Privacy policy

Last updated 11 October 2026

This describes what the Tare app and this website actually do with your information. It is written from the real contents of the database rather than from a template, so it is short, and everything in it is true. It is one policy for both: the app Tare and the website tare.cooking.

The short version

Tare holds your email address and the recipes, notes and meal plans you put into it. It is stored in the European Union. There is no advertising, no analytics and no tracking, in the app or on this website; the only outside components in the app are Google's notification delivery, which does nothing unless you turn a notification on, and Expo's update service, which Tare asks whether a newer version exists. Nothing is ever sold or shared for marketing. The one thing worth knowing beyond that: if a recipe you captured kept the website's own photograph, your phone fetches that picture from that website and keeps it for a while, the way a browser does, so the website sees your device about once a month — what that means. You can delete everything whenever you like.

Who is responsible

The controller of your personal data, in the sense of the GDPR, is:

Timothy Lauren Wickens
c/o flexdienst – #22029
Kurt-Schumacher-Str. 74
67663 Kaiserslautern
Deutschland
Email: support@tare.cooking

Tare is a small project run by one person. The same details, in the form German law asks for, are in the Impressum.

What Tare stores on its server

This is the complete list.

What	Detail
Your account	Your email address, and a password. The password is stored hashed — never in a readable form, and it cannot be read back by anyone including us. The sign-in system also keeps a short technical log of sign-in events — when they happened and from which network address — which exists to spot break-in attempts and is not used for anything else. Those entries are kept for a limited period set by our host, Supabase (days, not months), and are then discarded automatically. If you choose to sign in with Google instead of an email and password, Google's sign-in service hands our host the email address, the name and the profile-picture link it holds for you, and these are kept in the sign-in record; no password exists for such an account. Google learns that you signed in to Tare, and when. Signing in with your email never involves Google at all. If you choose to sign in with Apple, Apple's sign-in service hands our host the email address it holds for you — or, if you chose Hide My Email, a relay address that Apple forwards to you — and this is kept in the sign-in record; no password exists for such an account. On an Android phone, where Apple's sign-in page opens in a browser tab, the name Apple offers the first time is kept there too, as Google's is; on an iPhone it is not kept. Apple learns that you signed in to Tare, and when.
Your profile	Your email address, and a display name if you set one.
Your plan	Whether your account stands on the free shelf or is covered by a plan. A free account has no row at all — the absence is the answer — so for most people there is nothing here. Where there is a row it names the plan, when it was granted, and at most a short administrative note (for example, that it is a tester's complimentary plan). Once a subscription can be bought, a paid plan's row will also name which store sold it, the store's own reference number for the subscription, and the date the store last said it runs to — never a card, a name on a card or a price, which the store keeps. No row holds any of that today.
Cookbooks	Their names, who is in each one, each person's role (owner, can edit, or viewing), whether they share a kitchen, and when they joined.
Invite codes	Ten-character single-use codes, who created them, who used them, when they expire, what the code is an invitation to (a cookbook's recipes, or its meal plan as well), and whether that meal-plan offer has been taken up.
Recipes	Title, servings, prep and cook times, notes, the source web address if there is one, the ingredient lines exactly as they were written, the amounts Tare read from them, the method steps, courses and tags, who created the recipe, and where the recipe's words came from — typed in, captured from a web page, read out of a file, or not known. That last one is a fact about the recipe rather than about you: it records whether Tare fetched the words, never who did anything, and it exists so that anything built later which sends a recipe beyond its cookbook can leave somebody else's writing behind. Alongside those, three small facts about the recipe itself: whether it is open or waiting on the shelf (a free cookbook opens fifty recipes and lists the rest by name until there is room), whether its serving count was confirmed by a cook or copied from the page or file it came from, and, where a recipe was copied from another of your cookbooks, which recipe it was copied from. All three describe a recipe and none of them records anything about a person.
Photographs	There are two kinds, and a recipe never has both. A photograph you took or chose yourself is held in a private storage area reachable only through short-lived signed links; it is not publicly addressable. A photograph that came with a recipe you captured from a website is not stored at all — Tare keeps only its address on that website, and your phone fetches it from there. This has a consequence for you and it is described below. Either kind may also carry the framing you chose, kept as proportions of the picture rather than by cutting it.
Cook's notes	Remarks written while cooking, with who wrote them and when.
Favourites	Which person marked which recipe as a favourite.
Meal plan	Which recipe or typed note was planned for which day and meal, and how many servings that meal was planned for. This is kept for as long as the cookbook exists, so the record of what was actually eaten stays true.
Shopping list	What the people who share a kitchen have put on their shared shopping list: a name, an amount where Tare read one, which library ingredient and which recipe it came from, which planned meal put it there if it came from the meal plan, how many servings it was scaled to, and when it was ticked off. No person is recorded on a line — not who added it and not who ticked it. It is visible to the people who share that kitchen and to nobody else, and it is deleted with the cookbook.
Unread ingredient words	When Tare cannot read an ingredient line exactly, it records the words it did not recognise and how often they appeared, within that cookbook. This is used to improve the ingredient library. It contains ingredient text that somebody typed, which is why it is listed here.
Ingredient names your cookbook taught Tare	When Tare reads an ingredient it does not know and the line gives an amount, it remembers the name, kept with the cookbook it came from. From then on that word means something inside that cookbook and nowhere else. These are words somebody typed, which is why they are listed here. You can see them and remove any of them under Ingredients in the app. Nothing records who typed them, and they are deleted with the cookbook.
Notification switches	Only for a phone on which you turned a notification on: a push token for that phone (the address Expo and Google use to reach it), which of the two notifications you asked for, when you turned one on, and when the phone last opened Tare. Nothing is stored for anybody who never turned one on. Turning both off deletes it, and so does signing out on that phone; a token whose phone has not opened Tare for ninety days is deleted automatically. See notifications below.
Notifications waiting to be sent	Who is owed a message about which cookbook, of which kind, and — for a message about a new recipe — which recipe: ids only, no words. Kept for at most seven days, sent or not.

