Privacy Policy

Last updated: 23 September 2026

This Privacy Policy explains how Pipiro (“Pipiro”, “the app”, “we”, “us”) collects, uses, and protects your personal data when you use the Pipiro mobile application and related services.

We respect your privacy and are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR), applicable Lithuanian law, and - for California residents - the California Consumer Privacy Act as amended by the California Privacy Rights Act (see Section 9).

1. Who is responsible for your data (Data Controller)

Pipiro is operated by:

• Controller: AJ Studio, MB
• Registered address: Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania
• Contact form: pipiro.app/contact

AJ Studio, MB decides why and how your personal data is processed. It is the data controller for the purposes of the GDPR, and the business that collects your personal information for the purposes of the California Consumer Privacy Act (see Section 9).

We are not required to appoint a Data Protection Officer under Art. 37 GDPR. Privacy questions and requests are handled directly by us at the addresses above.

2. What data we collect

We only collect data that we need to provide the app’s features.

2.1 Account data

• Email address - used to sign you in and to send you one-time sign-in codes.
• Authentication identifiers - if you sign in with Google or Apple, we receive a unique account identifier from that provider (and, where you allow it, your name).
• Display name (optional) - if you choose to set one.
• Profile photo (optional) - if you sign in with Google or Apple and your account has a profile picture, we receive and store its image URL to show your avatar. You can also upload your own profile photo or remove it at any time.

2.2 Content you create

• Recipes you create, import, fork, or edit - including titles, descriptions, ingredients, steps, notes, tags, cooking times, and version history.
• Recipe photos you upload or take with your camera.
• Cook history, collections, shopping lists, and your weekly meal plan that you create to organise your recipes.

2.3 Recipe import data

When you import a recipe from a social or web link, we process:

• the URL you provide;
• the public content of that page (text and images) that we fetch in order to extract the recipe;
• the extracted recipe data returned to you.

The fetched content is sent to our AI provider solely to extract structured recipe information (see Section 4).

2.4 Technical data

• Standard technical information needed to operate a mobile app and cloud backend, such as your IP address, device type, and app version, processed by our infrastructure providers for security, abuse prevention, and reliability.
• Local settings stored only on your device (e.g. preferences), which are not transmitted to us.

2.5 One-time codes

When you sign in by email, we store a hashed (irreversible) version of your one-time code temporarily (it expires within 10 minutes) to verify your login.

2.6 Usage analytics

To understand how the app is used - which features are used and which are not - and to guide improvements, we collect aggregated, privacy-preserving usage statistics: counts of actions such as recipes created, imported, or cooked, and whether key features are used. We also count new sign-ups, and - to see how many people install the app but never sign up - first launches of the app after installation (only the platform and the store country, before you sign in and with no identifier), and to measure retention we record once per day that your account was active.

This analytics is first-party: it is generated by our own backend from the actions you take in the app and stored only in our own infrastructure (see Section 5). We do not use Google Analytics, and apart from the Meta measurement described below we use no third-party analytics SDK; these statistics use no advertising or cross-app tracking identifiers, and we never include the content of your recipes, collections, or notes in them - only counts and whether a feature was used. Because the statistics are aggregated and contain no tracking identifiers, they do not require a consent banner; we rely on our legitimate interest in operating and improving the app (Art. 6(1)(f)). The account activity used for retention is deleted when you delete your account.

Apple Search Ads attribution (iOS only). We advertise Pipiro on the App Store, and to know whether those ads bring people who actually use the app, we ask Apple - once, when you first sign in after installing - whether your download came from one of our Apple Search Ads campaigns. This uses Apple’s AdServices framework in its standard mode: Apple answers from its own records, no tracking permission is requested, no advertising identifier is used, and nothing follows you across other apps or websites. Apple’s answer is a yes/no plus campaign-level identifiers (which campaign, ad group and keyword, and the storefront country) - never anything about your device or you. We record it alongside your account’s usage statistics above, so we can compare how people who came from ads and people who found the app themselves use it. It is deleted with your account.

