Privacy policy

Kladde only keeps what it needs to turn your handwritten recipes into a digital cookbook. There is no advertising, no tracking across websites and no selling of data.

1. Controller

This policy follows the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, it applies as well.

2. What data we process

• Account: name, email address, password (stored only as a hash), language, appearance, whether you want tips by email, and the date you last used Kladde.
• Kitchen: the kitchen’s name, its members and their roles, and the email addresses of people invited to it.
• Recipes and photos: the photos of your recipe pages (originals are always kept), the recipes made from them, categories, notes, dish photos (your own or created by AI), translations, allergen and nutrition estimates, and your cookbooks (selection, order, cover, foreword) with their PDFs.
• Shared recipes: if you share a recipe, a random link that shows it (and, if you choose, its handwritten original and a PDF) to anyone who has the link, and a preview image with its title, the kitchen’s name and the dish photo. If someone saves a copy in their own Kladde, we note which shared recipe it came from, so it is saved only once.
• Public kitchen profile: only if an owner switches it on: the kitchen’s name, the address chosen for it (kladde.ch/@…), an optional short text, and the shared recipes the kitchen picks for it, with their title, category and dish photo. Members’ names and email addresses and all other recipes are never shown there.
• AI usage: for each AI request the time, the model used, the number of tokens, the cost and any error message. For each reading we keep what the AI read and how much you corrected in the review.
• Credits and payments: plan, credit balance and credit history: for each action the credits charged, which kind of credits they came from (Pro credits of the year or your other credits) and whether your own AI key was used; for each purchase the amount, currency and date, for 14 days the right of withdrawal. Link (Stripe) sells and charges them; Kladde never sees card details, only a customer ID, the subscription status and the amounts. Purchases in the app are sold by Apple (iPhone, iPad) or Google Play (Android); through RevenueCat we receive the product, price, currency, tax, date and transaction number, linked to your kitchen’s number in Kladde, never your Apple ID or payment details.
• Early access: if you sign up on kladde.ch, your email address and language.
• App: the Kladde app for iPhone, iPad and Android shows app.kladde.ch and tells Kladde that it is the app and which version it is. If you turn on notifications, we store a token from Firebase Cloud Messaging for your phone so we can send them to it.
• Sign in with Google: if you sign in with Google, Google gives us a user ID for Kladde, your email address and your name. We keep the ID with your account. On the website you sign in on Google’s own page and no Google script runs on our pages; in the app, your phone’s Google sign-in is used.
• Document scanner on Android: in the Android app, Google’s ML Kit document scanner finds and straightens the page on your phone, through Google Play services. The photos are not sent to Google for this; only the pages you keep are uploaded to Kladde.
• Sign in with Apple: if you sign in with Apple, Apple gives us a user ID for Kladde, your email address (or a private relay address from Apple that forwards to you) and, the first time only, your name. We keep the ID and a token from Apple with your account; when you delete your account we end the link at Apple as well.
• Technical data: the host’s server logs record IP address, time and the address requested. When your browser opens a photo or PDF, Cloudflare receives the device’s IP address and browser details.
• Visitor statistics: on the public pages of kladde.ch (not in the app, not on shared recipes and not on kitchen profiles), our own Matomo installation records which pages are opened, the page you came from, the approximate region, browser and device type and language. Your IP address is shortened by two bytes before it is stored. It sets no cookie and stores nothing on your device, and if your browser sends “Do Not Track”, nothing is recorded.

