Privacy policy

As of October 26, 2026. This is a translation; the German version is binding.

In short

• I only store what Food Plan needs to work.
• No advertising, no tracking, no analytics services. The app loads no content from other providers (fonts, maps, videos), only pictures of your household that you hold the rights to from Cloudflare (section 6).
• Just one cookie, for signing in. That is why there is no cookie banner.
• An AI model by Anthropic reads recipes. What goes there is in section 5; names and email addresses are not part of it.
• I do not sell data. It only goes to the service providers I need to run the app (for emails Google, section 10), and to where you send it or link it yourselves (Bring!, the Shopping List app, Vorratsbuch).
• You download your data yourself; you delete your account and your household yourself (sections 11 and 12).

1. Controller

I run Food Plan as a private individual. There is no data protection officer; none is required.

2. Your account and your household

When you register or accept an invitation, I store your username, your name, your email address, your password (only as a scrypt hash; nobody can read it), your role in the household (admin or member), your settings (such as kcal or kJ) and which version of the terms of use you agreed to, and when. The household has its name and its settings: number of servings, shopping days, what is always at home, monthly budget and what importing has cost.

Invitations: an admin creates an invitation link with the name of the person they invite and passes it on themselves; Food Plan sends nothing. The server only keeps a hash of the link. Admins see the members' names, usernames, roles and whether an email address is on file, not the address itself.

Why: so you can sign in and collect recipes, plan and shop with your household. I need the email address so you can reset your password yourself and learn when your recipes are imported; never for advertising. Food Plan only sends it emails about your account and the note after importing (section 10). A new address counts once you have confirmed it with the link in the email; until then the previous one stays.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract of use); I keep the version and time of your consent to the terms of use as proof (Art. 6(1)(f) GDPR). Without username, name, email address and password, no account can be created.

3. Recipes, photos and weekly plan

Your recipes are stored (ingredients, method, notes, classification such as course and cuisine, your own times and servings), the photos of the pages you import, dish pictures (cut out of a photo, taken from the recipe's web page or uploaded by you), the weekly plan, collections, and every member's favorites and wish list. Also who imported, checked, changed or planned a recipe, who confirmed that your household holds the rights to a picture (and when), and for every import its source, time, duration and cost.

• The app makes photos smaller on your device and saves them anew; metadata such as where and when a photo was taken is dropped. Only when importing in the background does the app read the time a photo was taken beforehand, to put the photos in the right order.
• PDF, Word and text files stay on the server only until the import is done; after that only the recipe remains, and from a PDF file the picture of the dish if there is one in it. When importing in the background, you first collect photos, files and links in a draft; when the job is over, the files are deleted, while file names and links stay in the list of jobs. Only photos and PDF pages on which sorting found no recipe stay 14 more days, so that you can look at what was skipped (the pages as a small PDF file of their own). For a section of a Word or text file that was too long for one recipe, its heading and first words stay in the list of jobs.
• Web pages: If you enter the address of a recipe, the server fetches the page and its picture itself. The page only sees the server, not you. Address, time of retrieval and author stay with the recipe.
• Printing: The server makes PDF and Word files of recipes and the weekly plan when you ask for them; it does not keep them. If you upload your own Word styles, only the styles, the design and the page format are kept, with file name and time, until someone restores the default styles. The text of the file is not stored.

Please import recipes only: no photos of people and no private notes or documents. The AI reads whatever is on a photo (section 5).

Legal basis: Art. 6(1)(b) GDPR.

4. Who sees what

• Your household sees everything from section 3 except your wish list. The household sees who counts which recipes among their favorites.
• Befriended households: With a friend link or through a recommendation, two households become friends and see each other's name. Recipes only go to befriended households: by share link, as a copy, with your household's name, your name and your username. Pictures only go along when someone of your household has confirmed the rights to them, then with the name and time of that confirmation; the other household may keep them and share them on. For a web recipe, my server loads its picture again from the web page for the other household. Later changes do not carry over. You see which households redeemed your link.
• Recommending: Whoever opens your recommendation link sees your household's name, even without an account. If a new household registers with it, you are friends.
• Recipe link: Whoever opens a recipe link of yours sees, even without an account, your household's name, your name and the titles of the recipes (for a collection also its name), but no recipes and no pictures. Once a household accepts the link, or a new one registers with it, you are friends and it gets the recipes as above. The link works once, for 14 days.
• The operator: The operator's account shows of other households only what running the app requires: name, number of members and admins, costs and number of imports, budget, credit and discount, whether Bring! and the Shopping List app are set up, how often you sent to Bring! and who recommended whom; no recipes, plans or settings. It also shows the names of ingredients the nutrition table does not know yet, from all households, without revealing where they come from. Technically, as the operator I have access to all data on the server. I only look at it when running the app requires it (for example to find an error or restore data) or when you ask me to.

