Privacy Policy – Kochkumpel (Android app)

This is a translation. In case of discrepancies, the German version prevails.

Last updated: November 2026

1. Controller

Email: support@volketec.de

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

Kochkumpel works without a user account, email or password. Your recipes, photos and settings are stored only locally on your device. There is no advertising, no tracking, no analytics, no advertising ID and no crash reports sent to us.

Data only leaves your device in the cases described below:

3. Local storage on your device

Recipes (recipes.json), recipe photos and settings are kept in the app's private storage. Other apps cannot access them. We do not receive this data.

Android backup: If Android backup ("Google One / Backup") is enabled on your device, Android backs up your local recipes and photos to your Google account and restores them on a new device. This is a feature of Android/Google; we have no access to it. The anonymous ID, caches and settings are excluded from the backup. You can turn off backup in the Android settings.

4. Groups, meal plan, shopping list, shared recipes (Google Firebase)

When you create or join a group, we use Google Firebase provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google") as a processor:

• Firebase Authentication (anonymous): A random user ID (UID) is created. It is a pseudonym, not complete anonymisation. We do not collect an email address, phone number or password.
• Cloud Firestore: We store the display name you choose, your group memberships and roles, and the content you share in a group: meal plan entries, shopping list entries, shared recipes including a reduced-size photo. Before upload, photos are resized and metadata (EXIF, e.g. GPS location, camera model) is removed. Content is visible only to members of the respective group; this is enforced on the server by security rules.
• When connecting, Google technically processes your IP address and technical connection data.
• Storage location: Google data centres in the European Union (Firestore multi-region "eur3": Belgium and the Netherlands). A transfer to Google LLC (USA) cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission's Standard Contractual Clauses also apply.
• Legal basis: Art. 6(1)(b) GDPR (providing the feature you use).
• Retention: until you delete the data (section 9), leave the group, or the group's creator deletes the group.

5. Feedback & suggestions

Under Settings → Feedback & suggestions you can suggest a feature (feature request) or report a bug (bug report). The following is stored via Google Firebase (Cloud Firestore):

• Content of the report: title, description, category or "What did you expect?" / "What happened?"
• Technical details: app version, Android version, selected language – no device identifier, no name
• a random request ID and the time
• optionally a screenshot you select yourself (resized, metadata/EXIF removed)
• optionally your email address – only if you enter it and agree to be contacted. It is stored separately from the report and is never visible to other users.

The report itself contains neither your email address nor your user ID. Free text is cleaned before sending; obvious passwords/tokens are redacted automatically.

Abuse protection: To prevent the form from being used for spam, we store only the time and number of your reports for your anonymous ID (max. 1 per minute, 5 per 24 hours). This counter is deleted automatically after 2 days.

• Legal bases: Art. 6(1)(f) GDPR (legitimate interest in improving the app, fixing bugs and preventing abuse); for the email address Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future by emailing us.
• Retention: reports until resolved, at most 24 months; email addresses until the follow-up is resolved, at most 12 months, or until you withdraw consent.

6. Abuse protection: Firebase App Check (Google Play Integrity)

For group and feedback features, Firebase App Check uses the Google Play Integrity API to check whether requests come from a genuine, unmodified installation of the app. Google processes information about the integrity of device and app (e.g. whether the app was installed from Google Play). Legal basis: Art. 6(1)(f) GDPR (protecting our infrastructure and your data against abuse).

7. Offline translation (Google ML Kit)

Translations happen on your device; recipe texts are not sent to servers. When downloading a language model (once, approx. 30 MB per language) and for diagnostics, Google ML Kit transmits technical data to Google, according to Google: device information (manufacturer, model, Android version), app package name and version, a per-installation identifier (not intended to uniquely identify a person or device), performance metrics, error codes and the selected source and target languages. Google uses this data for diagnostics and usage statistics of the ML Kit feature and, according to Google, does not share it with third parties. Legal basis: Art. 6(1)(b) GDPR (providing the translation) or Art. 6(1)(f) GDPR.

8. Recipe import and in-app browser

When you import a link or open a web page under "Discover", the app retrieves that page directly (encrypted via HTTPS only). The website operator receives your IP address and usual browser data; their privacy policy applies. Imported recipes are stored only locally on your device.

Photos and camera: The app only accesses a photo when you take it yourself or select it via the Android photo picker. There is no background access to your media library.

This website

The app's web pages (kochkumpel.volketec.de) are delivered via Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit, Google necessarily processes your IP address as well as time, requested page and browser identifier in order to deliver the page and protect it against attacks. Delivery uses a worldwide server network; data may be transferred to the USA on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework), alternatively Standard Contractual Clauses. We do not evaluate access logs ourselves. The pages set no cookies, load no external content and contain no analytics or tracking tools. Legal basis: Art. 6(1)(f) GDPR.

9. Deleting your data

• In the app: Settings → Groups → "Delete my cloud data". This deletes all groups you created including their content, removes you from all other groups and deletes your anonymous ID in Firebase. Local recipes are kept.
• Leave a group: in the group → "Leave group".
• Without the app: see kochkumpel.volketec.de/en/delete-account.html or email support@volketec.de with the subject "Data deletion Kochkumpel". For feedback, please state the request ID, as reports are not linked to a person.
• Local data is deleted in the app or by uninstalling it.

There are no statutory retention obligations for the data processed in the app, as no contracts are concluded and no payments are processed through the app.

10. Recipients

We do not pass data on to third parties and do not sell data. The only recipients are:

• Google Ireland Limited (Firebase Authentication, Cloud Firestore, App Check) as a processor under Art. 28 GDPR on the basis of the Firebase Data Processing Terms,
• Google in connection with ML Kit and Play Integrity (see sections 6 and 7),
• the operators of websites you visit yourself (section 8),
• members of your groups – only for the content you share in the group.

11. Security

All connections are encrypted via HTTPS/TLS; unencrypted connections are technically blocked in the app. Google encrypts data stored in Firebase at rest. There is no end-to-end encryption – Google as processor could technically access stored group content. Access within the app is restricted to group members by server-side security rules.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent (Art. 7(3)). You can lodge a complaint with a data protection supervisory authority, e.g. the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

As we do not identify you by name or email, we can only process access requests concerning group data using details you provide (e.g. group name, display name, request ID).

13. No automated decision-making, no profiling

There is no automated decision-making and no profiling.

14. Children

The app is not directed at children but at people aged 16 and over. The online features (groups, feedback) should only be used by people aged 16 and over; younger users need their parents' consent.

15. Changes

We update this policy when the app changes. The version published here applies.