Flourwise Privacy Policy
Updated: 22 September 2026 · Version 3.0
1. Scope and controller
This policy covers Flourwise for Android and iOS and flourwise.com. The controller is Mariusz Lasak, ul. Zakopiańska 19, 34-323 Ślemień, Poland, tax ID 6443468840. Contact: support@flourwise.com. There is no Flourwise login account. A store account used for purchases is separate from the data stored in the app.
2. Recipes, photos and backups
Recipes, photos, ingredients, calculations, baking history, starters, timers and settings are stored on your device. Flourwise does not provide automatic synchronization of this library to a developer-operated cloud. Selected content is transmitted if you use AI import or sharing. System backups may contain app data: Android backup/device transfer and, on iOS, iCloud or computer backups depend on your system settings. This is different from live synchronization between devices. We cannot access your personal system backup. Manual exports go to the location or service you choose; the portable JSON backup does not include photo files. Keep separate copies of important photos. Local content is retained until you delete it; exported files and existing backups have their own lifecycle.
3. Purchases
Google Play handles Android purchases; Apple handles App Store purchases through StoreKit on iOS. The app processes product and transaction information, verified entitlement status, expiration and renewal information to provide Pro access, and stores a local entitlement cache. We do not receive your payment-card details or store password. Store providers process account, payment and purchase records under their own privacy notices and legal retention duties. Purchase records and receipts supplied to support may be retained to resolve the request and meet accounting or legal obligations.
4. Optional AI recipe import
After your explicit choice and AI consent, the selected text, normalized photo, or URL and extracted page content are sent to Google for recipe extraction. Android uses the Gemini API; iOS uses Firebase AI Logic with a Google Cloud backend and Firebase App Check/Apple App Attest to verify app authenticity. This verification involves technical identifiers, attestation tokens and network metadata. It is separate from optional analytics consent. Selected AI photos are re-encoded to remove EXIF metadata; visible information in the image remains. The rest of your recipe library is not sent for this operation. Do not include sensitive or unnecessary personal data.
5. AI recipients and retention
A recipe website contacted for URL import sees your IP address and request metadata. Google receives the selected input and technical request data; Apple participates in iOS authenticity verification. Imported output is saved locally when you save the recipe. Paid Gemini/Google Cloud terms restrict use of customer content for model training, subject to their applicable terms and any separate permission. Processing is not a promise of zero retention: security, abuse monitoring and service logging may retain request data under the provider rules. Deleting a local recipe does not recall a request already processed. See the linked Google service notices below.
6. Optional analytics and crash reports
Firebase Analytics and Crashlytics are controlled by separate, initially disabled choices. They process usage events, app/OS version, device characteristics, approximate location derived from IP, app-instance or installation identifiers, and diagnostic stack traces. These identifiers are pseudonymous, not a guarantee of anonymity. App telemetry does not intentionally include your recipe text, photos or imported URLs. Advertising consent is disabled. You can withdraw either choice in privacy settings; this stops the respective future collection but does not automatically erase prior server records. Analytics user/event retention was configured to 2 months in the recorded configuration; aggregate reports and retention reset rules can differ. Crashlytics retains crash data and associated identifiers for 90 days before beginning deletion. The Analytics setting does not shorten Crashlytics retention.
7. Permissions and network access
System pickers provide access to selected photos/files; taking a photo requires camera permission. Local reminders require notification authorization where the operating system requires it; iOS AlarmKit alarms have a separate system permission on supported versions. These permissions are optional for unrelated functions. Core calculations and saved recipes work offline; AI import, store verification, optional telemetry, external links and a user-requested App Store update check require network access.
8. Website, newsletter and support
Firebase Hosting processes network requests including IP addresses and technical logs for delivery and security. The site uses Umami Cloud for page views and interaction statistics; it does not set analytics cookies, but requests still expose IP and browser metadata to the service. Website preferences and calculator state may use browser storage or URL parameters. Brevo processes email address, language and subscription/consent records for newsletter or iOS availability messages requested by you. You can unsubscribe at any time. Mailing-list data is kept while the subscription remains active; minimal suppression/consent records may be kept to respect opt-outs and establish compliance. Support emails and attachments are used to respond and handle any related claims, for as long as necessary for that purpose and applicable legal duties. Avoid sending unnecessary private information.
9. Purposes, legal grounds and transfers
Local functions, entitlement verification and requested support rely on performance of a contract (GDPR Article 6(1)(b)); optional AI transfers, app analytics and marketing rely on consent (6(1)(a)). Security, abuse prevention and handling claims rely on legitimate interests (6(1)(f)); mandatory records rely on legal obligations (6(1)(c)). Google, Apple, Brevo and Umami may process data outside your country, including outside the EEA. The applicable provider terms describe processing locations and safeguards such as standard contractual clauses or an applicable adequacy decision. We do not claim that all processing is confined to the EU or the USA. We do not sell your personal data or use it for decisions producing legal or similarly significant effects through automated profiling.
10. Your rights and contact
Where applicable, you may request access, correction, deletion, restriction, portability, object to processing based on legitimate interests, or withdraw consent without affecting earlier lawful processing. Contact support@flourwise.com. We respond within one month, subject to lawful extensions with notice. We may need proportionate information to verify a request; without an identifier we may be unable to associate pseudonymous records with you. You may complain to UODO (uodo.gov.pl) or your competent supervisory authority. The service is intended for adults and not directed at children. We publish changes here and will provide additional notice or obtain new consent where required. See the deletion guide for local data, backups and subscriptions.