Privacy Policy
Effective date: [Date] · Last updated: [Date]
This Privacy Policy explains how Ocak ("we", "us", "our") collects, uses, shares, and protects your personal information when you use the Ocak mobile application and website (ocak.io) (collectively, the "Service"). It also explains your rights under applicable privacy laws including the GDPR, CCPA/CPRA, and PIPEDA. By using the Service, you acknowledge that you have read and understood this Privacy Policy.
1. Who We Are
Ocak is operated by Maksym Kharchenko ("Developer", "we", "us"). For the purpose of the GDPR, we are the data controller of your personal information.
- Contact: privacy@ocak.io
- Website: ocak.io
2. Information We Collect
2.1 Information You Provide Directly
- Account information: Your name and email address when you create an account using Google Sign In, Apple Sign In, or email and password.
- Recipe content: Recipes you save, create, import, or generate. This content is yours and is stored to provide the Service.
- Meal plans and grocery lists: Your weekly meal plans and generated grocery lists.
- Dietary preferences: Dietary restrictions and preferences you set (e.g. vegan, gluten-free, halal). Optional, used only to personalise AI generation.
- Communications: Any messages you send us via email or support channels.
- Photos: Recipe photos you upload, stored in our cloud storage.
2.2 Information Collected Automatically
- Usage data: Pages and features you visit, buttons you tap, time spent in the app.
- Device information: Device type, operating system version, unique device identifiers.
- Crash reports: Automatically collected error and crash data to help us fix bugs.
- IP address: Collected when you use the Service, used for security and fraud prevention.
2.3 Information from Third Parties
- Google Sign In: Your name, email address, and Google profile photo from Google LLC.
- Apple Sign In: Your name and email address (or private relay email) from Apple Inc.
- Payment information: Subscription status and subscriber identifier from Paddle. We never see or store your payment card details.
3. How We Use Artificial Intelligence
Ocak uses the Anthropic Claude API to generate recipes. When you request an AI-generated recipe, we send your text prompt and dietary preferences to Anthropic's servers.
- Recipes shown as "AI Generated" are created by an AI language model, not a human chef. Review them before cooking, particularly regarding food safety and allergens.
- Your prompts may be processed outside the European Economic Area. Appropriate safeguards apply — see Section 7.
- We do not use your recipe content to train AI models.
- We do not use AI to make automated decisions about you that have significant legal effects.
This disclosure is required by the EU AI Act, GDPR Article 22, and the CCPA/CPRA.
4. How We Use Your Information
| Purpose | Legal basis (GDPR) | Description |
|---|---|---|
| Providing the Service | Contract performance | Operating your account, saving recipes, generating meal plans |
| AI recipe generation | Contract performance | Sending your prompts to Anthropic Claude API |
| Personalisation | Legitimate interest / Consent | Using dietary preferences to tailor AI suggestions |
| Analytics | Legitimate interest | Understanding how users use the app to improve it (PostHog) |
| Error monitoring | Legitimate interest | Detecting and fixing crashes and bugs (Sentry) |
| Security | Legitimate interest | Preventing fraud, protecting user accounts, enforcing rate limits |
| Communications | Consent | Sending transactional emails such as welcome messages |
| Legal compliance | Legal obligation | Complying with applicable laws and regulations |
We do not use your information for advertising, and we do not sell your personal information to third parties.
6. Your Privacy Rights
6.1 Rights Under GDPR (EU/EEA Users)
- Right of access: Request a copy of the personal information we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete information.
- Right to erasure: Request deletion of your personal information where we no longer have a legal basis to process it.
- Right to restriction: Request that we limit how we use your information while a dispute is resolved.
- Right to data portability: Receive your personal information in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: Where processing is based on consent, withdraw it at any time.
- Right to lodge a complaint: Lodge a complaint with your national data protection authority.
6.2 Rights Under CCPA/CPRA (California Residents)
- Right to know: Know what personal information we collect, use, share, and sell.
- Right to delete: Request deletion of your personal information.
- Right to correct: Request correction of inaccurate personal information.
- Right to opt out of sale: We do not sell or share your personal information for cross-context behavioural advertising. No opt-out is necessary.
- Right to limit use of sensitive personal information: We collect dietary preferences as sensitive personal information. You may request we limit use of this data to providing the core Service only.
- Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
To exercise California rights, contact privacy@ocak.io with subject "California Privacy Request". We will respond within 45 days.
6.3 Rights Under PIPEDA (Canadian Users)
If you are a Canadian resident, you have the right to access your personal information and request corrections. Contact privacy@ocak.io to exercise these rights.
6.4 How to Exercise Your Rights
- Email: privacy@ocak.io
- Response time: 30 days (GDPR) or 45 days (CCPA)
- Verification: We may ask you to verify your identity before processing your request
- You may also delete your account directly in the app: Settings → Delete Account.
7. International Data Transfers
Ocak is operated from Ukraine and uses service providers in the United States and European Union. If you are located in the EEA, your personal information is transferred to countries outside the EEA, including the United States.
We rely on the following safeguards:
- Standard Contractual Clauses (SCCs): Approved by the European Commission and included in our data processing agreements with US-based service providers.
- Adequacy decisions: Where available for the destination country.
You may obtain a copy of the applicable transfer mechanisms by contacting privacy@ocak.io.
8. Data Retention
We retain your personal information for as long as your account is active or as needed to provide the Service.
| Data type | Retention period |
|---|---|
| Account information | Until account deletion + 30 days |
| Recipes, meal plans, grocery lists | Until account deletion + 30 days |
| Usage analytics | 24 months |
| Crash and error logs | 90 days |
| Email correspondence | 3 years |
| Payment transaction records | 7 years (legal requirement) |
After account deletion, anonymised aggregate data (not linked to you) may be retained for analytics purposes.
9. Security
We implement appropriate technical and organisational security measures including:
- Encryption in transit (TLS 1.2+) for all data
- Encryption at rest for database contents
- Row Level Security (RLS) in our database — you can only access your own data
- Limited employee access to personal data on a need-to-know basis
- Regular security monitoring via Sentry
- Secure authentication via Supabase Auth
No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but take commercially reasonable steps to protect your information.
10. Children's Privacy
The Service is not directed to children under the age of 13 (US) or 16 (EU). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us at privacy@ocak.io and we will delete it promptly.
11. Third-Party Links
The Service may allow you to import recipes from third-party websites by pasting a URL. We are not responsible for the privacy practices of those websites. This policy applies only to information collected through our Service.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Sending an email to your registered address
- Displaying a notice in the app when you next open it
The "Last updated" date at the top of this policy indicates when it was last revised. Your continued use of the Service after changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy:
- Email: privacy@ocak.io
- Website: ocak.io
- Response time: Within 30 days
For GDPR-related enquiries, you may also contact your local data protection authority. A list of EU authorities is available at edpb.europa.eu.