Privacy Policy for Pickeroni

Last updated: 13 October 2026

This privacy policy applies to the “Pickeroni” app for iOS and Android and to the website pickeroni.com. It explains which personal data we process, for what purposes and on which legal basis, who receives it, how long we keep it and what rights you have. We offer Pickeroni in the European Union and in Iceland, Liechtenstein and Norway.

Contents

• 1. Controller and contact
• 2. Overview
• 3. Your account
• 4. Year of birth (optional)
• 5. Signing in with Apple or Google
• 6. Emails from Pickeroni
• 7. Your content and shared lists
• 8. Invitations
• 9. Push notifications
• 10. Unlock via in-app purchase
• 11. Recipe reports
• 12. Security and operations
• 13. Usage statistics
• 14. Website pickeroni.com
• 15. Contacting us by email
• 16. Permissions and data on your device
• 17. Recipients
• 18. Transfers to third countries
• 19. Retention and deletion
• 20. Your rights
• 21. Your right to object
• 22. No automated decisions
• 23. Children and young people
• 24. Data security
• 25. Changes to this privacy policy

1. Controller and contact

The controller responsible for processing your personal data is:

Felix Pieschka
Steglitzer Damm 34
12169 Berlin
Germany

Email for privacy questions and requests concerning your rights: contact@pickeroni.com
Further contact details are in our legal notice at pickeroni.com/impressum.

Felix Pieschka runs Pickeroni as a sole proprietorship. In this policy, “we” and “us” refer to the controller. We have not appointed a data protection officer. We are not required to do so, because fewer than 20 people regularly process personal data by automated means for us and none of our processing operations requires an appointment (Section 38 of the German Federal Data Protection Act (BDSG), Art. 37 GDPR).

2. Overview

The key points

• Account: For an account we need your email address, a display name and a password – or your sign-in with Apple or Google (sections 3 and 5). Your year of birth is optional (section 4).
• Content: Only the members of the lists you share them with can see your recipes, polls, meal plans and shopping lists. Polls are not secret (section 7).
• Notifications: You only receive push notifications if you enable them in the app (section 9).
• Statistics: We analyse in aggregate how Pickeroni is used. You can object to this in the app at any time (sections 13 and 21).
• Service providers: Our servers are located in the EU. For emails and push notifications we use service providers who may also process data in the USA (sections 17 and 18).
• Retention: We keep most data until you delete your account; logs and technical data for much shorter periods (section 19).
• Deletion: You can delete your account at any time, in the app or on our website. Section 19 explains what remains afterwards without a link to you or with other members.

What we do not do

• We do not sell data, and we only pass it on to the recipients named in this policy (section 17).
• No third-party advertising and no advertising SDK in the app; the only promotional notices concern our own unlock.
• No tracking across apps and websites of other companies.
• No analytics SDK and no crash-reporting SDK in the app (in particular no Firebase Analytics and no Crashlytics).
• No cookies on our website and no content loaded from third-party servers (section 14).
• No processing of your data by artificial intelligence.
• No newsletter and no marketing emails.
• No access to your contacts. We do not collect location data; we remove location information from uploaded photos when storing them (section 7).
• No profiles of individuals and no automated decisions (section 22).

3. Your account

What data:

• your email address, your display name and your password. We store the password only as an irreversible hash (bcrypt);
• the time and version of your acceptance of the Terms of Use. With the same checkbox you confirm that you are at least 16 years old and that you have read this privacy policy;
• the language of your app, so that emails and notifications reach you in your language;
• the time of your last use (updated at most once a day) and whether we have terminated your account for inactivity (section 19);
• a counter of the meal plans you have created, for the free limit under the Terms of Use, and a flag indicating whether the app should still ask for your name (section 5);
• the version of your app, which it sends with every request. We do not store it; we only check whether the version is still supported, and if not, the app asks you to update.

Confirming your email address: After you register, we send you a confirmation link that is valid for 60 minutes. You can only use your account after clicking it; this ensures that the address belongs to you. If someone registers again with an address that has not yet been confirmed, the new details replace the old ones; a new password only takes effect after the new link is clicked. If you later change your email address, you have to confirm the new one as well. We send a security notice to the old address (section 6), and your other devices are signed out.

Forgotten password: On request we send you a link to reset your password, valid for 60 minutes.

Sessions: For each device on which you are signed in, we store a session token with the time of sign-in, last use and expiry – no IP address and no device name. Under Account › Active sessions you can see your sessions and end them. A session expires after 90 days without use; every use extends it. It also ends when you sign out, end it, reset your password, change your password or email address (then on your other devices) or delete your account. We also use the time of last use for usage statistics (section 13).

Check for known passwords: When you register and when you reset or change your password, we check whether it appears in known data breaches. To do so, we create a SHA-1 hash of the password on our server and send only its first 5 characters to the “Have I Been Pwned” service. The service replies with all known hashes beginning with those characters; we do the comparison ourselves (so-called k-anonymity). Your password, the full hash, your email address and your IP address do not leave our server. When you register we only warn you and you can continue; when you reset or change your password, we reject a known password.

