Smakly App – Privacy Policy 2.0

Version: 2.0

Effective Date: 24 September 2026

Mateusz Anders ("I", "me", or "my") operates the Smakly mobile application (the "App") as a sole trader, under the business name Mateusz Anders IT Solutions, ul. Wały Jagiellońskie 28/30 lok. 2, 80-853 Gdańsk, Poland (full details in section 13). This Privacy Policy explains how I collect, use, disclose, and safeguard your information when you use the App.

1. Information Collected

1.1 Information You Provide

Account information: email address, username, display name, and profile picture — or, instead of a picture, one of the drawn avatars the App offers, of which only your choice is stored.
Recipes and content: recipes you create, including text, images, ingredients, and cooking steps.
Social interactions: comments, reviews, likes, follows, and membership of shared planners.
Cooking in the App: each time you finish a recipe in cooking mode — by ticking its last step, or by rating it from there — which recipe it was, when you finished and when you opened cooking mode. At most one a day is kept for each recipe: cooking the same recipe again the same day does not add another. If you cook ahead and mark which planned meals that cooking covers, a link to each of those meals is kept as well — one per meal. Leaving cooking mode any other way records nothing.
Showing your cooking: whether showing your cooking is turned on in Settings. It is off until you turn it on, and it is deleted with your account.
Notification settings: whether the summary of what is new from the people you follow is on, when the last one was sent to you, and when you last opened the feed of the people you follow. They are deleted with your account.
Shopping lists: the lists you create (their name, the days a list was made for and how it was made) and the items on them. Lists are stored on Smakly's server so that they are available on each of your devices and can be shared with other people. For each item, whether it has been bought, who ticked it and when is recorded. So are the people a list is shared with — who added them and when — and who has pinned the list.
Events: cooking events you create or participate in, including dates and meal details.
Reports you file: the categories you selected, any written explanation, and a copy of the reported content as it stood when you reported it. The copy is necessary because comments, profiles and the names of shared planners can be edited or deleted the moment they are reported, which would otherwise make a report impossible to assess.
Users you block: the list of accounts you have blocked. This is a setting of yours, not a sanction, and only you and I can see it.
Invitations you decline: the fact that you declined a follow request or an invitation to a shared planner from a particular person, and when. Without this record, withdrawing and resending an invitation would reset the protection against repeated invitations.
Username history: your previous usernames and the dates they changed, so that a freed username cannot immediately be taken by someone else to impersonate you.
Dietary settings: your daily calorie target, the meal-slot template that divides it across the day, and the portions and calories you record for planned meals.
Language settings: the language you use the App in (chosen in Settings, or the language of your phone), which is saved to your account, and the recipe languages you can pick in Settings for discovering recipes; if you pick none, discovery follows the App's language. Neither is visible to other users, and both are deleted with your account.
Invite links to a shared planner: if, as the owner of a shared planner, you create an invite link — the link itself, who created it and when, until when it is valid, and when it was revoked.

Your daily calorie target is a setting of the planner: it is the figure the meal-slot template divides across the day to suggest portions. Every account starts with a neutral default of 2000 kcal, and the App works the same whether or not you change it. I process it to provide the planning features you signed up for — the legal basis is performance of our contract — and for nothing else. It is not used to profile you and it is deleted with your account.

Your calorie target and meal-slot template are visible to the other members of a shared planner you have joined. That is what a shared planner is for: a meal for several people has to be portioned for everyone at the table, and that cannot be worked out without each person's target. People who have been invited but have not yet accepted see neither, and nobody outside your shared planners sees either. If you would rather not share a figure of your own, leave it at the default or plan on your own rather than in a shared planner.

1.1a Information Generated by Moderation

If a moderation decision concerns you, I also hold:

A record of warnings: the date, the category of the violation and the reason given, together with the expiry date.
A record of decisions: what was blocked, when, on what grounds and by whom, so that the history of a decision can be reconstructed if you appeal it.
A bar on re-registration: if your account was blocked indefinitely, a digest of your email address. The address itself is not stored. The digest is only ever used to answer, at sign-up, whether that address is barred.

