Privacy Policy

1. Who we are

Zuppi is provided by Nathan O’Dowd, based in Edinburgh, Scotland, United Kingdom. Nathan O’Dowd is the controller of personal information processed for the website and Zuppi-operated services described here. Contact hello@zuppi.recipes for privacy questions or a postal contact address.

This notice covers the live website and waitlist, and the app features described below when they are available in your build. Android alpha testing is now available through Google Play, while iPhone testing is coming soon. Joining the waitlist does not install the app, create a sharing account or start app diagnostics or TestFlight data collection.

This notice includes the current Android alpha. Apple sign-in, iCloud, Apple Intelligence and TestFlight descriptions apply to iPhone. The Android section explains Google sign-in, device storage, backups and permissions; the connected-service and diagnostics sections also apply to Android where those features are used.

2. Website & waitlist

When you join the waitlist, we store your email address, signup time, the version of the email consent you accepted, a random unsubscribe token, confirmation-email delivery details and, once recorded, the time we notified you about testing. We use this to measure interest, confirm your signup and email you when testing opens. Duplicate email addresses count once and do not trigger repeated confirmation emails.

Joining is optional and based on your consent. It is not consent to a newsletter or unrelated marketing. Every confirmation and testing email includes an unsubscribe link. You can also withdraw by emailing hello@zuppi.recipes from the address you used. Confirming removal deletes the active waitlist record immediately; our email delivery provider also maintains suppression information so opted-out contacts are skipped by later broadcasts. Withdrawing does not affect processing that was lawful before withdrawal.

Our hosting provider delivers the site and stores the waitlist. The database was created in Western Europe; this is not a guarantee that all processing stays there. Our hosting provider processes connection information, including IP addresses, to deliver and protect the site. The signup application uses an IP-based request limit, but does not store IP addresses or browser details in the waitlist table or log submitted emails.

Our email delivery provider receives waitlist email addresses and email content to send the confirmation and testing messages, record delivery activity and manage broadcast opt-outs. Before a testing announcement, current consented waitlist records can be reconciled into our email delivery provider’s dedicated testing list; withdrawn or already-notified records are excluded. The website uses optional analytics only with your consent, as explained below. We do not sell the list or share it for targeted advertising.

3. Your recipes & device data

Zuppi keeps recipes, ingredient amounts, steps, photos, notes, source links, import evidence, shopping lists, pantry items, meal plans, cooking progress and settings in app storage on your device. On iPhone, the app, share extension and widgets use shared app storage where needed. Android stores its personal library and import inbox in app-private storage.

A personal recipe library is not automatically a public library. Information can leave your device when you import from online sources, use cloud assistance, enable Zuppi personal sync, use online barcode lookup, choose sharing or public-link features, export content or send feedback. Those routes are explained below.

Device data is subject to your operating system’s protections and device and backup settings. Android backup and transfer behaviour is explained below. Keep an export of recipes that matter to you, especially during beta testing.

Website analytics & cookies

If you choose “Accept analytics”, we use Google Analytics (provided by Google) to understand website visits, page use and engagement, and improve Zuppi. Google receives cookie identifiers, device and browser information, website activity and connection information including your IP address; Google states that Analytics does not log or store IP addresses. This is separate from joining the waitlist. We rely on your consent for this optional processing.

Until you accept, we do not load the Google Analytics tag or send analytics requests. You can reject analytics and still use the website and waitlist. Use in the footer to change your choice or withdraw consent at any time. Withdrawal stops future collection and removes this site's Analytics cookies; it does not undo earlier lawful processing or automatically delete data already received by Google.

We store your choice in your browser’s local storage under zuppi-analytics-consent-v1 for 180 days to remember it. If you accept, Google uses _ga and _ga_ZWHZCR56RG cookies to distinguish browsers and maintain session information. We configure these cookies to expire after 180 days without renewal on each visit. Clearing browser storage or using a different browser may prompt a new choice. Browser settings may shorten these periods.

We disable Google signals and advertising personalisation in the website tag. We do not send your waitlist email to Analytics. Page-view addresses omit query strings and fragments, and unsubscribe pages are not measured. Google retains analytics information according to the Analytics property's retention settings; cookie expiry is separate from server-side retention. See how Google uses information from sites that use its services and Google’s Privacy Policy.

Google may process information internationally, including outside the UK and EEA. Its data processing terms describe applicable transfer safeguards. Contact hello@zuppi.recipes about analytics data or privacy rights.

