Flourwise Privacy Policy

Last Updated: April 21, 2026 Version: 2.0

---

1. Introduction

Flourwise ("we", "our app") respects the privacy of its users. This Privacy Policy explains what data we collect, how we process it, and what rights you have regarding its processing.

The app works mainly locally - your recipes, ingredients, and baking data are stored exclusively on your device and are not automatically sent to the cloud or external servers.

---

2. Data Controller

Data Controller:

Mariusz Lasak ul. Zakopiańska 19 34-323 Ślemień Poland Tax ID: 6443468840 Contact email: support@flourwise.com App website: https://flourwise.com

Legal Basis:

Data processing is based on:

• Art. 6 para. 1 lit. a GDPR (user consent)
• Art. 6 para. 1 lit. b GDPR (contract performance - service provision)
• Art. 6 para. 1 lit. f GDPR (legitimate interest of the controller - error analysis and quality improvement)

---

3. What Data We Collect and Store

3.1 Data Stored Locally (on Your Device)

Type of data:

• ✅ Baking recipes (name, ingredients, instructions)
• ✅ Recipe photos (if you add them)
• ✅ Ingredients and their proportions
• ✅ Baking calculations (hydration, preferments)
• ✅ Baking journal and notes
• ✅ Starters and their feeding history
• ✅ Baking task schedule
• ✅ App settings (theme, language, preferences)
• ✅ Timer data
• ✅ Other app functionality (baking mode, sessions)

Purpose of processing:

Enabling basic app functions (creating, editing, and viewing recipes).

Legal basis:

Art. 6 para. 1 lit. b GDPR (service provision).

Retention period:

Data is stored on your device until you delete it or uninstall the app.

Sharing:

This data is NOT automatically sent to us or any third parties. You can export it to a PDF file - then it is saved in a location you choose.

3.2 Payments and Subscriptions (Google Play Billing)

Type of data:

If you use the Premium version of the app, the following data is processed by Google Play Store:

• Google account email associated with the purchase
• Purchase and subscription history
• Subscription status (active/cancelled)
• Transaction identifier

Purpose of processing:

Enabling purchase and management of Premium subscription in the app.

Legal basis:

Art. 6 para. 1 lit. b GDPR (contract performance - Premium service provision).

Sharing:

This data is processed exclusively by Google LLC in accordance with Google's Privacy Policy. We do not have direct access to your credit card data - all payments are handled by Google Play's secure infrastructure.

Retention period:

Data is stored by Google in accordance with their policy and legal requirements for financial documentation.

Your rights:

You can manage your subscription and cancel it at any time in Google Play settings.

3.3 Newsletter

Type of data:

When you subscribe to our newsletter on the website, we collect:

• Email address
• Date and time of subscription
• Language preference
• Consent record

Purpose of processing:

Sending you baking tips, blog updates, and app news.

Legal basis:

Art. 6 para. 1 lit. a GDPR (your explicit consent via checkbox).

Service provider:

We use Brevo (Sendinblue) to manage our newsletter. Brevo is GDPR compliant and stores data on EU servers (Frankfurt, Germany). Brevo Privacy Policy

Retention period:

Until you unsubscribe or 2 years of inactivity.

Your rights:

• Unsubscribe anytime via link in each email
• Request data deletion: support@flourwise.com
• View what data we have about you

---

4. AI Recipe Import (Google Gemini) — optional

The app includes an optional "Import with AI" feature that lets you quickly add a recipe from a link (URL), photo, or pasted text. It uses an external AI model — Google Gemini, accessed via the Google Gemini API (Google LLC, USA).

The feature is fully voluntary and requires an active action on your part (tapping the "Import with AI" button). If you do not use it, no data is sent to Google Gemini on this account.

4.1 How it works

1. You tap "Import with AI" and choose a source: URL, photo, or text.
2. For URL — the app fetches publicly available page content via HTTPS using a standard mobile Chrome User-Agent (many blogs block uncommon user-agents outright, so we present as a regular mobile browser visit). For photo — the app sends a copy of the selected image. For text — the pasted text is sent.
3. The fetched content (URL/photo/text) is sent to the Google Gemini API along with a system prompt instructing the AI to extract ingredients, steps, and recipe metadata.
4. Google Gemini returns structured data (JSON) with ingredients and steps.
5. The app saves the extracted recipe locally only on your device. Nothing is synced to our cloud.

