Privacy Policy
Verdano. Last updated: 22 September 2026.
1. Who is responsible
The controller responsible for processing your personal data is:
Jakob Znidaric
Stadtplatz 16
3400 Klosterneuburg
Austria
Email: support@verdano.recipes
Verdano is operated by an individual, not a company. Because the controller is established in Austria, this policy and the rights described in it are applied under the EU General Data Protection Regulation (GDPR) to all users of Verdano, wherever they live, and not only to users in the European Union.
2. There is no account
Verdano has no sign up, no login, no password and no user profile. We never ask for your name, email address, phone number, date of birth or postal address. We have no way to identify you as a person.
So that subscriptions and usage limits work, the app generates a random identifier the first time you open it. This is a random UUID created on your device and stored in the iOS Keychain. It is not your device's serial number, advertising identifier or any other hardware identifier, and it is not derived from anything about you. It survives reinstalling the app. Under GDPR this identifier is treated as personal data because it is pseudonymous rather than anonymous, which is why it is described here.
3. What stays on your device
The following are stored only in the app's local storage on your device. They are not transmitted to us, and we cannot read them:
- Your saved recipes, including titles, ingredients, instructions and photos
- Your collections and favourites
- Your shopping list
- Your preferences, including dietary profile and unit settings
- Local counters used to show how much of your free allowance is left
Deleting a recipe in the app deletes it. Deleting the app removes all of it.
4. What is sent to our server, and why
Verdano's server exists to turn something you provide into a structured recipe. When you import or modify a recipe, the following is sent:
- The content you chose to import. A web link, a pasted block of text, a photo of a recipe, or a video link. For a web or video link, our server retrieves the page or video in order to read it.
- The random identifier described above, so we can count usage against your free or subscribed allowance and prevent abuse.
- Standard technical request data, such as your IP address, which is unavoidable when any app contacts any server.
We do not store the recipe content, the photo, the page or the result on our server. It is processed to produce a response and is then gone. The only things our server keeps are described in section 7.
5. Who else processes your data
We use the following providers. Each acts as a processor on our instructions, under a data processing agreement.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| OpenAI, L.L.C. | Reads the content you import and converts it into a structured recipe. Also powers the nutrition estimate and the "healthify" suggestion. | The recipe text, page content or photo you chose to import, and recipe content you ask to be modified. Not your identifier. | United States |
| Fly.io, Inc. | Hosts our server and the short lived counters in section 7. | All requests to our server pass through it, including your IP address and random identifier. | United States |
| Functional Software, Inc. (Sentry) | Reports crashes and errors so we can fix them. | Error details, app version and device model. Our server is configured to strip request bodies and identifying headers before sending, and personally identifying data is disabled. | European Union (Germany) |
| PostHog, Inc. | Product analytics: which features are used and where people get stuck. | Events such as app opened, recipe imported or subscription started, linked to the random identifier. No recipe content. | European Union |
| RevenueCat, Inc. | Manages subscription status and tells the app whether you are subscribed. | The random identifier and your purchase and subscription status. | United States |
| Apple Inc. | Distributes the app and processes all payments. | Everything relating to your purchase. We never see your payment details. | United States and elsewhere |
| Hostinger International Ltd. | Hosts our support mailbox. | If you write to us, your message and your email address. | European Union, with some sub-processors outside it |
We do not use advertising networks, we do not sell or share personal data, and we do not carry out profiling or automated decision making that has legal or similarly significant effects on you.
6. Transfers outside the European Economic Area
OpenAI, Fly.io, RevenueCat and Apple process data in the United States. Hostinger, which hosts our support mailbox, is based in the European Union but may use sub-processors outside it. These transfers rely on the European Commission's Standard Contractual Clauses, on the EU to US Data Privacy Framework where the provider is certified under it, or on both. Sentry and PostHog are configured to process in the European Union.
7. How long data is kept
Because there is no account and no recipe database, there is very little to keep.
| What | Where | How long |
|---|---|---|
| Recipes, collections, shopping list, preferences | Your device only | Until you delete them or uninstall the app |
| Content you import (text, photo, page, video) | Processed in memory on our server | Not stored. Discarded once the response is returned |
| Email you send to us | Our support mailbox, hosted by Hostinger | Kept while we deal with your message, then for up to 12 months so we can follow up |
| Usage counter, keyed to the random identifier | Our server | Expires automatically after 35 days |
| Subscription status cache, keyed to the random identifier | Our server | Expires automatically after 1 hour |
| Rate limiting counters | Our server | Minutes |
| Crash and error reports | Sentry | 90 days |
| Product analytics events | PostHog | Up to 12 months |
| Subscription records | RevenueCat and Apple | As required for the subscription and for tax and accounting purposes |
OpenAI may retain API data for a limited period for abuse monitoring under its own terms. It is not used to train its models on our account.
8. Legal bases for processing
- Performance of a contract (Art. 6(1)(b) GDPR): importing and structuring recipes, and providing subscription features you have paid for.
- Legitimate interests (Art. 6(1)(f) GDPR): preventing abuse of our service through rate limits and usage counters, diagnosing crashes, and understanding in aggregate which features are used. Our interest is in keeping the service working, affordable and improving. You can object to this at any time using the contact address below.
- Legal obligation (Art. 6(1)(c) GDPR): retaining records required by tax and accounting law.
9. Your rights
You have the right to request access to your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. You can also withdraw consent where processing is based on consent.
Please note an important practical limit. Because Verdano has no account and we hold no name or email address, we usually cannot connect a request to any data we hold, and we are not required to collect additional information purely in order to identify you (Art. 11 GDPR). If you want to exercise a right in relation to server side data, you will need to supply your random identifier, which is not shown in the app. Contact us and we will explain how to retrieve it. For everything stored on your device, deleting the item or uninstalling the app is immediate and complete, and does not require us at all.
If you believe your data has been handled unlawfully, you have the right to lodge a complaint with a supervisory authority. The competent authority for us is:
Österreichische Datenschutzbehörde
Barichgasse 40 to 42
1030 Vienna, Austria
www.dsb.gv.at
10. Children
Verdano is not directed at children and we do not knowingly collect data from children under 16. If you believe a child has provided personal data, contact us and we will remove what we can.
11. Security
Traffic between the app and our server is encrypted in transit. Requests to our server are authenticated, and our error reporting is configured to strip request contents and identifying headers before anything is sent. No system is perfectly secure, but we hold so little data that there is very little to lose.
12. Changes to this policy
If we change how data is processed, we will update this page and the date at the top. Significant changes will be noted in the app.
13. Contact
For any question about this policy or to exercise a right, write to support@verdano.recipes.