Legal basis: Art. 6(1)(b) GDPR; sharing and befriending happen at your request.

5. Reading recipes with AI: Anthropic

An AI model (Claude) by Anthropic reads recipes. What it needs for that goes there:

• the photos, PDF pages and texts from Word and text files you import, and when importing in the background, a small version beforehand for sorting;
• for web pages, the address and the recipe data or the page's text;
• a recipe's text to classify it (course, cuisine, method), and its photos to find the dish picture on them;
• names of ingredients to match them to the nutrition table. If the table does not know an ingredient, the model searches the web for its nutritional values; only ingredient names go out for this.

Your name, your username, your email address and your household's name do not go there. Whatever is on a photo or in a file goes along in full, though; so please import recipes only.

The recipient is Anthropic Ireland, Limited, Ireland, as processor (Art. 28 GDPR); processing also takes place at Anthropic, PBC in the USA. Anthropic is not certified under the EU-U.S. Data Privacy Framework. The transfer to the USA therefore rests on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). They are part of Anthropic's data processing agreement; you find a copy at www.anthropic.com/legal/data-processing-addendum.

According to Anthropic's terms (as of October 2026), the data is not used to train the models. Anthropic deletes requests and responses after 30 days at the latest. If Anthropic reviews a violation of its usage policies, it keeps them for up to 2 years, and the scores of that review for up to 7 years. When importing in the background, Food Plan uses Anthropic's batch interface (Batch API): requests and responses stay there for up to 29 days; Food Plan deletes each job there as soon as the responses are collected.

Legal basis: Art. 6(1)(b) GDPR; importing is the service you use.

6. Pictures at Cloudflare

Photos and dish pictures are stored in the R2 storage of Cloudflare, Inc., San Francisco, USA, in an area that keeps the data in the EU. Pictures someone in your household has confirmed holding the rights to (such as a dish photo you took yourself) the app loads directly from a service at Cloudflare (lunchplan-pictures.zurmuehl.workers.dev). Your browser sends your IP address and information about itself (such as browser and language) to Cloudflare; the request is usually answered by a data center near you, which may also be outside the EU. All other pictures, such as photos of cookbook pages, the app loads only when you are signed in, through my server, which fetches them from R2.

The addresses of the pictures at Cloudflare are signed and cannot be guessed. Anyone who knows such an address can see the picture without signing in, though, much like a share link.

Cloudflare processes the data on my behalf (Art. 28 GDPR) and is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). Legal basis: Art. 6(1)(b) GDPR.

Backup of the pictures: Every night the server copies new pictures to Backblaze, Inc., San Mateo, USA, likewise certified under the Data Privacy Framework (Art. 45 GDPR). I do not encrypt this copy. Legal basis: Art. 6(1)(f) GDPR (protection against data loss).

7. Shopping and pantry: Bring!, the Shopping List app and Vorratsbuch

An admin chooses where your household sends shopping. Something is only sent when someone in the household taps for it.

• Bring!, straight from Food Plan: An admin enters the email address and password of your Bring! account; the server stores the password only encrypted. Also the released lists and, for every member, the one chosen last. When sending, items and quantities go to Bring! Labs AG, Zurich, Switzerland. The server keeps the sign-in at Bring! in memory for up to 6 days. It stores who sent how many items to which list and when.
• Bring!, through the Bring! app: When you take a shopping trip or a recipe over into Bring!, your device opens a link of Bring!. Bring! then fetches a page from Food Plan with the name of the recipe or the shopping trip and the ingredients with quantities; the link to this page is valid for 72 hours. So that the Bring! app opens directly, the server asks Bring! for a short link.
• Shopping List app: I run the Shopping List app as well. If an admin connects your household to a household there, Food Plan stores the access encrypted, along with the name of the household there and the released lists. When sending, items with quantities, the dishes they are meant for and your name as sender go there. The connection can be ended in the settings at any time.
• Vorratsbuch: I run Vorratsbuch as well. If an admin links your household to a household there, the name of your household goes there; Food Plan stores the access encrypted, along with the name of the household there, who linked it and when. When someone in the household opens a recipe, the recipes or the weekly plan, Food Plan asks Vorratsbuch for the pantry: which foods are there in what quantity, their best-before dates and the names of the articles. The server keeps the pantry only in memory; it is not stored. When someone reserves the weekly plan in the pantry (also before sending to the Shopping List app and then after every change of the plan), for each dish the recipe's identifier and title, the cooking day and the quantities of the ingredients as foods of the catalogue go to Vorratsbuch, never the method; Food Plan stores the answer (what is reserved, what is missing, which article), who reserved and when. When someone taps “Cooked” on a dish, the same details for that dish go there, and Food Plan stores what Vorratsbuch booked, who reported it and when. The link can be ended in the settings at any time; the reservations go with it.