Meta ads measurement. We advertise Pipiro on Meta’s platforms (Facebook and Instagram). To learn whether those ads bring people who actually use the app, the app contains Meta’s measurement SDK, and our subscription provider RevenueCat can report subscription events to Meta on our behalf. Whether any of this is active depends on where your device is:

• European Economic Area, United Kingdom and Switzerland: nothing is recorded or sent until you agree. After your first sign-in the app asks, once, whether we may tell Meta when someone who came from an ad imports a recipe or subscribes. If you decline, or never answer, the SDK stays silent. You can change your answer at any time in the app’s Settings under Permissions, and withdrawing it stops all further sending. Legal basis: consent (Art. 6(1)(a) GDPR; Art. 5(3) ePrivacy Directive).
• United States: the measurement is on without a prompt, on our legitimate interest in knowing whether our advertising works (Art. 6(1)(f)); you can object at any time by writing to us (Section 12). We also set Meta’s “Limited Data Use” flag, which restricts what Meta may do with the events of California residents (Section 9).
• Everywhere else: the SDK sits in the app silent: it records nothing and sends nothing.

Where it is active, Meta is told that Pipiro was installed and opened, that a recipe was imported, and that a subscription was started, renewed or cancelled (the subscription events via RevenueCat, with the price and currency), accompanied by a random identifier generated for this app alone and basic device information such as device model, operating system version, language and IP address. Meta does not receive your name, email address, recipes, collections, notes, or anything else you write in the app. For the data it receives this way, Meta acts as an independent controller under its own privacy policy, not as a provider acting on our behalf.

Tracking permission (Apple’s App Tracking Transparency). On iOS, after you have agreed to the measurement (or, in the United States, after your first sign-in), the system asks once whether Pipiro may track your activity across other companies’ apps and websites. If you allow it, the device advertising identifier (IDFA) is included in the events above, which lets Meta match an install and what followed it to the ad that led to it - for people who also allowed tracking in Meta’s own apps. If you decline, or never see the dialog, no advertising identifier is used and Meta receives the events only in aggregate. You can change this at any time in your device settings under Privacy. On Android the advertising identifier is included once you have agreed to the measurement; you can reset or delete it in your device settings.

When you import a recipe from a web link and the import fails, we temporarily store the link (URL) you tried to import together with the reason it failed, so we can reproduce the problem and fix our importer (different sites present recipes differently). These records are not linked to your account, are accessible only to us, are never used for advertising or shared with third parties, and are automatically deleted within 30 days. We rely on our legitimate interest in keeping the import feature working (Art. 6(1)(f)).

Apple’s SKAdNetwork (iOS, all countries). Separately from the Meta tool above, iOS itself measures app-install ads through Apple’s SKAdNetwork. When an install follows an ad, the device - not our app - sends the advertising network (and us, a copy) one signed, aggregate report per conversion window, containing only the campaign and a small “conversion value” the app sets on the device: whether the app was opened, a recipe was imported, or a subscription was started in the days after installation. The report contains no identifier of you or your device, is delayed at random by Apple, and is only sent when enough people installed from the same campaign for the report to be anonymous. Nothing about you is sent to anyone from our app for this; we simply set the value and Apple does the rest. This works the same on every device, in every country, and needs no tracking permission.

Basic error and diagnostic logs generated by our backend are covered under technical data (Section 2.4). Apart from the Meta measurement described above, we use no third-party advertising SDKs, and we do not sell your personal data.

2.7 Subscription data

If you purchase a paid subscription (monthly or yearly), we process:

• your subscription status and plan (e.g. active or expired, monthly or yearly), so the app can unlock paid features;
• purchase and subscription identifiers provided by Apple or Google (such as a transaction identifier), together with an app-specific user identifier, used to link your purchase to your account and verify your entitlement.

Payment itself is handled entirely by the Apple App Store or Google Play. We never receive or store your card number or other payment details. We use RevenueCat to validate purchases and manage subscription status (see Section 5).

2.8 Nutrition estimation

When you ask Pipiro to estimate a recipe’s nutrition, we process that recipe’s ingredient lines (and its name and description) to calculate approximate calories and macronutrients. The ingredient text is sent to our AI provider solely to match each ingredient to reference nutrition values and estimate portion weights (see Section 4). We do not derive or store any information about your own health, diet, or body from this - the estimate describes the recipe, not you.

2.9 Households (shared recipe libraries)

Pipiro lets you share one recipe library with the people you cook with (a “household”). This is entirely optional - you are in a household only if you create an invitation or accept one, and a household holds at most five people.

