Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Dual Alliance Tech, LLC, doing business as KiWi Recipes ("KiWi Recipes," "we," "us," or "our") collects, uses, shares, and protects your personal data when you use the KiWi Recipes mobile application, browser extension, website, and related services (collectively, the "Service"). We are committed to transparency and to protecting your privacy across every jurisdiction in which we operate.

1. Who We Are

Dual Alliance Tech, LLC is a California limited liability company. We are the data controller (GDPR) and business (CCPA) responsible for your personal data.

For privacy inquiries: privacy@kiwirecipes.app

2. Data We Collect

We collect different types of data depending on how you use the Service. You can use many features without creating an account.

a) Account Data

b) Content You Create

c) Preferences & Dietary Data

这些偏好设置 — 包括可能间接涉及宗教习俗(如清真、洁食、耆那教,或严格的素食或全素限制)或医疗状况的偏好 — 仅存储在您的账户中并同步到您自己的设备,以便根据您的需求筛选食谱、餐计划和购物清单。我们不出售饮食偏好,不与广告商共享,也不将其用于跨应用追踪。当您使用 AI 功能时,您的饮食偏好仅会发送至 Google Vertex AI,以生成符合您需求的食谱,Google 不会将其用于训练 AI 模型。您可以随时在应用设置中查看或删除您的偏好。

d) Usage & Analytics Data

e) Device & Technical Data

f) Location Data

g) Photos & Images

h) Push Notification Data

If you enable push notifications, we store your device notification token and basic app presence state (foreground/background) to avoid sending unnecessary notifications while you are actively using the app.

3. How We Use Your Data

We use your data for the following purposes:

4. Legal Bases for Processing (EEA/UK Users)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

Legal BasisProcessing Activities
Contract performanceProviding core Service features: recipe storage, sync, meal planning, shopping lists, family sharing, AI recipe generation, allergen filtering
Legitimate interestsAggregated analytics to improve the Service, crash reporting to maintain stability, fraud prevention via Firebase App Check
ConsentPush notifications, optional location access for store features, optional photo access, marketing communications
Legal obligationResponding to lawful requests from authorities, tax and accounting records for paid subscriptions

5. Data Sharing & Third-Party Processors

We share your data only with the service providers necessary to operate the Service. We have Data Processing Agreements (DPAs) with each processor listed below.

ProviderPurposeData Shared
Google Cloud / FirebaseCloud infrastructure, authentication, database, file storage, push notifications, crash reporting, feature flagsAll Service data (encrypted in transit and at rest)
Google Vertex AIAI recipe generation and modificationRecipe prompts, dietary preferences, ingredients (no personal identifiers)
Apple (Sign in with Apple)Authentication (iOS/macOS users who choose Apple Sign-In)Authentication tokens; Apple may provide email and name at your discretion
Google (Google Sign-In)Authentication (users who choose Google Sign-In)Authentication tokens, email address, display name
Apple App Store / Google PlaySubscription billing (for paid features)Payment processed entirely by the app store; we receive only subscription status, not payment details
PostHog Inc. (EU Cloud)Product analytics and feature usageAnonymized usage events (e.g., recipe views, feature interactions), device type, app version, platform. No personal identifiers unless you are signed in, in which case your user ID is used as a pseudonymous identifier. Data is stored in the EU (Frankfurt, Germany).
Meta Platforms, Inc. (Instagram, Facebook)Displaying embedded Instagram and Facebook videos within recipes imported from or linked to those platformsPublic Instagram and Facebook post URLs. When you choose to play an embedded video, your device connects directly to Meta, which may receive your IP address and device data under Meta's own privacy policy. We do not send your account data or other personal identifiers to Meta.
Pinterest, Inc.在从 Pinterest 导入或链接到 Pinterest 的食谱中显示嵌入的 Pinterest Pin 卡片公开的 Pinterest Pin URL。当您选择查看嵌入的 Pin 时,您的设备将直接连接到 Pinterest,Pinterest 可能根据其自身隐私政策接收您的 IP 地址和设备数据。我们不会将您的账户数据或其他个人标识符发送给 Pinterest。

嵌入的 Instagram、Facebook 和 Pinterest 内容

Many recipes in the Service are imported from, or link back to, public videos on Instagram and Facebook. To show you the original creator's video, the Service displays the public post inline within the recipe. We do not download, host, or store the underlying video file.

When you choose to play an embedded Instagram or Facebook video, the content loads directly from Meta's servers. As with any embedded third-party content, Meta may collect technical information — such as your IP address, device and browser data, and cookies — in accordance with Meta's own Privacy Policy at facebook.com/privacy/policy. KiWi Recipes is not affiliated with, endorsed by, or sponsored by Meta, Instagram, or Facebook.

