Privacy policy

Knift

Who is responsible

Idyia Maritime Projects B.V.
privacy@knift.nl

The short version

Recipes, shopping list and your own prices sit on your device and stay there — no account needed for that. You need an account for three things: the paid part (which includes “Cook for less”), syncing between your own devices, and sharing offers, prices and your own recipes with others.

We store no name, no email address and no profile picture — not even from Google.

What we store if you create an account

Your Google identifier („sub") — a string of digits that only points at you together with Google’s own data — plus when the account was created and when it was last used. Legal basis: contract (Art. 6(1)(b) GDPR).
Signed-in sessions: a hash of the session key (not the key itself), two timestamps and whether it is a sign-in of the app or of the browser. They expire after 90 days and are then deleted. If you sign in in the browser (your own area under /mein), the same applies — as a cookie that expires after 12 hours.
Your entitlement to the paid part: when your trial started and, if we unlock the paid part for you by hand, until when that unlock applies. Whether and until when you are entitled is not stored separately — we work it out from these and from your subscription. With a subscription via Google Play also the proof of purchase (purchase token), product and plan, the subscription state and its expiry — but not your payment details, which only Google sees. So that a purchase is linked to the account that paid for it, the app gives Google Play a purchase reference when you buy: a value we compute from your Google identifier with a secret key, and from which the identifier cannot be worked back. Google keeps it with the purchase and hands it back to us every time we check the purchase; we do not store it but compute it again when needed — which is why it matches again after you delete your account and sign in anew with the same Google account. The payment itself is handled by Google Play; for that Google is a controller in its own right (Google’s privacy policy). Legal basis: contract (Art. 6(1)(b) GDPR).
Deletion codes, if you request one: valid for 30 minutes, deleted afterwards.
After you delete your account: a trial check value, if you started the free trial within the last 12 months or bought your first subscription within the last 12 months. It consists of a string we compute from your Google identifier with a secret key (HMAC-SHA256), which cannot be worked back into the identifier, and the day until which it applies — no identifier, no account, nothing else. The key is kept apart from the database and is not in its backups. If you sign in again with the same Google account before then, we can tell from it that the trial has been used, and it does not start again; your data export then includes the check value. It is deleted 12 months after the trial began and, if you bought a subscription, 12 months after your first purchase — the later of the two days applies. Purpose: the free trial should not come back with every new sign-in with the same Google account. Legal basis: legitimate interest in the trial not being used any number of times by deleting and signing in again (Art. 6(1)(f) GDPR). You can object to this (Art. 21 GDPR, see „Your rights").

What you upload yourself

Your data package, if you use syncing: your own written recipes, your own prices and which of them you deleted (for a deleted price the store, the name and the time, so that it disappears from your second device too; each deletion for 180 days, at most the latest 500), your shops with their addresses, the postcode of your household, your shopping statistics, the running shopping list and the list of dishes you bought. Of the dishes by Knift only an identifier travels — plus title, language, your own rating and your staple ticks; every app has the text itself or fetches it from us without signing in. The server stores the package and hands it back to your second device; it does not analyse it for us. Only when you open your statistics under “My area” does it work them out from it for you — from your shopping statistics and the titles of your dishes.
Of recipes you imported from someone else’s website, only the address travels — plus title, language, your own rating and your staple ticks. The recipe text itself does not leave your device. Your second device fetches it from the source itself; in the browser that fetch runs through the external service api.allorigins.win, which sees the recipe address. In the Android app your device fetches directly.
Contributions to offers, regular prices and ingredient matches, if you contribute something. That includes a coarse area, derived from your postcode (two digits plus country, e.g. „nl-80") — not the full postcode, no address, no coordinates.
Reports, if you report a wrong entry.
Recipes you published, if you release a recipe you wrote yourself for everyone: title, ingredients, method, servings, time, language and the display name you choose at that point (or none). They hang on your account, you can withdraw them at any time, they are included in the data export and go when the account goes. They only become visible to others after the operator releases them; if other users report a recipe, we take it out of the list.
A block on publishing, if we bar you from publishing recipes (sections 6 and 9 of the terms of use) or if two of your recipes were taken off the list after reports from others: since when, and for a block by us the reason we enter at that point. You see both under “My area”, in the app and in your data export. Purpose: keeping foreign, wrong or unsuitable content out of the shared recipe book and telling you why. Legal basis: contract (Art. 6(1)(b) GDPR) and legitimate interest in a reliable recipe book (Art. 6(1)(f) GDPR). Duration: a block by us until we lift it or you delete the account; one after reports as long as the reported recipes hang on your account. Everything else on your account — contributions, syncing, withdrawing — is not affected.

