Integritetspolicy

Last updated: 12 July 2026

Who is responsible

The data controller for Crave is Leo Bjerner, a private individual based in Sweden.

Contact for anything privacy-related: crave.app.inquiries@gmail.com

The short version

• Crave has no ads, no analytics SDKs, no tracking. We do not track you across other apps or websites, and we never sell your data.
• Voice input is transcribed on your phone. Your voice audio never leaves the device, and we never receive or store it.
• The text you type or dictate to generate meals is sent to OpenAI to create recipes, without your name, email, or any user ID attached. We do not store it on our servers.
• Your account, favorites, and shopping list are stored with our database provider (Supabase) and deleted when you delete your account — which you can do directly in the app.

What we collect, why, and for how long

Account data

When you create an account we store your email address and a hashed (encrypted) password — we can never see the password itself. If you sign in with Apple, we receive an identity token from Apple and, if you choose to share it, your name; if you use Apple's "Hide My Email", we only see the relay address Apple gives us.

• Why: to create and secure your account. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• How long: until you delete your account.

Meals you save

Your favorites (the full recipe: name, description, ingredients, instructions, nutrition estimate, image link) and your shopping list items (ingredient names, amounts, and which recipe they came from) are stored on our servers, linked to your account, so they are there when you come back.

• Why: this is the product working as expected. Legal basis: performance of a contract.
• How long: until you remove them in the app or delete your account.

What you enter to generate meals

To generate meal suggestions, the app sends your input to our server, which forwards it to OpenAI (our AI provider):

• your questionnaire answers (craving, goal, meal type, servings, cooking time),
• the free text you typed or dictated in "Mitt kök" (the ingredients you have at home),
• the titles of suggestions you recently swiped away (so you don't get the same dish again),
• your chosen content language (Swedish or English).

No user identifier of any kind is sent to OpenAI — no name, no email, no account ID, no device ID. OpenAI cannot connect this input to you as a person through anything we send.

We do not store this input on our servers. If your kitchen text is rejected by our content check (for example, non-food input), our logs record only the rejection category — never the text itself. OpenAI may retain API inputs for a limited period for abuse monitoring under its API data policy; per that policy, API data is not used to train OpenAI's models.

• Why: generating your meal suggestions is the core service. Legal basis: performance of a contract.
• How long: not stored by us; processed only for the duration of the request.

Generation activity log

Each time you generate meal suggestions, our server records one row containing your account ID and a timestamp — nothing about what you asked for. This is used to rate-limit requests and protect the service from abuse and runaway costs.

• Why: service protection. Legal basis: legitimate interest (keeping the service available and preventing abuse).
• How long: automatically deleted after 90 days, and immediately if you delete your account.

Subscription and purchase data

Crave uses RevenueCat to manage subscriptions. RevenueCat receives your account ID (the same ID as in our database — not your email) and the App Store purchase receipt from Apple, and tells us whether you have an active subscription. Payment itself is handled entirely by Apple; we never see your card details. Our server also checks your subscription status with RevenueCat (using your account ID) when you generate meals.

• Why: providing what you paid for. Legal basis: performance of a contract.
• How long: subscription records are kept by RevenueCat per its own retention policy; contact us if you want them removed.

Voice input

If you use voice input, the app asks for microphone and speech recognition permission. Speech is transcribed on your device using the operating system's on-device speech recognition. Your voice audio is never recorded to a file, never sent to us, and never sent to any third party. Only the resulting text appears in the ingredient field — and it leaves your phone only if you then tap generate, at which point it is treated exactly like typed text (see above). On devices that do not support on-device recognition, voice input is unavailable rather than falling back to server-based processing.

Meal images

Meal photos are fetched from Pexels, a stock photo service. When the app loads an image, your device connects directly to Pexels' servers, so Pexels sees your IP address — the same as when any app or website loads an image. The image search itself is performed by our server using a short auto-generated English dish description (for example "chicken pasta"), never your own text.

Data that never leaves your phone

The following is stored only on your device and is never sent to us or anyone else:

• your onboarding answers,
• your profile picture (stored in the app's local files only),
• your theme, language, and tour/tutorial state,
• the local list of recently dismissed meal titles (kept for 3 days; the titles — but nothing else — are included in generation requests as described above).

Deleting the app deletes all of this.

Who we share data with

We never sell personal data. We use these service providers (data processors) to run Crave:

Transfers outside the EU

OpenAI, RevenueCat, and Pexels are US companies, so some data is transferred to the United States as described above. These transfers rely on the EU–US Data Privacy Framework (for providers certified under it) and/or the European Commission's Standard Contractual Clauses. Note again that what OpenAI receives contains no identifiers linking it to you, and what Pexels receives is limited to what any image download technically exposes.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you,
• Correct inaccurate data,
• Delete your data ("right to be forgotten"),
• Receive a copy of the data you have provided, in a portable format,
• Object to processing based on legitimate interest (such as the generation activity log),
• Restrict processing while a dispute is resolved.

To exercise any of these, email crave.app.inquiries@gmail.com. We will respond within one month.

You also have the right to lodge a complaint with the Swedish data protection authority, IMY (Integritetsskyddsmyndigheten) — imy.se.

Deleting your account

You can delete your account directly in the app under Settings. This immediately and permanently deletes your account and everything linked to it on our servers: your email, sign-in data, favorites, shopping list, and generation activity log.

Note: deleting your account does not cancel an active App Store subscription — Apple requires subscriptions to be managed through the App Store. Cancel it in your device's subscription settings.

Children

Crave is not directed at children under 13, and we do not knowingly collect data from children.

Changes to this policy

If we change what data Crave collects or how it is used, we will update this policy and the "Last updated" date before the change takes effect.