Privacy Policy

1. Introduction

Adapt IT (“we”, “us”, or “our”) operates the Prvi zalogajmobile application (the “App”) and the website at https://prvizalogaj.com(the “Site”). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

By downloading or using the App you agree to this Privacy Policy. If you do not agree, do not use the App.

2. Data We Collect

2.1 Data stored locally on your device

The App stores the following data exclusively on your device using the Hive local database. This data is never transmitted to us:

• Language and dietary preferences (vegetarian, vegan, gluten-free, dairy-free, meat preferences)
• Favourite recipes and cooking history
• Meal plan calendar entries
• Active cooking session state (for session persistence across app restarts)
• IAP retry queue (encrypted purchase receipts queued for re-verification on network recovery)

2.2 In-App Purchase receipts

When you make a purchase, the App sends the purchase receipt issued by Apple or Google to our verification backend at api.prvizalogaj.com. We store only:

• The purchase receipt token (a cryptographic identifier issued by Apple or Google)
• The product ID purchased
• The entitlement state (active / expired)
• Timestamps of purchase and last verification

We do not store your name, email address, payment card details, or any personal identifier. The receipt token is an opaque string; we cannot derive personal information from it.

2.3 Device and install identifiers

The App generates two random identifiers. Neither is bought, shared, or linked to your identity, and neither is an advertising identifier.

• Install ID — a random UUID created the first time you open the App and erased when you uninstall it. It ties your purchases to your installation so entitlements survive a reinstall.
• Device ID — on Android the system-provided app-scoped ID, on iOS a random UUID held in the Keychain. It exists so the complimentary first month is counted per device rather than restarting on every reinstall.

2.4 Location — only if you turn it on

The App can sort supermarket branches by how far they are from you. This is off by default. It is switched on from Settings, at which point your device asks your permission, and you can leave it off and pick your city from a list instead — everything else works the same.

When it is on:

• We ask the operating system for an approximate position, not a precise one.
• The coordinates are sent to our backend in the body of a single request, used to calculate distances to shops, and discarded. They are not written to any database, and not recorded in our server logs — the request is deliberately shaped so that the coordinates never appear in a log line.
• On your phone the coordinates are held in memory only for as long as the App is open. The only thing saved is your yes-or-no answer, so we do not have to ask again.
• We never track you in the background, and never build a history of where you have been.

Shop positions themselves come from OpenStreetMap, are calculated once on our servers, and are stored as ordinary business addresses. That data is published under the Open Database License, © OpenStreetMap contributors.

2.5 Camera and photos — only if you use them

The App uses the camera for two separate things, both of which you start deliberately:

• Recipe ideas from a photo (paid feature). If you photograph your fridge or groceries, or pick an existing picture, the image is sent to our backend and forwarded to OpenAI, which reads what food is in it and suggests meals. We do not save the image: it is not written to our database, and our logs record only its size in bytes. What is done with it at OpenAI is governed by their terms, linked in Section 9.
• Scanning a purchase transfer code. The camera reads a QR code shown on another phone. Only the code itself is sent to us; no image or video from the camera leaves your device.
• Plates. If you sign in with Apple or Google and post a photo of a dish you cooked, we store that photo, the rating, an optional note, the display name you confirm, and the email address only when the provider sends one. The photo is stripped of location data before it is saved. Favorites, the week plan, cooking history, and taste (diet and the meats you want or skip) stay with this account too. This account is separate from your store purchases. You can delete it in Settings, which removes the account, the photos, the name, and that kitchen. The same removal happens when Apple tells us the person revoked Sign in with Apple or deleted their Apple Account.

2.6 Microphone and voice control

During a cook you can turn on voice control and say things like “next”. The microphone is active only while you have switched that on for that cook.

The audio is handled by your phone’s own speech recognition — Apple’s on iOS, Google’s on Android — which, depending on your device and language, may process it on their servers under their privacy policies. The App then matches the recognised words against a short list of commands. Neither the audio nor the transcript is ever sent to us, and nothing is recorded or kept.

2.7 Spoken cooking steps

The cooking companion can read each step out loud. It is off by default, and we ask you once, the first time you cook.

The voice is not produced on your phone, and not in the moment. We record every step of every recipe in advance, in each language, and host the resulting audio files ourselves. Turning the reader on downloads those files the way the App downloads a recipe photo, and keeps them for next time. Nothing you say, type, or cook is sent anywhere to make this work — the App only asks our server for a file.

Like any file request, the download appears in the server logs described in Section 2.9, so the log line names the recipe step being fetched. Those logs are deleted after 14 days and are not used to profile anyone.

