Privacy Policy

Last updated: 7 October 2026

This privacy policy is applicable to the Simmer app for iPhone and Apple Watch, together with any related services operated by Rauf Salikhov (collectively, the "Application"). Rauf Salikhov is hereinafter referred to as the "Service Provider". This policy also covers simmer.avrdu.de and the Simmer API.

Data controller

Rauf Salikhov is responsible for your personal data. Address: Bul. Despota Stefana 115, Belgrade, Serbia. Contact details are available through our support page.

Information collection and use

You can use local features without an account. When you use online features, we process:

• Account information: Apple or Google sign-in identifiers, an internal user ID and account timestamps, to authenticate you and provide access to your account. The current API does not store your name or email in the account database.
• Recipes and library data: recipes, ingredients, instructions, favourites, collections and meal plans you send to the API, to provide storage, synchronization and sharing.
• Shared content: recipes and uploaded photos you publish, with an internal account ID and timestamps. Shared recipes and image links are publicly accessible.
• Purchase information: Apple transaction identifiers, products, purchase environment, entitlement expiry and verification dates, to verify subscriptions and restore purchases. Apple processes payments; we do not receive card details.
• Technical information: IP addresses, request metadata, search queries, filters, recipe identifiers and imported URLs, to answer requests, secure the service and diagnose problems.
• Support correspondence: your email address and message contents when you contact us.

Local recipes, grocery lists, pantry data, cooking state, preferences and cached images are stored on your devices. Authentication credentials are stored in the system Keychain. Apple may include local data in device backups according to your settings.

Legal bases

Where GDPR applies, we process account, library and subscription data to perform our contract with you; technical data for our legitimate interests in security and reliable operation; and support messages to answer your requests. We rely on consent where required for optional processing and on legal obligations where applicable. We do not sell personal data, use it for advertising, or make automated decisions that have legal or similarly significant effects.

Service providers and disclosure

We use the following providers:

• Apple for sign-in, App Store billing, purchase verification and support email.
• Google for Google sign-in, if you choose it.
• Hetzner for website, API, database and backup hosting in Germany.
• Cloudflare R2 for uploaded recipe images in its EU region.

Shared content is disclosed to other users and public link visitors. Information may also be disclosed where required by law or to protect rights and service security. External recipe sources and image hosts receive requests when you open their content. The API fetches source websites when you import a URL.

International processing

The service is operated from Serbia. Hosting is in Germany and recipe image storage is in the EU. Apple and Google may process information in other countries under their own arrangements. Contact us for information about the processing locations and transfer arrangements applicable to your data.

Cookies and tracking

The website does not set cookies or use analytics. It uses locally hosted HTMX with browser history snapshots disabled. Browser caching and hosting security logs may still apply. The current app has no advertising or third-party analytics SDK.

Data retention and deletion

Account records and synced content remain until you delete them or request account deletion. Delete your account in Profile → Delete Account, or contact us if you cannot access it. Account deletion removes live account database records, including associated library, meal-plan, shared-recipe and subscription verification records.

For removal of uploaded photos or older shared copies, contact us with the public recipe link. Information in logs, backups and support correspondence currently has no fixed automatic expiry. Contact us to request deletion; backup copies may remain until they are replaced or removed. We may retain information when required by law. We do not represent that deleting an account immediately erases every backup, log or stored image.

Account deletion leaves local libraries on your devices and does not cancel Apple subscriptions or delete Apple's independent purchase records. See account deletion and subscriptions for instructions.

Your rights

Where GDPR applies, subject to its conditions, you may:

• Right of Access: You can request access to your personal data.
• Right to Rectification: You can request correction of inaccurate data.
• Right to Erasure: You can request deletion of your personal data (the "right to be forgotten").
• Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
• Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent where processing relies on it, without affecting earlier lawful processing.

To exercise your rights, use the Contact us button on our support page. We may request proportionate proof of identity. Where GDPR applies, we ordinarily respond within one month; if an extension is permitted, we explain it within that period. You may complain to your local data protection authority. In Serbia, this is the Commissioner for Information of Public Importance and Personal Data Protection. See the European Data Protection Board's list for EU authorities.

Children's privacy

Simmer is not directed to children under 13. If you believe a child has provided personal data, contact us to request its removal. Higher minimum ages and parental-consent requirements may apply under local law.

Security

We use access controls and authenticated requests to protect account data. No system can guarantee absolute security. Content you publish should be treated as public information.

Changes to this policy

We update the date on this page when the policy changes and provide notice of material changes where required.

Contact

For privacy questions or data requests, use the Contact us button on our support page.