Privacy policy

01 Controller

The controller within the meaning of the GDPR is:

02 This website (bitefresh.de)

Hosting & server logs

This website is hosted by Strato AG (Germany). When you visit, Strato processes technically necessary access data (IP address, date/time, requested page and browser type) to operate the website. The website is also delivered through Cloudflare’s content delivery network (Cloudflare, Inc., USA — standard contractual clauses). Cloudflare processes technically necessary connection data, including your IP address, to deliver pages securely and quickly. The legal basis is our legitimate interest in secure, stable operation (Article 6(1)(f) GDPR).

Cookies & analytics

We use technically necessary cookies, including cookies that store your consent choice through Complianz. We optionally use Google Analytics 4 to analyse website usage. Analytics starts only after you consent to the Statistics category. Google Analytics is not loaded without your consent. You can change your choice or withdraw consent for the future at any time through the consent settings.

Google Analytics 4 (optional)

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With your consent, page views, sessions, device and browser information, referring pages and a pseudonymous cookie identifier are processed. Your IP address is technically used for transmission and to determine location; Google states that IP addresses of users in the EU are not logged or stored. App account data is not sent to website analytics.

The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Refusing consent does not restrict your use of the website. Processing by Google LLC and service providers outside the EU, particularly in the USA, is possible. The agreed Google data processing terms and their transfer safeguards apply; the level of data protection may nevertheless differ.

No Google Ads tags are used on this website; optional data sharing in the Analytics account is disabled. Further information: Google privacy policy, Google Analytics: data and privacy in the EU and our Cookie policy and consent settings.

Fonts

We load fonts through Bunny Fonts (Bunny.net, EU servers) — in accordance with the GDPR, without connections to Google servers and without data transfers outside the EU.

03 Data we process in the app

Account: your email address, optionally your name, and your password (stored only as a hash). When you sign in with Google or Apple, we receive the email address you share through that service and, where applicable, your name.

App data: your stock, shopping lists, recipes, household budget and settings. These data are stored on our server in Germany for household sync and shared with members of your household if you join a household.

AI features (only after your explicit consent): When you use Freshy, recipe, meal-plan, voice, scan or recipe-import features, the text or speech transcript you provide, the stock names and preferences required for the request, and uploaded receipt, barcode, product or fridge photos are sent to the AI service Anthropic. For an eReceipt import, we also send the PDF or image file you select for it; we keep the recognised result of a receipt scan (photo or eReceipt) ready for about 24 hours so that you can retrieve it after an interruption. For a recipe import from photos or a PDF, we also send the recipe photos you take for it (up to three per recipe) or the uploaded recipe PDF. When importing from a recipe URL you provide, text extracted from that webpage may also be sent. Recipe from a video file: If you choose a cooking video, the app sends only its audio track, not the picture, to our server in Germany. There, our own speech-recognition service without internet access converts the audio into text. The audio and text themselves are processed only in memory, neither stored nor logged, and discarded immediately after the import. We send the recognised text to Anthropic to create the recipe. We keep the generated recipe ready for about 24 hours so that you can retrieve it after an interruption; only the recipe you accept is stored permanently. These contents are not stored there permanently. This may involve a transfer to the USA (Art. 46 GDPR, standard contractual clauses). This transfer only happens after you have explicitly agreed to it in the app (Art. 6(1)(a) GDPR). We ask for that consent before the first AI use; until then nothing leaves your device for AI purposes. You can withdraw it at any time in your profile under “AI features” — after that no further content is sent to the AI service and the AI features are locked, while all other functions of the app remain usable. Do not upload photos, files or text containing personal or sensitive information.

Barcode data: For product recognition the app sends the scanned barcode (EAN/UPC) directly to Open Food Facts. Open Food Facts technically receives your IP address, device/connection data, the barcode and the time of the request. No BiteFresh account identifier is transmitted.

Push notifications: a technical push token (Expo/Google/Apple), only if you allow notifications.

Emails: we use the email service Resend for registration, password and feedback emails; your email address may be processed in the USA (standard contractual clauses).