4.2 What data is sent to Google

• The URL you enter and the page content we fetch at that URL
• The photo you select (a file copy, with EXIF metadata stripped — see Section 4.12)
• The text you paste
• Your device IP address (visible to Google on every HTTPS connection)
• Basic API call technical metadata (size, timestamp, headers)

4.2a What the blog owner sees (URL import only)

When you import a recipe from a URL, the app fetches the page directly from the blog (HTTPS GET request with a standard mobile Chrome User-Agent). This is a standard HTTP fetch — the blog's web server sees:

• Your IP address (standard for every HTTP request; not sent by Flourwise but by your device/network)
• Our User-Agent string (identifies the request as coming from Flourwise)
• Request headers (Accept-Language, TLS fingerprint, etc. — standard HTTP metadata)

We do not send your name, account details, or any other Flourwise data to the blog. The blog can independently log or analyse the IP per its own privacy policy. To avoid exposing your IP to the blog, use the Text import tab instead — paste the recipe text and the blog is not contacted at all.

4.3 What data is NOT sent

• Your other recipes saved in the app
• Your name, Google account, email
• Baking history, journal, notes
• Starter data, timers, schedule
• Photo EXIF metadata (GPS, device info, capture timestamp) — stripped before sending to Gemini
• Any personal data that you did not include in the imported content

4.4 Processor

Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), acting as a data processor under GDPR Art. 28, through the Gemini API service.

Processing is governed by the Google Cloud Data Processing Addendum (DPA), which binds all Google Cloud / Gemini API customers.

4.5 Data Transfer to the USA

Google Gemini API servers are located in the United States. Transfer of your data outside the European Economic Area (EEA) is based on:

• EU-U.S. Data Privacy Framework (DPF) — Google LLC is self-certified. The framework was adopted by European Commission Decision C(2023) 4745 of 10 July 2023 and upheld by the EU General Court judgment of 3 September 2025 (Case T-553/23, Latombe v. Commission).
• Standard Contractual Clauses (SCC) — Commission Implementing Decision (EU) 2021/914 — used as an additional safeguard and fallback mechanism.
• UK Extension to the DPF — for UK users.
• Swiss-U.S. DPF — for Swiss users.

List of certified entities (including Google LLC): dataprivacyframework.gov/list.

4.6 AI Model Training — Your Data is NOT Used for Training

Flourwise uses the paid tier of the Google Gemini API. Per the Gemini API Additional Terms of Service:

• Google does NOT use your prompts (sent content) or AI responses to train Gemini models or any other Google models
• Data is processed solely to deliver the response
• Google may retain content for a limited period for security and abuse detection purposes only

4.7 Data Retention

Data type	Retention period	Where
Extracted recipe (AI output)	Until you delete it or uninstall the app	Local — your device
Input data (URL/photo/text)	Limited period (abuse detection)	Google LLC (USA)
Step photos fetched from the blog	Until you delete the recipe	Local — your device

4.8 Third-Party Data (URL import) — GDPR Article 14

When you import a recipe from a blog URL, we also capture publicly available information about the blog author (author name, site name). This data is not obtained from the data subject (the blog author), so GDPR Article 14 applies.

• Source of data: publicly available recipe webpage
• Categories: author name or pseudonym, blog name, URL
• Purpose: preservation of source attribution (legitimate interest under Art. 6(1)(f) GDPR — proper source labelling of the recipe)
• Retention: as long as you keep the recipe in the app
• Edit/delete: you can delete the author field or blog name in the recipe view at any time

4.8a Why we don't notify blog authors individually (GDPR Art. 14(5)(b))

Providing individual notice to each blog author whose recipe metadata our users import would require disproportionate effort: we would need to identify, locate, and contact thousands of independent bloggers globally whose content our users choose to import. The scraper honors robots.txt (RFC 9309) and noai / noimageai / TDM Reservation signals (see section 4.13), offers a Text tab as a non-automated alternative, and provides support@flourwise.com as an opt-out channel for any blog owner who wishes to be excluded. Under GDPR Art. 14(5)(b), these measures constitute the appropriate safeguards required when individual notice is not feasible. This Privacy Policy itself serves as the public notice required under Art. 14(5)(b).