4. Sign-in & personal sync

You sign in with Apple or Google when you first open the app. Your personal recipes still live on your device; the account is used for personal sync, Friends, Home and Zuppi Plus. Apple or Google can provide an account identifier, name and verified email address. Apple may provide a private relay address. The app protects session credentials in the device Keychain or Android Keystore. Zuppi stores provider identifiers and a keyed, non-reversible email fingerprint for account-link suggestions, but not the email address itself.

If you enable Zuppi personal sync, recipes, folders, favourites, notes, cooking history, pantry items, shopping lists and meal plans are encrypted in transit and stored by our hosting provider separately for each account. Home recipes and pantry items are stored separately for each Home. A limited recovery window allows us to restore data after operational problems.

You can export synced personal data and delete your sharing account in the app. Signing out stops that device’s session but does not delete the account, synced data, shared copies, system backups or an Apple subscription. Public recipe links contain recipe content you deliberately publish, omit personal annotations, and cannot be edited after publication.

4a. Google sign-in & Android alpha

Local library and backups

The current Android preview stores personal recipes, photos, notes, pantry items, shopping lists, plans, settings and pending imports on your phone. Google sign-in can enable Zuppi personal sync; Friends, Home and public links upload the content you choose to use with those features.

Android system backup and device-to-device transfer can include the app’s database, photos and preferences, depending on your device, backup provider and settings. The app excludes its installation identifier and protected sign-in/entitlement credentials from these backups. A separate queue of unsent diagnostics is also excluded. A restored device may therefore have your recipes but require a new sign-in. Manage system backups through Android and your backup provider; they are separate from Zuppi sharing.

Optional Google sign-in

The Android app asks you to sign in with Google when you first open it. Friends and Home can use Sign in with Google on iPhone or Android. Google supplies an identity token, which can contain your Google account identifier, name, email address, email-verification status and profile information. The app sends the token, a one-time sign-in challenge and your display name to Zuppi’s sharing service for verification.

The sharing service retains your Google provider identifier, Zuppi account identifier, display name, sessions and sharing records. It stores a keyed, non-reversible fingerprint of the provider-verified email for account-link suggestions, but not the address itself or a profile photo. The sign-in flow does not retain a Google refresh token. Zuppi does not receive your Google password or permission to read Gmail, contacts or Drive files. On iPhone, Google sign-in uses Google’s iOS SDK and stores its local sign-in state in the Keychain. Session credentials stored by the Android app are encrypted using Android Keystore.

If a verified Google email fingerprint matches one already supplied by Apple, Zuppi offers to link the sign-in methods. It never links them from the match alone. Linking requires a fresh Apple sign-in, uses a single-use proposal that expires after ten minutes, and remains optional. You can instead keep separate Zuppi accounts. Apple private relay addresses usually will not match a Google address.

Signing out ends the Zuppi session; it does not delete your sharing account or Google account. Use the sharing account’s deletion control to remove its account and session records. Our account deletion page explains the steps, what is deleted and what is kept. A Home host must first transfer or delete the Home. Clearing Android app storage or uninstalling removes local app data, but does not delete server records, system backups or copies already shared or exported. Email hello@zuppi.recipes if you need help with deletion.

Android permissions and Google services

• Camera and selected photos: used for recipe images, photo text recognition and supported barcode scanning. The Android photo picker gives access to the images you select, without granting access to your whole photo library. Text recognition runs on the device; recognised text can subsequently be sent to the cloud when you choose an import.
• Notifications, alarms and background work: used for cooking timers, import progress and resuming work after interruption. You can manage notifications and exact-alarm access in Android Settings. Denying these can affect reminders or background updates.
• Microphone: the current package declares an audio permission, but the present preview does not provide audio/video transcription or hands-free speech commands. Installing it does not grant microphone access. This notice will be updated if those features become available.

Google’s on-device recognition services support text recognition and barcode scanning. They process images and recognised text on your device, but can contact Google for recognition updates and send performance and usage metrics. See Google’s Privacy Policy. Contact us for information about the recognition services used on your device. Android does not use the iPhone Reminders, Live Activities or Apple cloud-assistance integrations.

