Privacy policy

Who processes the data

The Cheflex app is run by me, Martin Papoušek, sole trader, registered office Bezručova 4201, 430 03 Chomutov, Czechia, Business ID (IČO) 05006864. For anything to do with data protection, write to cheflex@email.cz.

I can’t see the data you keep in the app on your phone, and I’m not its controller — it’s under your control alone. I’m the controller only of what you send me by email or through Feedback, of the purchase verification, of the encrypted bundles on the phone-pairing server and of the website’s operating data.

What the app stores on your phone

The app works with the details you enter and keeps them solely in your device’s memory: how many people are in the household and their names or nicknames; for each of them, age, sex, height, weight, activity level and chosen goal; allergies, diets and foods you don’t eat; the marks you give ingredients and cuisines in the taste questionnaire; generated meal plans, shopping lists and ticked-off items; ratings of meals you’ve cooked and your own notes on recipes; the app’s last five technical errors (the error message and where in the code it happened — for Feedback, nothing from your details).

Some of that is health data within the meaning of Article 9 GDPR — typically weight and allergies. That’s exactly why it stays on your phone and is never sent anywhere. The one exception is pairing with a Teammate, which you switch on yourself: a member’s body details and allergies travel, encrypted, only to that member’s own phone (see “Pairing two phones”).

A Teammate’s phone holds a copy of what the main phone sends it: the meals that have been put together, the shopping list, the household members’ names, animals, portion sizes and thumbs, the household’s notes on those meals, and the body details and allergies of its own member only. Once the pairing ends, the app offers the Teammate a new invite code or a household of their own; either one deletes the copy and keeps only their own member’s thumbs (with a household of their own, their details too). Until they choose, the copy stays on the phone; uninstalling the app deletes it as well.

A mirror — a second device of the person who runs the household — receives the whole household, including every member’s body details and allergies, just as they appear on the main phone.

Everything you enter is kept in the app’s own storage on your phone, not in cookies. Uninstall the app and it all goes. I have no backup and can’t restore it. Mind your phone backups: if you have iCloud or Google Drive backup switched on, a copy of the app’s data may sit in it for a while — that’s your phone’s backup, which I have no access to.

In the Menu you’ll find “Erase all data” — one confirmation and everything the app knows about you and your household is gone.

Where the data goes

Data about you and your household goes nowhere. The app has no accounts, uses no advertising or analytics libraries, collects no device identifiers or location, and doesn’t ask for your contacts, photos or camera (an invite’s QR code is read by the phone’s own camera, not by the app). The only things that leave it are the anonymous statistics you switch on yourself, what’s needed to buy the full version in the app from the store, and — if you pair phones with a Teammate — encrypted bundles for the other phone; all of it is described below. The last exception is a message you send me from Feedback.

Anonymous statistics — only if you switch them on

So that Cheflex can get better based on how it’s really used, the app can count how often things happen — say, that the setup was completed, a meal plan was put together, a recipe was opened, the shopping list was used or the app ran into an error (just the count, not what happened). It also counts how often the full-version offer was shown, how often someone tapped to buy and how often a purchase went through — just the numbers, nothing about the purchase itself. Once a day it then sends a summary of those counts for the past days to my server at cheflex.app.

It’s off until you switch it on yourself — on the welcome screen, when I ask once after your first plan is done, or any time under Menu → Anonymous statistics. Until you do, the app counts nothing and stores nothing on your phone for it. If you switch it off, anything still waiting to be sent is deleted too, and the app works exactly the same.

All it adds to the counts is the language, the app version, the device type (Android, iPhone or web, and whether it's a phone, tablet or computer), how many people you cook for in the app (1 to 4), whether you’ve unlocked the full version, whether the app tracks calories or just gives you ideas, and how long you’ve had the statistics switched on (first day, under a week, under a month, longer). The first time you open the app in a new week, in a new month or ever, it counts that as one — so the number of devices running the app can be counted without any ID.