• What becomes visible to the others. When you join a household, the recipes you already had - along with their versions, cook history, and photos - move into the shared library, together with your shopping lists and your weekly meal plan. Every member can read, edit, and delete them, and can see who cooked or changed what. Your collections stay private to you, even inside a shared household.
• Your profile within the household. The other members see your display name, username, and profile photo, so that recipes, edits, cooks, and ratings can be attributed to a person rather than to an anonymous account.
• Invitations. An invitation stores the name of the person who created it and a random invite code, so that whoever opens the link can see who invited them. Anyone holding a valid invitation link or code can join, so share it only with people you trust; a pending invitation can be revoked in the app.
• Matching an invitation after you install the app. If you open an invitation link before Pipiro is installed, our backend briefly stores an irreversible hash of your IP address together with your platform (iOS or Android) and the invitation concerned. This serves one purpose only: so that when you first open the app we can offer you the invitation you came for, instead of it being lost during installation. These records are deleted automatically within one hour, are not linked to your account, and are never used for advertising, profiling, or tracking you across apps or websites. We rely on our legitimate interest in making invitations work (Art. 6(1)(f)).

2.10 Sharing recipes and collections by link

Pipiro lets you share a single recipe, or a collection of recipes, with anyone via a link. Sharing is always your action - a link exists only after you tap “Share”, and you can stop sharing at any time.

• What can be seen. Anyone who opens the link - even without a Pipiro account - sees a preview of the shared recipe or collection in the browser: its name, photo, and short description. The full content (ingredients, steps, a collection’s recipes) opens only in the Pipiro app, signed in to an account, and always as the current version.
• Link previews. When the link is sent in a message or posted somewhere, the receiving app or platform may render a preview card (name, photo, and - for a collection - your name) and may keep that preview on its own systems.
• Your name. A shared collection shows the name you set in the app, so the person opening or following it can tell whose collection it is.
• Only the current version. A person opening the link never sees your version history, cook history, or notes - only the recipe as it currently stands. Your later edits are available at the same link.
• Stopping sharing. When you stop sharing, every previously sent link stops working immediately. Sharing again creates a new link.
• Saved copies. A signed-in viewer can save copies of your shared recipe or a shared collection’s recipes into their own library. A copy belongs to their account and keeps working after you stop sharing; if you created the recipe, the name you set in the app is shown on the copy as the recipe’s author. Stopping sharing does not remove copies that were already saved.
• Following a collection. Someone can also follow your shared collection. Their account then stores the collection’s name and the name you set in the app, so they can tell whose collection they follow; you see only how many people follow the collection, never who. If they allow notifications, they may be notified when you add or edit recipes. Stopping sharing disconnects every follower.
• Matching a shared link after you install the app works the same way as for household invitations (Section 2.9): a briefly stored record of an irreversibly encoded (hashed) IP address and platform, deleted within one hour.

2.11 Push notifications

Pipiro sends push notifications only if you allow them at the operating-system prompt - for example when a recipe import you started finishes in the background, as an optional reminder to rate a cook you logged, or when a collection you follow gets new recipes. To deliver them we store a device push token (an identifier issued to your installation of the app) with your account; delivery uses Firebase Cloud Messaging (Google, see Section 5). The token enables delivery and nothing else. You can turn notifications off at any time in your device settings, and the token is deleted with your account.

3. Device permissions

The app may ask for the following permissions. You can decline or revoke them in your device settings; some features will not work without them.

• Camera - to take photos of your recipes.
• Photo library - to attach existing photos to recipes.
• Motion / sensors - used locally to enable hands-free interactions while cooking. This sensor data stays on your device and is not collected by us.
• Tracking (iOS) - Apple’s App Tracking Transparency permission, asked only after you have agreed to Meta ads measurement (or, in the United States, after your first sign-in). It lets the advertising identifier accompany the measurement events described in Section 2.6; everything in the app works the same whether you allow it or not.

4. How we use your data and the legal basis

Do you have to give us this data? An email address (or a Google/Apple sign-in) is necessary to create an account - without it we cannot provide the service. Everything else is optional: a display name, a profile photo, recipe photos, joining a household, and a subscription are all things the app works without.

Automated decision-making. We do not take decisions about you that produce legal or similarly significant effects based solely on automated processing, and we do not profile you (Art. 22 GDPR). The AI features in Sections 2.3 and 2.8 work on recipe text, not on you: they extract a recipe or estimate a recipe’s nutrition, and their output never affects your account, your price, or your access.

Legitimate interests. Where we rely on legitimate interests (Art. 6(1)(f)), we have weighed that interest against your rights and freedoms and use only aggregated, non-identifying, or short-lived data for those purposes. You can object at any time - see Section 8.

