Privacy Policy

In short: three promises

• Usage analytics stay off until you say yes. No usage statistics are sent before you agree in the app, and you can withdraw at any time. We do send crash reports to keep the app stable. They never include your name, email or recipes.
• You never pay for privacy. The free version and Matlyst Pro have exactly the same privacy. Pro gives you features, not privacy.
• No ads, no data sales. Matlyst shows no advertising, has no ad networks in the app and never sells your personal data.

1. Who is responsible

Matlyst is run by a private individual in Norway. The controller of your personal data is Patrick Omassa Kabia, Vollebekkveien 2J, 0598 Oslo, Norway. Contact: hei@matlyst-app.no.

2. What we process

Account. Your email and password if you sign up with email. Your Apple ID if you use Sign in with Apple; Apple shares your name and email and lets you hide your email. Your Google account if you use Sign in with Google; Google shares your name and email. Older versions of the app created an anonymous account automatically the first time you opened it. Current versions don’t. You can link such an account to an email address, Apple ID or Google account.

Profile and visibility. Name, username and profile photo, all optional. Preferences you give: goals and measurement units, both optional. Your name, username and photo are visible to other signed-in users who search for you, follow you or share a household with you. You can remove them at any time.

Consent records. For analytics, the food log and AI sharing, we store your country of residence, the minimum age you confirmed and the time of each consent. We do not store your date of birth or year of birth.

Your content. Recipes you import or create, folders, favourites, ratings, notes, meal plans, shopping lists, your pantry, and the household you plan with.

Food log and calorie goal (optional, health data). If you turn on the food log, we process meals, calories, nutrients and your calorie goal. This requires separate, explicit consent, and you must confirm that you are at least 18, wherever you live. You can withdraw consent in Settings. Your food log is then deleted and the calorie goal is reset. If you gave consent before the 18+ limit, under the age limit for your country, we keep your food log and calorie goal but hide them and stop new entries until you confirm that you are 18 or over. If you say no, or that you are under 18, your food log is deleted and the calorie goal is reset.

Imports. When you import a recipe, the link, image, text or file you choose is sent to our server to extract and translate the recipe. When you import from TikTok or YouTube, our server asks the platform for the caption, the thumbnail and who posted it. The TikTok link goes to TikTok, and the ID of the YouTube video or playlist to Google (YouTube Data API). Our server makes the request, so we don’t send your account ID, email address or IP address. Instagram often blocks requests from servers, so the app fetches the post directly from your phone, and our server may also ask Meta for the same post. When your phone fetches the post, Meta receives the link, your IP address and the usual technical details of the request, and Instagram may set cookies in the app. The app then sends the caption, the image and who posted it to our server. Each time the app starts, it also loads the Instagram home page once so that your first Instagram import works. This happens even if you don’t import anything, and Meta then receives your IP address but nothing about your Matlyst account. Instagram and TikTok links are sent as you shared them, and share links can contain the platform’s own tracking codes. Matlyst uses YouTube API Services. By importing from YouTube, you agree to the YouTube Terms of Service. See also the Google Privacy Policy. When you import a whole playlist, the app shows the video thumbnails straight from YouTube’s servers (i.ytimg.com), so Google receives your IP address. Matlyst doesn’t ask for access to your Google or YouTube account to import. You can see and revoke the access you’ve given apps in Google’s security settings.

Technical data.

• Crash reports (Sentry), without your name, email or user ID.
• A push token if you allow notifications. Notifications are delivered through Expo, which passes them on via Apple on iOS and Google Firebase Cloud Messaging on Android. Progress for an import on your Lock Screen (Live Activity) is sent by our server directly to Apple. Expo and Apple or Google receive the push token and the text of the notification, such as the name of a recipe. Firebase is used only to deliver notifications, not for analytics.
• App updates. The app downloads updates from Expo’s servers, so Expo sees your IP address, which app version and platform you use, and a random ID that stays the same for your installation.
• App version and device information.
• Service status. The app checks a status file at status.matlyst-app.no when you open it or return to it, and every five minutes while it is showing an outage notice, so it can tell you if Matlyst is down. The file is hosted on GitHub Pages (GitHub, USA), which sees your IP address and the usual technical details of the request, but nothing about your account.
• Usage analytics, only with your consent. The anonymous flow is explained below.

Emails. We send a few kinds of email from the app: sign-in emails, such as confirming your account, a link to reset your password and confirming a change of email address; a welcome when you sign up; a thank-you when you buy Matlyst Pro; one reminder 48 hours after sign-up if you haven’t saved a recipe yet; and a note when feedback you sent has been published or fixed. All of them go out through Resend (USA), which receives your email address, your first name where the email uses it, and the content of the email. The reminder is sent only once. If you don’t want it, you can object by replying to any email from us or writing to hei@matlyst-app.no.