1.2 Information Collected Automatically

Push notification tokens: Expo push tokens used to deliver notifications to your device. This is the only device identifier Smakly's server receives; the App uses no analytics tools.
Suggestions shown to you: which recipes your home feed has suggested to you, and when.
IP address and User-Agent (the name and version of the App or browser and of the operating system): they reach the server with every request. I record them in three places: when your acceptance or acknowledgement of the Terms and the Privacy Policy is recorded — as evidence of when and from where it happened; in the server logs — to diagnose faults and protect the App from attacks; and, the IP address alone, in the counter that limits the number of requests — only for as long as that limit lasts.
Advertising data: the App uses Google AdMob to display advertisements. Google AdMob may automatically collect:
- Advertising identifiers (e.g. Google Advertising ID on Android, IDFA on iOS).
- Device information (model, OS version, screen size, network type).
- Approximate location data derived from your IP address.
- Ad interaction data (impressions, clicks, views).
- Crash reports and performance data (how long the App takes to start, how often it hangs, how much energy it uses), which Google collects to improve its own advertising software.
What Google may do with this data depends on the choices described in section 11. For details on how Google processes it, see Google's Privacy Policy and How Google uses information from sites or apps that use its services.
Language in requests: every request from the App carries the language the App is set to, so that the server answers in it and keeps recipe discovery to it. The server does not store it with the request; your account's language is kept separately (see "Language settings" in section 1.1).
Language of content: the language of recipes and comments is detected automatically on Smakly's server from their text, without any third party. A recipe's language is stored with the recipe; a comment's language is worked out when the comment is shown and is not stored. When a recipe's text is too short to tell, it is taken to be in the language of its author's account.

1.3 Information from Third Parties

Social login providers: if you sign in via Google or Apple, your email address and account identifier are received from those services.
Sign in with Apple: Apple lets you hide your email address. If you do, I receive an address that Apple creates for Smakly (ending in @privaterelay.appleid.com) instead of your own, and Apple forwards the emails I send to it. If you share your name in Apple's sign-in window, it becomes the display name of your new account; you are not asked for one otherwise. So that the sign-in can be revoked when you delete your account, I also keep the token Apple issues to Smakly for your Apple ID.

2. How I Use Your Information

I use the information collected to:

Create and manage your account, and let you sign in. Without this there is no account, so the legal basis is performance of our contract.
Provide and maintain the App's features — your recipes, the meal planner, cooking mode, shopping lists — and keep them working. This is the service you signed up for, so the legal basis is performance of our contract.
Enable social features such as following users, sharing recipes, and joining shared planners. These are part of the App, so the legal basis is performance of our contract.
Show the people who follow you what you do with recipes; show on your profile the recipes you recommend and, if you choose, what you cook; and count how often recipes are cooked, liked, commented on and rated so that popular recipes are easier to find. All of this is part of the social features the App provides, so the legal basis is performance of our contract; what you cook is shown — on your profile, in your followers' feed and on your reviews — only when you turn it on in Settings.
Suggest recipes in your home feed, favouring popular ones, and remember which recipes were suggested to you so that refreshing the feed brings ones you have not been shown yet. This is part of the feed the App provides, so the legal basis is performance of our contract.
Use your language settings and the language of content to answer you in your language, write your notifications and emails in your account's language, keep recipe discovery (home feed suggestions, Discover, search, tag suggestions) to the languages you read, give a language to a short recipe whose text is too short to tell, and point out comments written in a language other than the App's so they can be translated on your phone (section 2a). This is part of the features the App provides, so the legal basis is performance of our contract.
Keep your shopping lists in step across your devices, share them with the people you add to them, show who bought what, tell a person that they have been added to a list, and tell the people on a list when everything on it has been bought. This is part of the features the App provides, so the legal basis is performance of our contract.
Send push notifications about activity relevant to you (e.g. new followers, comments, event updates). Your phone asks for your permission before the first one is sent, and you can turn them off at any time in Settings or in your device settings, so the legal basis is your consent.
Ask for your opinion of the App — once: a welcome note when your account is created, sent by email and placed in your notifications, and, after you plan your first meal, your phone's own prompt to rate the App in the store, shown once. I send no further requests for feedback. I do this to find out what to fix and build next, which is my legitimate interest in improving the App. Answering is entirely optional.
Record when a version of the Terms and of the Privacy Policy was accepted or acknowledged, together with the IP address and User-Agent it came from — so that I can show which version binds you, which is my legitimate interest.
Keep server logs with the IP address and User-Agent, and limit the number of requests from one IP address, to diagnose faults and protect the App from attacks — my legitimate interest in the security of the service.
Process account deletion requests and check that the request really comes from you. Acting on the request is a legal obligation (Article 17 GDPR); checking who is asking protects your account, which is my legitimate interest.
Enforce the Terms of Service and protect against misuse: reviewing reports, blocking content and accounts, keeping the record of warnings, and limiting repeated unwanted invitations. Keeping the App safe for the people who use it is my legitimate interest, and for illegal content it is also a legal obligation.
Give you the reasons for a moderation decision that affects you, and handle your appeal against it. Telling you why is a legal obligation under the Digital Services Act; handling the appeal is my legitimate interest in getting the decision right.
Display advertisements through Google AdMob. In the European Economic Area, the United Kingdom and Switzerland, personalised ads, and the reading of your device's advertising identifier that they need, happen only if you agree to them in the consent form the App shows you, so the legal basis there is your consent. Outside those countries ads may be personalised on the basis of my legitimate interest, and you can object to that at any time (section 11). If you do not agree to personalisation, I still show non-personalised ads, and to show them Google receives the data needed just to deliver an ad (section 11). The ads pay for the App, which is my legitimate interest. What happens if you refuse is described in section 11.
Answer lawful requests from public authorities — a legal obligation.

