Privacy Policy for the tastivo app

Last updated September 11, 2026

This policy describes what the tastivo app (iOS and Android) does with your data. In short: your cookbook stays on your device. Only when you share a post with tastivo or submit a link, a video or text for recognition does our server process that content, and it deletes it afterwards. The website tastivo.de has its own privacy policy (German).

1. Controller

Thomas Harnisch
Königskinderweg 74f
22457 Hamburg
Germany
Email: info@tastivo.de

2. What stays on your device

Recipes, shopping lists, settings (language, appearance) and your monthly AI import counter are stored locally on your device. There is no account. Deleting the app deletes this data. Text you paste and screenshots you pick are analysed entirely on the device and never leave it. On newer iPhones the app may additionally use the operating system’s language model; this also runs exclusively on the device.

3. Backup file

In Settings you can export your cookbook including pictures as a file. The file is created on your device and only leaves it to the destination you choose in your operating system’s share menu, such as a cloud drive or an email. We do not receive it.

4. iCloud sync (iOS only, tastivo Plus only)

If you turn on iCloud sync, the app stores your cookbook in your own iCloud Drive (folder “tastivo”) so it is available on all devices signed in with your Apple ID. The data is held by Apple under your Apple account and Apple’s privacy policy applies. We have no access to it. You can turn sync off at any time in Settings and delete the folder in the Files app.

5. Recognising shared posts (AI import)

When you share a post from Instagram, TikTok, YouTube or Facebook with tastivo, paste a link or pick a video from your gallery, the app sends the address or the video file together with your device identifier and app language to our server (api.tastivo.de). The server fetches the publicly accessible post and first reads the caption with rules. If that is not enough, caption, audio track and single frames of the video are transmitted for recognition to OpenAI, acting as our processor (OpenAI Ireland Ltd. or OpenAI, L.L.C., USA; transfer based on the EU standard contractual clauses and the EU-US Data Privacy Framework). The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

Video, audio and frames are deleted on our server immediately after processing. The generated recipe is kept on the server for at most seven days so the app can collect it, and after that only on your device. Recognised recipes are also cached for up to 24 hours under a hash of the address so the same post does not have to be processed twice; this cache contains no reference to your device. Every recipe created with AI is marked in the app as machine-generated.

6. Device identifier and quota

On first launch the app generates a random device identifier, stored on the device. For this identifier our server stores the time and cost of each AI import in order to count the monthly quotas, as well as platform, app version and language for operation. It cannot be traced back to you as a person. The legal basis is our legitimate interest in fair and secure operation (Art. 6 (1) (f) GDPR). You find the identifier in the app’s Settings; quote it if you want access to or deletion of this data.

7. Server logs

Each request to our server records IP address, time, requested function and status code in logs that are deleted after 14 days at the latest. They serve to fend off attacks and to find errors (Art. 6 (1) (f) GDPR).

8. Notifications

If you allow notifications, our server stores a push token for your device so we can tell you when a shared recipe is ready or an import failed. Delivery runs through the Expo Push Service (Expo, Inc., USA) and your operating system’s service (Apple or Google). You can switch notifications off at any time in the system settings. Timers in cooking mode are local notifications without a server.

9. Advertising

Free use is co-financed by advertising: a banner at the bottom, occasionally a full-screen ad after saving a recipe or in cooking mode, and when opening the app. Ads are served by Google AdMob (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Before the first ad, the app asks via Google’s consent form whether personalised ads are allowed; on iOS the operating system additionally asks for permission to track. Without consent only non-personalised ads or no ads are shown. You can change your consent at any time under “Ad settings” in Settings. The legal basis is your consent (Art. 6 (1) (a) GDPR). Information on data processing by Google: policies.google.com/technologies/partner-sites. With tastivo Plus no ads are shown.

10. tastivo Plus

You subscribe through the App Store or Google Play. Payment data is received exclusively by Apple or Google. Our server only learns whether a valid subscription exists for your device identifier, in order to unlock ad-free use, the higher quota and iCloud sync.

11. Recipe link (only on request)

If you tap “Share recipe link” on a recipe, the app stores the recipe (title, ingredients, steps, servings, times, image address and source) on our server as a web page under a random, unguessable address so that you can pass it on. The page is blocked for search engines, contains no device identifier and remains stored until you delete the link in the app. Anyone who knows the link can see the recipe. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

12. Thermomix version (AI)

On request our server rewrites the preparation steps into a Thermomix version. For this, title, ingredients and steps of the recipe are transmitted to OpenAI (see section 5); the result is an AI suggestion and is labelled as such. The recipe is not stored permanently for this; the cost counts towards the cost budget of your device identifier.

13. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to lodge a complaint with a supervisory authority. For data on your device you exercise these rights yourself by deleting the app or using the backup function. For everything else, write to the email address above.

14. Changes

We update this policy when the app or the legal situation changes. The current version is always available in the app under Settings and on this page.