Google Play alpha registration

When you request Android alpha access at android.zuppi.recipes, we store the normalised email address you submit, the signup and update times, the privacy-notice version, a pending self-join status, attempt count and a limited processing-failure code if the address could not be recorded. Use the Google account selected in the Play Store on your Android phone. Our hosting provider delivers the page and stores this record. New registrations receive a one-off setup email through our email delivery provider with the Google Group and Google Play joining steps. We store an email delivery reference, attempt times and a limited failure code so we can avoid duplicate emails and retry temporary delivery failures. An IP-based request limit protects the form, but the tester record does not store your IP address or browser details. The page has no website analytics and this registration does not add you to the marketing waitlist.

After the address is stored, the page shows links to the Zuppi Test Pilots Google Group and the closed Google Play test. You must join the group yourself using the same Google account. Following those links sends you to Google, which handles group membership, testing enrolment and app delivery under its own privacy terms. When you choose Check my membership, our service sends the address you entered to our membership checker hosted by Google to check membership of the Zuppi Test Pilots group. It returns only whether that address is a member; the page does not show the member list. This checks the submitted address, not ownership of that email account. A membership check does not confirm Google Play opt-in or installation eligibility. The joining guide uses an encrypted, HTTP-only cookie containing your submitted email, progress and expiry time for up to seven days. Starting again clears this browser cookie, but does not leave the group. The checker only reads membership of Test Pilots. It does not add or remove members, access Gmail, contacts or Drive files, or use domain-wide delegation. Google temporarily caches a membership result for up to one minute using a protected identifier instead of the plain email address. We retain the access record while the alpha remains active or until it is no longer needed. Email hello@zuppi.recipes from the registered address to ask us to remove the website record; leave the Google Group separately to end its membership. App diagnostics after installation are described below.

5. Imports & cloud assistance

When you import a link, the app can contact the source website directly. That website receives ordinary connection information such as your IP address. Supported import routes depend on whether a post is accessible; Zuppi does not guarantee access to every social post.

Text recognition, supported speech recognition and deterministic recipe parsing can run locally. On iPhone, cloud recipe processing is included in the service described at signup and in the Terms of Use. Recipe links, pasted text, text recognised in photos and saved recipe text can be sent to Zuppi’s cloud AI service for extraction and suggested improvements. Recipe text can contain personal information you include. You can turn Cloud AI for recipes off in Settings and keep using local imports and manual editing. Existing choices to turn it off are preserved. Saved-recipe suggestions require review before you apply them.

Android imports

Android link and cloud-text imports send the source URL and any supplied recipe text to Zuppi’s cloud service. Photo text recognition happens on the phone before an import. The dedicated “From ChatGPT” route prepares pasted recipe text locally; it still sends the import outcome diagnostics described below. The current Android preview does not use Apple Private Cloud Compute or upload video files for transcription.

Zuppi’s cloud import service

The service can receive a post URL to resolve it and retrieve public post information, or evidence text to turn into ingredients and steps. Evidence can include captions, comments, text recognised in images, transcripts and text you paste. Recipe structuring uses Zuppi’s cloud AI service.

Requests include a random installation identifier, client version and, where available, a Plus entitlement token. The installation identifier is hashed with a salt for service counters; it is still a pseudonymous identifier, not a promise of anonymity. IP addresses are also used for short-lived abuse limits.

Resolved posts are cached for up to 30 days and structured recipe results for up to 90 days. Results can be reused for matching source content across installations. Do not include private information in text intended only to describe a recipe. Cached content is not a private backup of your library. Contact us with the source link or other identifying details if you need help locating submitted content.

Resumable cloud imports also keep job inputs, progress, results and diagnostic state so an interrupted import can recover. Collection removes the full result from that job, while a smaller status record can remain. Uncollected results and jobs needing attention can remain until resolved or removed; the cache periods above do not set a deletion deadline for those records.

Successfully processed public-source recipes can enter a shared recipe catalogue for reuse, retaining source attribution, recipe content, revisions and content/evidence hashes. That catalogue is separate from your personal library and does not have an automatic expiry in the current service. Contact us about removal or corrections using the source link.

Temporary media used on the device for an import is cleaned up after completion, failure or cancellation. Interrupted runs or deletion failures can leave temporary files until cleanup can run again. The cloud extraction API receives URLs and text rather than uploaded video files.

6. Friends & Home sharing

Where available, these optional features use Zuppi’s online sharing service. Connecting can create a server-side account containing your sign-in provider identifier, protected verified-email fingerprint, account identifier, display name, sharing preferences and authentication sessions. Apple identity tokens and authorisation codes are sent to verify Apple sign-in, and encrypted Apple refresh credentials are retained. Google identity tokens are sent to verify Google sign-in on iPhone and Android; Zuppi does not retain a Google refresh token. Subscription identifiers and signed transaction information may be processed to verify hosting or other paid access.