Purposes: to create your account, sign you in and keep you signed in, provide you with Pickeroni's features under the Terms of Use, and protect your account.

Legal basis:

• Account, sign-in, sessions, confirmation and reset links, language and free-limit counter: Art. 6(1)(b) GDPR (performance of the user agreement).
• Time and version of your acceptance of the Terms of Use: Art. 6(1)(b) and (f) GDPR. Our legitimate interest is being able to prove which version of the Terms of Use you accepted and when.
• Check for known passwords and check of the app version: Art. 6(1)(f) GDPR. Our legitimate interest is to protect accounts from being taken over with leaked passwords and to ensure that only app versions that work correctly with our server access it.
• Time of your last use and termination for inactivity: Art. 6(1)(f) GDPR. Our legitimate interest is to identify accounts that are no longer used and to delete them under section 19 instead of storing them indefinitely.
• Storing the session token on your device: section 16.

Recipients: our hosting provider as processor; for emails, Amazon Web Services (section 6). The members of your lists can see your display name, and so can anyone who knows an invitation link, in the invitation preview (section 8).

Retention: account data until your account is deleted (section 19). We delete confirmation links as soon as you use them; we delete unused confirmation and reset links 7 days after they expire. We delete ended sessions immediately and expired sessions 7 days after they expire.

Obligation to provide data: We need your email address, display name, password and acceptance of the Terms of Use to conclude the contract with you; without them we cannot create an account. The other data arise from your use of the app.

4. Year of birth (optional)

When registering with an email address, you can optionally enter your year of birth. We store only the year, not the day and month. We do not ask for it when you sign in with Apple or Google. The app does not offer any year according to which you would be younger than 16.

Purpose: exclusively for aggregated age statistics. We want to understand which age groups use Pickeroni. We do not use it to verify your age, we do not show the year in your profile or anywhere else in the app, and we do not send it back to the app.

How we analyse it: We only count how many accounts fall into an age group: under 18, 18–24, 25–34, 35–44, 45–54, 55–64 and 65 and over (plus “unknown” if no year was given). The count is taken once a day as of the previous day, and each group is rounded down to a multiple of five. Groups with fewer than five people therefore never appear on their own. We do not analyse the year of birth for individuals and do not combine it with other data into profiles.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to align Pickeroni's features, content and communication with the age groups that actually use it. Because young people aged 16 and over also use Pickeroni, we have given particular weight to their interests: we store only the year, analyse only rounded-down totals, pass nothing on and let you object at any time.

Recipients: The year is stored only in our database at our hosting provider (processor). We store the totals per age group as a time series on our own equipment (section 13). We do not pass the year of birth on to anyone.

Retention: until you delete your account or ask us to delete the year; in backups until they expire (section 19).

Optional: You can use Pickeroni without restriction without providing it.

Objection, correction, deletion: If you switch off “Contribute to usage statistics” under Account › Usage statistics, your account will no longer be counted in the age statistics either (section 21). The year itself remains stored. If you would like it corrected or deleted, write to us at contact@pickeroni.com; this is currently not possible in the app.

5. Signing in with Apple or Google

Instead of using an email address and password, you can sign in with your Apple or Google account. In that case we do not receive the following data from you but from Apple or Google.

What data:

• an identifier of your Apple or Google account and the provider;
• your email address – with Apple, possibly a relay address if you choose “Hide My Email”. The address is treated as confirmed;
• your name, if the provider transmits it. Apple only does so on the very first sign-in. If no name is provided, we temporarily use the part of your email address before the “@” as your display name (with Apple, possibly the part of the relay address), and the app asks you once for your name.

How it works: The app receives a signed sign-in token from Apple or Google and sends it to our server. We verify the signature with Apple's or Google's public keys; we do not send any data to the providers in doing so. If there is no Pickeroni account yet, we only create it once you accept the Terms of Use in the app. We verify the token beforehand and count the sign-in attempt; without your acceptance we store nothing further. An account created this way is not automatically linked to an account you created with the same email address and a password.

On Android, “Sign in with Apple” runs via a web page: Apple sends its response to pickeroni.com/auth/apple/callback, and our website immediately passes it on to the app without storing it. The web server's access log only records that this address was called, not the sign-in data (section 12).

Protection against abuse: For one hour, we count sign-in attempts per Apple or Google identifier, which we store only in pseudonymised form for this purpose, and for the same period we keep a hash (SHA-256) of each sign-in token used, so that it cannot be used a second time.

Purposes: to sign you in without a separate password and create your account; to protect sign-ins against abuse.

Legal basis: sign-in and account creation: Art. 6(1)(b) GDPR. Protection against abuse: Art. 6(1)(f) GDPR; our legitimate interest is to fend off automated sign-in attempts and the reuse of intercepted sign-in tokens.

Recipients: Apple and Google process your data during sign-in as independent controllers under their own privacy policies (Apple: apple.com/legal/privacy, Google: policies.google.com/privacy); see also sections 17 and 18.

Retention: identifier and link until your account is deleted. When you delete your account, we also revoke the link at Apple. Counters and token hashes are valid for one hour; we delete expired entries daily.