The legal bases, in one place. Every purpose above rests on one of the four grounds in Article 6(1) GDPR:

Performance of our contract (Article 6(1)(b)) — your account, your recipes, the meal planner, shopping lists, shared planners and the other social features, the home feed, and writing to you in your own language. This is what you signed up for.
My legitimate interest (Article 6(1)(f)) — the security of the service, moderation, preventing abuse and spam, asking for your opinion of the App, showing non-personalised ads, and personalised ads outside the European Economic Area, the United Kingdom and Switzerland. You can object to any processing on this basis (section 6).
A legal obligation (Article 6(1)(c)) — the handling of illegal content, the statement of reasons for a moderation decision, acting on your GDPR rights, and lawful requests from public authorities.
Your consent (Article 6(1)(a)) — personalised advertising in the European Economic Area, the United Kingdom and Switzerland (section 11) and push notifications (section 10). You can withdraw either at any time, as easily as you gave it; withdrawing it does not make what was done beforehand unlawful.

What you have to give me. An email address and a username are required to have an account: I need them to create it, to tell you apart from other people using the App, and to reach you about your account and about moderation decisions. Giving them is a requirement of our contract — not of any statute — but without them the account cannot be created and the App cannot be used. Everything else is optional: a display name, a profile picture, a bio, a calorie target other than the default, a photograph on a recipe. The App works without them.

2a. Artificial Intelligence

Your data is not processed by artificial intelligence tools. Your recipes, photographs, comments, calorie target, meal plans and shopping lists are not sent to any provider of such tools, and are not used to train any of them. Where artificial intelligence is used in the App, and how what it produced is marked, is described in section 3.1a of the Terms of Service.

Translating comments. A comment written in a language other than the App's can be translated with the "Translate" button — only when you press it, never on its own. The translation happens on your phone, done by the system's own translator: Apple Translation on an iPhone with iOS 18 or newer, Google ML Kit on Android. The text of the comment is not sent to me to be translated, and it is not sent to Apple or to Google either.

The one thing that does leave your phone is the request to download a language, the first time you translate from it: on Android the App asks Google for the language pack (a few tens of megabytes, over whatever connection you are on), and on an iPhone iOS fetches it from Apple. That request is a request for a file. It carries no comment, no recipe and nothing about you beyond what any download tells the server it came from, and it is governed by Apple's and Google's own terms. Once the language is on your phone, translating works with no connection at all.

What tells the App that a comment is worth translating is not your phone but my server: it works out which language a comment is written in, from the text, where the text says so clearly, and sends that along with the comment (section 1.2). The comment is on my server in any case — that is where you write it — but I never translate it.