What is stored on your phone

Your settings (units, whether photographs are shown, whether the screen stays awake, light or dark, which spelling of English), a saved copy of your recipes, meal plan and shopping list so the app works with no signal, a temporary copy of the recipe photographs your phone has drawn — bounded, expiring and cleared like a browser's cache, as described under the recipe's photograph — and anything you did with no signal that has not been sent yet — a cook's note, a whole recipe, the photograph attached to one, or a change to the shopping list.

All of it is deleted when you sign out or delete your account.

Four more things are kept on the phone. They are facts about the phone rather than your account, so signing out does not clear them, and none is sent anywhere by itself:

The kitchen timers you have running — which recipe and step, how long, and when each ends. Each is forgotten an hour after it ends.
A record of the last time Tare closed unexpectedly — the error's message and where in Tare's own code it happened, which screen was open, Tare's version, the phone's Android version, and when. Nothing about you, your recipes or your cookbooks. Tare offers to send it to us as an email that you read before it goes, from your own email app; it stays until you send it or dismiss it.
The identifier of the last notification you tapped — a random id the phone itself made up when it showed the notification, kept so that a tap Android reports twice is acted on once. Nothing about you and nothing about what the notification said.
From version 1.6.0: an invite code that arrived by a tapped link (https://tare.cooking/join/…) and has not yet been put into a join box — the ten characters somebody sent you, nothing about you. It is taken once, by the screen with the join box, and reaches our server only when you tap Join, exactly as a typed code does. Opening such a link also means this website is asked for a page whose address contains the code, which Cloudflare's short-lived request logs record like any other page request.

When you add a recipe from a website

There are three ways to do this and they do not behave the same, so all three are described.

Pasting a link

When you paste a recipe's web address into Tare, Tare's own server fetches that page on your behalf and reads the recipe out of it. The website you are capturing from therefore sees a request from Tare, not from you — your device's address is not passed to it. The page is read and discarded; only the recipe you choose to save is kept.

Sharing a link into Tare

You can also send a recipe's address to Tare from another app — a browser, a messaging app — through Android's own share sheet. What reaches Tare is the address and nothing else: not which app you shared from, not anything else that was on the screen there. From that point it is handled exactly as a pasted link above, with Tare's server fetching the page rather than your phone.

Using the browser built into Tare

When you browse to a site inside Tare instead, you are visiting that site directly, exactly as you would in any browser, and that site can see your device in the ordinary way. Its own privacy policy applies to that visit, not this one. Third-party cookies are switched off in Tare's browser, and what it stores is kept separate from every other app on your phone.

That browser opens on DuckDuckGo. The Find one page turns the choices you make there into an ordinary web search and opens the results in that browser, and Just browse opens DuckDuckGo's front page. So when you use either, DuckDuckGo receives the search words and your device's request, exactly as it would if you searched there in any browser, and DuckDuckGo's own privacy policy applies to that. DuckDuckGo states that it does not save your searches or your IP address; that is its statement, not ours. Tare does not send those searches anywhere else and does not keep them.

The recipe's photograph

If you keep the photograph that came with a captured recipe, Tare does not copy it. It saves only the picture's address on the website it came from. That means your phone asks that website for the picture, and that website can therefore see your device's address, when you looked, and — from the address of the picture itself — roughly what you are cooking.

We would rather tell you this plainly than leave it out. It is the one place in Tare where a company other than the ones listed further down learns anything about you, and it happens quietly rather than at a moment you chose.

Your phone keeps what it has fetched, the way a browser does, so the website is asked about once a month for each photograph rather than every time you open the recipe. That copy lives on your phone only: it is limited in size (about 340 MB at most, across every photograph), it is dropped after thirty days or sooner when room is needed, Android may clear it at any time, and it is never uploaded, never shared and never put in an export. It is deleted when you sign out or delete your account. Tare's servers still hold no copy.

It applies only to recipes captured from a website. A photograph you took yourself is in Tare's own private storage, and no other website is ever contacted for it.
Why it works this way: the photograph is the part of a recipe page that most clearly belongs to whoever made it, so Tare does not take a copy and re-publish it. It also means the picture can travel with your recipes when you download your data.
A picture shown this way can stop working if that website removes it. Tare says so on the recipe rather than pretending otherwise.