Obligation to provide data: Signing in with Apple or Google is optional; you can register with your email address instead. If you choose it, we need the data listed above for the sign-in.

6. Emails from Pickeroni

We only send emails relating to your account – no newsletter and no advertising:

• confirmation of your email address (on registration, again at your request and to the new address when you change it – until you confirm it, we store it as a pending address and your previous one stays in use);
• a link to reset your password;
• a security notice to your previous address when you change it. It names the new address so that you can recognise a change you did not make and let us know at contact@pickeroni.com.

Confirmation and reset emails contain your display name and a link with a one-time code and your email address. If you open the link on a device without the app, the code and address appear in our website's access log (section 14).

Sending: Until it is sent, each email waits in a queue on our server (section 12). It is sent via Amazon Simple Email Service (SES) in the Frankfurt region (eu-central-1) using the sender domain mail.pickeroni.com. If an email cannot be delivered or the recipient marks it as spam, Amazon notifies us by email (via Amazon SNS). This notification contains the email address concerned and ends up in our mailbox (section 15).

No engagement tracking: We do not measure whether you open an email or click a link in it.

Legal basis: confirmation and reset emails: Art. 6(1)(b) GDPR. Security notice: Art. 6(1)(f) GDPR; our legitimate interest is to protect your account from being taken over. Processing of bounce and spam notifications: Art. 6(1)(f) GDPR; our legitimate interest is reliable delivery without repeatedly sending to invalid or rejecting addresses.

Recipients: Amazon Web Services as processor; for the notifications in our mailbox, OVH and Posteo (section 15). For third-country aspects of Amazon, see section 18.

Retention: in the queue until sent (failed jobs: section 12); notifications in our mailbox as described in section 15.

7. Your content and shared lists

What data:

• recipes: name, ingredients, steps, servings, duration, difficulty, categories, optionally a link to a third-party website, and photos (taken with the camera or selected from your photo library);
• lists with their members, roles (owner or member) and date of joining; who added a recipe to a list;
• polls, your votes and your participation;
• meal plans (including what has been marked as “cooked”) and shopping lists with items you entered yourself;
• corrections you make to the sorting of a shopping list by supermarket aisle, which we remember.

Who sees what:

• You and the members of the lists you assign a recipe to can see it. Only signed-in members can load photos. There is no public profile, no public search and no comments or chats.
• The members of a list see its recipes, polls, meal plans and shopping lists as well as the display names of the other members. Personal meal plans and shopping lists are visible only to the person who created them.
• Polls are not secret: members can see by name who voted for which recipe, even while the poll is running.
• Remembered aisle corrections apply to all members of the list or, for personal shopping lists, only to you, never to other lists. We remember at most 500 per list or person; when a new one is added, the oldest is dropped.

Copies and stored names:

• Members can use “Save recipe” to copy a recipe you share with their list, including its photo, into their own account. The copy then belongs to them and remains even if you delete the original, leave the list or delete your account. Internally, the copy remembers which recipe it came from, so that we can also find copies when blocking a recipe (section 11). The app points this out the first time you share a recipe.
• Polls, meal plans and shopping lists store the name of a recipe; polls also store their own copy of its photo. The name and photo copy remain there even if the recipe is deleted; the photo copy is deleted together with the list.
• If we block a recipe after a report, we no longer show its name and photo there to anyone and delete the photo copy; the votes remain (section 11).

Photos: We re-encode every uploaded photo on the server (JPEG, original and thumbnail). This removes all embedded metadata (EXIF), including location data (GPS); we only read the image orientation beforehand. The app does not remove metadata on your device: it reaches us with the upload, but only the re-encoded version is stored.

Deleting polls: When a finished poll is deleted, we first hide it. We delete it permanently, including the votes and photo copies, 30 days after hiding it.

When you delete your account: If you are the owner of a list with other members, it passes with its content (except your own recipes) automatically and without asking to the member who has belonged to it the longest; that member then manages the list. We delete lists without other members. Section 19 explains what else remains.

Data of other people: If you upload photos in which other people can be recognised, or write information about others into a recipe, we also process their data. Only upload such photos if the people shown agree (Terms of Use § 8). Anyone who finds themselves in content on Pickeroni and does not want this can write to contact@pickeroni.com; members can also report recipes in the app (section 11).

Links to third-party websites: For a recipe link, the app shows the domain and opens the page outside the app. What happens to your data there is determined by the operator of that website.

Improving aisle sorting: To improve the automatic sorting of shopping lists by supermarket aisle, we analyse which item names (in normalised spelling) we could not assign to an aisle and which corrections are common. This includes items entered by hand and ingredients from recipes only you can see. We only analyse names that appear in at least five different lists or accounts, without identifiers and without reference to any person. We do not apply the results automatically but review them ourselves. After an objection to usage statistics, your personal shopping lists and corrections are no longer included (section 13).