Bring! is a provider of its own; for everything that arrives there, Bring!'s privacy policy applies. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR). The Shopping List app and Vorratsbuch each have their own privacy policy. Legal basis: Art. 6(1)(b) GDPR, at your admin's request.

8. Credit and Stripe

Households that pay for importing top up credit; today this is open only to the operator for trying it out. An admin tops up on a payment page of Stripe Payments Europe, Limited, Dublin, Ireland. You enter card and payment details only there; Food Plan never sees them. Stripe receives the amount and the numbers of household and account. Stripe processes the payment data and checks for fraud under its own responsibility; Stripe's privacy policy applies to that.

Food Plan books every top-up and every charge (for an imported recipe or a send to Bring!) with time and amount. Legal basis: Art. 6(1)(b) GDPR, for keeping the bookings Art. 6(1)(c) GDPR.

When a household is deleted, its bookings are kept, locked, because accounting records have to be retained (up to 8 years, Section 147 of the German Fiscal Code; Art. 17(3)(b) GDPR): with the household's name, but without accounts. Nobody sees them in the app any more. If money paid in is still left when it is deleted, I also keep the email address of the admin who deleted it until it is refunded, so that I can get in touch with questions.

9. On your device

• One cookie (lunchplan_session) keeps you signed in: 60 days or until you sign out. The server only keeps a hash of it.
• Settings of this device (localStorage): the language, if you choose it in the settings, and whether you last imported right away or in the background, and what you last chose for printing (dish picture, notes and so on).
• Until you close the tab (sessionStorage): a link you share to Food Plan from another app, the filter of the recipe list and what you checked off while cooking.
• Caches: the app keeps its files and these pages ready for offline use (service worker), your browser the pictures it has shown.

All of this is strictly necessary for the service you use; no consent is needed for it (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). None of it is used to recognize you across other sites.

10. Server, logs and backup

Server: Food Plan runs on a rented server of Contabo GmbH, Munich, in a data center in the EU. Contabo processes the data on my behalf (Art. 28 GDPR).

What the server sees on a request: Your browser sends your IP address and information about itself (such as browser and language) with every request. There is no access log.

• When you sign in, register, open links or use “Forgot password?”, the server remembers the IP address in memory, for “Forgot password?” also the username or email address entered, to slow down too many attempts in a short time (protection against guessing passwords and against emails nobody asked for). Only attempts in the last hour count; none of it is written to disk for this.
• If the app is briefly unreachable (for example during a restart), the web server in front of it writes an entry with IP address, time, the address requested and the browser's information to its error log; cookies are not in it.
• Food Plan itself writes an operations log: when what happened and who did it, with username and household number. For example that a recipe was edited, an ingredient added, a member invited or something sent to Bring!, or that a new household registered, with its name; when connecting to the Shopping List app or linking Vorratsbuch, the name of the household there. If an email with the link for a new password could not be sent, the log has the username and the reason, never the address or the link; for the email after a background import only the number of the collection and the reason. Recipes appear there by their identifier, which is made from the title. Also errors with the address requested. On start, it names all households.

Both logs are limited to 30 MB each; older entries drop out. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service).

Backup: Every night I back up the databases and the files on the server. The backup is encrypted before it leaves the server; only I have the key. It is stored with Backblaze, Inc., San Mateo, USA, which only sees encrypted data. Backblaze is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). The pictures are backed up by the nightly copy from section 6. Legal basis: Art. 6(1)(f) GDPR (protection against data loss).