4.9 No Automated Decision-Making (GDPR Art. 22)

The AI Import feature does not make any decisions about you. The AI only parses content from your input (URL/photo/text) into a structured recipe format (ingredients, steps, metadata). It does not generate a profile, does not evaluate you, does not make decisions affecting your rights or freedoms.

GDPR Article 22 does not apply. Nevertheless:

• You can always verify the AI output and edit it before saving the recipe
• You have the right to human intervention (your manual edit of the output)
• AI may make mistakes — we recommend verifying ingredients and steps

4.10 Legal Basis

• GDPR Art. 6(1)(a) — your voluntary consent expressed by tapping "Import with AI"
• GDPR Art. 6(1)(b) — contract performance (providing the service you requested)
• For blog author data (URL import): GDPR Art. 6(1)(f) — legitimate interest in preserving source attribution

4.11 Your Rights Regarding the AI Feature

• Right to decline: you don't have to use AI Import — you can add a recipe manually, via the baker's calculator, or by pasting text without AI
• Right to withdraw consent: stop using this feature at any time; once imported, the data is already local
• Right of access/erasure: the extracted recipe is local — you have full control (edit/delete in the app)
• Right to information: this privacy policy constitutes the full information required under GDPR Articles 13 and 14
• Right to object — regarding processing of blog author data, email support@flourwise.com

4.12 Technical Safeguards

• All Google Gemini API calls over HTTPS (TLS 1.2+)
• URL validation before sending — blocks localhost, private addresses, metadata endpoints (SSRF protection), plus post-connect address verification (DNS rebinding protection)
• Size limits: photos up to 20 MB, text up to 10,000 characters, page content up to 20,000 characters; streaming response reads with progressive caps to protect against DoS
• Gemini API key secured with Application Restrictions in Google Cloud Console (package name + SHA-1 certificate fingerprint)
• EXIF metadata stripping — before sending to Gemini, the app decodes the photo and re-encodes it as JPEG without metadata (GPS, device model, capture date, UserComment). Only the pixels needed for recipe recognition reach Google (GDPR Art. 5(1)(c) — data minimization principle)
• Prompt injection defense — the Gemini system instruction uses a strict contract that ignores instructions embedded inside fetched page content, photos, or pasted text
• Privacy-by-design hints — when pasting text or importing a photo, the app shows a visible warning that the content will be sent to Google AI, reminding you to avoid including personal data (emails, phone numbers) in the input

4.13 Respect for website owner preferences

For URL import, Flourwise honors standard web opt-out mechanisms before sending anything to AI:

• robots.txt (RFC 9309): before fetching a page, we check /robots.txt. If the path is disallowed for User-agent: *, import is aborted and the user is told to use the Text tab instead (manual paste is not automated access).
• X-Robots-Tag HTTP header with noai or noimageai: if present on the response, we abort AI processing for that page.
• HTML <meta name="robots" content="noai"> tag: same behavior.
• W3C TDM Reservation Protocol: <meta name="tdm-reservation" content="1"> — honored per EU DSM Directive Art. 4(3) right to reserve TDM (text and data mining).
• Website owner direct contact: if you are a website owner and do not want Flourwise to fetch your content, email support@flourwise.com with your domain — we will add it to an internal block list in the next app release.

These measures implement "good web citizenship": we fetch publicly available pages only when the owner does not object via standard signals. Users retain the ability to manually copy-paste recipe text into the app (Text tab) — that path does not involve any automated fetching from the blog.

---

4a. Diagnostic Data (Firebase Analytics & Crashlytics)

Starting in version 2.0, Flourwise uses Firebase Analytics (anonymous usage metrics) and Firebase Crashlytics (crash reports) from Google LLC to improve app quality and detect technical problems.