When you enable recipe sharing, the recipes made available for Friends are uploaded to the sharing service. Accepted friends can browse the recipes you make visible. Home stores its shared recipes, still photos and pantry information so members can work with them. We also store invitations, memberships, friendships, blocks, change records and information needed to resolve duplicate or conflicting edits.

Other participants can see the profile and shared content relevant to their invitation, friendship or Home membership. Home members can change shared content. People can keep personal copies of recipes they have already copied; withdrawing visibility or leaving a Home does not recall those copies.

You can use available controls to hide recipes, stop visibility, remove or block friends, leave a Home or delete your sharing account. A Home host must transfer hosting or delete the Home before deleting their account. Signing out only ends the session. If a control is unavailable or fails, contact us for help.

7. Barcode catalogue

When online catalogue lookup is enabled, barcode scans send the product code to Zuppi’s catalogue service. Requests include a random installation identifier and may include a Plus token. We use a salted hash of the installation identifier for quotas and contribution handling. The service may ask Open Food Facts for product data. Loading externally hosted product images may contact their host directly.

If you contribute a product or correction, the supplied product details can become part of the shared catalogue. Correction records include the product code, changed field, value, time and installation hash. Product data can be included in catalogue exports; do not submit personal information as a product description.

Open Food Facts product data is made available under the Open Database Licence, with separate image licensing. Catalogue lookup does not upload your whole pantry. Pantry sharing through Home is a separate feature.

8. Device permissions

The following integrations describe iPhone. See Android permissions above for the current Android preview.

• Camera and selected photos: for scanning recipes or barcodes, importing screenshots and adding recipe images. Recognised text may then enter the cloud import route; photos attached to shared recipes can be uploaded when you share them.
• Microphone and speech: for supported cooking commands and transcribing import audio. The app’s speech recognition requests on-device processing; availability depends on the device and language.
• Reminders: if connected, Zuppi reads and writes the selected shopping list, including items and completion state, while syncing. Apple’s permission can grant broader access than that single list; Zuppi’s integration is scoped to the list you choose.
• Notifications and Live Activities: for cooking timers and related on-device updates.

You can change permissions in iOS Settings. Disconnecting Reminders stops further sync and keeps existing items. Turning off a permission may disable the related feature.

9. Purchases, TestFlight & support

Apple processes App Store payments. We do not receive payment-card details. The app uses StoreKit transaction information to determine access, and the sharing service may verify signed transactions and retain entitlement records. Actual purchase availability and prices are shown by Apple when offered.

If you later choose to test through TestFlight, Apple provides crash logs and usage data to Apple and the developer automatically. Feedback you submit can include screenshots, comments and identifying information. We use testing data to diagnose problems and improve Zuppi. See Apple’s TestFlight terms and testing data details. Joining the website waitlist alone does not start this collection.

Android preview diagnostics

The current Android preview automatically reports app-session starts (at most once per hour) and import activity, including starts, completion, partial results and failures, to Zuppi’s diagnostics service. Reports include a random installation identifier, event/import identifiers, timestamps, Android and app versions, source category, import entry point, duration, outcome, error codes and whether AI was used. The server stores a salted hash of the installation identifier. These records are pseudonymous, not anonymous.

Dashboard event payloads do not include your Google account, email, recipe text, images or full source URL. Separate import-failure reports can include the source hostname, error message and diagnostic counts, such as how much source text was available. The cloud service also records import-job progress and failure diagnostics. Our hosting provider receives ordinary connection information and uses IP-based abuse limits.

We use these reports to identify faults, assess import reliability and improve the preview. They are separate from optional Google Analytics on this website: rejecting website analytics does not turn them off, and the optional analytics and crash-reporting switches do not control these first-party reports. You may object to this processing or ask about your records by emailing hello@zuppi.recipes. Stop using the preview if you do not want further app-generated reports; uninstalling removes its local pending queue. Reports already received follow the retention rules below.

On Android, Zuppi Plus is bought through Google Play, which processes the payment. We do not receive payment-card details. The app and our service check the purchase with Google Play to confirm your subscription and keep an entitlement record linked to your account.