Legal basis:

• Storing and displaying your content, copies, stored names and handing over the list: Art. 6(1)(b) GDPR; this is the core of Pickeroni.
• Copies and stored names remaining with others after deletion: Art. 6(1)(f) GDPR; the other members have a legitimate interest in continuing to use recipes shared with them and the results of joint polls and plans (Terms of Use § 8, § 9).
• Data of other people in your content: Art. 6(1)(f) GDPR; the legitimate interest lies in storing content and showing it to the members of a list as users wish. The people shown are protected by the obligation to upload only with their agreement, the limited circle of list members and the ability to report content.
• Improving aisle sorting: Art. 6(1)(f) GDPR; our legitimate interest is better automatic sorting for all users.

Recipients: the members of your lists; our hosting provider as processor; the content of push notifications passes through Google and Apple (section 9).

Retention: until you delete the content or your account; exceptions and what remains with others are set out in section 19. We delete remembered corrections together with the list or your account.

Obligation to provide data: You decide what you enter. Without content you cannot use the respective feature.

8. Invitations

You can invite people to a list using an invitation link (8 characters, valid for 7 days) or an invitation code (6 characters, valid for 90 minutes); each list has at most one valid link and one valid code. You share the link or code via your device's share dialog, for example by messenger or text message. The app does not integrate any messengers itself; the service you choose is responsible for the transmission.

Public preview: Anyone who opens the link can see, without an account and without signing in, the name of the list and the display name of the inviting person. Only share the link with people you want in the list.

Invitation statistics: We count how often a link was opened and when it was first opened, and for each joining we store who joined, whether a new account was created and when. If you delete your account, we remove the link to you; the entry remains for statistics without any personal reference.

Legal basis: inviting, preview and joining: Art. 6(1)(b) GDPR. Invitation statistics: Art. 6(1)(f) GDPR; our legitimate interest is to understand how invitations are used and how many new users come to Pickeroni through them, in order to improve the feature.

Recipients: anyone who knows the link (preview); our hosting provider.

Retention: links and codes become invalid when they expire; we delete them together with the list or your account. Invitation statistics: we delete the details of individual joinings after 25 months; after that, only totals without reference to any person remain.

9. Push notifications

Push notifications are optional. Before the app asks your operating system for permission, it explains in a separate notice what it sends notifications for – after you start a poll, join via an invitation or share a list, never when the app starts.

Step 1 – enabling on your device: Only when you choose “Enable” in the notice or tap “Enable notifications” under Account › Notifications, and your operating system grants permission, does the app switch on Google's Firebase Cloud Messaging (FCM) service. The Firebase SDK then creates an installation ID and a device token on your device and reports them to Google. Before that, the app does not create either identifier and sends nothing to Firebase. This applies on all devices, including older Android versions that allow notifications without asking. The app remembers on your device that you have enabled notifications.

Step 2 – registration with us and sending: The app reports the device token to our server. We store it with the platform (iOS or Android) and the associated session, for at most 20 devices per account. For a notification we pass the text and token to FCM; Google delivers it itself on Android and via Apple's Apple Push Notification service (APNs) on iOS. Notifications contain names of lists and recipes and display names of other members; this content therefore passes through Google's servers and, on iOS, Apple's servers.

Occasions: a poll was started (with its end time), is ending soon or has ended; someone joined one of your lists; new recipes were added to a list (bundled, 40 to 180 minutes later). You can switch off each type individually under Account › Notifications.

Troubleshooting: If notifications do not arrive, we can send a test notification to the devices of your account.

Your operating system's permission is not consent under data protection law. It only technically allows the app to display notifications. We do not base push notifications on consent but on the following legal bases.

Legal basis:

• Creating and reading the installation ID and device token on your device (step 1): Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); this is strictly necessary for us to send you the notifications you have expressly enabled. Further processing: Art. 6(1)(b) GDPR.
• Registration and sending (step 2): Art. 6(1)(b) GDPR, because you have enabled the feature and can switch off each type.
• Test notification: Art. 6(1)(f) GDPR; our legitimate interest is to find and fix delivery errors.

Recipients: Google (Firebase Cloud Messaging, Firebase Installations) as processor, and on iOS also Apple (APNs). Both may process data in the USA (section 18).

Retention and ending: If you sign out or delete your account in the app, the app ends the activation, switches off FCM and has the device token and installation ID deleted at Google; according to Google, the associated data is then deleted within 180 days. After your next sign-in the app asks again. We delete the device token on our side together with the associated session, i.e. when you sign out, end the session, the session ends because of a password or email change, or you delete your account, and also as soon as Google reports it as invalid when sending. When a session expires, we delete the device token with it (section 3). If you delete your account via the website or by email, this does not reach your device (section 16).

Obligation to provide data: none; without enabling them you will not receive push notifications.

10. Unlock via in-app purchase

Pickeroni can be unlocked with a one-time in-app purchase; there is no subscription. You make the purchase with Apple (App Store) or Google (Google Play), where you also pay. We do not receive any payment data. Apple and Google process the purchase data as independent controllers under their own privacy policies.

What data: platform, transaction ID (Google: purchase token), the product purchased, the time at which we verified the purchase, whether it took place in the store's test environment and, if applicable, when it was refunded. In addition, your account has a random purchase identifier that contains no further information about you.

