This privacy policy explains which personal data BromeoCook processes, why, for how long, and what your rights are. It applies to the BromeoCook apps for iPhone and Android, the web app at app.bromeocook.com and the website bromeocook.com.
1. Who we are
BromeoCook is a service of The Gatekeeper Enterprises, located in Eygelshoven, registered with the Dutch Chamber of Commerce under number 81476817. We are the data controller for your data.
Questions about privacy? Use the contact form.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password (encrypted) or your Google account | Creating your account and letting you log in | Performance of the contract |
| The name you enter | Greeting you in the app and showing it with recipes and reviews you share | Performance of the contract |
| Onboarding answers (cooking experience, goals, days per week you cook, apps you used before) | Tailoring and improving the app | Performance of the contract / legitimate interest |
| Language, units and notification preferences | Remembering your settings | Performance of the contract |
| Your recipes, notes, photos, cooking calendar and shopping list | The core of the app: saving, planning and cooking | Performance of the contract |
| Links, texts and photos you import | Turning them into a recipe with AI (see §4) | Performance of the contract |
| Reviews, favourites and views of shared recipes | Showing reviews and keeping counts (counts are anonymous to others) | Performance of the contract |
| Use of AI features (which feature, when) | Tracking the free monthly limits | Performance of the contract |
| Push notification token | Sending cooking reminders, only if you turn notifications on | Consent |
| Premium status and subscription details (no payment details) | Unlocking Premium features | Performance of the contract |
| Name, email address and message from the contact form | Answering your question | Legitimate interest |
| Technical data (IP address, time, error messages) in server logs | Security and fixing problems | Legitimate interest |
We do not use your data for advertising, we do not sell it and we do not build profiles for others.
3. What is public?
Your recipes are private. Only if you share a recipe with a link or choose “Show in Discover” can others see that recipe, the name you entered and its reviews. Reviews you write are visible with your name to everyone who can see the recipe. If someone saves a shared recipe, they get their own copy, which stays with them even if you stop sharing later.
4. Who we share data with
We work with these service providers (processors). They only receive what they need for their task.
| Provider | Purpose | Location |
|---|---|---|
| Our own server (Supabase, self-hosted) | Storing accounts, recipes and photos | The Netherlands |
| Anthropic (Claude) | Extracting recipes from links, texts and photos you import | United States |
| OpenAI | Generating recipe photos (only the recipe’s title, description and ingredients) | United States |
| Signing in with Google, if you choose to | United States / EU | |
| Expo | Delivering push notifications | United States |
| RevenueCat, Apple and Google | Processing subscriptions and purchases | United States / EU |
| Our email provider | Sending confirmation and password reset emails | The Netherlands |
For transfers to the United States we rely on appropriate safeguards such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. AI providers do not use data we send through their API to train their models.
When you import a link, our server (or your own phone, for websites that block servers) loads the public page. The website sees a normal visit.
5. How long we keep your data
- Account data, recipes and photos: as long as your account exists.
- Use of AI features: up to 13 months.
- Messages from the contact form: up to 12 months. For spam protection we don’t store your IP address, only an irreversible code derived from it.
- Server logs: up to 30 days.
- Backups: overwritten within 30 days.
If you delete your account, we delete your data as described on the Delete your account page.
6. Security
We encrypt connections (HTTPS), store passwords only in encrypted form and secure the database so you can only access your own data. Counters such as views and favourites cannot be changed from the app.
7. Cookies and local storage
We do not use tracking or advertising cookies. The app and website only store what is needed to keep you logged in and remember your preferences. Read more in the cookie statement.
8. Children
BromeoCook is intended for people aged 16 and over. If you are younger, you need permission from a parent or guardian.
9. Your rights
You have the right to access, correct, delete or port your data, and to object to or request restriction of processing. You can withdraw consent (for example for notifications) at any time in the app settings.
Much of this you can do yourself in the app: change your name and preferences, delete recipes and delete your whole account. For other requests use the contact form; we reply within one month.
If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
10. Changes
We update this policy when the app changes. For important changes we will let you know in the app. The date at the top shows when it was last updated.
The Dutch version of this document prevails in case of differences.