Nothing in the App decides anything about you automatically. There is no profiling and no automated decision-making within the meaning of Article 22 GDPR: moderation decisions, including blocking content and suspending accounts, are taken by a person, and reports are read by a person. Advertising personalisation by Google AdMob is described separately in section 11 and is governed by your choices in the consent form and your device settings.

3. How I Share Your Information

I do not sell your personal information. I may share your information with:

Anyone with a link to a recipe: if your recipe and your profile are public, the recipe has a web page at smakly.app that anyone can open, even without an account and without the App. The page shows the recipe's title and its photograph — not your name, your username, reviews or comments — and a messaging app the link is pasted into may fetch them for a preview. Search engines may also visit and remember the page. Once the recipe or the profile stops being public, the page stops showing it.
Other users: your profile information, recipes, comments, and social activity are visible to other users as part of the App's functionality. In particular, people who follow you may see, under your name or username in their home feed, the recipes you recently rated 4 or 5 stars, commented on or liked — and, only if you turn on showing your cooking in Settings, the recipes you finished cooking, with the day but not the time. Anyone reading a recipe sees how many times it has been cooked, without names. A review you wrote is marked as cooked by you if you have finished that recipe in cooking mode and have that setting turned on. Anyone who can see your profile — everyone, if your profile is public; the people who follow you, if it is private — sees there the recipes you rated 4 or 5 stars: which recipe, how many stars and the opening of your review, and how many such recipes there are. Only if you turn on showing your cooking in Settings do they also see how many times you have finished a recipe in cooking mode and which recipes you finished most recently, without dates. Either list shows a person only the recipes they could open themselves. Members of a shared planner you have joined additionally see your daily calorie target and meal-slot template, for the reason given in section 1.1.
People added to a shopping list: you can add to your list only people you plan meals with in a shared planner. The people you add see the list and its items, can change them, and see who ticked what. They are notified when they are added, with your name (your display name, or your username if you have none), the list's name and the number of items, and when everything has been bought, with the name of the person who ticked the last item. If the list was made from your own meals, they also see those meals' ingredients and quantities. Anyone added can leave the list, and you can take them off it. If you have been added to someone else's list, its owner and the others on it see what you tick.
People holding an invite link: the owner of a shared planner can create an invite link and pass it to anyone, for example in a messaging app. Anyone who has the link — even without an account and without signing in — sees the planner's name and the inviter's display name with their username beside it (or the username alone, if they have no display name); a signed-in user of the App also sees how many members it has. Members are not named. The messaging app the link is pasted into may fetch the same name and inviter's name to show a preview of the link. Whoever joins through the link becomes a member of the shared planner at once — with no invitation addressed to them and no approval from the owner — and, like any member, sees its planned meals and the other members' daily calorie targets and meal-slot templates (section 1.1), and they see theirs. The owner is notified of everyone who joins. A link works for 7 days; a shared planner has one link at a time, and creating a new one invalidates the previous one. The owner can revoke the link at any time and remove anyone who joined. Nobody can join through a link if either of them has blocked the other — they or any member of the planner, whoever blocked whom. A shared planner can have at most 10 people. This is part of shared planning, so the legal basis is performance of our contract.
Service providers: third-party services that help operate the App, including:
- Hosting and storage: DigitalOcean, on servers in Amsterdam, the Netherlands. The database and the images you upload are held there.
- Push notifications: Expo (Expo Inc., United States), which receives your push token and the content of the notification.
- Email delivery: ZeptoMail (Zoho Corporation), in its European data centre, which receives your email address and the content of the message.
Sign-in providers: if you sign in with Google or Apple, that provider verifies each sign-in. If you signed in with Apple and chose to hide your email address, the emails I send you pass through Apple's private email relay, which forwards them to your own address. When you delete your account, I ask Apple to revoke Smakly's access to your Apple ID. Google and Apple act as independent controllers under their own privacy policies.
App stores: the App is distributed through Google Play and the Apple App Store. When you download or update the App, Google or Apple processes the data involved under its own terms and privacy policy, as an independent controller.
Advertising partners: Google AdMob may collect and process data as described in section 1.2 to serve advertisements. I am responsible, together with Google, for that data being collected in the App and passed to Google; what Google does with it afterwards is Google's responsibility, as an independent data controller. See Google's Privacy Policy.
Legal requirements: when required by law, regulation, or legal process.

