Privacy policy

Version 2026-10-04. Draft document pending legal review before launch.

1. Data controller

[Titular pendiente de completar] (tax ID [NIF pendiente]), [Dirección pendiente]. Privacy contact: [correo de contacto pendiente].

2. What data we process

  • Account: name, email address and password (stored encrypted).
  • Sign in with Google: if you choose "Continue with Google", Google gives us your name, your email address and an identifier of your Google account. We never receive your Google password or access anything else in your account.
  • Profile and preferences: people at home, cooking time, goals, budget, favorite cuisines, language, unit system and what you do not like.
  • Intolerances and allergies: these are health data. We only process them if you choose to provide them, to filter recipes and warn you. You can delete them whenever you want.
  • Your content: recipes, photos, comments, collections, plans, shopping lists and pantry.
  • Public profile: only if you turn it on (display name, bio, links).
  • Technical data: sessions, IP address and browser when you accept legal documents (as proof of consent), and your phone's identifier if you turn on push notifications.

3. Why and on what legal basis

  • Providing the service you ask for (contract): account, plans, lists, recipes and in-app notifications.
  • Your intolerances, push notifications and public profile: your consent, which you can withdraw at any time.
  • Security, moderation and aggregated statistics to improve the service: legitimate interest.
  • Keeping proof that you accepted these documents: legal obligation and defense against claims.

We do not sell your data or use it for personalized advertising.

4. Who we share it with

  • The server hosting provider.
  • Firebase Cloud Messaging (Google) to deliver push notifications, only if you turn them on. This may involve transfers outside the European Economic Area with appropriate safeguards.
  • Google, only if you choose "Continue with Google": you sign in on its page and it confirms your name and email address to us. Google knows you have signed in to Cocinoa. This may involve transfers outside the European Economic Area with appropriate safeguards.
  • Machine translation services (DeepL and our own server) only for recipe texts, never for your personal data.
  • Open Food Facts to estimate prices: only product lookups, with no personal data.
  • YouTube (Google), only if you accept third-party content or play a video: it receives your IP address when the thumbnails or the player load. This may involve transfers outside the European Economic Area.
  • Instagram (Meta), only if you accept third-party content or open a post: it receives your IP address when the preview or the post loads. This may involve transfers outside the European Economic Area.

5. How long

For as long as you have an account. When you delete it we erase your data, except the consent records, which we keep for up to 5 years so we can prove it, and whatever the law requires us to keep.

6. Your rights

You can access your data, correct it, delete it, object to or restrict its use, and take it with you: in your profile you will find "Download my data" and "Delete account". For any other request write to [correo de contacto pendiente]. If you think we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es).

7. Cookies and local storage

We use technical cookies needed to log in and protect forms, and the browser's local storage to remember the theme, the recipe view, the accessibility options and your cookie choice. These do not need your consent.

With your consent we show third-party content: the thumbnails of YouTube videos related to a recipe load from Google's servers, which receive your IP address and may use their own cookies (Google privacy policy). If you do not accept, videos appear without a thumbnail and the YouTube player (in its privacy-enhanced mode) only loads when you click to watch.

In the same way, the previews of Instagram posts related to a recipe load from Meta's servers through its official embed, which receives your IP address and may use its own cookies (Instagram privacy policy). If you do not accept, the post only loads when you click to view it.

If you click "Continue with Google", the Google page that opens uses its own cookies (Google's privacy policy). We do not contact Google until you click the button.

We remember your choice for 12 months. You can change or withdraw it at any time from "Cookies" in the footer. We do not use advertising or analytics cookies.

8. Minors

Cocinoa is not intended for children under 14.

9. Security

We apply reasonable technical and organizational measures: encrypted connections, encrypted passwords, role-based restricted access and audit logs of administrative actions.

10. Changes

If we change this policy in a significant way we will publish a new version and ask you to accept it.