Optional reporting on iPhone

Shortly after the first screen opens, Zuppi asks whether you want to share optional analytics. Reporting starts off. “Share analytics” enables Zuppi usage and import diagnostics, our analytics provider’s usage analytics, crash reports and performance reports together. “Don’t share” leaves them off and does not limit features. Settings → Help improve Zuppi → Analytics changes this choice at any time.

Zuppi’s diagnostics service receives app-session starts and import events with installation and event identifiers, app and system versions, source categories, timing, outcomes and controlled diagnostic codes. The server hashes the installation identifier. Our analytics events do not include account details, recipe text, images or full source URLs. Separate optional failure diagnostics may include a source hostname and an error message. Cloud service requests necessarily carry ordinary connection information regardless of this optional reporting choice.

Our analytics provider receives app lifecycle, engagement and limited import events, using app-instance identifiers and app, device and operating-system details. Crash reporting receives crash traces, session identifiers and device and app diagnostics. Performance reporting receives startup times, supported rendering measurements and network diagnostics including URL patterns, timing, response codes and transfer sizes, with installation identifiers. Our own event adapter does not attach recipes or account details to these events. The reports help us understand use, find failures and improve performance.

Turning Analytics off stops new optional collection, clears Zuppi’s unsent app queue, resets local analytics data and requests deletion of unsent crash reports. Previously submitted cloud jobs receive the new choice when the app next contacts them; requests already in flight may finish. Turning the switch off does not automatically erase reports already received. Contact us for help with a deletion request. Our analytics provider retains received data under its service settings and policies. Contact us for information about the provider and the policies relevant to your reports.

Our optional analytics integration disables advertising storage, advertising user data, advertising personalisation and advertising-identifier collection. Optional analytics consent is separate from website cookies, Google AdMob consent and Apple’s tracking permission. Earlier Android builds can have separate analytics and crash-reporting switches; the Android preview diagnostics above describe that platform.

If you send an in-app support or content report, Zuppi receives your message, content references, selected attachments, app and system versions, and an email address only if you request email updates. Our hosting provider accepts and queues the report; our support management provider stores it for our support and moderation work. Our email provider delivers requested updates. Reports are not shown to the person being reported. Avoid sending passwords, payment details or information unrelated to your request.

9a. Advertising

On the free plan, Zuppi shows one native ad, labelled Sponsored, on the import screen. Ads are provided by Google AdMob (provided by Google). Zuppi Plus removes ads.

To show and measure ads and prevent ad fraud, the Google Mobile Ads SDK can collect and send to Google your device’s advertising identifier (on Android, the Android advertising ID; on iPhone, the IDFA only if you allow tracking), IP address and the approximate location derived from it, app and device information, ad interactions such as views and taps, and diagnostic information about ad performance. We do not give Google your recipes, your account details or your email address.

In the UK, EEA and Switzerland, you see Google’s consent form after signing in, and personalised ads are only requested with your consent. On iPhone, Apple’s tracking prompt appears once; if you decline, only non-personalised ads are requested. Non-personalised ads still use the information above for delivery, frequency capping, measurement and fraud prevention. You can change your consent choice in the app’s settings where offered, and reset or delete your advertising ID in Android Settings (Privacy, Ads) or turn off tracking in iPhone Settings.

See how Google uses information from apps that use its services and Google’s Privacy Policy. Google may process information internationally, including outside the UK and EEA.