We use ElevenLabs to make the recordings. That happens on our side, ahead of time, from our own recipe text. No user data is sent to them, and nothing is sent to them while you cook.

2.8 Things you write to us

If you send a recipe suggestion from Settings, we store the text you wrote together with your device ID, so we can read it and avoid counting the same suggestion twice. Please do not include personal details in it.

2.9 Server logs

Like any web service, our backend records a line for each request: the time, the path called, the response status, the browser or app making the call, and your IP address. These logs exist for security and debugging, are not used to profile anyone, and are rotated and deleted after 14 days. As described in Section 2.4, coordinates are kept out of them by design.

3. Analytics and crash reports

Production releases of the App send pseudonymous usage events and crash reports to Firebase Analytics and Firebase Crashlytics. An event can include the screen you opened, a recipe id, a meal slot, the shop you compared, your language, and which plan the install is on (free, the complimentary month, Sous Chef, Chef de Cuisine, or the steak guide on its own). We do not send search text, recipe prompts, text you share in from another app, photos, voice, location, or the words on your shopping list.

Our verification backend at api.prvizalogaj.com may send server error reports, performance traces, and operational logs to Sentry when configured. These contain technical diagnostics only (request path, error type, server environment) — not recipe prompts, text you share in from another app, purchase receipts, names, or email addresses.

Site analytics stay off until you accept the banner. Local and other unconfigured builds of the App send nothing. A production release does, and there is no switch for it inside the App. The legal basis is our legitimate interest in seeing which features are used and what crashes. You can object by emailing us.

4. AI recipe generation

Paid plans can generate a recipe from a description you type, from text you share in from another app, or from a photo as described in Section 2.5. Sharing a reel sends us the link and, when the other app includes it, the caption. It does not send the video. If the share is only a link, you can paste the caption yourself. What you write or paste, the number of servings and your language are sent to our backend and forwarded to OpenAI, which writes the recipe from that text.

The finished recipe is saved on our servers as an unpublished draft, so that a good one can be reviewed and added to the catalogue for everyone. It is stored as recipe content — a title, ingredients and steps — and is not filed against you. Your prompt, and any caption you share or paste, is not stored as a field of its own, and our production logs record only its length, never its text. Please do not put personal details into a recipe prompt or a pasted caption.

5. Advertising

The App does not show ads. We do not use an advertising SDK, we do not read an advertising identifier, and we do not send your recipes, prompts, shopping list, or location to an advertiser.

6. Data We Do Not Collect

• No payment card details or contact lists. A Plates account, which exists when you sign in, stores the display name you confirm, an email address when Apple or Google sends one, and your favorites, week plan, cooking history, and taste. Deleting the account removes them
• No precise or background location, and no history of where you have been
• No recordings of your voice, and no transcripts of what you said
• No photographs from the recipe-idea feature are stored. A photo you post on Plates is kept until you delete the account or we remove the post
• No contacts, messages, calendars, health data, or files
• No sale, rental, or sharing of personal data with data brokers
• No advertising identifiers and no advertising

7. Purpose of Processing

We process the limited data described above for the following purposes:

• Purchase verification: to confirm your entitlement to paid content and prevent fraud (legitimate interest / contract performance).
• Entitlement persistence: to restore your purchases across reinstalls on the same account (contract performance).
• Product quality: when you consent, to understand feature use and diagnose crashes so we can improve the App and Site (consent / legitimate interest where permitted).
• Plates:to show photos and ratings people attach to official recipes, and to review reports (the person's request).

8. Data Retention

• On your device — until you uninstall the App or clear its data.
• Purchase entitlements — for as long as the purchase remains valid, plus 90 days so that a restore still works.
• Complimentary-month record — the device ID and the start and end dates, kept so reinstalling does not restart the month.
• Recipe suggestions you send — until we have read and acted on them.
• Location — not retained at all. It is used to answer one request and dropped.
• Photos sent to the AI feature — not retained by us.
• Plates — the photo, rating, optional note, display name, any email the sign-in provider sends, and the favorites, week plan, cooking history, and taste kept with the account, until you delete the Plates account in Settings or we remove a post. Uninstalling the App does not delete this account.
• Server logs — 14 days, then deleted automatically.

You may request earlier deletion at any time; see Section 12.