How it works: To confirm a purchase, our server asks Apple (App Store Server API) or Google (Google Play Developer API) whether it is valid, transmitting the transaction ID or purchase token. When you buy, the app passes your account's purchase identifier to Apple or Google; this lets us check that the purchase belongs to your account. A purchase belongs to at most one Pickeroni account. If Apple or Google refunds a purchase, we learn about it through a notification from Apple or a daily check and end the unlock.

Purposes: to grant the unlock for your account and to prevent a purchase from being assigned to several accounts.

Legal basis: Art. 6(1)(b) GDPR.

Recipients: Apple or Google for verifying the purchase (sections 17 and 18).

Retention: until your account is deleted. After that, you can assign the same store purchase to a new account using “Restore purchases” after it has been verified again. For our tax records, Apple's and Google's statements are decisive, not the purchase data stored by us; we therefore delete the latter together with your account.

Obligation to provide data: Without this data we cannot grant the unlock.

11. Recipe reports

Members of a list can report a recipe that someone else has shared there using “Report recipe”, for example because it is illegal. This is our notice and action mechanism under Art. 16 of the Digital Services Act (DSA). How to report without an account is explained in our legal notice.

What data: the reported recipe, the reporting person, the reason (inappropriate, copyright, spam, other), an optional comment (up to 1,000 characters), the name of the recipe and the identifier of its owner at the time of the report, the processing status and the timestamps. The comment is free text and may contain information about other people.

How it works: We also receive each report by email in our mailbox (with the identifiers of the owner and the reporting person, the recipe name, reason and comment, without email addresses). We review reports ourselves; there is no automated decision. If we block a recipe, only its owner can still see it: it disappears from all lists, can no longer be shared or saved, and its name and photo no longer appear in polls, meal plans and shopping lists. We can also block copies saved by members.

Purposes: to review notices of illegal or impermissible content, decide on them and document this.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA (obligation to receive and process notices) and Art. 6(1)(f) GDPR; our legitimate interest is being able to prove our decisions and defend against legal claims.

Recipients: our hosting provider; for the email, OVH and Posteo (section 15).

Retention: We delete reports at the end of the third calendar year after they have been dealt with, so a report dealt with in 2026 at the end of 2029. This corresponds to the regular limitation period for claims that may arise from our decision. If you delete your account, we remove the link to you as the reporting person; we do the same with the owner's identifier when the owner deletes their account. Section 15 applies to the email in our mailbox.

Obligation to provide data: Reporting is optional. Without a reason we cannot process a report.

12. Security and operations

To keep Pickeroni secure and stable, we process the following data when operating our server. The legal basis in each case is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation: fending off attacks and abuse, finding and fixing errors, preventing outages and restoring data after an outage.

Access logs: Each time our app interface (api.pickeroni.com) or our website is called, the web server logs the full IP address, the time, the requested address including its parameters, the status code, the previously visited page (referrer) and the browser or app identifier (user agent); there are also error logs. Retention: 14 days.

Application log: errors and warnings of our application. For requests by signed-in people, an entry contains their user identifier (a number); database error messages may mention individual values, such as an email address. We do not write passwords or access tokens into it. Retention: 30 days.

Protection against abuse (rate limiting): We limit how many requests may arrive within a short time. To do so, we count requests per IP address (for IPv6 shortened to the first 64 bits), per user identifier, per email address for sign-in, “Forgot password” and resending the confirmation, and per provider identifier for signing in with Apple or Google. We store email address, IP address and provider identifier only in pseudonymised form (as HMAC-SHA256 with a secret key), the user identifier as a number. The counting windows last from a few minutes to one hour; we delete expired entries daily.

Performance monitoring: Using the Laravel Pulse tool, we record slow requests (over one second), slow database queries and background jobs, and errors. For a slow request by a signed-in person, we store their user identifier so that we can see whether problems affect particular accounts. The data is stored on our server; the dashboard can only be reached from approved IP addresses. Retention: 7 days.

Operational metrics: counts without reference to individuals, such as requests per interface, status codes, plan tier (guest, free, unlocked), app version, response times, error types, the state of the queue, scheduled tasks and backups, and results of push and email sending. We transmit them over an encrypted connection (WireGuard) to a server of our own in the controller's home network in Germany and store them there as time series. Retention: 25 months.

Queue: We send emails and push notifications via a queue in our database. A job contains, for example, the email address, content and the code of a confirmation or reset link, and on registration also the password hash. We delete it after it has run. If a job fails, we store it with the error message in order to find the error and delete it after 7 days.

Browser sessions: For our internal dashboard and for browser requests to our app interface originating from pickeroni.com, the server creates sessions with the IP address, browser identifier and, where applicable, user identifier. The app, our website and the deletion page do not trigger this. Sessions become invalid after 120 minutes and are then deleted regularly.

Backups: We back up the complete database and all uploaded photos: unencrypted on our server with every update of the app interface (where we delete them after 14 days), and regularly in encrypted form on a storage device (NAS) in the controller's home network in Germany. We store the decryption key neither on the server nor on the NAS. Backups contain all data described in this policy as of the time of the backup. Retention: we delete each backup after 90 days at the latest.