5. Service providers (sub-processors)

We use trusted third-party providers to run Pipiro. They process data only on our behalf and under appropriate data-protection terms:

• Google Firebase / Google Cloud - authentication, database, file storage, serverless functions, and hosting of our own first-party usage statistics. Our backend is hosted in the European Union (region europe-west1, Belgium).
• Anthropic - provides the AI models used to extract structured recipe data from the content you import and to estimate a recipe’s nutrition. Imported page content and, for nutrition estimates, recipe ingredient lines are sent to Anthropic for these purposes. Anthropic does not use this data to train its models under our business terms.
• RevenueCat - validates app-store purchases and manages subscription status. RevenueCat receives an app-specific user identifier and purchase information from Apple or Google; it does not receive your name, email address, or payment details. Where Meta ads measurement is active (Section 2.6), RevenueCat also reports subscription starts, renewals and cancellations to Meta on our behalf, keyed to the same random app-specific identifier (and the advertising identifier, if you allowed tracking).
• Meta Platforms - measures whether our ads bring people who install and use the app, in the regions and under the conditions described in Section 2.6. Unlike the providers above, Meta acts as an independent controller for the events it receives, under its own privacy policy, rather than processing them on our behalf.
• Postmark - sends transactional emails (such as your one-time sign-in codes).
• Google / Apple Sign-In - if you choose these sign-in methods, the respective provider processes your authentication.

International transfers. Our own backend runs in the European Union, but some of the providers above - in particular Anthropic, RevenueCat, and Postmark, which are US-based - may process data outside the European Economic Area. Where that happens, the transfer is protected by an appropriate safeguard under Chapter V of the GDPR, normally the European Commission’s Standard Contractual Clauses together with the contractual and technical measures agreed with that provider. You can request a copy of the safeguards that apply to a particular transfer via our contact form.

We do not sell your personal data, and we do not disclose it to third parties for their own purposes - the providers above act only on our instructions and may not use your data for anything else.

6. How long we keep your data

• Account and content data - kept for as long as your account exists.
• Subscription data - kept for as long as your account exists; records of transactions may be retained longer where required for accounting or other legal obligations.
• One-time sign-in codes - deleted automatically within 10 minutes.
• Household invitations - an invitation stops working 7 days after it is created, or as soon as it is used or revoked. The record of it (who created it and when) stays with the household account until that account is deleted.
• Link-matching records (Sections 2.9 and 2.10) - deleted within one hour.
• Share links - a shared recipe or collection stays reachable at its link until you stop sharing it, delete it, or delete your account. Copies that other people saved to their own libraries before that stay in their accounts, with the name you set in the app as the recipe’s author.
• Device push tokens - kept while your account exists; deleted with it.
• When you delete your account, we permanently delete your account, recipes, versions, cook history, and associated files (see Section 8).
• If you leave a household, the recipes you created leave with you; the shared shopping lists and weekly meal plan stay with the household, and your star ratings are removed from the cooks that stay behind.
• If you delete your account while in a household, the recipes you created are deleted for everyone in that household - including members who have been cooking from them - while the shared shopping lists and meal plan remain with the household.

7. How we protect your data

• Data is transmitted over encrypted connections (HTTPS/TLS).
• Access to backend data is restricted; the app’s database is deny-by-default and access is scoped to your own account and, if you have joined one, to the household you share it with.
• One-time codes are stored only as irreversible hashes.

No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the State Data Protection Inspectorate within 72 hours of becoming aware of it, and will tell you directly where the breach is likely to result in a high risk to you (Art. 33-34 GDPR).

8. Your rights (GDPR)

If you are in the European Union, the European Economic Area, or the United Kingdom, you have the right to:

• access the personal data we hold about you and receive a copy of it (Art. 15);
• rectify inaccurate or incomplete data (Art. 16);
• erase your data - the “right to be forgotten” (Art. 17);
• restrict processing in certain circumstances (Art. 18);
• data portability - receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller (Art. 20);
• object to processing based on our legitimate interests, including the usage statistics and App Store attribution described in Section 2.6 (Art. 21). If you object, we stop that processing unless we can demonstrate compelling legitimate grounds that override your interests;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before you withdrew it (Art. 7(3)).

How to exercise them. You can delete your account and all associated data directly in the app at any time, and you can edit or remove your display name, profile photo, recipes, and other content in the app whenever you like. For any other request, get in touch via our contact form.

How we respond. We answer within one month of receiving your request. If the request is complex, or you have made several, we may extend that by up to two further months and will tell you why within the first month. Exercising these rights is free; we may charge a reasonable fee or decline only where a request is manifestly unfounded or excessive (Art. 12(5)). We may ask you to confirm the email address associated with your account, so that we do not hand your data to someone else.

Complaints. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. In Lithuania this is the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija), whose current contact details are published at https://vdai.lrv.lt. We would appreciate the chance to put things right first.