4a.1 What data is collected

• Firebase Installation ID — anonymous identifier tied to the app install (not to your Google account or device). Resets on reinstall.
• Event metadata — event name (e.g. scraper_succeeded), timestamp, app version, OS version, device model, country code derived from IP, approximate language.
• Event parameters — functional data only: scraper source type (URL/photo/text), duration in ms, ingredient count, step count, error type. No recipe content, no personal text, no photos.
• Crash stack traces — Kotlin/Java exception stacks with app state at crash time, anonymized device info.

4a.2 What data is NOT collected

• No recipe titles, ingredients, steps, or notes
• No photos or URLs you paste
• No contact information or account identifiers
• No precise location (only country from IP)
• No advertising ID (we do not serve ads)

4a.3 Processor

Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), acting under the Firebase Data Processing and Security Terms. Data is stored on Google Cloud infrastructure in the United States.

4a.4 Retention

2 months — minimized from the Firebase default of 14 months. Configured in the Firebase Console under Analytics → Data Settings → Data Retention.

4a.5 International transfer (USA)

Same legal framework as for Google Gemini (see Section 4.5): EU-U.S. Data Privacy Framework + SCC + Google Cloud DPA.

4a.6 Legal basis

GDPR Art. 6(1)(f) — legitimate interest (product improvement, debugging, crash diagnosis). We minimize the data collected (anonymous installation ID, event metadata only, 2-month retention) to balance legitimate interest against your privacy rights.

4a.7 Right to opt out

Firebase Analytics and Crashlytics collection can be disabled directly in the app: Settings → Privacy → toggle "Anonymous usage analytics" or "Crash reports". The change takes effect immediately (the SDK stops sending events). You can also disable globally via Google Play Services (device Settings → Google → Usage & Diagnostics) or by uninstalling the app. In debug builds, Crashlytics is always disabled regardless of toggles to avoid polluting production metrics.

Technical limitation of the Firebase SDK: Google's Firebase Analytics SDK sends anonymous operational events regardless of your consent choice: the first_open event on first app installation, and a Firebase SDK Heartbeat each time the app's process is started fresh (known as a cold start, typically a few times a day when you reopen the app after Android has freed its memory). Each such event contains only a timestamp, the app's Firebase project identifier, the SDK version, the operating system version, and the device language. It does not contain any user identifier, advertising ID, recipe content, screen views, or personal information. This is a built-in behavior of the Firebase SDK that cannot be disabled from the application code without removing the analytics dependency entirely. After opt-out, no further data (analytics events, screen views, custom events such as paywall_converted, scraper_started) is sent.

4a.8 No profiling

Firebase Analytics data is not used to make automated decisions about you (GDPR Art. 22 does not apply). Event data is aggregated for product metrics, never used to identify individual users.

---

4b. Automatic Device Backup (Android Auto Backup)

Flourwise uses the standard Android Auto Backup mechanism. Your app data (recipes, bakes, starters, photos, settings) is automatically backed up to your personal Google Drive account, managed by the Android operating system.

4b.1 How it works

• Android backs up your app data once per day when the device is connected to Wi-Fi and charging
• Backup is stored in your own Google Drive under your Google account — not on our servers
• You can view, manage, and delete your backups via Google Drive app → Backups section
• When reinstalling the app or setting up a new device, Android automatically restores the backup

4b.2 What is backed up

• Recipe database (titles, ingredients, steps, journal entries)
• Bake sessions and history
• Starter logs
• Recipe and bake photos
• App settings and preferences

4b.3 What is NOT backed up

• Purchase and Pro-status cache (is_premium_quick_cache.xml, premium_prefs.xml) — the Pro subscription is verified independently by Google Play Billing on each install, so the backup does not carry it over
• Scraper temporary files (scraper_photos/)
• Session tokens or encryption keys (if any)
• Debug preferences
• Internal statistics cache

4b.4 Controller and processor

You are the data controller for your Google Drive backups. Google LLC is the processor for your Google Drive account under your agreement with Google. Flourwise does not have access to these backup files — they are readable only by the app itself during restore.