Recipients: our hosting provider. Time series and encrypted backups are stored on the controller's own equipment, not with third parties.

13. Usage statistics

In addition to operations, we analyse how Pickeroni is used. This tells us whether new users get started well, whether they keep using Pickeroni, whether the free limits are right and which languages and platforms matter.

What we count:

• active users in the last 5 and 15 minutes and the last 1, 7 and 30 days, determined from the time your sessions were last used (section 3);
• of those who registered in the last 30 days, how many created a recipe within 24 hours, have their own list with at least two members within 7 days and a finished poll within 14 days, each counted from their own registration;
• accounts at the free limit and close to a hard cap, unconfirmed accounts, accounts with a push device per platform, accounts per app language, age groups (section 4), enabled notification types, accounts per plan and per sign-in method;
• recipes with a photo or with steps, participation in polls, invitations and joinings;
• events: account deletions, reaching a free limit, requests per app version.

How we count: Our server calculates these values from the stored data and outputs only totals, no identifiers and no information about individuals. We store the totals as time series on a server of our own in the controller's home network in Germany (section 12). Apart from the age groups, the values are exact; as long as Pickeroni has few users, a single increase could therefore be linked to the time of a registration. Only the controller has access. We do not create profiles of individuals. Usage statistics also include the analysis for aisle sorting (section 7).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to develop Pickeroni in a targeted way and manage it economically: to recognise which features are used, where new users get stuck, whether free limits and price are right, and which platforms and languages we should support.

Recipients: none; the time series are stored on the controller's own equipment.

Retention: the underlying data as described in the respective sections; time series: 25 months. We store the time of your objection for as long as it applies, at most until your account is deleted.

Objecting to usage statistics

You can object to usage statistics at any time without giving reasons. To do so, switch off “Contribute to usage statistics” in the app under Account › Usage statistics (switched on by default) or write to contact@pickeroni.com.

After that, your account is no longer counted in any usage metric: not in accounts, activity, the getting-started metrics, free limits, devices, language, age group, notification types, own recipes, votes and participations, memberships, invitations, purchases and events (free limit reached, joining, account deletion), and not in personal meal plans and shopping lists. Your personal shopping lists and corrections are no longer included in the analysis for aisle sorting either.

We continue to count shared content of lists – polls, meal plans and shopping lists in lists and the activity of lists – because it belongs to all members, and operations under section 12 (requests per interface and app version, hard caps as an indication of abuse). We also count how many accounts have objected – only this number, nothing else about you; for this we store since when your objection has applied (Art. 6(1)(c) GDPR in conjunction with Art. 21 GDPR). Time series already stored contain only totals and remain unchanged. You can switch the setting back on at any time.

14. Website pickeroni.com

Our website sets no cookies, stores nothing on your device and loads no content from third-party servers – no external fonts, no content delivery networks, no analytics services. That is why there is no cookie banner.

Access logs: For every page request, our web server logs the data described in section 12 (including the full IP address, the requested address with its parameters and the browser identifier).

Pages for links from emails and invitations: If you open an invitation link or a link to confirm your email address or reset your password on a device without the app, the website shows an information page. It stores nothing. However, because the code and – for confirmation and reset – your email address are part of the address, they appear in the access log.

Deleting your account without the app: At pickeroni.com/account/delete you can delete an account that has a password. The website passes your email address and password directly to our server and does not store them (section 19).

“Sign in with Apple” on Android: see section 5.

Legal basis: providing the website and access logs: Art. 6(1)(f) GDPR; our legitimate interest is to provide the website securely and detect attacks. Deletion page: Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR.

Recipients: our hosting provider.

Retention: access logs as described in section 12.

15. Contacting us by email

If you write to us at contact@pickeroni.com or another of our addresses (e.g. support@pickeroni.com from our emails), we process your email address, your name if you provide it, and the content of your message in order to deal with your request.

Route of emails: Our domain provider OVH forwards all emails sent to addresses at pickeroni.com to a mailbox at Posteo, where we store them. Recipe reports (section 11) and notifications about undeliverable emails (section 6) also go to this mailbox.

Requests concerning your rights: If you ask by email for access, deletion or similar, we check whether the request comes from you, usually by sending a query to the email address of your account (section 20).

Legal basis: requests concerning your account or the contract: Art. 6(1)(b) GDPR. Requests concerning your data protection rights: Art. 6(1)(c) GDPR in conjunction with Art. 12 to 22 GDPR. Other requests: Art. 6(1)(f) GDPR; our legitimate interest is to answer requests. Keeping requests after they have been dealt with: Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR (proof of how we handled requests concerning your data protection rights) and Art. 6(1)(f) GDPR; our legitimate interest is to defend against legal claims and to be able to refer to earlier requests when you contact us again.

Recipients: OVH (forwarding) and Posteo (mailbox) as processors.

Retention: We keep requests concerning your data protection rights and your contract with us (such as complaints, defects, termination, withdrawal or refunds) until the end of the third calendar year after they have been dealt with, so that we can prove how we handled them (regular limitation period); we delete all other requests at the end of the calendar year following the one in which they were dealt with. We delete emails about reports together with the report (section 11), and notifications about undeliverable emails after 3 months.