9. California privacy rights (CCPA/CPRA)

This section applies to residents of California and supplements the rest of this policy. It uses the terms defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). Pipiro is a small European app and may not meet the CCPA’s revenue or volume thresholds for a “business”; we honour the rights set out below for California residents regardless.

9.1 What we collect, and why

In the preceding 12 months we have collected the following statutory categories of personal information. The sources and purposes are described in full in Sections 2 and 4, and “disclosed to” means the service providers in Section 5, who process it only on our instructions.

Sources. Directly from you (what you type, upload, and import); from Google or Apple if you use their sign-in; from Apple or Google Play for purchases; and automatically from your device and our infrastructure for technical data.

How long we keep it. See Section 6. In short: account and content data for as long as your account exists; one-time codes for 10 minutes; invitation-matching records for one hour; failed-import URLs for 30 days.

Business purposes for which we use it. Providing and securing the service, verifying subscriptions, sending transactional email, importing recipes and estimating nutrition at your request, sharing a library with your household, preventing abuse, improving the app, and complying with the law - as set out in Section 4.

9.2 We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We have not done so in the preceding 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

The Apple Search Ads attribution described in Section 2.6 is neither a sale nor a share: Pipiro asks Apple whether your download came from one of our own App Store campaigns and receives a campaign-level answer. No personal information about you is disclosed to Apple for advertising, no advertising identifier is used, and nothing follows you across other apps or websites.

Because we neither sell nor share personal information, and because we use sensitive personal information only for the purposes permitted by CCPA § 1798.121 and its regulations, we are not required to offer a “Do Not Sell or Share My Personal Information” link or a “Limit the Use of My Sensitive Personal Information” link, and there is no opt-out preference signal (such as Global Privacy Control) for us to act on. Apart from the Meta ads measurement in Section 2.6, Pipiro contains no third-party advertising or analytics SDKs, and we offer no financial incentives in exchange for personal information. For that measurement we enable Meta’s “Limited Data Use” mode, under which Meta processes the events of California residents only to measure our advertising and not for its own purposes.

We disclose personal information for business purposes only to the service providers and contractors listed in Section 5, and to public authorities where the law requires it.

9.3 Your California rights

As a California resident you have the right to:

• know what personal information we have collected about you - the categories, the sources, the business purposes, the categories of third parties it was disclosed to, and the specific pieces of personal information;
• delete the personal information we hold about you, subject to the exceptions in CCPA § 1798.105(d);
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information - we do neither, so there is nothing to opt out of;
• limit the use and disclosure of sensitive personal information - we already confine it to permitted purposes;
• non-discrimination - we will not deny you the service, charge you a different price, or give you a lower quality of service because you exercised any of these rights.

9.4 How to make a request

• Delete everything: delete your account in the app. This permanently removes your account and content, and is the fastest route.
• Any request: email [email protected] or use our contact form.

Verification. We will ask you to confirm the email address associated with your Pipiro account, and may ask you to write from that address or to confirm details only the account holder would know. Information you give us for verification is used for that purpose only and then deleted. If we cannot verify you, we will tell you why.

Authorized agents. You may use an authorized agent. We will ask the agent for written permission signed by you, and may contact you directly to confirm the request and verify your identity.

Timing. We confirm receipt within 10 business days and respond within 45 calendar days. If we need longer we will tell you within those 45 days and may take up to 45 further days. Requests are free.

9.5 Shine the Light

California Civil Code § 1798.83 lets California residents ask whether we disclosed personal information to third parties for those third parties’ own direct marketing purposes. We do not, and never have.

9.6 Other US states

If you live in another US state with a comprehensive consumer privacy law - such as Colorado, Connecticut, Virginia, Texas, Oregon, or Montana - you have comparable rights to access, correct, delete, and port your personal data, and to opt out of targeted advertising, sale, and profiling, none of which we carry out. Use the same channels above. You may appeal a decision we make about your request simply by replying to it, and we will respond to an appeal within 45 days.

10. Children

Pipiro is not directed to children under the age of 16, and we do not knowingly collect personal data from anyone under 16. We do not knowingly sell or share the personal information of anyone under 16 - we do not sell or share personal information at all (see Section 9.2). If you believe a child has provided us with personal data, get in touch via our contact form and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you in the app. Your continued use of Pipiro after changes take effect means you accept the updated policy.

12. Contact

Questions or requests regarding your privacy:

• Contact form: pipiro.app/contact
• Post: AJ Studio, MB, Perkūnkiemio g. 19, LT-12120 Vilnius, Lithuania

California residents submitting a CCPA request may also email [email protected] (see Section 9.4).