10. Retention & deletion

• Waitlist: a daily cleanup removes signups older than 12 months, or more than 30 days after they are marked as notified, whichever comes first. Your personal unsubscribe link removes the active signup immediately after confirmation. Our email delivery provider may retain suppression and delivery records needed to honour opt-outs, protect delivery and meet legal obligations. Email removal requests are handled by us.
• Device data: retained according to your use and deletion choices. Zuppi account sync stores data with our hosting provider, separately from iCloud. Deleting the app does not necessarily remove Keychain entries, operating-system backups, server records or exported copies.
• Android local data and backups: retained until you delete it, clear app storage or uninstall, subject to system backup and restore settings. System backups are managed by your backup provider; uninstalling is not a request to delete them. Signing out does not delete local recipes.
• Android diagnostics: the local delivery queue removes acknowledged events and prunes unsent events older than seven days or beyond 2,000 events when it runs. Dashboard event and import-activity records are configured for daily deletion after 90 days. Daily aggregate counts, which omit installation identifiers, are retained without an automatic expiry. Separate import-failure rows are scheduled for deletion after 30 days, with aggregate counts retained without an automatic expiry.
• Cloud imports: post caches expire after 30 days and recipe-result caches after 90 days. Import quota counters expire after 26 hours and IP limit entries after two minutes; blocked-post cache entries expire after one hour. Resumable import jobs and the shared recipe catalogue have the separate retention described in the imports section; those records are not all covered by cache expiry. Host-level diagnostics and recovery data follow the service provider’s retention.
• Sharing: account and shared records are retained to provide the feature until deleted through the relevant controls or a supported request. Deleted-item markers can remain for synchronisation. Duplicate-operation records are cleaned after 30 days; expired sessions, challenges and invitations are cleaned by the service. Leaving a Home preserves its shared content. Deleting a Zuppi account starts retryable removal of its identity, synced personal data, authored shared content and publication links. Original authorship is retained for new shared records; older records can identify only their last editor. Independent copies other people saved remain. Minimal deletion markers prevent old sessions from recreating data. Unclaimed photos and deleted publication objects are eligible for cleanup after seven days; shared objects still used by other people remain.
• Catalogue: product facts and contributions are retained for the continuing catalogue. Correction records can include the installation hash until removed; they do not have an automatic expiry in the current service. Contact us about corrections or personal data submitted by mistake.
• Support and testing: retained while needed to resolve the issue, follow up and investigate related faults, or meet legal obligations. We consider the issue’s status, sensitivity and continuing need. Apple controls retention within its own systems.

Our service providers’ recovery backups may retain deleted data for their recovery period. A deletion from an active table is not a promise of instant erasure from every backup. Contact us for help identifying information held in our services.

11. Purposes, legal bases & recipients

Where UK or European data-protection law applies, we rely on consent for the waitlist email, optional website analytics and optional app analytics, crash reports and performance reports; providing the service you request for app storage, imports, sharing and entitlement checks; legitimate interests for operating and securing the site, preventing abuse, handling support and improving reliability, including the first-party Android session/import diagnostics described above and non-personalised ads on the free plan; consent for personalised ads; and legal obligations where records must be retained. Optional device permissions and feature choices provide additional controls. You may object to processing based on legitimate interests.

Google provides optional website analytics and app reporting when you consent, Android sign-in, Google Play billing, AdMob advertising, and the on-device recognition services described above; it may also provide your Android system backup service. Our hosting and cloud AI provider supplies website delivery, data storage, security and recipe processing for Zuppi services. Our email delivery provider handles waitlist messages, testing lists, delivery records and unsubscribe handling. Our support management provider stores messages, content references and attachments for support and moderation. Apple provides sign-in, iCloud, App Store and TestFlight services. Source websites and Open Food Facts receive requests when relevant features use them. Our email provider handles support correspondence. Shared content reaches the people you choose to share with. We may also disclose information where legally required or to protect legal rights.

Providers operate internationally, so information may be processed outside the UK or your country. Our hosting and cloud AI provider’s data processing agreement sets out transfer safeguards, including applicable standard contractual clauses and UK provisions. Contact us for a copy of the relevant safeguards and details of the providers handling your information. Apple’s processing is described in its privacy policy; Google’s Android-related processing is described in Google’s Privacy Policy. Contact us for information about safeguards relevant to your data.

We do not sell personal information. Google AdMob uses information for personalised ads only with your consent, as described in section 9a. If the business changes ownership, any transfer of personal data must respect this notice and applicable law; material changes will be communicated.

12. Your choices & rights

Depending on applicable law, you can request access, correction, deletion, restriction or a portable copy of personal information, object to certain processing, and withdraw consent. We will not discriminate against you for exercising applicable privacy rights. Some requests are subject to legal exceptions and proportionate identity checks.

Email hello@zuppi.recipes. Tell us which feature you used and provide enough information to locate the relevant record. We normally respond to UK GDPR rights requests within one month; if an extension is permitted and needed, we will explain it. We cannot retrieve a personal recipe stored only on your device or in your private iCloud database.

You can complain to the UK Information Commissioner’s Office, or the relevant data-protection authority where you live. You do not have to contact us first.

13. Children & changes

Zuppi is not directed at children under 13. If you are under 18, review the app and testing terms with a parent or guardian; local age and consent requirements also apply. If you believe a child has sent us personal information without appropriate permission, contact us so we can investigate and take appropriate action.

We will update the date on this page when this notice changes. For material changes affecting information already collected, we will provide appropriate notice and obtain fresh consent where required. A waitlist signup will not automatically become permission for unrelated marketing.