Smakly App – Privacy Policy 1.0

Version: 1.0

Effective Date: 9 August 2026

Mateusz Anders („I”, „me”, or „my”) operates the Smakly mobile application (the „App”) as an individual. This Privacy Policy explains how I collect, use, disclose, and safeguard your information when you use the App.

1. Information Collected

1.1 Information You Provide

Account information: email address, username, display name, and profile picture.
Recipes and content: recipes you create, including text, images, ingredients, and cooking steps.
Social interactions: comments, reviews, likes, follows, and group memberships.
Shopping lists: items you add to your shopping lists.
Events: cooking events you create or participate in, including dates and meal details.
Reports you file: the categories you selected, any written explanation, and a copy of the reported content as it stood when you reported it. The copy is necessary because comments, profiles and group names can be edited or deleted the moment they are reported, which would otherwise make a report impossible to assess.
Users you block: the list of accounts you have blocked. This is a setting of yours, not a sanction, and only you and I can see it.
Invitations you decline: the fact that you declined a follow request or a group invitation from a particular person, and when. Without this record, withdrawing and resending an invitation would reset the protection against repeated invitations.
Username history: your previous usernames and the dates they changed, so that a freed username cannot immediately be taken by someone else to impersonate you.
Dietary settings: your daily calorie target, the meal-slot template that divides it across the day, and the portions and calories you record for planned meals.

Your daily calorie target is a setting of the planner: it is the figure the meal-slot template divides across the day to suggest portions. Every account starts with a neutral default of 2000 kcal, and the App works the same whether or not you change it. I process it to provide the planning features you signed up for — the legal basis is performance of our contract — and for nothing else. It is not used to profile you and it is deleted with your account.

Your calorie target and meal-slot template are visible to the other members of a group you have joined. That is what a group is for: a shared meal has to be portioned for everyone at the table, and that cannot be worked out without each person’s target. People who have been invited but have not yet accepted see neither, and nobody outside your groups sees either. If you would rather not share a figure of your own, leave it at the default or plan on your own rather than in a group.

1.1a Information Generated by Moderation

If a moderation decision concerns you, I also hold:

A record of warnings: the date, the category of the violation and the reason given, together with the expiry date.
A record of decisions: what was blocked, when, on what grounds and by whom, so that the history of a decision can be reconstructed if you appeal it.
A bar on re-registration: if your account was blocked indefinitely, an irreversible digest of your email address. The address itself is not stored. The digest is only ever used to answer, at sign-up, whether that address is barred.

1.2 Information Collected Automatically

Device information: device type, operating system, and unique device identifiers.
Push notification tokens: Expo push tokens used to deliver notifications to your device.
Usage data: features you use, actions you take, and the time and frequency of your activities.
IP address: collected when you interact with the App’s services, including for consent and account-deletion verification.
User-Agent: browser or app client information sent with your requests.
Advertising data: the App uses Google AdMob to display advertisements. Google AdMob may automatically collect:
- Advertising identifiers (e.g. Google Advertising ID on Android, IDFA on iOS).
- Device information (model, OS version, screen size, network type).
- Approximate location data derived from your IP address.
- Ad interaction data (impressions, clicks, views).
For details on how Google processes this data, see Google’s Privacy Policy and How Google uses information from sites or apps that use its services.

1.3 Information from Third Parties

Social login providers: if you sign in via Google or Apple, your email address and account identifier are received from those services.

2. How I Use Your Information

I use the information collected to:

Create and manage your account.
Provide, maintain, and improve the App’s features.
Enable social features such as following users, sharing recipes, and joining groups.
Send push notifications about activity relevant to you (e.g. new followers, comments, event updates).
Process account deletion requests and verify your identity.
Enforce the Terms of Service and protect against misuse: reviewing reports, blocking content and accounts, keeping the record of warnings, and limiting repeated unwanted invitations.
Give you the reasons for a moderation decision that affects you, and handle your appeal against it.
Display advertisements through Google AdMob. Ad content may be personalized based on your device information and usage patterns, subject to your device’s ad personalization settings.
Comply with legal obligations.

2a. Artificial Intelligence

I use artificial intelligence tools in one place only: to write some of the recipes that Smakly itself publishes, which are marked „AI” in the App and described in section 3.1a of the Terms of Service.

That use does not touch your information. Your recipes, photographs, comments, calorie target, meal plans and shopping lists are not sent to any provider of artificial intelligence tools, and are not used to train any such tool.

Nothing in the App decides anything about you automatically. There is no profiling and no automated decision-making within the meaning of Article 22 GDPR: moderation decisions, including blocking content and suspending accounts, are taken by a person, and reports are read by a person. Advertising personalisation by Google AdMob is described separately in section 11 and is governed by your device settings.

3. How I Share Your Information

I do not sell your personal information. I may share your information with:

Other users: your profile information, recipes, comments, and social activity are visible to other users as part of the App’s functionality. Members of a group you have joined additionally see your daily calorie target and meal-slot template, for the reason given in section 1.1.
Service providers: third-party services that help operate the App, including:
- Hosting and storage: DigitalOcean, on servers in Amsterdam, the Netherlands. The database and the images you upload are held there.
- Push notifications: Expo (Expo Inc., United States), which receives your push token and the content of the notification.
- Email delivery: ZeptoMail (Zoho Corporation), in its European data centre, which receives your email address and the content of the message.
Advertising partners: Google AdMob may collect and process data as described in section 1.2 to serve advertisements. Google acts as an independent data controller for the data it collects through AdMob. See Google’s Privacy Policy.
Legal requirements: when required by law, regulation, or legal process.

