Privacy notice

The service provider named in the legal notice is responsible for data processing. The same page contains contact details for privacy enquiries.

When you access the website, the web server processes connection data required for technical operation. This may include your IP address, date and time, requested path, HTTP method, response status, transferred data volume, referrer, browser, and operating-system information.

Processing is necessary to provide the website securely and reliably, diagnose errors, and prevent misuse. The legal basis is Article 6(1)(f) GDPR. Log data is deleted when it is no longer needed for these purposes. Data connected to a specific security incident may be retained until the incident and any related claims have been resolved. Hosting and infrastructure providers may act as recipients or processors.

We also calculate an approximate number of unique visitors during the previous 24 hours. The IP address and browser identifier are converted on the server, using a secret key, into a pseudonymous identifier that cannot be reversed. Raw data is not stored for this statistic, no cookie is set, and no identifier is shared with third parties. The pseudonymous identifier is deleted no later than 31 days after the last visit. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a data-minimising measurement of use and reach.

Auth.js uses cookies that are strictly necessary for sign-in and account security. These include a sign-in session cookie and short-lived cookies that protect the Google OAuth flow through CSRF, state, and PKCE checks.

The session cookie may remain valid for up to 30 days and is removed when you sign out. Sign-in security cookies generally last for the browser session or about 15 minutes. In production they are configured as HTTP-only, SameSite, and Secure over HTTPS. Storage or access is necessary for the sign-in and account service requested by the user under Section 25(2)(2) TDDDG. Related personal-data processing is based on Article 6(1)(b) GDPR and, for security measures, Article 6(1)(f) GDPR.

If you explicitly consent, we use Google Analytics 4 to produce usage statistics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before consent, the Google script is not loaded, analytics cookies are not set, and measurement data is not sent to Google.

Data may include visited pages, time, referrer, approximate region, browser and device information, session data, and a random client identifier. Google uses the IP address to derive an approximate region and states that it discards the address before logging. Google Signals and personalised advertising are disabled.

The legal basis for setting and reading analytics cookies is Section 25(1) TDDDG; subsequent processing is based on consent under Article 6(1)(a) GDPR. Analytics cookies are limited to 90 days and user and event data in the Analytics property is retained for two months. You can withdraw consent at any time using “Cookie settings” in the footer. Available analytics cookies will then be deleted. The withdrawal does not affect processing performed before it.

Google may process data outside the European Economic Area and refers to the EU-US Data Privacy Framework and standard contractual clauses. See Google’s Analytics privacy information and privacy policy.

Google sign-in is optional and starts only when you select the relevant button. You are then redirected to Google. After approval, Google sends a stable account ID and basic profile information such as name, email address, and profile image. SimpleMeals never receives your Google password.

We use this data only to sign you in, provide a session, and associate saved recipes with your account. The legal basis is Article 6(1)(b) GDPR, supplemented by Article 6(1)(f) GDPR for security and misuse prevention. Google Ireland Limited generally provides the service in the EEA, and Google may process data outside the EEA. See Google’s privacy policy for details.

When you bookmark a recipe, the stable Google ID, recipe ID, and time of saving are stored in a local database solely to display your account-specific bookmarks. The legal basis is Article 6(1)(b) GDPR. A bookmark remains until you remove it. Deleting your account removes all locally stored bookmarks and ends the session; it does not delete your Google account or data processed independently by Google.

If you contact us by email or use the feedback form, we process your message, the selected category, and any voluntarily supplied email address to handle the request. Depending on the request, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. Messages are deleted once the matter is complete unless statutory retention duties or legitimate reasons require longer storage.

Personal data is disclosed only where necessary for the purposes described, required by law, or covered by your consent. Recipient categories may include hosting and infrastructure providers, administrators with necessary technical access, and Google for sign-in and—after consent—audience measurement. Transfers outside the EEA take place only where Articles 44 et seq. GDPR are satisfied, for example through an adequacy decision or safeguards such as standard contractual clauses.

Subject to statutory requirements, you have rights of access, rectification, erasure, restriction, and data portability. You may object to processing based on Article 6(1)(f) GDPR for reasons arising from your particular situation and may withdraw consent at any time for the future. Use the contact details in the legal notice to exercise your rights. You may also complain to a data-protection authority; for a controller based in Bonn, this is generally the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.

No decision based solely on automated processing that produces legal or similarly significant effects within the meaning of Article 22 GDPR takes place.

Version dated 29 July 2026. We update this notice when features, providers, or data processing change.