4. Data Storage and Security

Your data is stored on secure servers located in the European Union (Amsterdam, the Netherlands). I use industry-standard security measures to protect your information, including encrypted connections (TLS), hashed passwords, and access controls.

Transfers outside the European Economic Area. Three things involve processing in the United States: push notifications are delivered through Expo, which receives your push token and the text of the notification; advertising is served by Google, which processes the data described in section 1.2 as an independent controller; and if you sign in with Google or Apple, that provider verifies the sign-in and thereby learns that you use the App — and, if you hid your email address from me with Apple, Apple's relay handles the emails I send you. These transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified under it, on the EU–US Data Privacy Framework. Your account data, recipes, images, meal plans and moderation records stay within the EEA. The hosting provider (DigitalOcean) and the email provider (Zoho) are headquartered outside the EEA; where their staff outside the EEA have access to the data — during technical support, for example — this relies on the Standard Contractual Clauses in their data processing agreements.

While I strive to protect your information, no method of transmission over the internet or electronic storage is completely secure. I cannot guarantee absolute security.

5. Data Retention

I retain your personal data for as long as your account is active or as needed to provide the App's services. When you delete your account, your personal data and associated content are permanently removed. The table below gives the periods for data that has its own, shorter period or can outlive the deletion of an account — and only for the reasons it lists.

Data	How long	Why
Reports that have been decided — reporter, written explanation, copy of the reported content	12 months from the decision, then stripped of personal data	The reasons for a decision have to remain available while it can still be appealed or disputed. The period matches how long a warning counts, so the source data lives exactly as long as its consequence. After that only the bare fact of a report, its categories and its dates are kept, for statistics.
Reports that are still open	Not deleted while open	They are still awaiting a decision.
Warnings	Count for 12 months, kept for 24	The extra year is the margin needed to show the grounds for an account block issued on a third warning.
Digest of an email address barred from re-registration	3 years	Long enough to cover a realistic risk of return. The same period applies to every category of violation; only a digest of the address is stored, not the address itself, so the intrusion is small.
An indefinitely blocked account and its content	Until you delete the account	A block does not take your content away: you can sign in, read the reasons, ask for a copy of your data and delete the account (Terms, section 3.8).
Content blocked for breaching the Terms	Together with the content the block concerns — until you delete it or delete your account; a version pinned in somebody else's meal plan — as in the row below, but without the photograph	A blocked recipe stays with its author so that they can fix it (Terms, section 3.7); a blocked version cannot come back into circulation.
A recipe version planned in somebody else's meal plan — name, photograph, portions, nutritional values, ingredients and steps, no longer linked to the author	After the recipe or the author's account is deleted — until no entry in anyone's meal plan uses it any more	Deleting a recipe must not wipe other people's meals from their calendar (Terms, section 3.1). The people in that plan see the name, the photograph and the nutritional values; they do not see whose recipe it was.
Record of accepting and acknowledging the Terms and the Privacy Policy — version, date, IP address, User-Agent	Until the account is deleted	It shows which version binds you; once the account is deleted, the contract ends.
Server logs — IP address, User-Agent, the address and time of the request	14 days	Long enough to spot an attack or diagnose a fault.
Server backups	At most 30 days, then overwritten	They protect against losing data in a failure. I do not restore deleted accounts from them; if a backup ever had to be used, accounts deleted since are deleted again.
Users you have blocked	Until you unblock them, or until either account is deleted	This is your setting, and only you decide when it ends.
Declined invitations and follow requests	Until you accept a later invitation from that person, or until either account is deleted. Records of declined follow requests are erased as well when you switch your profile to public, since a public profile does not decide who follows it. Repeated declines make the record — and the restriction — indefinite.	Deleting the record sooner would restore the ability to invite you repeatedly. A single decline places no restriction on the sender, so the record exists to recognise the second one; from then on nothing further is expected to arrive for you to accept.
Recipes suggested to you in the home feed	3 days	That is how long the feed holds back a recipe it has already suggested; after that the record serves no purpose and is deleted.
Shopping lists, their items and who ticked what	A list is archived 14 days after the last day it was made for, if nobody has changed it in that time (a list without dates: after 30 days without changes), and deleted after 60 days in the archive. A list anyone has pinned is not archived. All your lists are deleted with your account; when someone who ticked items deletes their account, the record that they ticked them is removed.	A list serves one shopping trip and is not needed after it. The archive leaves time to bring it back; standing lists (such as "Household") are pinned so that they stay.
Deleted lists and items; identifiers of synchronised changes	30 days	That is how long it takes for the deletion to reach every phone that has the list, instead of the list coming back from that phone's copy. The identifiers stop the same change being applied twice when a phone sends it again.
Invite links to a shared planner — the link, who created it and when, its expiry, its revocation	A link works for 7 days or until it is revoked. Its record is deleted 30 days after the link stopped working (it expired or was revoked), or earlier with the shared planner or with the account of the person who created it.	A link is meant to reach particular people within a short time; after 7 days it stops working, so that one pasted somewhere public does not stay an open invitation. A dead link serves nothing; 30 days leave time to look into a complaint about a link that was just turned off.
Previous usernames	30 days as a reservation; the change itself is kept for the life of the account	A freed username is otherwise a ready-made tool for impersonating its previous owner.