Obligation to provide data: Contacting us is optional; without contact details we cannot reply.

16. Permissions and data on your device

Permissions: The app uses the following permissions of your device. You can withdraw them at any time in your device settings; the respective feature is then unavailable.

• Camera (iOS only): to photograph a dish for a recipe photo. On Android the app uses the system camera app and needs no permission for this.
• Photos: to select a picture for a recipe. The app only receives the photos you select.
• Notifications: for push notifications (section 9) and for local notifications of the timers in cooking mode, plus vibration.
• Keep screen on: in cooking mode, so that the screen does not switch off.

Stored on your device:

• in your device's secure storage (iOS Keychain or Android Keystore): your session token, so that you stay signed in; also recently viewed recipes, language, theme, dismissed tip cards, the update notice last shown, the code of an invitation to be continued after sign-in, and whether you have enabled push notifications;
• an image cache (image files and an index in the app's cache) so that images load faster;
• after enabling push notifications, the Firebase SDK's installation ID and device token (section 9).

The app does not download fonts from the internet. On Android, cloud backup of the app data is switched off, so no copy of this data is created at Google.

Legal basis: storing and reading this data on your device: Section 25(2) no. 2 TDDDG; in each case this is strictly necessary for us to provide the feature you are expressly using (sign-in, your settings, invitation, fast display, push notifications after enabling). Insofar as personal data is processed: Art. 6(1)(b) GDPR. Your operating system's permissions are not consent under data protection law.

What remains after signing out, account deletion and uninstalling: If you sign out or delete your account in the app, the app deletes the session token, recently viewed recipes, tip cards, the pending invitation code, the image cache and the push activation, device token and installation ID. Only language, theme and the update notice last shown remain – device settings without reference to you as a person. If you uninstall the app, Android deletes all its data. On iOS, Keychain entries survive uninstallation; the app deletes them the first time it starts after a reinstall.

If you delete your account via the website or by email, this does not reach the app directly. If the app is open and notices that the sign-in is no longer valid, it cleans up as when you sign out. If it only notices at the next start, it deletes only the session token; the other data remains on the device until you sign out again after a new sign-in or uninstall the app, and the installation ID and device token remain at Google until the app has them deleted at the next sign-out. To avoid this, sign out in the app before deleting your account.

17. Recipients

We only pass personal data on to the following recipients. Processors process data only on our behalf and on our instructions on the basis of a contract under Art. 28 GDPR. Independent controllers decide on the processing themselves; their own privacy policies apply.

Not recipients of personal data, named for completeness:

• Have I Been Pwned (Troy Hunt, delivered via Cloudflare): during the password check, receives from our server only the first 5 characters of a hash, no data that can be linked to you (section 3).
• Let's Encrypt (Internet Security Research Group, USA): issues the certificates for encrypted connections to our domains and receives no data from you.
• The controller's own equipment in the home network in Germany (server for time series, NAS for encrypted backups): no third parties (sections 12 and 13).

18. Transfers to third countries

Our servers and hosting are located in the EU (section 17). Data can only reach countries outside the EU and the EEA (third countries) through the following recipients:

• Google (Firebase Cloud Messaging, Firebase Installations): FCM is a global service; Google may process device tokens, installation IDs and notification content in the USA and at other locations. Google LLC is certified under the EU-US Data Privacy Framework. For the USA, the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR) therefore applies. For other countries and in addition, the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) apply, which form part of Firebase's data processing terms.
• Amazon Web Services: We use the Frankfurt region. Access from the USA, for example by the parent company during maintenance or on the basis of US law, cannot be ruled out. Amazon is certified under the EU-US Data Privacy Framework; in addition, AWS's data processing agreement contains standard contractual clauses.
• Apple (APNs, “Sign in with Apple”, App Store) and Google (Google sign-in, Google Play) as independent controllers: they may process data in the USA. Apple Inc. and Google LLC are certified under the EU-US Data Privacy Framework.

You can check whether a US company is certified at www.dataprivacyframework.gov. We will send you a copy of the standard contractual clauses on request to contact@pickeroni.com; they are also published on the European Commission's website.

19. Retention and deletion

We only keep data for as long as we need it for the respective purpose. Overview:

Deleting your account

You can delete your account at any time:

• in the app under Account › Delete account;
• without the app at pickeroni.com/account/delete if your account has a password (with email address and password);
• by email to contact@pickeroni.com, especially if you only sign in with Apple or Google and have no password. To make sure nobody else can delete your account, we send a query to your account's email address and delete the account after you confirm, at the latest within one month of receiving your request.

What we delete: your account with email address, display name, password hash, year of birth and settings; your recipes including photos; your memberships and invitations; your purchases (section 10); your sessions and device tokens; the link with Apple or Google; your personal meal plans and shopping lists including remembered corrections; your participation in polls. When you delete your account, we also revoke the link at Apple.

What remains without a link to your account: your votes in polls; for polls, meal plans and shopping lists in shared lists, the information on who created them, and for recipes in lists, who added them; reports you submitted and reports concerning your recipes; the invitation statistics. In each case we remove the reference to your account.

