FlavorMap · last updated 15 August 2026
FlavorMap is a world-cuisine recipe app for iPhone. This page describes exactly what the app stores, what leaves your device, and what it does not do. It is written to be checked against the app, not to be skimmed.
The controller for the processing described here is the developer of FlavorMap. For any question about your data, or to exercise any of the rights in section 7, write to ecomcg90@gmail.com.
FlavorMap contains no advertising, no advertising identifiers, no analytics or tracking SDKs, and no third-party trackers. Nothing is sold or shared with data brokers. There is no profile built about you for marketing.
The full recipe catalogue ships inside the app and works offline. Your saved recipes, cooked-country stamps, week plan, shopping list, diet preferences and the ingredients you last typed are stored on the device. If you never sign in, this data never leaves your iPhone.
Signing in uses Sign in with Apple. Apple gives the app a stable identifier for you; we do not ask for, and do not receive, your name or email address unless you choose to share them with Apple's Private Relay. That identifier is stored so your purchase and your free trial follow you across reinstalls and devices.
Saved recipes, passport stamps, week plans and diet preferences are stored in our database so they survive a lost phone. The database is Supabase (PostgreSQL), hosted in the eu-west-2 (London) region.
When you ask FlavorMap to invent a recipe, the ingredients you typed, your language, your portion size and your diet preferences (for example vegetarian or halal-friendly) are sent to our server, and from there to the model provider OpenRouter, which routes the request to a language model. The result is cached so the same request does not have to be generated twice.
Allergies are treated separately. An allergy says something about your health, which European law (GDPR Article 9) protects more strictly than an ordinary preference. Your allergy list is therefore not sent to the model provider unless you explicitly turn that on. Without that consent the list stays on our side, and the app shows the warning it always shows: check the ingredients yourself before you cook.
To make sure the seven-day free trial is given once and not once per reinstall, we store a one-way hash of your Apple identifier together with the date your trial started. The hash cannot be turned back into your Apple ID. These rows are deleted after 12 months.
The app counts how many AI recipes you generated per day, to enforce the daily limit. These counters contain no recipe content. They are deleted after 90 days.
| Purpose | Basis (GDPR Art. 6) |
|---|---|
| Account, saved library, sync | Performance of the contract (6(1)(b)) |
| Free trial, purchase, abuse limits | Performance of the contract and legitimate interest (6(1)(b), 6(1)(f)) |
| Sending allergies to the model provider | Explicit consent (9(2)(a)) — off unless you turn it on |
| Party | Role | Where |
|---|---|---|
| Apple | Sign in with Apple, App Store purchases | Per Apple's own privacy policy |
| Supabase | Database and server functions | eu-west-2 (London) |
| OpenRouter | Routes AI recipe requests to a language model | United States |
Requests to OpenRouter leave the European Economic Area. They carry your ingredients and diet preferences, and — only with your explicit consent — your allergies. They do not carry your name, email address or Apple identifier.
| Data | Kept |
|---|---|
| Account and library | Until you delete your account |
| Cached AI recipes | Until the cache entry expires |
| Daily usage counters | 90 days |
| Trial ledger (hashed) | 12 months |
You have the right to access, correct, export, restrict and erase your data, and to withdraw consent at any time.
Deleting your account is built into the app: Settings → Delete account. That removes your account, your saved library, your passport, your week plans, your diet preferences and your usage counters. Two things are deliberately kept, and neither of them identifies you afterwards:
For anything else, write to ecomcg90@gmail.com. You also have the right to lodge a complaint with your national data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
FlavorMap is not directed at children under 13 and does not knowingly collect data from them.
If this policy changes in a way that affects you, the new version appears here with a new date, and the app points to this same address.