Where a report concerns material that is criminal in nature, retention follows the applicable law rather than this policy, and the material is preserved rather than deleted.

6. Your Rights

Under the GDPR you have the following rights:

Access: request a copy of the personal data held about you.
Correction: request correction of inaccurate or incomplete data.
Deletion: request deletion of your account and data. You can initiate this from the App's settings.
Restriction of processing: require me to keep your data but stop doing anything else with it — while I check whether something you say is inaccurate really is, while I consider an objection you raised, or instead of deletion where you still need the data for a legal claim.
Data portability: request your data in a structured, machine-readable format.
Withdraw consent: withdraw consent at any time where processing is based on consent.
Object: object to processing of your data for certain purposes.
Complain to a supervisory authority: if you think I am handling your data unlawfully, you can lodge a complaint with the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or with the authority in the EU country where you live or work. You do not have to contact me first.

To exercise any of these rights, please contact me at contact@smakly.app. I answer within a month. You have these rights whether or not your account is blocked and whether or not the current version of the Terms has been accepted — you can get a copy of your recipes, meal plans and shopping lists by asking in those cases too.

7. Data Deletion

You can permanently delete your account and all associated personal data at any time. The process is self-service and works as follows:

Request deletion in the App. Open the App and go to Settings → Delete account. This sends a confirmation email to the address registered on your account.
Confirm via email. Open the email I send you and click the confirmation link. The link is required so that nobody but you can delete your account.
Deletion is completed immediately. Once confirmed, your account and all personal data linked to it are permanently removed from the App and from my database. The exceptions — moderation data, versions of your recipes planned in other people's meal plans, and backups, which expire after at most 30 days — are listed in section 5, with their periods.

Deleting your account permanently removes, among other things: your profile and profile picture, your recipes and meal plans, your shopping lists, your followers and follows, your membership of shared planners (and the shared planners you own, which are deleted for all their members — the meals planned in them stay in the participants' calendars), your notifications, your active sessions, and your consent records. If you signed in with Apple, I also ask Apple to revoke Smakly's access to your Apple ID. This action cannot be undone and the data cannot be recovered.

If you registered but never verified your email address, your account and its data are automatically deleted within 24 hours, without any action required on your part.

If you are unable to access the App or need assistance with deleting your data, contact me at contact@smakly.app and I will process your request.

8. Minors

The App is for adults. You must be at least 18 years old to have an account — section 1 of the Terms of Service says so, and one of the reasons is on this page: the App shows advertising that may be personalised, and I do not want to aim such advertising at minors — the law and the ad networks' own rules give them particular protection from advertising based on profiling.

I do not knowingly collect personal data from anyone under 18. If I learn that an account belongs to someone under 18, I close it and delete the data. Where I am in doubt, I ask first, by writing to the email address the account uses. If you confirm that you are under 18, or do not reply within 14 days, I block the account; if within a further 30 days you do not confirm that you are 18 or over, I close it and delete the data. If you reply that you are 18 or over, the account stays. If you are a parent or guardian and believe your child has an account here, write to contact@smakly.app.

9. Third-Party Links

The App may contain links to third-party websites or services. I am not responsible for the privacy practices of those third parties. I encourage you to review their privacy policies.