4. Data Storage and Security

Your data is stored on secure servers located in the European Union (Amsterdam, the Netherlands). I use industry-standard security measures to protect your information, including encrypted connections (TLS), hashed passwords, and access controls.

Transfers outside the European Economic Area. Three things involve processing in the United States: push notifications are delivered through Expo, which receives your push token and the text of the notification; advertising is served by Google, which processes the data described in section 1.2 as an independent controller; and if you sign in with Google or Apple, that provider verifies the sign-in and thereby learns that you use the App. These transfers rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified under it, on the EU–US Data Privacy Framework. Your account data, recipes, images, meal plans and moderation records stay within the EEA.

While I strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. I cannot guarantee absolute security.

5. Data Retention

I retain your personal data for as long as your account is active or as needed to provide the App’s services. When you delete your account, your personal data and associated content are permanently removed, except for the moderation data listed below, which is kept for the periods stated.

Data	How long	Why
Reports that have been decided — reporter, written explanation, copy of the reported content	12 months from the decision, then stripped of personal data	The reasons for a decision have to remain available while it can still be appealed or disputed. The period matches how long a warning counts, so the source data lives exactly as long as its consequence. After that only the bare fact of a report, its categories and its dates are kept, for statistics.
Reports that are still open	Not deleted while open	They are still awaiting a decision.
Warnings	Count for 12 months, kept for 24	The extra year is the margin needed to show the grounds for an account block issued on a third warning.
Digest of an email address barred from re-registration	3 years	Long enough to cover a realistic risk of return. The same period applies to every category of violation; only an irreversible digest is stored, so the intrusion is small.
Users you have blocked	Until you unblock them	This is your setting, and only you decide when it ends.
Declined invitations	Until you accept an invitation from that person	Deleting the record sooner would restore the ability to invite you repeatedly.
Previous usernames	30 days as a reservation; the change itself is kept for the life of the account	A freed username is otherwise a ready-made tool for impersonating its previous owner.

Where a report concerns material that is criminal in nature, retention follows the applicable law rather than this policy, and the material is preserved rather than deleted.

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

Access: request a copy of the personal data held about you.
Correction: request correction of inaccurate or incomplete data.
Deletion: request deletion of your account and data. You can initiate this from the App’s settings.
Data portability: request your data in a structured, machine-readable format.
Withdraw consent: withdraw consent at any time where processing is based on consent.
Object: object to processing of your data for certain purposes.
Complain to a supervisory authority: if you think I am handling your data unlawfully, you can lodge a complaint with the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or with the authority in the EU country where you live or work. You do not have to contact me first.

To exercise any of these rights, please contact me at contact@smakly.app.

7. Data Deletion

You can permanently delete your account and all associated personal data at any time. The process is self-service and works as follows:

Request deletion in the App. Open the App and go to Settings → Delete account. This sends a confirmation email to the address registered on your account.
Confirm via email. Open the email I send you and click the confirmation link. The link is required so that nobody but you can delete your account.
Deletion is completed immediately. Once confirmed, your account and all personal data linked to it are permanently and irreversibly removed from my systems, except for the moderation data listed in section 5, which is kept for the periods stated there.

Deleting your account permanently removes, among other things: your profile and profile picture, your recipes and meal plans, your followers and follows, your group memberships, your notifications, your active sessions, and your consent records. This action cannot be undone and the data cannot be recovered.

If you registered but never verified your email address, your account and its data are automatically deleted within 24 hours, without any action required on your part.

If you are unable to access the App or need assistance with deleting your data, contact me at contact@smakly.app and I will process your request.

8. Children’s Privacy

The App is not intended for children under the age of 16. I do not knowingly collect personal information from children under this age. If I become aware that data has been collected from a child under 16, I will take steps to delete that information promptly.

9. Third-Party Links

The App may contain links to third-party websites or services. I am not responsible for the privacy practices of those third parties. I encourage you to review their privacy policies.

10. Push Notifications

The Expo push notification service is used to send you notifications about activity in the App (e.g. new followers, comments on your recipes, event updates). You can disable push notifications at any time through your device settings.

11. Advertising

The App displays advertisements provided by Google AdMob. These ads help support the App’s development and operation. AdMob may use your device’s advertising identifier and other data to serve ads, including personalized ads based on your interests.

You can manage your ad personalization preferences through your device settings:

Android: Settings → Google → Ads → Opt out of Ads Personalization.
iOS: Settings → Privacy & Security → Tracking → disable tracking for Smakly, or Settings → Privacy & Security → Apple Advertising → disable Personalized Ads.

Opting out of personalized ads does not remove ads from the App — you will still see advertisements, but they may be less relevant to you.

12. Changes to This Privacy Policy

I may update this Privacy Policy from time to time. When changes are made, the „Effective Date” at the top will be updated and you will be notified through the App. Major changes will require your explicit acceptance before you can continue using the App. Minor changes will be presented for your acknowledgment.

13. Contact

If you have questions or concerns about this Privacy Policy, please contact me at:

Data controller: Mateusz Anders, an individual established in Poland.
Email: contact@smakly.app — the same address handles data protection requests, moderation appeals and reports of illegal content.

There is no data protection officer: the App is run by one person, and none of the conditions in Article 37 GDPR that would require one apply.