a data processing agreement and processes the request outside the EU, including in the United States, covered by the European Commission's Standard Contractual Clauses.
- What happens to the image. — nothing from the scan is kept on our side. Our edge function stores no copy and logs no image, and Anthropic does not train its models on it; under Anthropic's commercial terms API inputs and outputs are deleted within 30 days, though content its automated safety systems flag can be held longer. Of the text that comes back, we keep only the items you confirm on the review screen — never the page photo itself. The one exception: if your device spots a photo of the finished dish on the page, we save a cropped copy of just that photo once you choose to import the recipe.
- A word about receipts. — a till receipt can show far more than groceries: the shop, the date and time, a loyalty-card number, the last digits of a payment card, and items that hint at your health, beliefs, or habits. Only scan a receipt if you are comfortable with the whole of it being read; crop or cover anything you would rather not send, and check the review screen before saving — only the items you keep are stored.
- Your control. — scanning is optional. You can decline the camera and photo permissions, or withdraw them at any time in your device settings, and carry on adding recipes by importing a URL, pasting text, or typing them in.
- Legal basis. — where the GDPR applies, we process this data to provide a feature you have asked for (Art. 6(1)(b) GDPR). Extraction is a text-recognition step, not an automated decision with legal or similarly significant effects under Art. 22 GDPR — you review and confirm every result before anything is saved.
How Anthropic handles what it receives is set out in Anthropic's privacy policy.
Voice input for shopping lists
ChefCart lets you add items to a shopping list by speaking them ("Milk, butter, six eggs") instead of typing.
- When the microphone is used. — only while you are actively dictating, from the moment you tap the microphone button until you stop or the recording ends. ChefCart does not listen in the background and has no always-on listening or wake word.
- How your speech is transcribed. — the audio is processed by your own device's speech recognition: Apple's Speech framework on iOS, Android's speech recognition service on Android. Where your device supports offline recognition for your language, the audio never leaves your device. Where it does not — which is common for languages other than English, and depends on which language packs your device has installed — your operating system may send the audio to Apple or Google to transcribe it. In that case the processing is carried out by Apple or Google as independent controllers under their own privacy policies, not by us.
- What ChefCart receives and stores. — we receive only the transcribed text, and we store only the shopping-list items you confirm on the review screen. We never receive, record or store the audio itself, and no audio is sent to ChefCart's servers at any point. We do not use voice data for profiling, advertising, or to train any model.
- Your control. — voice input is optional. You can decline the microphone permission, or withdraw it at any time in your device settings, and carry on adding items by typing — no functionality is lost.
- Legal basis. — where the GDPR applies, we process this data to provide a feature you have requested (Art. 6(1)(b) GDPR). Access to the microphone rests on the permission you grant on your device, which you can revoke at any time.
Where your device does send audio away to be transcribed, Apple and Google decide for themselves what happens to it — see Apple's privacy policy and Google's privacy policy.
Legal bases (GDPR Art. 6)
We process data on these bases: contract (Art. 6(1)(b)) — running your account and Pro subscription, and delivering features you ask for such as photo scanning and voice input; consent (Art. 6(1)(a)) — analytics and non-essential cookies, which you can withdraw any time; legitimate interest (Art. 6(1)(f)) — security, fraud prevention, basic operation; legal obligation (Art. 6(1)(c)) — tax records, lawful requests. We do not make automated decisions about you that have legal or similarly significant effects.
Who we share data with
We share data only with processors needed to operate the service, each under a data processing agreement. None of them sell your data:
- Supabase (Ireland, EU) — authentication, database, and the edge function that relays scan photos to Anthropic.
- Anthropic (US) — reads the photos you scan and returns the text. It receives them from our edge function, does not train its models on them, and deletes them within 30 days.
- Vercel (US, EU edge) — hosts this marketing site at the edge and provides cookieless web analytics (anonymous page-view counts) that only load after you consent.
- PostHog Cloud EU — anonymous product analytics, loaded only after you've consented.
- RevenueCat — manages your Pro subscription and talks to Apple / Google.
- Resend — delivers transactional email.
- Firebase Cloud Messaging / Apple Push Notification Service (via Expo) — delivers push notifications you've subscribed to.
We may also disclose data to comply with a valid court order or law-enforcement request. We tell you whenever the law allows.
International transfers
Most data stays in the EU. Some processors (Anthropic, Vercel, RevenueCat, push services) operate globally and may transfer data outside the EU. The clearest case is photo scanning: Anthropic does not offer EU-region processing for this service, so a photo you scan is processed outside the EU, including in the United States. We rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Contact us if you'd like details on a specific transfer, or a copy of the safeguards.
Security
Data in transit is encrypted with TLS. Data at rest is encrypted by our infrastructure providers. Authentication is handled by Supabase using industry-standard hashing and OAuth flows. Photos you scan are sent over TLS to a ChefCart edge function, which forwards them to Anthropic for text extraction and keeps no copy — our API key stays on the server, never inside the app.
Retention
We keep your data while your account is active. When you delete your account from the app, we erase everything within 30 days, except where law requires us to keep records longer (for example, invoice records under § 257 HGB / § 147 AO for up to 10 years).
Your rights
If our processing falls under GDPR, you have the right to:
- access — get a copy of the data we hold about you;
- rectify — correct inaccurate data;
- erase — delete your data;
- restrict — limit how we process it;
- object — to processing based on legitimate interest;
- portability — receive your data in a structured, machine-readable format;
- withdraw consent — at any time, for processing based on consent;
- lodge a complaint — with your local supervisory authority. In Bavaria: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.
Most rights can be exercised directly in the app (Settings → Account). For anything else, email contact@chefcart.com. We respond within 30 days.
Users under 16
ChefCart is for users aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has shared data with us, contact us and we will delete it.
Changes
We update this policy when our practices change. Material changes are announced in the app and via email at least 30 days before they take effect.
Contact
Questions, requests, or complaints: Michael Stadler, Esterbergstraße 40, 81377 München, Germany — contact@chefcart.com.