3. Why, and on what legal basis

• Providing Kladde (account, cookbook, reading, translating and analysing recipes, dish images, sharing, PDFs, team invitations, credits and plans): to fulfil our contract with you (GDPR Art. 6(1)(b)).
• Service emails such as invitations, confirmation and password links, credit notices, renewal reminders and warnings before an unused account is deleted: part of the contract. We keep a copy of every email we send you (recipient, type, language, subject, content without confirmation and password links, who caused it) to answer questions about it and to find errors (legitimate interest, Art. 6(1)(f)).
• Tips by email: in your first weeks up to three emails with tips for getting started, based on our legitimate interest (Art. 6(1)(f)). Occasionally we may also send news about Kladde’s own features and offers, on the same basis. We tell you about this when you sign up; you can switch both off with the link in each email or in the app’s settings.
• Quality and security: to fix problems and improve how well handwriting is read, the operator can see which pages were read by which AI model, what it cost and how much you corrected. To choose the best models, the operator can have pages you have already reviewed read again by other AI models from section 4 and compare the result with your saved recipe. This costs you no credits, stays with the operator and is not published (legitimate interest, Art. 6(1)(f)).
• Access by the operator: the operator can open a kitchen’s recipes, original pages and photos only when this is needed for support you asked for, to fix reading errors, against misuse or illegal content, or because the law requires it. For the same reasons the operator can view the app as you see it, read-only and for at most 30 minutes at a time, without being able to change, upload or buy anything. Every opening and every such view is logged with the reason (legitimate interest, Art. 6(1)(f); legal duty, Art. 6(1)(c)).
• Bookkeeping: keeping payment records as required by law (Art. 6(1)(c)).
• Visitor statistics: to see how kladde.ch is found and used and whether it works (legitimate interest, Art. 6(1)(f)).
• Notifications: only if you turn them on in the app, to tell you when a recipe has been read, a cookbook is ready or you received credits (contract, Art. 6(1)(b)). You can turn them off in the app’s settings or the iPhone settings at any time.

We don’t use your recipes and photos for anything else and don’t look at them without one of these reasons, and we don’t sell data. Apart from the fixed rules in the terms of use (such as deleting unused free accounts or the limit after repeated withdrawals), we don’t make automated individual decisions about you.

4. Who receives data

• cyon GmbH, Basel (Switzerland): hosting of the website, the database, the mailbox info@kladde.ch and the visitor statistics (Matomo).
• Cloudflare, Inc. (USA), Cloudflare R2: stores the photos, PDFs and database backups in data centres in the EU, as our processor. The files are private: they can only be opened through links from Kladde that expire after a short time. When your browser loads such a file, Cloudflare receives its IP address and browser details.
• AI model providers: Google (Gemini API), OpenAI and Anthropic, all based in the USA. They receive only what a task needs: to read a recipe, the photos of its pages and the names of your categories; to translate it or estimate allergens and nutrition, the recipe’s text; for an AI dish image, the recipe’s title and main ingredients. We only use the paid APIs; under the providers’ terms this data is not used to train their models. If your kitchen uses its own AI key, the terms of your contract with that provider apply.
• Amazon Web Services EMEA SARL, Luxembourg (Amazon SES): sends Kladde’s emails from its data centre in Frankfurt (Germany) and receives your email address and the content of the email, as our processor. AWS keeps delivery data (such as bounces and complaints) to deliver emails reliably. Its parent company Amazon Web Services, Inc. is in the USA.
• Stripe / Link: purchases are sold through Link, a service of Stripe (Stripe Technology Europe, Limited, Ireland, and Stripe Payments Company, USA), acting as reseller. For this, Link processes your name, email, billing address and payment details as an independent controller under its own privacy policy.
• People you share with: anyone who has the link to a shared recipe can see it, save a copy in their own Kladde and, if you allow it, download the PDF; apps that show link previews load its preview image. Shared pages are marked so that search engines don’t list them.
• Visitors of a public profile: anyone can open a kitchen’s public profile and the recipes shown on it. Profiles are marked so that search engines don’t list them, and no visitor statistics are recorded on them. Visitors can report a profile to us by email; we use the report only to check the profile.
• Apple Distribution International Ltd. (Ireland) and Apple Inc. (USA): sell in-app purchases as an independent controller under Apple’s own privacy policy, and deliver notifications to iPhones and iPads (Apple Push Notification service).
• Google Ireland Limited and Google LLC (USA), Firebase Cloud Messaging: forwards notifications to your phone, as our processor. It receives the phone’s token and the notification (title, short text and the page it opens).
• Google Ireland Limited and Google LLC (USA), Google Play and Sign in with Google: Google Play sells in-app purchases in the Android app as an independent controller under Google’s own privacy policy. If you choose “Sign in with Google”, Google confirms your name and email address to us and learns that you sign in to Kladde.
• RevenueCat, Inc. (USA): processes in-app purchases for us, as our processor: your kitchen’s number in Kladde, the purchases and the purchase records of Apple or Google.

