Privacy policy

Your recipes are yours to choose. Yumo processes the content you submit to save recipes and adapt them to your selected goal. Product analytics and marketing attribution are separate optional choices, both off by default.

Who is responsible

Yumo is operated by John Uschold, the controller responsible for the personal information described here.

Privacy contact: decostudiosdev@gmail.com.

What we process

• Recipe content: links, selected photos and PDFs, extracted text, source titles and creator names, your selected recipe goal, and generated ingredients, instructions and nutrition estimates.
• App and security identifiers: an installation identifier, a server-issued user identifier, Apple App Attest verification data, and technical request information such as IP addresses. These help protect the service and enforce usage limits. No sign-in is required; this does not mean all processing is anonymous.
• Purchases: subscription product, transaction and entitlement information supplied by Apple and RevenueCat. We do not receive your full payment-card details.
• Support: your email address and any information you include in a message to us.
• Optional product analytics: if you turn this on, PostHog receives structured events about how Yumo is used, such as screens and feature actions, import and cooking outcomes, broad result categories, timing, app version, and subscription state. Events use a pseudonymous installation or server user identifier. They do not include recipe contents, submitted URLs, photos, PDFs, free text or dietary details.
• Optional marketing attribution: if you turn this on, AppsFlyer receives the attribution and app events needed to measure where installs and subscriptions came from. This includes conversion events such as onboarding completion, a recipe being saved, and cooking completion, plus a pseudonymous AppsFlyer installation identifier, app version, event timestamps, broad campaign or source labels when available, and technical information supplied by the SDK. The current Yumo configuration does not request ATT permission or collect IDFA. It does not use these permissions to show advertising in Yumo.

Your saved library, cookbooks, meal plan, shopping list and cooking preferences are stored on your device. Recipe processing also creates server-side results and usage records. Deleting the app or a saved recipe does not automatically delete those server records.

iCloud library sync

In versions with iCloud sync, Yumo also saves recipes, cookbooks, favourites, meal plans and shopping lists in your private iCloud database when iCloud is available. This uses the iCloud account on your device and does not create a Yumo sign-in. Cooking preferences, active cooking timers and installation credentials remain local. Apple provides the iCloud storage, and your iCloud storage allowance applies.

Sync runs while Yumo is open. Settings shows whether your latest changes have synced; changes that have not uploaded cannot be restored from iCloud. Synced changes, including deletions, propagate to your other devices. This is synchronization, not a historical backup. Deleting Yumo does not by itself erase its iCloud data. Manage Yumo’s iCloud access and storage through Apple’s device settings. If you change iCloud accounts, Yumo pauses syncing the existing library to avoid copying it into a different account.

Recipe processing and AI services

When you request recipe processing, Yumo sends the recipe content you choose and your selected goal to our server and to Google Gemini through OpenRouter for AI processing. OpenRouter routes requests to the model provider. For supported social links, Apify may retrieve the source content. PDFs may be converted to recipe text before processing; images may be resized.

Do not submit private, sensitive or identifying content that you do not want these services to process. You can decline processing and continue using saved recipes, or turn off permission in Settings. Turning it off stops future recipe requests until you allow them again; it does not undo processing already performed.

Other service providers

We use Hetzner to host the API, Supabase to store database records, Vercel to host this website, and Apple and RevenueCat to manage subscriptions and app integrity. If you enable product analytics, we use PostHog for structured product analytics. If you enable marketing attribution, we use AppsFlyer for install, campaign and subscription attribution. Our backend may send verified RevenueCat subscription lifecycle events to AppsFlyer only when the attribution choice permits it and a consented AppsFlyer identifier is available; native RevenueCat-to-AppsFlyer forwarding is disabled. Hosting and analytics services receive only the information needed for their stated purpose. Providers process information under the terms and privacy arrangements applicable to those services.

Optional analytics SDKs also include technical context such as device model and type, operating system, language and region settings, screen dimensions, app build, SDK version and session identifiers. Their servers receive network information needed to deliver requests. We disable PostHog IP-based location enrichment and do not collect precise location.