9. Third Parties

We share data only with the following parties, and only as described:

• Apple Inc.— to verify iOS purchases via Apple App Store Server API. Apple’s privacy policy: apple.com/privacy
• Google LLC— to verify Android purchases via Google Play Developer API. Google’s privacy policy: policies.google.com/privacy
• EU VPS hosting provider — supplies compute and networking for our self-managed verification backend. The provider does not access application data. Contact us at info@adapt-it.agency for the current provider name and privacy policy.
• Google Firebase / Google Analytics— product analytics and crash reports from production releases of the App, and site analytics after you accept the banner. Google's privacy policy: policies.google.com/privacy.
• Functional Software, Inc. (Sentry)— provides server-side error monitoring, performance tracing, and operational logs for our verification backend when configured. Sentry's privacy policy: sentry.io/privacy.
• OpenAI, L.L.C.— writes recipes from the description you type or the text you share in from another app, and reads the food in a photo you choose to send, as described in Sections 2.5 and 4. OpenAI's privacy policy: openai.com/policies/privacy-policy.
• Apple and Google speech recognition— your phone's own voice recognition may process spoken commands on their servers, as described in Section 2.6. This happens between your device and the platform; we neither receive nor store any of it.
• ElevenLabs, Inc.— records the spoken cooking steps described in Section 2.7. We send them our own recipe text, ahead of time, to produce audio files we then host. No user data reaches them, and your device never contacts them. ElevenLabs' privacy policy: elevenlabs.io/privacy-policy.
• OpenStreetMap Foundation — supplies the positions of shop branches, looked up once by us from published addresses. No user data is sent to them, and your own location is never shared with them. Store positions are © OpenStreetMap contributors, available under the Open Database License.

We do not sell, rent, or share personal data with advertisers or data brokers.

10. Children's Privacy

The App is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Security

Our backend is deployed with TLS encryption in transit and uses parameterised queries against a PostgreSQL database. Purchase receipts are stored as received from Apple and Google and are not further transmitted. We apply rate limiting and bearer-token authentication on all verification endpoints.

12. Your GDPR Rights

If you are located in the European Economic Area, you have the following rights regarding personal data we hold about you (i.e., IAP entitlement records):

• Access — request a copy of the data we hold about your purchase receipts.
• Erasure — request deletion of your entitlement record. This will invalidate any active entitlements tied to that record.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Complaint — lodge a complaint with your local supervisory authority (in Croatia: AZOP — azop.hr).

To exercise any of these rights, email us at info@adapt-it.agencywith the subject line “GDPR Request”. We will respond within 30 days.

13. Google Play — Data Safety Declaration

This section mirrors what we declare on the Google Play Data Safety form. Everything is encrypted in transit, none of it is sold, and you can ask us to delete it.

• Purchase history — collected, required for the app to work. Receipt tokens, used to confirm what you have bought.
• Device or other IDs — collected, required for the app to work. The install and device identifiers in Section 2.3, used for entitlements and the complimentary first month.
• Approximate location — accessed but not collected. Used in the moment to work out which shops are nearest and then discarded; it is not stored on our servers or logged. Optional, and off unless you turn it on.
• Photos — accessed but not collected. Sent to our server and on to OpenAI only when you use the photo feature, to identify ingredients; not stored by us. Optional.
• Audio — not collected. Voice commands are recognised by the operating system; neither audio nor transcript reaches us.
• Other user-generated content — collected when you send a recipe suggestion, a recipe prompt, or text shared in from another app. Optional. The shared text itself is not stored; the finished recipe may be kept as an unpublished draft, as described in Section 4.
• App activity and crash logs — collected from production releases, as described in Section 3. There is no in-app switch. Debug builds do not send them.
• Not collected at all: name, email address, contacts, messages, calendar, health and fitness, financial details, files, or web browsing history.
• Children: the app is not directed at children.

14. Apple App Store — App Privacy Nutrition Labels

This is what we declare in App Store Connect. Nothing we collect is used to track you across other companies’ apps or websites.

• Data Used to Track You: none. The App does not use an advertising identifier.
• Data Not Linked to You: purchase history (receipt tokens); identifiers (the install and device IDs in Section 2.3); user content (recipe prompts, text shared in from another app, photos sent to the AI feature, recipe suggestions); coarse location, used only to rank nearby shops and not retained; usage data and crash diagnostics from production releases.
• Data Linked to You: the Plates account, when you sign in — name, email when the provider sends one, favorites, week plan, cooking history, and taste.
• Data Not Collected: contact info, health and fitness, financial info, contacts, messages, browsing history, sensitive info, and audio.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date at the top of this page. Continued use of the App after changes constitutes acceptance of the updated policy.

16. Contact Us

For privacy-related questions or requests, contact:
Adapt IT
Bregovita ulica 7, 10292 Harmica, Croatia
Email: info@adapt-it.agency