类似地,从 Pinterest 导入或链接到 Pinterest 的食谱显示包含返回原始 Pin 链接的 Pin 卡片。当 Pin 卡片加载时,您的设备将直接连接到 Pinterest 服务器,Pinterest 可能根据其位于 policy.pinterest.com/privacy-policy 的自身隐私政策收集技术信息——例如您的 IP 地址、设备和浏览器数据以及 Cookie。KiWi Recipes 与 Pinterest 没有关联,未获其认可,也非其赞助商。

We never sell, rent, or trade your personal data to third parties, and we do not use your data for third-party marketing. The free version of the Service may display contextual, non-personalized advertising — ads selected from the content on your screen and your general (city-level) region (for example, an ad shown alongside a pasta recipe), never from a profile of your behavior. If such ads are shown, the advertising partner receives only the limited technical data needed to serve, cap, and measure the ad (such as IP address, general region, device type, and app version). We do not permit advertising partners to build profiles of you, and we never share your recipes, dietary preferences, health or nutrition information, or any other personal content with them. KiWi Premium removes advertising entirely.

6. International Data Transfers

Your data is primarily stored and processed on Google Cloud infrastructure located in the United States (us-central1 region). If we add regional processing in the European Union or Japan to reduce latency, we will update this policy. If you are located outside the United States, your data is transferred to and processed in the United States.

We rely on the following safeguards for international transfers:

In addition to the legal safeguards above, we apply the technical measures described in Section 8 — including encryption in transit and at rest — to protect your personal data during and after cross-border transfer.

7. Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

Data TypeRetention Period
Account data & content (recipes, meal plans, shopping lists)Until you delete your account or individual content. We delete account data within 30 days of an account deletion request.
Preferences & dietary dataUntil you change or remove them, or until account deletion
Analytics events12 months, then automatically deleted or anonymized
Crash reports (Firebase Crashlytics)90 days (Google's standard retention)
AI image uploads (photo-to-recipe)3 days, then automatically deleted
Push notification tokensUntil you sign out, disable notifications, or delete your account
AI 文本输入(发送给 KiKi 的提示)在食谱生成后最多保留 24 小时,然后从任务跟踪存储中自动删除。提示不会存储在生成的食谱上或与其一起存储。

8. Security

We take the security of your data seriously and implement the following measures:

9. Children's Privacy

KiWi Recipes is intended for users aged 18 and older. Users aged 16-17 may participate only as members of a family group managed by a parent or guardian.

We do not knowingly collect personal data from children under 16 (or under the applicable age of digital consent in your jurisdiction, such as 18 in India under the DPDPA). If you are under 16, please do not use the Service or provide any personal data.

Our family sharing features are designed so that a parent or guardian (who must be at least 18 years old) creates and manages the account. Family members aged 16-17 may join the family group with the account holder's consent and under their responsibility; nutrition tracking and public sharing are unavailable to them. Children do not create their own accounts.

If we learn that we have collected personal data from a child under 16 without verifiable parental consent, we will delete that data promptly. If you believe we have collected data from a child under 16, please contact us at privacy@kiwirecipes.app.

10. Your Rights

Regardless of where you live, you have the following rights regarding your personal data:

To exercise any of these rights, please use our data request form. We will respond within the deadline set by your jurisdiction — typically 30 days, shorter for some regions — and may ask you to verify your identity before fulfilling your request.

11. Additional Rights for EU/EEA/UK Residents

If you are in the European Economic Area or the United Kingdom, you have the following additional rights under the GDPR / UK GDPR:

You also have the right to lodge a complaint with your local data protection authority. For the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). For the United Kingdom, this is the Information Commissioner's Office (ico.org.uk). For other EU member states, you can find your authority at edpb.europa.eu.

EU Representative (Article 27 GDPR): As Dual Alliance Tech, LLC is established outside the European Union, we have designated a representative in the EU for matters relating to the processing of personal data of individuals in the EEA. Our EU representative is Luc Runderkamp, Paulinelaan 1a, 1399 VK Muiderberg, The Netherlands. You may contact our representative by email at privacy@kiwirecipes.app on all questions related to the processing of your personal data and the exercise of your rights under the GDPR.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

Categories of personal information we collect (as defined by the CCPA): Identifiers (email, name, account ID); internet or electronic network activity (usage analytics, recipe views); geolocation data (store locations you save); sensory data (photos you upload); inferences drawn from dietary preferences to personalize recipes. We collect these categories for the business purposes described in Section 3.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising as defined by the CCPA/CPRA. Any advertising in the free version of the Service is contextual — based on the content of the screen you are viewing and your general (city-level) region, never on a profile of your behavior — which does not constitute "selling" or "sharing" under the CCPA/CPRA. We do not use or disclose sensitive personal information for purposes other than providing the Service. Because we neither sell nor share personal information, a "Do Not Sell or Share My Personal Information" opt-out is not required; if our practices ever change, we will provide the opt-out before any such processing begins.