Purposes and legal bases

Where the GDPR applies, we process information necessary to provide requested recipe features, subscription access and support to perform our contract with you. AI recipe processing is enabled by default and can be turned off in Settings. Your saved recipes remain available when processing is off. Our legitimate interests in preventing fraud, protecting service availability and diagnosing failures support necessary security and operational processing. We may retain records to meet applicable legal obligations.

Product analytics and marketing attribution are optional and enabled by default for installations without saved preferences. You can turn either option off independently in Settings → Privacy choices. Previously saved choices are preserved. We do not send optional events while the relevant option is off, and we do not backfill activity from periods when it was off. The app stops its local SDK collection when a choice is withdrawn; a server-side choice update and any already queued export may finish once the device is online, after which future exports are blocked. Verified subscription lifecycle events are sent from our backend to AppsFlyer only when marketing-attribution consent is active and a consented AppsFlyer identifier is available. The native RevenueCat-to-AppsFlyer forwarding integration is disabled so a later withdrawal can be respected. AppsFlyer sharing with advertising-network partners is disabled in the current configuration. Withdrawing a choice stops future collection and forwarding; it does not itself delete records already received by a provider. You can request deletion as described below.

We do not use your recipe goals to make decisions producing legal or similarly significant effects about you. Nutrition estimates describe recipes, not a medical assessment of you.

How long information is kept

Recipe-processing job records expire about 30 minutes after completion or failure and are removed during cleanup. Extracted and generated recipe results are cached separately to avoid repeating processing; this cache currently has no automatic expiry. Usage, subscription and device-verification records are retained as needed to provide access, enforce limits and prevent abuse. These records are not automatically erased when you uninstall the app.

Support correspondence and operational logs are kept as needed to resolve requests, maintain security and meet legal obligations. Provider logs and backups may follow separate retention schedules. Contact us to request deletion; we will explain any information we must retain and why.

Optional PostHog and AppsFlyer records are retained according to the retention settings and service terms for the Yumo accounts. The applicable hosting region, retention period, transfer mechanism and partner-sharing settings will be verified before production activation and will be kept current in this policy or the linked provider information. We do not promise a provider retention period until that account configuration has been confirmed.

Sharing a recipe

Recipe share links are intended to be opened by other people. Anyone with a working link may be able to view its recipe and source information. Avoid sharing a link to content you intend to keep private.

Your rights and choices

Privacy choices in Settings lets you copy locally retained privacy references to help us locate your records for an access or deletion request, including after you withdraw optional consent. These references are not automatically sent to support.

Depending on where you live, you may have rights to access, correct, delete or receive a portable copy of your personal information, restrict processing, object to processing based on legitimate interests, and withdraw consent. You may also complain to your local data-protection authority, including the authority where you live, work or believe an infringement occurred.

Send requests to decostudiosdev@gmail.com. We may ask for information reasonably needed to identify your app records and verify your request. Do not send payment-card details. For a verified deletion request, we locate the matching Yumo installation or server user record, stop optional exports, delete or anonymize eligible Yumo records, and submit the corresponding provider request to PostHog and AppsFlyer using their documented data-subject workflow. We record the request and any information that must be retained to comply with law or protect the service, and explain those limits. Cancelling a subscription is separate from withdrawing analytics consent or deleting data: manage subscriptions through your Apple account.

Security and international processing

Connections to our API use HTTPS, and production database access is restricted to backend services. Our providers may process information outside your country, including outside the European Economic Area. The current PostHog hosting region, AppsFlyer processing locations, applicable safeguards, and any partner-sharing configuration will be confirmed before optional collection is enabled in production. Contact us for details about the arrangements relevant to your information. No storage or transmission system can be guaranteed completely secure.

Children

Yumo is not intended for children under 13 or anyone below the minimum age for independently consenting to this processing in their country. If you believe a child has submitted personal information, contact us so we can investigate and respond.

Changes and contact

We will update this page when our practices change. If the disclosed AI, analytics or attribution processors or purposes change, we will update the in-app disclosure and seek renewed permission as appropriate. Privacy questions: decostudiosdev@gmail.com.