What remains with others: copies of your recipes that members have saved, including photos; the names of your recipes in polls, meal plans and shopping lists and the photo copies in polls (except after blocking, section 11); items you entered in shared shopping lists, without any indication that they came from you. Your own lists with other members pass to another member (section 7).

What deletion does not cover immediately:

• logs and technical data until their period expires: application log (30 days), access logs (section 12), performance monitoring (7 days), pseudonymised counters for protection against abuse (until the daily clean-up);
• backups, at most 90 days;
• emails in our mailbox, for example about reports (section 15);
• if you delete via the website or by email: the installation ID and device token at Google and the data on your device (section 16). So please sign out in the app first.

Inactive accounts: If you do not use your account for 36 months, i.e. you neither sign in nor open the app with your account, we will terminate the user agreement by email with three months' notice (§ 15 (3) of the Terms of Use). If you sign in before the notice period ends, the termination does not take effect and your account remains. Otherwise we delete the account when the notice period has ended, as described above. If you bought the unlock, we will refund the price on request in this case (§ 15 (3) of the Terms of Use).

20. Your rights

Under the GDPR you have the following rights. To exercise them, contact us informally at contact@pickeroni.com or at the address in section 1.

• Access (Art. 15 GDPR): which data we process about you, for what purposes, to whom we disclose it and for how long, and a copy of this data. There is no dedicated feature for this in the app; write to us.
• Rectification (Art. 16 GDPR): You change your display name, email address and password yourself in the app under Account. We change your year of birth on request by email.
• Erasure (Art. 17 GDPR): section 19.
• Restriction of processing (Art. 18 GDPR), for example while we check whether your data is accurate.
• Data portability (Art. 20 GDPR): On request by email, you receive the data you have provided to us and that we process by automated means on the basis of the contract in a structured, commonly used and machine-readable format; where technically feasible, we also transmit it directly to another controller. There is no export feature in the app.
• Objection (Art. 21 GDPR): section 21.

• Complaint to a supervisory authority (Art. 77 GDPR): You can lodge a complaint with any data protection supervisory authority, in particular in the EU or EEA state where you live or work or where the alleged infringement took place. The authority responsible for us is:

  Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
  Alt-Moabit 59–61
  10555 Berlin, Germany
  www.datenschutz-berlin.de

We do not base any processing on consent (Art. 6(1)(a) GDPR). Accepting the Terms of Use is not consent under data protection law.

We respond to requests within one month. For complex or numerous requests, this period may be extended by two further months; in that case we will inform you within the first month and give the reasons (Art. 12(3) GDPR). If we have reasonable doubts that a request comes from you, we will ask, usually via your account's email address.

21. Your right to object

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that we base on Art. 6(1)(f) GDPR (legitimate interests).

In this policy, this concerns: proof of your acceptance of the Terms of Use, the check for known passwords, the check of the app version and the identification of inactive accounts (section 3), the age statistics (4), protection against abuse when signing in with Apple or Google (5), the security notice and the processing of bounce notifications (6), data of other people in content, copies and stored names remaining with others and the analysis for aisle sorting (7), the invitation statistics (8), test notifications (9), the documentation of reports (11), security and operations (12), usage statistics (13), the website's access logs (14) and other requests by email (15).

If you object, we will no longer process this data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can object to usage statistics, including the age statistics, without giving reasons, most easily in the app under Account › Usage statistics using the “Contribute to usage statistics” setting (section 13).

You can send your objection informally to contact@pickeroni.com or by post to the address in section 1.

22. No automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR), and we do not carry out profiling. Free limits, usage limits and protection against too many requests do apply automatically, but according to fixed values that are the same for everyone and not on the basis of an assessment of you as a person. We decide on reports ourselves.

23. Children and young people

You may use Pickeroni from the age of 16. If you are not yet 18, you need your parents' consent (Terms of Use § 3). You confirm this when you register; we do not verify your age technically. If we learn that someone under 16 is using Pickeroni, we terminate the contract and delete the account; we let them know beforehand.

The special age limit for consent (Art. 8 GDPR) does not matter for us, because we do not base any processing on consent. The age statistics include the group “under 18” (section 4). Where we rely on our legitimate interests, we give particular weight to the interests of young people.

24. Data security

We protect your data with technical and organisational measures (Art. 32 GDPR), including:

• Connections between the app, the website and our server are encrypted with TLS; the app does not establish unencrypted connections.
• We store passwords only as bcrypt hashes.
• On your device, the session token is kept in the iOS Keychain or the Android Keystore.
• We limit sign-in attempts and other requests; we store the identifiers used for this in pseudonymised form.
• The backups on the NAS are encrypted.
• On our side, only the controller has access to the data.

No system is completely secure; we adapt our measures to the state of the art.

25. Changes to this privacy policy

We update this privacy policy when Pickeroni, our processing or the legal situation changes. You can find the current version at pickeroni.com/privacy and in the app under Account › Legal; the date at the top shows when it was last updated. This policy is available in German and English; both versions have the same content.

Last updated: 13 October 2026