Password check. When you choose a password, we check whether it has turned up in known data breaches. Our server makes a SHA-1 hash of the password and sends only the first five characters to the Pwned Passwords service (Have I Been Pwned). The service replies with the leaked hashes that start the same way, and we do the comparison ourselves. Your password, the full hash and your email address never leave our server.

Feedback. When you send feedback in the app, we store your text, category, status and limited technical context. You decide whether to attach a screenshot. Published feedback is shown without your name, email, screenshot or technical context.

Clipboard. Only if you turn it on, the app looks for a link on your clipboard to suggest an import. This happens on your device, the app reads nothing but web addresses, and nothing is sent until you choose to import.

Pantry and best-before dates. When you tick items off your shopping list, they can be added to your pantry with an estimated best-before date based on the type of food. The estimate is a guide, not a guarantee, and you can change or delete pantry items at any time.

3. Anonymous usage analytics in the app

Usage analytics are anonymous within the meaning of GDPR Recital 26. Each event is sent on its own to Matlyst’s own server, Supabase in the EU, without an ID and without a login. The time is rounded down to the hour, and only recognised event names and predefined properties are accepted.

The server keeps the event temporarily without fields for a user, account, device or IP address. The row is deleted after it is forwarded, and always within seven days. Events are shuffled before they go to PostHog in the EU. Each event receives a new random ID and is sent without an IP address, location or person profile. The events cannot be looked up by person.

The queue on your phone is used only after you say yes. It contains no ID and is cleared if you say no or sign out. Withdrawing consent stops collection. The legal basis is consent under Article 5(3) of the ePrivacy Directive and section 3-15 of the Norwegian Electronic Communications Act.

When the app sends an event, Supabase records the IP address, country, user agent and exact time in its operational logs. On Matlyst’s Pro plan, these logs are kept for seven days. Matlyst does not read the logs. They contain no user ID or event content.

Older app versions continue to send pseudonymous data to the previous PostHog project until they are updated. The website’s own PostHog flow is separate and is not changed by this.

4. Why we process it

We rely on these legal bases:

• Contract (Art. 6(1)(b)): import, storage, planning, sync and the Pro subscription; showing your profile to other users if you fill it in; sign-in emails, the thank-you for your purchase and app updates.
• Legitimate interest (Art. 6(1)(f)): keeping the service stable and secure with crash reports, the status check and the password check; the welcome email and the one reminder after sign-up; and handling feedback you send.
• Consent (ePrivacy Directive Art. 5(3) and Norwegian Electronic Communications Act § 3-15): anonymous usage analytics in the app. The events are anonymous under GDPR Recital 26.
• Consent (GDPR Art. 6(1)(a)): pseudonymous usage analytics in older app versions until the app is updated, analytics on the website, personalised daily dinner suggestions and push notifications.
• Consent (Art. 6(1)(a)): the email newsletter. The newsletter is for app users. You sign up in the app by ticking the box when you create your account or by saying yes when the app asks, and we store your answer and the time. The newsletter is sent through Resend to the email address on your account, in the language you use in the app. You withdraw consent with the unsubscribe link in every newsletter or by emailing hei@matlyst-app.no.
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): the food log and calorie goal.

5. Artificial intelligence

Matlyst uses AI to read, categorise and translate recipes, to answer questions in Ask Matlyst and to suggest dinners. Content you choose to send to an AI feature (text, images, files, questions) is processed by Anthropic Ireland, Limited. This only happens once you have confirmed the AI notice and allowed AI sharing. Without that permission, nothing is sent to AI, including from older accounts and from background jobs.

• Whenever you use Ask Matlyst, you are talking to an AI, not a person. AI-generated content is labelled in the app.
• We use Anthropic through a paid API. It uses your content only to answer you, may keep it for a limited period to detect abuse, and does not use it to train AI models.
• Please don’t send private information the recipe doesn’t need.
• Before you allow AI sharing, you confirm the minimum age for your country (see section 13). You can use the rest of the app without it.
• AI answers can be wrong. Always check allergens, food safety and instructions involving heat or sharp tools yourself. Younger users should ask a responsible adult for help with these.
• Reporting AI content. If you report an answer, a tip or a recipe made with AI, we store the text as it appeared on screen, the recipe ID if it is a saved recipe, the reason you chose, any comment, your account and the time. We use the report to review the content and fix mistakes, based on our legitimate interest in keeping AI content safe (Art. 6(1)(f)). Reports are deleted after 12 months, and when you delete your account. The alert we receive about a new report contains only the part of the app it came from and the reason, not the text or who you are.

