Privacy Policy
Last updated: 23 September 2026
This policy explains how the CookBooker mobile app and the cookbooker.mesmoustaches.dev website collect, use, share, retain and delete your personal data. It applies to every version of the app, on iOS, iPadOS, Android and watchOS.
1. Who is the data controller
CookBooker is published by Mes Moustaches Dev, a French simplified joint-stock company (SASU), represented by Thibault François.
For any question about your data: contact@mesmoustaches.dev
2. What CookBooker does
CookBooker is a digital cookbook. You give it the address of a recipe published on a cooking website or blog, the app automatically extracts the title, the ingredients, the steps and the photo, then saves the result in your personal collection. Your recipes sync across your devices, can be shared with the members of your Brigades, and stay available offline. An optional premium subscription unlocks extra features, including weekly meal plan generation.
3. Data we collect
3.1 Account data
An account is required to sync and share your recipes. Depending on the sign-in method you choose, we receive:
| Sign-in method | Data received |
|---|---|
| Primary email address, display name, profile picture, Google account identifier | |
| Apple | Email address (real or Apple private relay address, your choice), name if you provide it |
| Email address, display name, profile picture | |
| Email and password | Email address, password stored as a hash, never in clear text |
3.2 Content you create
- The recipes you import or write, along with the address of the source page
- Your categories, favourites, notes, quantity adjustments and shopping lists
- The Brigades you create or join, and the recipes you share in them
- The weekly meal plans generated for you, if you use that feature
3.3 Technical and usage data
- Device model, operating system, app version, language and country
- Crash reports and performance diagnostics
- Aggregated usage events (app opens, successful or failed imports, screens viewed)
- Device advertising identifier, for users of the free version
3.4 Subscription data
We receive your subscription status (active, trialling, expired) and the transaction identifier provided by the App Store or the Google Play Store. We never receive or store any payment card details: payments are handled exclusively by Apple and Google.
4. Use of data obtained through Google APIs
CookBooker requests only the userinfo.email and userinfo.profile
Google scopes. That data is used solely to create your account, authenticate you on
subsequent sign-ins, display your name and picture inside the app, and identify you to the
other members of your Brigades.
CookBooker does not read, modify, store or delete any other data in your Google account: no Gmail, no Drive, no Calendar, no Contacts, no Photos.
CookBooker's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. That data is never sold, never shared with data brokers, never used for advertising targeting, and never used to train general-purpose AI models.
5. Why we process this data
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account, sync your recipes across your devices | Performance of the contract |
| Automatically extract recipe content from a web address | Performance of the contract |
| Share your recipes with the members of the Brigades you join | Performance of the contract |
| Generate weekly meal plans for premium subscribers | Performance of the contract |
| Manage subscriptions, trials and refunds | Performance of the contract |
| Fix crashes, measure aggregated usage and improve the app | Legitimate interest |
| Show personalised ads in the free version | Consent, collected on first launch and revocable at any time |
| Answer your requests and meet our legal obligations | Legitimate interest and legal obligation |
6. Recipe extraction and artificial intelligence
When you import a recipe, the address you provide and the public content of that page are sent to the Google Gemini API, which extracts its structure. When you request a weekly meal plan, the titles of your saved recipes and your previous plans are sent to the same API to produce a suggestion.
These requests contain neither your email address, nor your name, nor your account identifier. Google processes them as a data processor under its paid developer offering and does not use them to train its models.
Extraction is automated and can be wrong. Always check quantities, temperatures, cooking times and allergens against the original recipe before you cook.
7. Recipients and processors
| Service | Role |
|---|---|
| DigitalOcean | Hosting of our application server and of the database holding your accounts and recipes |
| Google (Gemini API) | Automated recipe extraction and meal plan generation |
| Google Firebase (Analytics, Crashlytics) | Aggregated audience measurement and crash reporting |
| Google AdMob | Ad delivery in the free version |
| RevenueCat | Subscription and premium entitlement management |
| Apple, Google | App distribution and payment processing |
We do not sell your personal data and do not pass it to any data broker or advertiser outside the scope described above.
8. Transfers outside the European Union
Some of our processors are established in the United States. Those transfers rely on the European Commission's standard contractual clauses and, where applicable, on those providers' certification under the EU-US Data Privacy Framework.
9. Retention
- Account and recipes: kept for as long as your account exists
- Inactive account: deleted after 24 months without a single sign-in, following a warning email
- Deletion you request: effective immediately, with no backup copy kept beyond 30 days
- Crash reports and aggregated statistics: 14 months maximum
- Purchase records: kept for as long as our accounting and tax obligations require
10. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent at any time.
You can delete your entire account and all your data directly from the app: open your profile, then "Delete my data". The detailed steps are on the Delete my data page.
For any other request, write to contact@mesmoustaches.dev. We answer within 30 days. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
11. Security
Traffic between the app and our servers is encrypted in transit (HTTPS/TLS). Passwords are never stored in clear text. Database access is restricted and authenticated. No system is perfect, so please use a unique password and report anything unusual to us.
12. Children
CookBooker is not intended for children under 13 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
13. Changes to this policy
We may update this policy. The last updated date is shown at the top of this page. If a change is significant, you will be notified in the app before it takes effect.
14. Contact
Mes Moustaches Dev — contact@mesmoustaches.dev