13. Rights for Users in Japan (APPI)

If you reside in Japan, the Act on the Protection of Personal Information (APPI) grants you the following rights:

Cross-border transfer notice (APPI Article 28): Your personal data is transferred to and processed in the United States by Dual Alliance Tech, LLC and its service providers (primarily Google Cloud). The United States has not been designated by Japan's Personal Information Protection Commission (PPC) as providing an equivalent level of data protection. The measures taken by the recipient include: Google's EU-U.S. Data Privacy Framework certification; the EU Commission's Standard Contractual Clauses incorporated into Google's Data Processing Addendum; SOC 2, ISO 27001, and ISO 27018 certifications; and encryption of all personal data in transit and at rest. For publicly available information on the United States' personal data protection system, see the PPC's country-specific guidance at ppc.go.jp. You may contact the PPC with questions or complaints.

14. Rights for Users in South Korea (PIPA)

If you reside in South Korea, the Personal Information Protection Act (PIPA) grants you the following rights:

Specific items of personal information collected: email address, display name (if provided), user ID, dietary preferences and allergies, recipe content you create, store locations you save, recipe view events, device platform, and crash reports. These items are collected for the purposes described in Section 3 and retained for the periods described in Section 7. Personal information is provided to the third-party processors listed in Section 5 for the stated purposes only.

Data Protection Officer: For PIPA-related inquiries, contact privacy@kiwirecipes.app. You may also file a complaint with the Personal Information Protection Commission (PIPC) at pipc.go.kr.

15. Rights for Users in Brazil (LGPD)

If you reside in Brazil, the Lei Geral de Proteção de Dados (LGPD) grants you the following rights:

We process your personal data under the following LGPD legal bases: performance of a contract (core Service features), legitimate interests (analytics, crash reporting), and consent (push notifications, optional features). You may contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd with questions or complaints.

根据 Article 41 of the LGPD,我们已指定我们的隐私官员为 Encarregado de Proteção de Dados(数据保护官),负责接收数据主体和 ANPD 有关我们处理您个人数据的通信。可通过 privacy@kiwirecipes.app 联系 Encarregado。Para solicitações relacionadas aos seus direitos sob a LGPD, você pode escrever em português para privacy@kiwirecipes.app.

16. Rights for Users in Turkey (KVKK)

If you reside in Turkey, the Kişisel Verilerin Korunması Kanunu (KVKK, Law No. 6698) grants you the following rights:

Your personal data is transferred to the United States for processing. We rely on your explicit consent and contractual necessity as the legal basis for this cross-border transfer under the KVKK. You may file a complaint with the Personal Data Protection Authority (KVKK Board) at kvkk.gov.tr.

17. Rights for Users in India (DPDPA)

If you reside in India, the Digital Personal Data Protection Act, 2023 (DPDPA) grants you the following rights:

Age requirement: The DPDPA requires verifiable parental consent for processing data of individuals under 18 years of age. KiWi Recipes requires users in India to be at least 18 years old. If you are under 18 and located in India, you may not use the Service.

You may file a complaint with the Data Protection Board of India once it is operational.

18. Rights for Users in Canada (PIPEDA / Quebec Law 25)

If you reside in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Law 25) grant you the following rights:

Quebec Law 25 additional requirements: We collect and use your personal information only for the purposes described in Section 3. We conduct privacy impact assessments for systems that process personal information. You have the right to data portability in a commonly used technological format. We will notify you and the Commission d'accès à l'information of any confidentiality incident that presents a risk of serious injury.

19. Rights for Users in Australia and New Zealand

If you reside in Australia, the Privacy Act 1988 and the Australian Privacy Principles (APPs) govern how we handle your personal information. If you reside in New Zealand, the Privacy Act 2020 applies.

We do not use or disclose your personal information for the purpose of direct marketing unless you have consented. You may opt out of analytics data collection at any time through the app settings.

20. Rights for Users in Thailand (PDPA)

If you reside in Thailand, the Personal Data Protection Act B.E. 2562 (PDPA) grants you the following rights:

You may file a complaint with the Personal Data Protection Committee (PDPC) or the Office of the Personal Data Protection Committee at pdpc.or.th.

21. Rights for Users in Indonesia (PDP Law)

If you reside in Indonesia, Law No. 27 of 2022 on Personal Data Protection (PDP Law) grants you the following rights:

You may file a complaint with the supervising authority once established by the government of Indonesia.

22. Rights for Users in Mexico (LFPDPPP)

If you reside in Mexico, the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) grants you the following ARCO rights:

You may file a complaint with the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) at home.inai.org.mx.