4b.5 Retention

Controlled by you. Google keeps the backup for your app as long as you use the app at least once every 2 months. If you do not use the app for 2 months, Google may delete the backup automatically. You can also delete backups manually at any time in the Google Drive app.

4b.6 How to opt out

You can disable automatic backup on your device: Settings → Google → Backup → toggle off for Flourwise, or globally: Settings → System → Backup → Google Drive.

4b.7 Encryption

Android backups are end-to-end encrypted (E2EE) on devices running Android 9 or later when a screen lock is set (PIN, password, or pattern). The encryption key is derived from the screen lock and is not known to Google — even Google cannot read such a backup without your device and its screen lock. On older Android versions or when no screen lock is set, the backup uses standard server-side encryption, but the key is held by Google. This encryption policy is fully managed by the Android system, not by Flourwise.

---

5. App Permissions

The app may request the following permissions:

5.1 Files and Photos (no permissions required)

Mechanisms used:

• Photo Picker - system dialog for selecting photos (Android 13+)
• Storage Access Framework - system dialog for file selection
• Share Sheet - system sharing dialog

Purpose:

• Adding photos to recipes (from gallery)
• Exporting recipes to PDF
• Creating and restoring backups
• Importing/exporting recipes (JSON)

Important:

The app does NOT require permissions to access storage or files. Android system automatically shows file/photo selection dialogs, and the app receives access only to the files you choose.

When:

Only when the user selects the option to add a photo, export or import data.

5.2 Notifications

Purpose:

• Baking timer notifications
• Reminders about baking activities

When:

Only when the user sets a timer or uses baking mode.

5.3 Camera — optional

Purpose:

• Taking photos of recipes directly from the app

When:

Only when the user selects "Take photo" option (instead of "Choose from gallery").

5.4 Timers and Alarms

Purpose:

• Running baking timers in the background
• Precise notifications and alarms
• Vibrations for notifications
• Restoring timers after device restart

Permissions:

• VIBRATE - vibrations for timer notifications
• WAKE_LOCK - waking device when timer completes
• FOREGROUND_SERVICE - running timers in background (when app is minimized)
• FOREGROUND_SERVICE_DATA_SYNC - timer state synchronization
• USE_EXACT_ALARM, SCHEDULE_EXACT_ALARM - precise alarms (to the second)
• RECEIVE_BOOT_COMPLETED - restoring active timers after device restart
• USE_FULL_SCREEN_INTENT - full-screen notifications for important timers

When:

Automatically activated when you use timer functions in baking mode.

Important: The only actual permission required by the app is CAMERA - and only if you want to take photos directly from the app. All other features (export, backup, selecting photos from gallery) work without any permissions thanks to Android system mechanisms.

---

6. Your Rights (GDPR)

Under GDPR, you have the right to:

6.1 Right of Access (Art. 15 GDPR)

You can request information about what data we process about you.

How to exercise:

View in the app - all recipes and settings are stored locally on your device.

6.2 Right to Rectification (Art. 16 GDPR)

You can correct or update your data.

How to exercise:

Edit directly in the app - all data is local.

6.3 Right to Erasure - "Right to be Forgotten" (Art. 17 GDPR)

You can request deletion of your data.

How to exercise:

Uninstall the app or delete recipes in settings. All data is stored locally on your device, so deleting it removes it completely.

6.4 Right to Restriction of Processing (Art. 18 GDPR)

You can request suspension of data processing.

How to exercise:

Write to us at support@flourwise.com

6.5 Right to Data Portability (Art. 20 GDPR)

You can receive your data in a format that allows its transfer.

How to exercise:

Use "Export recipes to PDF" or "Export to JSON" function in the app.

6.6 Right to Object (Art. 21 GDPR)

You can object to data processing.

How to exercise:

Write to us at support@flourwise.com

6.7 Right to Withdraw Consent

If data is processed based on consent, you can withdraw it at any time.

How to exercise:

Write to us at support@flourwise.com

Response time: We will respond to your request within 30 days.