It never sends names, age, weight, goals, allergies, tastes, dish names or what you search for. There’s no device or install ID, and the summaries carry no date or time. The storage that holds the counts automatically records the time each summary arrives; I use that time only to count summaries per day, and it’s deleted after 90 days. The request reaches the server through Cloudflare, which processes your IP address briefly to protect against attacks; I don’t store it with the counts. So nobody can tell who sent the data — it isn’t personal data (Recital 26 GDPR), which is also why it can’t be handed over or deleted on request.

I may keep and use the aggregate numbers without limit — to develop the app, and as part of Cheflex should someone else ever take it over.

Buying the full version

To tell whether the full version has been paid for, the app verifies the purchase with the App Store or Google Play through RevenueCat (RevenueCat, Inc., USA), which handles purchases for me as a processor. RevenueCat receives a random purchase ID that the app generates, the store’s confirmation of the purchase and the technical details needed to verify it (device type, operating system version, IP address). It doesn’t get your name, your email or anything you keep in the app. The purchase record is kept for as long as the app exists. It’s what restores the full version on another phone, so it can’t be deleted sooner – the restore would go with it.

This is processed to carry out the purchase you’re making (Article 6(1)(b) GDPR). From the same data, RevenueCat shows me aggregated purchase reports (how many and in which country) so I can tell whether the app covers its costs — that’s my legitimate interest (Article 6(1)(f) GDPR). The transfer to the USA is protected by the EU Standard Contractual Clauses, which form part of the contract with the processor.

Pairing two phones (Captain and Teammates)

When you pair the main phone with a Teammate’s phone, the two send each other bundles of data through the pairing server (cheflex.app, running on Cloudflare): the main phone sends the state of the household, and the Teammate sends back the ticked-off shopping, thumbs and changes to their own body details. Each bundle is encrypted on the phone itself (AES-256-GCM) with a key derived from the invite, which the server never gets. So neither I nor Cloudflare can see what’s inside — names, meals, numbers, thumbs.

To the mirror (the Captain’s second device) the main phone sends the whole household. When the mirror takes the captain’s armband, it also receives the connection keys, encrypted, so it can go on running the household.

What the server does see: random identifiers for the mailbox and the phone (they give nothing away about whose they are), a hash of the mailbox password, the kind of message (such as a phone joining or leaving) and who it’s for, the size and time of each bundle, and the IP address the phone connected from — which Cloudflare keeps briefly in its operating logs, as it does for the website. I don’t record the contents of the bundles anywhere. All I count is how many pairings and messages there were each day, with no identifier of any kind. To prevent abuse, the server also counts new mailboxes and invites by a salted hash of the IP address — kept only in the server’s memory, never written anywhere, and gone by the next day at the latest.

How long: an invite for 10 minutes or until it’s used, bundles for 30 days at most, a mailbox with no activity for 180 days. “Erase all data” on the main phone deletes the mailbox straight away if the phone is online at the time. When a phone is unpaired, the old mailbox disappears as soon as the other paired phones check in. Otherwise the server clears it out by itself within those periods.

Even though I can’t read the bundles, I treat them as personal data. I process them only so that I can provide the pairing you’ve switched on (Article 6(1)(b) GDPR), and the technical details to keep the service running securely (Article 6(1)(f) GDPR). For body details and allergies, the basis is your explicit consent (Article 9(2)(a) GDPR), which you give expressly on the Teammate’s phone when connecting — the app says right by the button what will be sent; you withdraw it by ending the pairing.

The server is run for me by Cloudflare, Inc. as a processor. The transfer to the USA relies on the EU–US Data Privacy Framework, as it does for the website.

When you write to me

You send a Feedback message from your own email — the app just opens your mail app with the text filled in, and nothing goes until you send it yourself. Only I receive it. I then process the content of your message and your email address, because I need it to reply (legitimate interest, Article 6(1)(f) GDPR). The cheflex@email.cz mailbox is provided by Seznam.cz, a.s., and the messages sit on its servers in the EU.