Data is therefore processed in Switzerland, the EU (among others Germany, Ireland and Luxembourg) and the USA. For transfers to the USA we rely on the Swiss-U.S. and EU-U.S. Data Privacy Framework or on the providers’ standard contractual clauses.

5. How long

• Account, recipes, photos and what the AI read for them: until you delete them or your account. A deleted recipe is kept hidden for 30 days and then removed for good, with its photos. Free accounts unused for 12 months are deleted after two email reminders.
• Notification tokens: until you turn notifications off, log out on that phone or delete your account, or Firebase reports the token as no longer valid.
• After an account is deleted, a one-way code made from its email address (not the address itself) is kept for 12 months, only so that welcome credits aren’t given twice to the same address.
• Accounts whose email address was never confirmed: 7 days after sign-up.
• Shared links: until you turn sharing off; a new link is created each time you turn it on again.
• Public profile: until an owner switches it off, the recipe is taken off the profile or no longer shared, or the kitchen is deleted; it then disappears at once. An address that is given up stays reserved for 90 days (only the address and the kitchen it belonged to) so nobody else can take it over, then it is deleted.
• Cookbooks and their PDFs: until you update or delete the cookbook, or delete your account. PDFs of single recipes are stored so they open faster, until the recipe changes or is deleted.
• The AI’s raw answer: 90 days after the review. Individual AI usage records: 13 months, then only as a monthly total without personal data.
• Invitations: the link is valid for 14 days; the invitation is deleted 14 days after that. Copies of sent emails: 12 months. Payment records: 10 years, as required by law; after an account is deleted they are kept without the link to it (amount, currency, date and Stripe reference).
• Early access: until we invite you, at most 12 months. The log of the operator’s access (section 3): 2 years. Failed background tasks (which may contain a recipe’s ID): 30 days.
• Database backups: up to 14 days.
• Visitor statistics: individual page views 180 days, after that only as totals without personal data.

6. Cookies and browser storage

Kladde only sets technically necessary cookies (sign-in, protection against forged requests, language). So the app works offline, your browser keeps recently opened recipes and photos that haven’t been uploaded yet on your device. There are no analytics or advertising cookies; the visitor statistics in section 2 work without them. The app also remembers on your phone whether you turned notifications off, and keeps a cookie with the phone’s notification token so it can be removed when you log out.

7. Security

All connections are encrypted (HTTPS). Photos are kept in private storage and can only be opened through signed links that expire, or through a shared recipe’s link. AI keys are stored encrypted. New passwords are checked against known data leaks (Have I Been Pwned): only the first five characters of a one-way code made from the password are sent, never the password itself. To recognise attacks, Kladde records forms that were blocked as automated and failed sign-ins to the administration (IP address, time, the email address entered and browser) and keeps them for 90 days. Changes of an account’s email address, and undoing them, are recorded the same way. A new email address only replaces the old one after you confirm it, and the old address can undo the change for 7 days.

8. Your rights

You can ask what data we hold about you, have it corrected or deleted, have its processing restricted, receive it in a common format, and object to its processing, including to the model comparisons in section 3 and to the visitor statistics (switch on “Do Not Track” in your browser, or write to us). You can export your recipes and photos in the app at any time (Settings → Data & privacy) and delete your account there. Write to info@kladde.ch. You can also complain to the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to the data protection authority where you live.

Deleting your Kladde account: in the app or on app.kladde.ch, open Settings → Delete account. This deletes your account, the kitchens you own alone with their recipes, photos and PDFs, and your notification tokens; what we must keep is listed in section 5 (for example payment records for bookkeeping). If you can no longer sign in, write to info@kladde.ch from the address of your account and we delete it for you.

9. Changes

If this policy changes materially, we will tell you in the app or by email.

Last updated: October 9, 2026