Privacy Policy

Effective August 31, 2026

This Privacy Policy explains how HaqLabs, an independent software studio ("HaqLabs", "we", "us"), collects, uses, and shares personal data through ReciLore, a household-first recipe app for importing recipes, planning meals, cooking together, and preserving family food memories.

It describes how ReciLore works as of the effective date above. If a feature described here changes, we will update this policy and the effective date.

Information we collect

Account and profile information. When you sign in, we receive your name and email address from Apple or Google, along with a provider identifier and the account ID we create for you. You can add a first name and a profile photo.

Household and recipe content. We store the content you and your household create or import, including:

household names and membership
recipes, ingredients, steps, tags, and imported source links
meal plans, meal votes, and cooking assignments
grocery lists and their checked/unchecked state
cooking history (what was cooked, when, and by whom)
family food memories: free-text notes and stories you write about meals
photos you upload of recipes and of cooking moments
your preferences (theme, week start, default servings, saved recipe, pinned recipes, hidden tabs)

Invitations. When you invite someone to your household, we store the email address you enter and a single-use invite link so the invitation can be accepted.

Recipe import content. When you import a recipe from pasted text, a web page, or a YouTube video, the recipe text (and, for videos, the video description) may be processed to extract structured recipe data. See "Recipe import and AI processing" below.

Purchase information. If your household subscribes to ReciLore Full, we receive subscription and transaction identifiers from the app store and our billing processor, along with the purchaser's account ID, so we can grant and verify access. We do not receive or store your full payment card details.

Notifications. In-app notifications (for example, "a member joined your household" or "action needed on billing") are stored as records in our database with the display names and household name needed to show them. They appear only inside the app; ReciLore does not send device push notifications and does not register or collect a push token. The app also schedules local reminders on your device for cook-mode timers, which are not sent to us.

Diagnostics. ReciLore includes no third-party analytics, advertising, or crash-reporting tools, and does not build advertising profiles. It has a minimal first-party diagnostic log (for example, notes on where automatic recipe parsing fell short, tagged with a household identifier and kept for 30 days) that is currently switched off. If we turn it on to investigate a problem, we will update this policy and its effective date.

Location. ReciLore does not request or access your device's location, and has no location-based features.

On-device data. To work offline, the app keeps a copy of your household's recipes, meal plan, and grocery list in local storage on your device, along with a queue of changes waiting to sync. Your sign-in session is stored in the device's secure keychain.

How we use information

to provide the app: sync your household's data across members and devices, and support offline use
to parse recipes you import into structured ingredients and steps
to operate meal planning, grocery lists, cooking mode, and memories
to send in-app notifications about your household and account
to grant and verify subscription access, and prevent one purchase from unlocking multiple households
to troubleshoot problems and improve recipe parsing
to protect ReciLore and its users and to comply with law

We do not sell personal data, and we do not use your recipes, memories, or photos to train our own machine-learning models.

Recipe import and AI processing

ReciLore first tries to read a recipe using deterministic parsing on your device and on our servers, with no AI involved. When that is not enough, the recipe text you pasted or imported, or a YouTube video's description formatted as recipe text, is sent to a third-party AI provider (currently DeepSeek) solely to return structured recipe data. This provider operates outside your country of residence, so this involves an international transfer of that text.

For YouTube imports, the video identifier is sent to the YouTube Data API (operated by Google) to retrieve the title, description, channel, and thumbnail. Use of YouTube features is also subject to Google's Privacy Policy.

Recipe images from imported recipes are generally displayed directly from the original website's servers rather than copied to ours.

ReciLore is built around shared households. Recipes, meal plans, grocery lists, cooking history, and memories you add are visible to every current member of that household, and members may edit or build on them.

Leaving a household stops future sharing but does not retract content you already contributed; it may remain part of that household's shared history. Where removing your attribution outright would damage another member's records, we may instead replace your name with a neutral label such as "Former member".

Photo visibility

Recipe photos, memory photos, and profile photos are stored in cloud storage buckets that are readable by anyone who has the file's URL. URLs are long and not published, but they are not access-controlled. Please keep this in mind before uploading anything sensitive.

Service providers

We share personal data only with providers that help us run ReciLore:

Supabase: database, authentication, file storage, real-time sync, and data export generation
Apple: Sign in with Apple, and App Store billing for subscriptions
Google: Google sign-in, the YouTube Data API for video imports, and Google Play billing
RevenueCat: subscription purchase handling and server-side receipt verification; it receives your account ID for purchase attribution
DeepSeek: AI parsing of imported recipe text, as described above

Each provider may process data outside your country. We may also disclose data if required by law or to protect the rights, safety, and property of ReciLore, our users, or the public.

Data retention and deletion

We keep personal data for as long as your account and household are active, and then as described here.

Deleting your account. In-app account deletion is not available yet. To request deletion of your account and profile, email [email protected] from the address on your account. Content you contributed to a shared household may be retained by that household, with your attribution pseudonymized where needed.

Deleting a household. A household owner can delete a household from within the app. Deletion has a 30-day recovery window, after which the household and its recipes, meal plans, grocery lists, memories, and photos are permanently removed. Subscription transaction records are retained as a billing audit trail, with the purchaser's identity pseudonymized.

Automatic clean-up. Recipes in the trash are purged 30 days after deletion; checked-off grocery items are removed 30 days after they are checked; read notifications are removed after 30 days (and all notifications after 90 days); diagnostic events are removed after 30 days; data export download links expire after 48 hours.

Exporting your data. Households on ReciLore Full (or within the 30-day window after a Full plan lapses) can generate a portable export of their recipes and memories from Settings. Whatever your plan, you can request a copy of your personal data by emailing [email protected].

On-device data. The local copy of household data on your device is cleared when you sign out or switch households, and can be reset from Settings.

Your choices and rights

You can update your profile name and photo, and your household name, in the app. You can control which optional tabs are shown. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing.

To exercise these rights, contact [email protected]. We will respond as required by applicable law. You can also manage sign-in permissions with Apple or Google directly, and manage subscriptions through your app store account.

Children's privacy

ReciLore is intended for adults managing a household. It is not directed to children under 13 (or under 16 where local law sets that age), and we do not knowingly collect personal data from them. A household organizer is responsible for any content they add about family members, including children. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

Security

We use encryption in transit, access controls, and row-level database security so that household data is reachable only by its members. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International transfers

ReciLore is operated with infrastructure and providers that may be located in the United States and other countries, and imported recipe text may be processed by an AI provider outside your country. Where required, we rely on appropriate safeguards for these transfers.

Changes to this policy

We may update this policy as ReciLore evolves. Material changes will be reflected in the app and on our website, with an updated effective date.

Contact us

Questions about this policy or your data can be sent to [email protected].

This document reflects how ReciLore works as of the effective date above and has not yet been reviewed by a lawyer. It will be finalized before ReciLore's public release and app-store submission.