---

7. Right to Complaint

If you believe we process your data unlawfully, you have the right to file a complaint with:

Personal Data Protection Office (UODO)

ul. Stawki 2 00-193 Warsaw Phone: +48 22 531 03 00 Email: kancelaria@uodo.gov.pl Website: https://uodo.gov.pl

---

8. Data Security

We care about the security of your data through:

• ✅ Data encryption in transit (HTTPS/TLS)
• ✅ Storing data locally on your device
• ✅ Minimizing collected data
• ✅ Regular security updates

8.1 Reporting Security Breaches

In case of a personal data breach:

1. Obligation to report to UODO:
   The Controller reports the breach to the Personal Data Protection Office within 72 hours of becoming aware of the breach (in accordance with Art. 33 GDPR).
2. Notifying users:
   In case of serious breaches that may result in high risk to users' rights and freedoms, we will notify users without undue delay (in accordance with Art. 34 GDPR). The notification will contain information about the nature of the breach and recommended actions.
3. Reporting incidents:
   If you suspect a breach of your data security, contact us immediately at support@flourwise.com

---

9. Children's Data

Flourwise is a general-purpose service not directed at children. We do not knowingly collect personal data from children below the minimum age in their jurisdiction:

• United States: under 13 (COPPA, 16 CFR Part 312)
• European Union: under 16, or a lower age (13-15) set by the individual member state under GDPR Art. 8(1)
• United Kingdom: under 13 (Age Appropriate Design Code)
• Brazil: under 13 (LGPD Art. 14)

If we learn that a child below the applicable age has used the app, we will delete their data. Parents or guardians can request deletion by contacting support@flourwise.com.

Note: we do not ask for date of birth or run an age-gate dialog because the app does not expose content requiring age verification (no social features, no user-generated content visible to others, no advertising to children, no in-app purchases targeted at children). Google Play classifies the app as "General audience".

---

10. Changes to Privacy Policy

We may update this Privacy Policy. We will inform you about significant changes through:

• Notification in the app
• Update of "last updated" date at the top of the document

We recommend regularly checking this page.

---

11. Contact

If you have questions about this Privacy Policy or data processing, contact us:

Email: support@flourwise.com Website: https://flourwise.com Response time: Up to 7 business days

---

---

12. Cookies & Website Hosting

The mobile app does not use cookies. All preferences are stored locally in device memory (Android DataStore).

The website (flourwise.com) is hosted on Google Firebase Hosting. Firebase may automatically collect standard server logs, including IP addresses and request metadata, for security and operational purposes. This data is processed by Google under their Firebase Privacy Policy. The website does not use tracking cookies or advertising pixels.

The website uses Umami Analytics to collect anonymous, aggregated usage statistics (page views, visit duration, referrers, country, device type). Umami is a privacy-focused, GDPR-compliant analytics tool — it does not set any cookies, does not use localStorage, and does not fingerprint or identify individual visitors. No personal data is collected or stored. For more information, see Umami's Privacy Policy.

---

13. Compliance with Regulations

This policy complies with the following legal frameworks:

• ✅ GDPR (General Data Protection Regulation, EU 2016/679) — European Union
• ✅ Polish Data Protection Act of 10 May 2018 — Poland
• ✅ UK GDPR + Data Protection Act 2018 — United Kingdom
• ✅ Swiss FADP (Federal Act on Data Protection) — Switzerland
• ✅ LGPD (Lei Geral de Proteção de Dados, Law No. 13,709/2018) — Brazil
• ✅ CCPA/CPRA (California Consumer Privacy Act + Privacy Rights Act) — California, USA
• ✅ VCDPA, CPA, CDPA, UCPA — Virginia, Colorado, Connecticut, Utah, USA
• ✅ Other U.S. state laws: Texas TDPSA, Oregon OCPA, Delaware DPDPA, New Jersey DPA, Tennessee TIPA, Minnesota MCDPA, Montana MCDPA, Nebraska DPA, New Hampshire DPA, Maryland ODPA, Rhode Island DTPPA, Indiana ICDPA, Kentucky KCDPA, Iowa ICDPA, Florida FDBR (to the extent applicable)
• ✅ EU AI Act (Regulation EU 2024/1689) — we are a deployer of the Gemini model (not a provider), so we are not subject to GPAI obligations. Recipes imported through the "Import with AI" feature are marked with a visible icon and an "AI Import" label in the recipe details (Article 50 of the AI Act, entering into force 2 August 2026).
• ✅ PIPEDA (Personal Information Protection and Electronic Documents Act) — Canada
• ✅ Google Play Developer Program Policies
• ✅ COPPA — the app is classified as "General audience" in Google Play with no child-directed content, no advertising, no social features. We do not knowingly collect data from children under 13 (see Section 9)