Contributions and reports hang on your account, so that „confirmed by independent accounts" — at least two, more where many contribute — can be checked at all. They go when the account goes.

Usage figures (only with your consent)

If you turn the switch on in the app, we store plain daily totals: which event happened how often, with app version and date. Without a sender — the table has no column for an account, these figures cannot be attributed to anyone, not even by us. No recipes, no products, no prices, no search terms, no times of day. They are deleted after 90 days. Legal basis: consent (Art. 6(1)(a) GDPR); you can withdraw it in the app at any time, and then nothing is counted any more and the local counter is cleared.

Server log

The service itself records which path was called with which result — without a sender: no IP address, no identifier, no browser fingerprint and without the query part of the address. The web server in front of it (nginx) additionally records, per request, the time, the full address including the query part (so also area, search term and chosen filters, for example “no pork”), the result and the size — also without an IP address. Only during technical faults (for example during a restart) and for unencrypted requests via http:// does it also record the IP address, for http also the browser details. All these files are deleted after 14 days. Legal basis: legitimate interest in safe operation and in tracing faults (Art. 6(1)(f) GDPR).

Who else sees the data

Google, because signing in runs through a Google account. Google learns that you sign in to this service. Google’s sign-in message to us contains, besides your identifier, your name, your email address and a link to your profile picture. We read only the identifier from it and store nothing else.
Google Play, if you buy a subscription. The app then gives Google the purchase reference named above — a value computed from your Google identifier, from which the identifier cannot be worked back. We give Google nothing more: no name, no postal address, nothing from your recipes, lists or prices. Google keeps the purchase reference with the purchase and hands it back to us whenever we check the purchase. The payment itself is handled by Google as a controller in its own right.
Google reports security incidents concerning your Google account to us (Cross-Account Protection): if it was hijacked, disabled or deleted, or you revoked all sessions there. We then end your sign-ins to this service — nothing more. Of the report we keep nothing but the number of events in the server log, without any identifier. Legal basis: legitimate interest in protecting your account (Art. 6(1)(f) GDPR).
The provider of the server this service runs on.

Your confirmed contributions to offers, prices and matches are visible to other users in your area — but with no indication of who they came from.

Your rights

Access (Art. 15): You can fetch a complete copy at any time: in the app under Settings → Account → „Request my data" or in the browser under “My area” → “Open data access”. It arrives as a page you can keep or pass on. In the Android app the file sits in the app’s private cache for this; it is removed the next time you share, the next time the app starts or after you delete your account, once it is older than 10 minutes — until then the app you hand it to may still need it — and straight away on “Reset everything”. The path /v1/auskunft delivers the same thing with your sign-in. On request we send it within 30 days.
Erasure (Art. 17): In the app under Settings → Account; without the app in the browser under “My area” → “Delete account” (sign in with Google, no code) or via the page /loeschen using a deletion code.
Rectification, restriction, portability (Art. 16, 18, 20) — write to us at the address above.
Objection (Art. 21) to the trial check value: write to us at the address above. Because we can only find the check value through your Google identifier, sign in with the same Google account under /mein and send us the identifier shown there. This creates a new, empty account; delete it right there under “My area” → “Delete account”, or ask us to delete it again — we then delete it by hand. Because it has neither a trial nor a purchase, no new check value remains from it. We then remove the check value.
Withdrawing consent to the usage figures: in the app under Settings → Account, while you are signed in, without giving reasons. Without signing in no figures are sent anyway — the switch needs an account.
Complaint to the data protection authority of your country of residence (in the Netherlands: the Autoriteit Persoonsgegevens).

How long things stay

Account, data package and contributions: until you delete the account.
Sessions: 90 days, in the browser 12 hours. Deletion codes: 30 minutes.
Usage figures: 90 days. Server log: 14 days.
Trial check value after an account is deleted: 12 months from the start of the trial and from the first purchase — the later day applies.
Backups: The database is backed up regularly; at most 14 copies are kept — the latest of each day, plus the state from before the last conversion of the database. A deleted detail may therefore sit in a backup for about two weeks, until it is overwritten in turn. Nothing is analysed from the backups; they exist only for recovery.

Changes

If what we store changes, this page changes with it. It belongs to the program and ships together with it.

Home · Terms of use · Delete account