10. Push Notifications

The Expo push notification service is used to send you notifications about activity in the App (e.g. new followers, comments on your recipes, event updates), the welcome note described in section 2, and a summary of what is new from the people you follow: how many recipes they published and recommended, with the name and author of the newest. The summary comes only when something is new since you last opened your home feed or since the previous summary; to know that, the App keeps the time the last one was sent to you. It is on until you turn it off in Settings → Notifications. You can disable all push notifications at any time through your device settings.

11. Advertising

The App displays advertisements provided by Google AdMob. They are what pays for running the App. To show them, AdMob may use your device's advertising identifier and other data from your device, and may use them to personalise what you are shown.

Personalised ads need your consent. In the European Economic Area, the United Kingdom and Switzerland — which is where you are if you are reading this in Poland — the App shows you Google's consent form before the first ad request and before the advertising part of Google's software is even started; until you answer, no ad is requested. The form is Google's User Messaging Platform, a consent management platform certified for this purpose, and Google records your answer on your device. You see it after you sign in, not before.

Outside those countries there is no consent form, and ads may be personalised without asking — the legal basis is then my legitimate interest in paying for the App with advertising. You have the right to object to personalisation at any time, and the objection takes effect at once: turn ad personalisation off in your phone's settings (below) — on an iPhone, declining the tracking prompt is enough too. In some US states Google also shows its own notice about the rights those states' laws give you, including the right to opt out of the "sale or sharing" of data for advertising; where it appears, you can change your answer in the App, under Settings → Ad privacy settings.

What you see depends on which answer you give. The form asks about personalised advertising. If you do not agree to personalised ads, you go on seeing advertising, only not tailored to you — chosen without the advertising identifier and without a profile of your interests, for example by the content you are looking at or your approximate location. Showing an ad at all still needs some of the data in section 1.2: Google receives, among other things, your IP address and basic information about the device, to deliver the ad, cap how often it is shown and detect ad fraud. The legal basis is then my legitimate interest in paying for the App with advertising (section 2). Neither answer costs you anything else: every other feature works exactly as before.

You can change your answer at any time in the App, under Settings → Ad privacy settings, which opens the same form again. Withdrawing your consent is as easy as giving it.

On an iPhone, Apple asks too. iOS asks a question of its own — whether the App may track you across other companies' apps and websites — everywhere, and after Google's form where there is one. That is Apple's requirement, separate from the consent the form asks for, and it governs only the advertising identifier (IDFA): the device hands it over only if you say yes. Without it the IDFA stays unavailable, so advertising cannot be chosen from what you do in other apps, even if you agreed to personalisation in Google's form. Neither answer changes how many advertisements you see. You can change your answer in the iPhone's Settings (see below).

You can also manage your ad personalization preferences through your device settings:

Android: Settings → Google → Ads → Opt out of Ads Personalization.
iOS: Settings → Privacy & Security → Tracking → disable tracking for Smakly, or Settings → Privacy & Security → Apple Advertising → disable Personalized Ads.

Turning personalisation off in your device settings does not remove advertising from the App: you go on seeing ads, only less matched to you.

12. Changes to This Privacy Policy

I may update this Privacy Policy. It is not a contract and there is nothing in it to agree to, so changes to it are put to you for your information and never block the App. You will be told about every change — other than a correction that does not change what the text means, such as a typo — in the App before it takes effect, and the "Effective Date" at the top will show the new version. If a change concerns a new purpose of processing or new recipients of your data, I will also tell you by email before I start processing your data that way. If a new purpose needs your consent, the App will ask for it separately, and saying no will not stop you using the App.

13. Contact

If you have questions or concerns about this Privacy Policy, please contact me at:

Data controller: Mateusz Anders, running a sole proprietorship under the business name Mateusz Anders IT Solutions, entered in the Polish Central Register and Information on Economic Activity (CEIDG).
Address: ul. Wały Jagiellońskie 28/30 lok. 2, 80-853 Gdańsk, Poland.
Tax ID (NIP): 5892110685; REGON: 544392830.
Email: contact@smakly.app — the same address handles data protection requests, moderation appeals and reports of illegal content.

There is no data protection officer: the App is run by one person, and none of the conditions in Article 37 GDPR that would require one apply.