13.1 U.S. State Privacy Rights (CCPA/CPRA and other states)

If you are a resident of a U.S. state with a comprehensive privacy law, you have the following rights:

• Right to Know / Access — what data we process about you (limited — app works mostly locally)
• Right to Delete — delete in the app or uninstall
• Right to Correct — edit directly in the app
• Right to Portability — "Export to PDF" or "Export to JSON"
• Right to Opt-Out of Sale/Sharing — We do NOT sell or share your personal information within the meaning of CCPA/CPRA. No opt-out mechanism is required because we don't sell/share.
• Right to Limit Use of Sensitive PI — we do not process sensitive categories within the meaning of CPRA § 1798.121
• Right to Opt-Out of Profiling — we do NOT profile users or perform automated decision-making with significant effects
• Global Privacy Control (GPC) — we honor the GPC signal sent by browsers; however, since we don't sell/share data, the signal has no practical application to our operations
• Right to Appeal — if we decline your request, you can appeal by emailing support@flourwise.com
• No Discrimination — exercising your rights does not affect your access to the app

California Privacy Rights Notice (§ 1798.135): We do not sell or share your personal information. This applies to both our mobile app and our website.

13.2 LGPD Rights (Brazil)

• Right to confirmation of processing (LGPD Art. 18 I)
• Right of access (Art. 18 II)
• Right to correction (Art. 18 III)
• Right to anonymization, blocking, or deletion (Art. 18 IV)
• Right to data portability (Art. 18 V)
• Right to information about sharing (Art. 18 VII)
• Right to withdraw consent (Art. 18 IX)
• Complaint to ANPD (Autoridade Nacional de Proteção de Dados): gov.br/anpd

13.3 EU AI Act — AI Content Labelling Obligation

Article 50 of the EU AI Act enters into force on 2 August 2026 and requires clear labelling of AI-generated or modified content. Flourwise already implements this principle today: recipes imported through the "Import with AI" feature (from a URL, photo, or text) are tagged with a visible icon and an "AI Import" label in the recipe details. Always verify ingredients and steps before baking — AI can make mistakes.

---

14. Data Export and Deletion - Practical Guide

How to Export Your Data:

Single recipe to PDF:

1. Open recipe 2. Click menu (⋮) in top-right corner 3. Select Export to PDF 4. Save to chosen location

All recipes (JSON):

1. Go to Settings 2. Select Data and privacy 3. Click Export recipes

Full backup (JSON):

1. Go to Settings 2. Select Data and privacy 3. Click Backup

How to Delete Local Data:

Single recipe:

1. Open recipe 2. Click menu (⋮) in top-right corner 3. Select Delete

All data:

1. Go to Settings 2. Select Data and privacy 3. Click Clear all data

Complete deletion:

Uninstall the app (removes all local data)

---

15. Frequently Asked Questions (FAQ)

Q: Are my recipes sent to the cloud?

A: No. All recipes are stored locally on your device.

Q: Can I use the app without Internet?

A: Yes! The app works fully offline. All features are available without an internet connection.

Q: Is my data sold?

A: We don't sell any data. All data is stored locally on your device.

Q: What will happen to my data if you stop developing the app?

A: Your data will remain on the device. The app stores all data locally.

---

Thank you for trusting and using Flourwise! 🥖

---

*Last updated: April 21, 2026* *Version: 2.0* *Language: English (EN)*