Nutrition: Ingredient names the nutrition table does not know yet are collected by the server in one place for all households, without reference to a household or person, so that each name is matched only once. Legal basis: Art. 6(1)(f) GDPR.

Sending email: Food Plan sends emails through a Google Mail account (Google Ireland Limited, Dublin), and only these:

• Confirming the address: After signing up, after an invitation and when you enter a new address, Google receives the new address, your name, your username, your household's name and the confirmation link, which is valid for 7 days.
• “Forgot password?”: If you request a link, Google receives your email address, your name, your username and the link, which is valid for one hour.
• Password changed, address changed: When your password changes, a note goes to your confirmed address; when you confirm a new address, it goes to the previous one. Google receives the address, your name and your username.
• After importing in the background: When a collection you started is done and “Notify me by email” was ticked, Google receives your email address, your name, the titles of the recipes imported, for failures the address of the recipe page or the name of the photo or file with the reason, and a link into the app.

Google may also process data in the USA; Google is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). Legal basis: Art. 6(1)(b) GDPR (you requested the link, entered the address or started the import); the notes on a changed password or address Art. 6(1)(f) GDPR (protecting your account). The server only keeps a hash of each link. Apart from the confirmation email, emails only go to a confirmed address; addresses entered before confirming existed also count only once you have confirmed them; until then an admin of your household helps with a forgotten password.

There are no other recipients. I only pass data to authorities when a law obliges me to.

11. How long

• Account: until you delete it yourself (Settings → My account) or an admin removes it. Then the account, sign-ins, favorites, wish list, the lists last chosen and your draft for importing in the background go at once. What you created stays with the household without your name: where it said who checked, changed or planned a recipe, it then says “former member”. Copies that befriended households took over belong to them and still name who shared them back then and who confirmed the rights to their pictures. If you are the only member, the household goes too.
• Household: until an admin deletes it (Settings → Household). Then all accounts, recipes, weekly plan, collections, imports, settings, share and friend links, friendships, the Bring! access, the connection to the Shopping List app and the link with Vorratsbuch (Food Plan ends both there too) go at once. Jobs still at Anthropic are canceled and deleted there. The pictures follow after 30 days (see below); the bookings are kept, locked (section 8).
• Recipes, weekly plan, collections and imports: as long as the household keeps them or exists.
• Credit bookings: as long as the household exists, then locked for up to 8 years (section 8).
• Photos and pictures: If a recipe is deleted and no other recipe uses its pictures, they wait 7 days and are then deleted; the pictures of a deleted household after 30 days. The copy at Backblaze is then kept hidden for another 60 days, after which it is gone.
• PDF, Word and text files: until the import is done.
• Drafts when importing in the background: until the start; a draft nobody has changed for 30 days is deleted with its files as soon as someone in the household opens importing again.
• Skipped photos and PDF pages when importing in the background: 14 days after the job is over.
• Links: 7 days for invitations and password resets by an admin, 7 days for confirming an address (a new address not confirmed yet stays with the account until you enter another one), one hour for the email of “Forgot password?” (its hash stays until it is used, replaced by a new one or the account is deleted), 14 days for sharing recipes (can be withdrawn at any time). 30 days after a share link expires or is withdrawn, the server removes it together with the record of who redeemed it. The page for Bring! is valid for 72 hours.
• Sign-in: 60 days, immediately on signing out. Changing your password signs out your other devices.
• At Anthropic: as in section 5.
• Logs: 30 MB each, older entries drop out (section 10).
• Backup: I keep older states for up to six months. After that, deleted data is gone from the backup too.

12. Your rights

You have the right to

• access to your data (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability, i.e. your data in a common format (Art. 20),
• object to processing based on legitimate interest (Art. 21).

Under Settings → My account you change your name, email address and password, download everything stored for your account and your household as a file with “Download my data” (recipes, weekly plan, collections, favorites, settings, imports; the photos for now only by their file names), and delete your account. Admins delete the whole household under Settings → Household. Both need your password. For everything else, write to datenschutz@zurmuehl.info; I answer within one month.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for me: the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

13. No automated decisions

An AI model reads recipes, classifies them and suggests nutritional values; Food Plan works out properties such as “vegan” or allergens from the ingredients. This concerns recipes, not you: there are no automated decisions about people and no profiling (Art. 22 GDPR).

14. Changes

If something new is added, such as emails for resetting the password or payment for all households, I adapt this policy. The date at the top shows the version.

Imprint