Error diagnostics: If the app crashes or an AI or voice command fails, we automatically send an error report to our server (the error message; for AI commands, excerpts of the failed command text and the AI response; app version and device platform). These reports are linked to your account and serve solely to fix errors (Art. 6(1)(f) GDPR); we delete them after 6 months at the latest, and at the latest when your account is deleted.

Subscription & purchase: We use RevenueCat (USA, standard contractual clauses) for subscription and purchase features. The service processes a technical app-user identifier and, after you sign in, an account identifier and your subscription/transaction status from the respective store, already when displaying subscription offers and checking existing entitlements. This does not require a completed purchase. We never see payment data.

One-time trial: If you confirm the one-time free trial in the store, we create an AI starter allowance for it on our server. It holds a non-reversible checksum of the store transaction (SHA-256; we do not store the transaction number itself), the identifier of the household the trial applies to, the start and end of the trial, and counters of the AI credits and scans used. See also section 7 for this record.

Technical import diagnostics: If a recipe import fails or a suspicious import is blocked, we also store the import type, a limited source-site category (such as YouTube or other website), the processing stage, the technical rejection reason and size measurements that are actually known. This additional diagnostic context contains no complete links, credentials, URL parameters, original images, recipe text or AI responses. It is used to fix errors and investigate abuse and is accessible only to authorized administrators. Its retention period is seven days; after that it is no longer displayed and is automatically cleared while the server is operating. Operational or cleanup failures can delay physical deletion; cleanup is resumed after they are resolved. Other technical error records have their own separate retention periods.

04 Optional community contributions

Price/receipt learning and consumption/shelf-life learning require two separate, optional consents. You can give them in your profile; the app also offers them in the AI consent dialog (one box per purpose, not pre-ticked) and once in a Freshy card (“May BiteFresh learn from your corrections?”). Tapping “Yes, help out” there gives both permissions that are still open; you can choose them individually in your profile. These contributions are not enabled without your explicit choice; previous switch settings do not count as new consent. Consent to the AI features (section 3) is separate and does not include either of these permissions. Private stock, scan and correction features remain available without these permissions.

The permission itself is linked to your account. For each purpose, our server stores the current permission status, the consent-text version, a revision counter, the time of the change and technical identifiers to protect against repeated or conflicting requests. This account-linked consent record is deleted with your account.

Permitted prices, deliberately confirmed product and barcode corrections, consumption rates and observations concerning explicitly confirmed best-before dates are processed pseudonymously. Individual contributions contain no account ID, photos, shopping lists or precise location. The household country, currency and app language selected when a contribution is recorded are retained for transmission; later settings changes do not rewrite that original context. Household country and currency are not verified evidence of the country of purchase. If the country or a reliable original context is missing, the app does not send the contribution and does not fill in the country from your IP address.

The server derives separate technical verification keys from your verified sign-in identity to detect repetitions and multiple votes; your email address or provider ID is not stored in the individual crowd report. Raw price, correction, consumption and best-before reports and their technical deduplication markers are retained for at most 13 months. The app only displays quality-checked aggregates after a minimum number of distinct contributors. Best-before observations are evaluated solely with a safety-oriented approach; recommendations to extend shelf life are not published.

You can withdraw each permission separately at any time in your profile. The device stops further contributions immediately; any pending confirmation of the change by the server is shown in the app. Withdrawal does not undo contributions already sent. Unsent contributions are no longer transmitted after withdrawal. Your own recipes are shared only after a separate explicit opt-in. Third-party recipes imported from websites or connected services and personal product photos are never automatically published. Sharing barcode corrections is part of price/receipt learning permission and cannot be enabled separately; private corrections remain possible.

05 Connected apps (Bring!, Cookidoo, Picnic)

When you connect an external service, you enter your credentials for that service. Your password is stored EXCLUSIVELY in encrypted form in your device’s secure storage (Keystore/Keychain) — never on our server. During sync, it is passed once through our server to the relevant service and is not logged. To keep sync reliable without overloading that service, our server stores an encrypted SESSION key (not your password) and uses it to retrieve your list regularly. You can disconnect at any time in your profile; this deletes the credentials from your device AND the session key and list state from our server.