23. Rights for Users in Taiwan (PDPA)

If you reside in Taiwan (Republic of China), the Personal Data Protection Act (PDPA) grants you the following rights:

Your personal data is transferred to the United States for processing. Taiwan's PDPA permits cross-border transfers unless restricted by the relevant central government authority.

24. Rights for Users in Israel

If you reside in Israel, the Protection of Privacy Law, 5741-1981 and its regulations grant you the following rights:

You may file a complaint with the Privacy Protection Authority (PPA) at gov.il/en/departments/the_privacy_protection_authority. Israel has been recognized by the European Commission as providing an adequate level of data protection.

25. EU/EEA Data Protection Authorities

If you are in the EU/EEA, you may lodge a complaint with your local data protection authority. Key authorities for our primary markets:

26. AI-Generated Content Disclosure

The Service uses artificial intelligence (Google Vertex AI) to generate, modify, and translate recipes. In accordance with the EU AI Act and applicable transparency requirements, we disclose that: recipe content marked as AI-generated or modified by KiKi (our AI assistant) is produced by an AI system, not a human author.

AI-generated content may contain inaccuracies. We do not use AI to make automated decisions that produce legal or similarly significant effects concerning you. The AI features are tools that generate recipe suggestions for your review — you decide whether to use, modify, or discard them.

Your interactions with the AI assistant (prompts, dietary preferences, ingredient requests) are processed by Google Vertex AI. These inputs are used solely to generate recipe content and are not used to train AI models. Google's Vertex AI data processing terms apply.

27. Cookies & Tracking Technologies

The KiWi Recipes mobile application does not use cookies. The app does not collect advertising identifiers (IDFA on iOS or GAID on Android) and does not participate in any advertising or cross-app tracking frameworks. If contextual advertising is introduced to the free version of the app, the app may use a device advertising identifier solely for ad frequency capping and fraud prevention — never for cross-app tracking, profiling, or personalized advertising. On iOS we do not request App Tracking Transparency permission because we do not track you across apps or websites.

Our website (kiwirecipes.app) does not use cookies, analytics, or any third-party tracking technologies. All fonts are self-hosted — no requests are made to external font services. The website makes no third-party requests beyond what your browser requires to load the page.

The in-app analytics described in Section 2(d) are collected by us and by PostHog (our product analytics processor, listed in Section 5). PostHog stores data in the EU (Frankfurt, Germany) and does not use your data for advertising or cross-app tracking. You can disable all analytics collection in the app's privacy settings.

Before you make a privacy choice, KiWi temporarily stores a small number of anonymous interaction events (for example: "a recipe was viewed") on your device. These events do not include your name, email address, account ID, or any other information that could identify you. If you choose to allow analytics, we send these events to our analytics provider (PostHog, EU region) so we can understand which features are used. If you choose not to allow — or if you never make a choice — the events are deleted from your device and nothing is ever sent. You can change your decision any time in Settings → Privacy; choosing to revoke also deletes any events still stored locally.

28. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date, and where feasible, through an in-app notification. We encourage you to review this page periodically. Your continued use of the Service after changes constitutes your acceptance of the updated policy. For material changes that affect your rights under GDPR, we will seek renewed consent where required.

29. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: privacy@kiwirecipes.app

Dual Alliance Tech, LLC, Pleasanton, CA, United States. EU/EEA residents may also contact our designated EU representative under Article 27 GDPR (details in Section 11).

创作者用户名与已发布内容

如果您选择一个发布者用户名(例如 @yourname),该用户名为公开信息。它会向任何查看您所发布菜谱的人展示——包括未登录、通过分享链接或二维码打开菜谱的人——并附加于您所发布的内容上。请将您的用户名视为公开的显示名称,不要包含您不希望公开的个人信息。

当您发布菜谱时,您所发布的内容——包括菜谱、您已编辑或添加的提示,以及您明确选择附带的任何照片——将变为公开可见,并归属于您的用户名。已发布的内容可能被我们或第三方(例如搜索引擎)缓存或编入索引,并且即使在您更改用户名或删除原始内容后,仍可能对您分享的对象保持可访问。

为展示菜谱的受欢迎程度,我们记录有限的按家庭维度的互动标记——例如哪个家庭收藏或保存了已发布的菜谱——并用以计算公开计数(例如收藏某菜谱的厨房数量)。这些标记用于运营互动功能,不用于构建广告画像。

您停止使用的用户名将被退役,且不会被提供供再次使用。如果您删除账户,我们将对您已发布菜谱上的归属信息进行匿名化处理(移除内容与您之间的关联)并退役您的用户名;接收方已保存的菜谱内容副本可能继续可用。您在更改用户名或删除账户之前所发布内容的快照可能继续留存。