6. Who we share data with

We never sell your data. We use these providers:

• Supabase: database, sign-in and file storage, temporary storage of anonymous app analytics and operational logs (EU/EEA).
• Anthropic Ireland, Limited: AI processing (Ireland and USA).
• Apple: Sign in with Apple, the App Store, purchases and iOS notifications (USA).
• Google: Sign in with Google, Google Play, purchases, Android notifications (Firebase Cloud Messaging), YouTube import lookups and website analytics with your consent (USA).
• RevenueCat: subscription management (USA).
• Expo: delivery of push notifications and app updates (USA).
• Resend: the emails we send from the app, such as sign-in and welcome emails and the newsletter (USA).
• Sentry: crash reports (EU, Frankfurt).
• PostHog: shuffled, anonymous events from the app, and separate website analytics with your consent (EU).
• Meta: Instagram posts you import, fetched from your phone and from our server, and the Instagram home page when the app starts (USA).
• GitHub: the status file the app checks for outages (GitHub Pages, USA).
• Have I Been Pwned (Pwned Passwords): password breach check, using only the start of a hash.

7. International transfers

• No transfer: Supabase, PostHog and Sentry (EU).
• United States, Standard Contractual Clauses (Art. 46): Anthropic.
• United States, EU-US Data Privacy Framework, with Standard Contractual Clauses where it does not apply: Apple, Google, Meta, RevenueCat, Resend, Expo and GitHub.

8. Storage on your device

To work offline, the app keeps a local copy of your recipes, ingredients and recipe photos, as well as your sign-in session and settings. Everything stays in the app’s protected storage and is deleted when you sign out. The ID-free analytics queue is used only after you consent and is cleared if you say no or sign out.

9. The website

The website uses essential local storage to remember your language and your consent choice (matlyst-sprak and matlyst-consent). Its PostHog and Google Analytics flow is separate from the app and loads only after you actively consent. You can withdraw that consent with the Change consent link at the bottom of every page. Our fonts are served from our own server, so no third party receives your IP address when a page loads.

10. Opt-out requests from rights holders

If you are a food creator, blogger or photographer, you can ask us to block imports of your content. Email hei@matlyst-app.no with the handle or domain you want blocked.

We store the handle or domain, the time of the request and the email address it came from, but not your IP address. We need the handle or domain for the block to work, and we keep the email address as a record of who asked for it, so we can reply and show why the block exists. Our legal basis is legitimate interest (Art. 6(1)(f)) in being able to honour and document requests from rights holders. If you’d rather we didn’t keep your email address, say so and we’ll keep only the handle or domain and the time.

We keep the record for as long as the block stands. If you ask us to lift it, we delete the whole record, including your email address. A block applies from the moment it is in place and does not remove recipes already imported. If you find content of yours that is already in Matlyst, tell us in the same email and we’ll remove it.

11. How long we keep data

• Account, profile and content: until you delete your account.
• Food log: deleted when you withdraw consent.
• Crash reports: 30 days.
• Push token: until you sign out or delete your account.
• Anonymous app analytics: collected only while your consent stands. If you say no, collection stops and the queue on your phone is cleared. The server row is deleted after forwarding and always within seven days. Events cannot be looked up by person.
• Feedback: while your account exists, or until you ask us to delete it. You can delete your own feedback while it is under review or has been declined.
• Newsletter: until you unsubscribe or delete your account.
• Reports of AI content: 12 months, or until you delete your account.
• Opt-out requests from rights holders: for as long as the opt-out stands.
• While a deletion is still going through at one of our providers, we keep your account ID, and your email address if needed, until it is complete. Nothing else, and no longer than it takes. The legal basis is legal obligation (Art. 6(1)(c)), because GDPR Articles 17 and 19 require us to complete the deletion at our providers.

You delete your account in Settings → Delete account. That removes your account, all your content and photos, and the personal data we sent to RevenueCat. Pseudonymous PostHog data from older app versions is deleted where it can be found using the old account ID. You cancel your subscription yourself with Apple or Google.

12. Your rights

You can ask for access to your data, correction, deletion, a copy of your data (portability) and restriction of processing. You can object to processing based on legitimate interest and withdraw consent at any time. You can download a copy of your data yourself in Settings. For anything else, email hei@matlyst-app.no; we reply within 30 days. You can complain to the Norwegian Data Protection Authority (datatilsynet.no) or to the authority where you live. See the regional additions below.

13. Age and consent

Matlyst has no general age limit. To give your own consent to analytics or AI sharing, you confirm that you have reached the minimum age for the country you live in: 13 in Norway and Sweden, 15 in Denmark and 16 in any other country. Choose the country you live in, whatever language you use in the app. The food log and calorie goal require you to be at least 18, wherever you live. We set that limit ourselves to protect young users. We store the country, the age you confirmed and the time, never your date of birth. We have no parental consent flow. Without the age confirmation, you can still use the rest of the app, but not the feature that needs it.

14. Regional additions

European Economic Area and Switzerland. Everything above applies. The lead supervisory authority is Datatilsynet, the Norwegian Data Protection Authority. You can also complain to the authority where you live. In Switzerland, the Federal Act on Data Protection applies, and you can complain to the Federal Data Protection and Information Commissioner (FDPIC).

Other countries. We apply the same protections everywhere. If local law gives you more rights, you have them. Contact hei@matlyst-app.no.

15. Changes

We may update this policy. For material changes, we update the date and tell you in the app or by email.