06 Alexa voice assistant (optional)

You can optionally connect BiteFresh to Amazon Alexa. To do so, you link your BiteFresh account to your Amazon account once. The Alexa skill supports German.

What Amazon does: Recording and recognising your speech are handled entirely by Amazon (Amazon.com Services LLC or Amazon EU S.à r.l.) — under its own responsibility and privacy policies. We do not receive voice recordings.

What we receive: the command recognised by Amazon, including the item named in it (for example, “Milch”), and an identifier for the account link.

What we return: the spoken reply. It may contain stock item names, expiry dates and shopping list entries; on its way to your device, it passes through Amazon’s services, where processing outside the EU may occur (Article 46 GDPR, standard contractual clauses).

Limits: Using German voice commands, you can ask about stock, mark packs as opened or almost empty, record a pack as consumed or spoiled, and manage shopping list entries. Alexa records consumption or spoilage only after your explicit confirmation. Deleting whole products, managing households and clearing the shopping list remain available only in the app. Recipe suggestions through Alexa use the app’s AI feature; your consent to AI processing and a plan that includes AI features still apply.

Legal basis and disconnection: Article 6(1)(b) GDPR. You can disconnect at any time in the Alexa app; access to your BiteFresh account expires immediately. The same happens when you change your password or delete your account.

07 Legal bases & retention periods

We process your data to perform the contract (Art. 6(1)(b) GDPR — providing the app), based on your consent (Art. 6(1)(a) — e.g. push, connected apps, community sharing and the transfer to the AI service) and on legitimate interest (Art. 6(1)(f) — operational security, abuse protection). We store account data until you delete your account.

Two categories outlive account deletion:

1. Pseudonymous raw price, product-correction, consumption and best-before reports and technical replay-protection markers are retained for no more than 13 months; published community results contain only the aggregates described in section 4.

2. The record of the one-time trial’s AI starter allowance (section 3) remains. When you delete your account, the account references are removed from it; what remains is the non-reversible checksum of the store transaction, the trial timestamps and the usage counters — no email address, no name, no account identifier. What does remain, however, is the identifier of the household the trial applied to. For as long as that household exists, the record can be related to its remaining members through it; so it is not fully anonymous. Its sole purpose is to prevent the same store transaction from triggering the one-time free trial a second time through a new registration; the legal basis is our legitimate interest in abuse protection (Art. 6(1)(f) GDPR). There is no fixed deletion period for this record. You may object to this processing under Art. 21 GDPR ([email protected]).

08 Your rights

You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21 GDPR), and the right to complain to a data protection supervisory authority. You can delete your account and its server data directly in the app: Profile → Delete account. For anything else, simply email [email protected].

09 App: no advertising or tracking SDKs

The BiteFresh app contains no advertising or tracking SDKs and does not sell data. We use only the services described above that are necessary to operate it. For approximate operational and capacity statistics, we store only your last active time, your approximate country of origin (a two-letter country code derived from your IP address by our provider Cloudflare; we do not store the IP address itself), your selected app language and the country selected in your household settings. These are analysed only in aggregate — for example, the number of active users and how many are from Germany, Austria and Switzerland — without creating movement or usage profiles. The legal basis is our legitimate interest in secure operation appropriate to demand (Article 6(1)(f) GDPR).

To identify errors and secure operation, our server logs technical data about app requests: time, app version, platform (iOS/Android), duration and result, a random request number and pseudonymous identifiers for your account and household, but no stock contents or email address. These logs are deleted after no more than 14 days. If an error occurs, we store an error report (time, function, error code, app version, platform and your account identifier) so we can help you and fix the error; it is deleted after 90 days (legitimate interest, Article 6(1)(f) GDPR).

10 Changes to this policy

BiteFresh is continually developed; features may change. This privacy policy is updated when changes occur (see the date below).

11 Privacy contact

For information and to exercise your rights, contact us at [email protected].