Privacy Policy
Savoria — Last updated: July 7, 2026
This Privacy Policy explains what data Savoria ("the app", "we") collects, why, on what legal basis, how long it is kept, and how you can exercise your rights. Savoria is an AI-powered recipe app for Android, published by JEYLAB (a French SARL, Paris Trade Register 943 632 588, registered office: 6 rue Émile Dubois, 75014 Paris), the "data controller" within the meaning of the GDPR (contact below, full details in the legal notice).
1. Data we collect and why
| Data | When | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Google account information (email address, display name) | When you sign in with Google (required to use the app) | Authentication, syncing your data across your devices | Performance of the contract |
| Your content: recipes, shopping lists, food finds, kitchen equipment settings | As you use the app | Storing and syncing your data (Google Firebase Firestore) | Performance of the contract |
| Images (recipe and address illustrations generated by AI) | When an image is generated | Displaying your content (Google Firebase Storage) | Performance of the contract |
| Messages, photos and documents you submit to AI features | When you use the AI chef, recipe import or cooking assistant | Sent to the Google Gemini API to generate the response, through our server function which relays them without storing them. Chat history is stored locally on your device only — it is never uploaded to our servers. Not used to build a profile of you. | Performance of the contract |
| Public content of a social media post (caption or description, and where applicable the video, of an Instagram, TikTok or YouTube link you submit) | When you import a recipe from a social media link | The post's content (caption and, where applicable, video) is fetched by a server-side service relying on an open-source tool, without signing in to any social media account, and sent to the Gemini API to extract the recipe. Any video transits temporarily through our server and is deleted immediately after analysis: no platform content is retained; only the resulting structured recipe is saved to your account. | Performance of the contract |
| AI usage counters (number of requests per day/month, token counts, model used) | When you use AI features | Abuse prevention, fair-use quotas, cost monitoring | Legitimate interest (protecting the service against abuse) |
| Anti-fraud token: a non-identifying, one-way hash derived from your email address | When an account is created and a free trial offer is available | Preventing abuse of the free trial offer (deleting then recreating an account to claim it again). The hash cannot be used to re-identify you and is never used for any other purpose. | Legitimate interest (fraud prevention) |
| Crash and stability data (Firebase Crashlytics: device model, OS version, crash stack traces) | If the app crashes or malfunctions | Diagnosing and fixing bugs | Legitimate interest (security and stability of the service) |
| Usage analytics (Google Analytics for Firebase: screens viewed, in-app events, pseudonymous app identifier, device information) | Only if you consent, at first launch or later in Settings | Understanding how the app is used to improve it | Consent — you can refuse or withdraw it at any time in Settings without losing any feature |
| Proof of consent (accepted terms version, analytics choice, timestamp, app version) | When you accept the terms and whenever you change your analytics choice | Being able to demonstrate that consent was collected, and which version was accepted | Legal obligation (GDPR art. 7.1) |
2. What we do NOT do
- We do not sell or rent your data to anyone.
- We do not show ads and do not use advertising trackers.
- We do not use your recipes, messages or images for marketing or profiling.
- The service uses the paid tier of the Gemini API: under its terms, your AI prompts are not used by Google to train its models. Google may however retain them temporarily for abuse detection and legal compliance purposes.
- No connection to your social media accounts: importing from Instagram, TikTok or YouTube is performed server-side, without authenticating to any platform — the app never asks for social media credentials and stores no session or platform cookie.
Please avoid including sensitive personal information (e.g. health details) in messages sent to the AI — it is not needed for cooking advice.
3. Sharing with other users
Savoria lets you share your recipes, shopping lists and addresses with people you explicitly authorize using a share code. An access request must be approved by you before the requester can see anything. Shared data is only visible to the people you grant access to, and you can revoke access at any time in the app settings.
4. Third-party services (processors)
Savoria relies on the following services, operated by Google LLC / Google Ireland Ltd:
- Firebase Authentication — sign-in
- Firebase Firestore & Firebase Storage — data and image storage
- Google Gemini API / Vertex AI — AI text and image generation
- Firebase Crashlytics — crash reporting
- Google Analytics for Firebase — usage statistics (with your consent only)
Their processing is governed by Google's Privacy Policy.
5. International transfers
Data processed by Google may be stored on servers located outside the European Union, including in the United States. These transfers are covered by the EU-U.S. Data Privacy Framework, to which Google LLC is certified, and by the European Commission's Standard Contractual Clauses where applicable.
6. Retention
- Account and content data: kept as long as your account exists; deleted immediately when you delete your account.
- AI chat history: stored locally on your device only; removed when you delete it in the app or uninstall the app.
- AI usage counters: kept while your account exists, deleted with the account.
- Anti-fraud token: retained for 24 months, including beyond account deletion — this is precisely what prevents recreating an account to obtain a new trial offer. After that period it is deleted automatically. It is a non-identifying hash, never linked to your identity.
- Videos relayed during a social media import: ephemeral transit only — deleted immediately after analysis, never retained.
- Crash data: retained by Firebase Crashlytics for 90 days.
- Analytics data: retained for a maximum of 14 months.
7. Data deletion
You can delete your account and all associated data at any time:
- In the app: Settings → Account → "Delete my account". Deletion is immediate and irreversible.
- Online: submit a deletion request form. Requests are processed within 30 days and confirmed by email.
Deletion removes: your recipes, shopping lists, addresses, equipment settings, sharing profile, generated images, AI usage counters, and your sign-in account. Nothing personally identifiable is retained after deletion, with the sole exception of a non-identifying anti-fraud token (see §1 and §6) that prevents trial-offer recycling and cannot be used to re-identify you.
8. Your rights
Under the GDPR you have the right to access, rectify, erase and port your data, to restrict or object to processing based on legitimate interest, and to withdraw your consent at any time (for analytics, via the toggle in Settings). The app's local backup export (Settings → Maintenance) gives you a portable JSON copy of your recipes, lists, addresses and equipment at any time.
To exercise any right, email us at the address below. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (cnil.fr), or with the supervisory authority of your country of residence.
9. Data security
Your data is stored on Google Firebase infrastructure, protected by per-user access rules: your data is only accessible to your authenticated account and to users you have explicitly granted sharing access to. Data is encrypted in transit (TLS) and at rest on Google's infrastructure.
10. Children
Savoria is not directed at minors under 15 (the age of digital consent in France) and does not knowingly collect data from them.
11. Changes to this policy
If this policy changes, the update will be published at this address with a new "Last updated" date. For material changes, you will be informed in the app.
12. Contact — data controller
Savoria is published by JEYLAB, a French SARL with share capital of €1,000, Paris Trade Register 943 632 588, registered office at 6 rue Émile Dubois, 75014 Paris. For any privacy question or request: savoriaapp@gmail.com (see also the legal notice).