Every message carries a technical header: the app and data versions, language, theme, device and browser type, the time and the app’s latest technical errors, if there were any (the error message and where in the code it happened, nothing from your details). Without it a bug can’t be reproduced, so it always goes along.

If you tick “Attach household settings”, a summary without names is added: how many of you there are; for each adult, their goal, weight, activity and excluded ingredients; for children, only the portion size; plus the app mode, tastes, meals, plan length and shopping day. That’s health data, so it’s sent only with your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the box. By ticking it you confirm that you’re at least 16 and that the others in your household know about it and agree — letting them know is up to you. I’m just as happy to help without the attachment.

I delete the message once the matter is resolved, and within two years at the latest.

Your rights, and how to ask for deletion

Under the GDPR you have the right of access to your data and the rights to rectification, erasure, restriction of processing, data portability and to object. For what you keep in the app, you exercise them directly on your phone — no copy exists with me, so I can’t hand it over or delete it on your behalf. You can object at any time to the processing I base on legitimate interest — your email to me and the website’s operating data; just write.

For messages you’ve sent me, write to cheflex@email.cz from the same address the message came from — a line like “please delete my message of (date)” is enough. That also withdraws your consent to the attachment. Within a month I’ll delete the message from the mailbox, together with my replies, and let you know. If you write from a different address, I’ll check with the original one first. In the same way you can ask what I hold about you, or have something corrected.

If we can’t sort it out, you can complain to the Czech Office for Personal Data Protection (uoou.gov.cz) or to a supervisory authority in your own country — typically where you live or work (Article 77 GDPR).

Website

The cheflex.app website runs on the Cloudflare network. On every visit, Cloudflare processes the technical details without which it couldn’t deliver the page or defend it against attacks — mainly your IP address, browser type and the time of the request — and keeps them briefly in its operating logs. Cloudflare is a US company; the transfer of data to the USA relies on the EU–US Data Privacy Framework. This happens on the basis of my legitimate interest in running the website securely (Article 6(1)(f) GDPR).

The website’s pages use no cookies and no visitor tracking. The only things stored in your browser (localStorage) are the website language and its look (dark or light kit), and only if you switch them by hand. They aren’t sent anywhere, and you delete them by clearing the site’s data in your browser settings.

The app demo on the home page asks for your weight, sex, goal and activity level to show what the app works out. All of that is calculated by your browser alone: the demo stores nothing, sends nothing and keeps no statistics. Reload or close the page and everything you entered is gone.

The cheflex.app/p page that an invite link opens doesn’t send the code in the link to the server — the browser keeps everything after the # sign to itself. The page stores nothing and measures nothing.

What the app stores hold about you

The download, and any purchase, goes through Apple (App Store) or Google (Google Play). They process data about the download, the payment and any crash of the app under their own policies, which I have no say over and no access to in any form that would identify you. You’ll find their policies with them.

How long things are kept

On your phone: shopping and cooked meals for three months back, then they’re deleted. The rating history for a year. The last thumb on a recipe stays until you change it — it’s what tells the app that the meal didn’t make the cut, and that should keep applying. If you choose “Clear history and ratings” in the Menu, all ratings go and switched-off recipes come back on. Everything else stays until you delete it or uninstall the app.

With me: email messages for two years at most; the purchase record at RevenueCat for as long as the app exists (otherwise it couldn’t be restored); encrypted phone-pairing bundles for 30 days at most, and an unused mailbox for 180 days.

Children

The app isn’t meant for children under 16 to use on their own. A child can be a member of the household — their details are then entered by a parent or other legal guardian, and the same applies to them: they stay on your phone.

Changes to this policy

If the app changes in a way that changes how data is processed, I’ll update this policy and the date at the top, and announce it at least a month in advance on cheflex.app and in the app’s update notes. A substantial change — if the app ever started sending another kind of data off the phone, say — I’ll also announce in an app update, not just by quietly editing the page.