Privacy policy

In short

• We collect what is needed to run Papupata: your account details, what you create in the app, and technical logs.
• AI features send the content you ask about — text, photos, videos, links and, in live voice, your speech — to third-party AI providers so they can answer. They do not use it to train their models.
• We do not sell personal data, show advertising or use third-party advertising trackers.
• Your recipes and lists are private until you share them.
• You can delete your account and everything on it at any time in Settings.

What we collect

• Account: the name you chose, your email address (or the relay address Apple gives us if you hide yours), your language and settings, and — on iPhone — the identifier Sign in with Apple provides. Web accounts also hold a hashed password.
• Content: recipes and their revisions, photos and videos you upload, links you import, shopping lists, shops and their aisle order, menus, favourites, cooking preferences and allergens, and your cook sessions, including your conversations with the assistant.
• AI usage: one record per request with the feature used, the tokens or seconds consumed and the cost, and every change to your bean balance. Failed requests are recorded too.
• Friends: your friends, friend requests, the invitation codes you received or gave out, and people you blocked.
• Purchases: the transaction identifier and product of every App Store purchase. We never see your card details.
• Technical data: IP address, device and browser type, timestamps, page addresses, error reports and diagnostic logs, including some logs the app sends from your device to our logging service.

How we use it

• To provide Papupata: keep your account, store and show your content, run the AI features you ask for, and process purchases.
• To keep the service working and safe: fix errors, measure performance, enforce limits and spending caps, and detect abuse.
• To communicate with you about your account, the service or these documents.
• To meet legal obligations and to establish or defend legal claims.

Legal bases under the GDPR: performance of our contract with you (providing the app), our legitimate interests (security, stability, abuse prevention and improving the service), legal obligations, and consent where we ask for it, which you can withdraw at any time.

AI features

The assistant and the other AI features are powered by models run by third-party providers. When you use one, the content needed to answer is sent to the provider: for example the photo, video, text or link you import; the recipe and the conversation you are asking about; what you are looking for when you search; the words you said when adding to a list; and, in live voice, your speech as you speak. The provider processes it to produce the answer and, under our agreements with them, does not use it to train models.

We do not send your email address, password, friends or purchase details to AI providers. Some AI providers process data outside the EEA; see International transfers below.

Microphone and voice

The microphone is used only while you hold the talk button or while hands-free is switched on, and the app shows which. The wake phrase is detected on your device.

Depending on the device and mode, speech becomes text on your device, through Apple’s speech recognition under Apple’s privacy terms, or — in live voice — by streaming the audio to our voice provider, which turns it into text and speech in real time. We keep the text of what was said and answered as part of your conversation history. We do not store audio recordings.

Spoken replies come from a voice on your device by default. If a server voice is used, the sentence to be spoken is sent to a speech provider and the resulting audio may be cached.

Sharing your content

A recipe is private when you make it. You can share it with friends in Papupata or make it public, in which case anyone with the link can read it. Shopping lists are shared only with the people you name, who can see the list and who else is on it. Friends see your name and what you have shared with them.

Who we share data with

We use service providers that process data on our behalf and on our instructions: hosting and database, file storage for photos and videos, AI and voice model providers, a page-reading service for links you import, Apple for sign-in and payments, and logging and monitoring services. We may also disclose data where the law requires it, to protect our rights or someone’s safety, or as part of a merger or sale of the business.

We do not sell personal data and we do not share it with advertisers.

International transfers

Our servers and database are in the EU. Some providers, including AI providers, process data outside the EEA, for example in the United States. Such transfers rely on the European Commission’s standard contractual clauses or an adequacy decision.

Cookies

Papupata sets only necessary cookies: one that keeps you signed in, one for your language and one for your light or dark theme. There are no advertising or analytics cookies, which is why there is no cookie banner.

How long we keep it

Your account and content are kept until you delete them. Deleting your account (Settings → Delete your account) removes everything on it at once, and copies in backups are gone within 30 days. Technical logs are kept for up to about 30 days. Purchase records are kept as long as accounting law requires. Cached speech audio expires on its own.

Your rights

You can ask to access, correct, delete or receive a copy of your personal data, object to or restrict certain processing, and withdraw consent. Write to the contact address above; we reply within one month and it is free of charge. You can also complain to your data protection authority. Ours is the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi).

Children

Papupata is not intended for children under 13, or under the higher age your country requires, and accounts are invitation-only. If a child has an account, tell us and we will remove it.

Security

Data travels over HTTPS, passwords are stored hashed, private photos are served through short-lived signed links, and the database is reachable only by the app. No system is completely secure. If a breach puts your data at risk, we will inform you and the authorities as the law requires.

Changes

We may update this policy. The date at the top shows the current version, and material changes are announced in the app.