When you bring recipes in from a file

Tare can read a file of recipes you already have — one Tare wrote for you, or an export from another recipe app. You choose the file through Android's own document picker, or share it to Tare from another app through Android's Share menu, and either way Tare is given access to that file and nothing else.

Reading a file needs no permission to read your storage, and Tare cannot see, list or search anything you have not handed it.
Nothing is collected and nothing is sent anywhere new. The recipes go into your own account exactly as if you had typed them.
If the file came from another recipe app, Tare can offer to go and find each recipe's photograph by fetching the page it came from. That is the same fetch described under Pasting a link above, made by Tare's server rather than by you, and you can stop it at any point.
If the file carries a picture beside a recipe, what happens depends on whether that recipe names a website. Where it does, the picture is that website's photograph: Tare does not upload it or keep it. Where the recipe names no website, the picture is treated as your own photograph of your own dish and is uploaded to Tare's private storage, made smaller first, exactly as a photograph you attach with the camera. Before anything is saved, Tare tells you how many recipes bring their own photographs.

When you share a recipe

Tapping Share on a recipe hands Android's own share sheet a block of plain text — the title, the servings and times, the ingredients as your phone is showing them, the method, any footnotes from the original page, and a line saying where the recipe came from. You choose which app receives it, exactly as you would when sharing anything else on your phone.

The photograph is not sent, and neither are cook's notes. A note is somebody's remark with their name on it, so it stays in the cookbook it was written in. No other person's name, favourite or membership is sent either.
Nothing goes to Tare's server, and no other company is involved. Tare does not record which app you chose, or whether you changed your mind and closed the sheet. What happens to the message afterwards is between you and whoever you sent it to.

When you turn notifications on

Tare can tell you two things, and only if you switch each one on: that somebody else added a recipe to a cookbook you are in, and that the meal plan of the kitchen you share changed. Both are off until you turn them on. Tare asks Android's permission at the moment you turn one on, never when the app first opens.

When you turn one on, Tare stores a push token for that phone with your two switches, as listed in the table above. No token is stored for anybody who never asked. Turning both switches off deletes it; so does signing out on that phone, and deleting your account.

A notification names the cookbook and nothing else — A recipe was added to Weeknights. It never names a person or a recipe, and it never says what changed. The cookbook's name is a word its owner typed, and it travels through Expo's push service and Google's Firebase Cloud Messaging to reach your phone. Nothing about you is measured by either of them on Tare's behalf.

A kitchen timer is different: your phone sets it for itself. When you start a timer beside a step, the phone's own alarm shows it when time is up — for example 10 min is up — Lentil soup, step 4 — on your own lock screen. Nothing leaves the phone: no token, no server, no Expo, no Google. Tare asks permission at the first timer you start; if you refuse, the timer still counts down on screen and the phone just does not sound it.

Where your data is kept

Tare's database, accounts and the photographs it holds are hosted by Supabase, in Amazon Web Services' Ireland region (eu-west-1). Your personal data is therefore stored inside the European Union. (A captured recipe's photograph is not held by Tare at all — it stays on the website it came from, as described above.)

Supabase's parent company is based in the United States. That relationship is governed by a data processing agreement with the standard contractual clauses, rather than by geography.

Tare runs four small server functions, which execute at whichever data centre is nearest the request rather than necessarily in Ireland. They are:

Recipe capture — fetches a recipe page you have asked for, reads it, and returns the result to your phone. It stores nothing.
Account erasure — carries out the deletion when you delete your account. It stores nothing.
Sending notifications — once a minute, and only when a message is waiting, it reads the outbox described above, sends what is owed, and marks it sent. That mark is the only thing it writes; it also deletes outbox rows older than seven days, and forgets a push token whose phone has uninstalled Tare or has not opened it for ninety days.
Subscriptions — once a subscription can be bought, Google Play tells this function when one starts, renews, is cancelled or ends, and your phone tells it the same after a purchase. It asks Google about that purchase and, from Google's answer alone, writes or removes the plan row described in the table above — which store, the store's reference for the subscription, and the date it runs to. It stores nothing else. So that Google can match a subscription to your account, your phone gives Google Play Tare's own account id for you at the moment you buy — an opaque id, never your name or email.

Like any host, Supabase keeps short-lived technical logs of the requests it receives — the time, what was asked for, and the requesting network address — for a period Supabase sets (days, not months), used only to keep the service running and secure.

Outside the European Union

Some of the companies involved are in the United States, so a little does leave the EU in the ordinary course of using Tare. When the app asks Expo, a United States company, whether a newer version exists, that request goes to Expo's servers there; and if you turn a notification on, your push token and the cookbook's name pass through Expo's push service and Google's Firebase Cloud Messaging on the way to your phone. If you choose Continue with Google, Google's sign-in service is involved in the same way; Continue with Apple involves Apple's sign-in service, also a United States company, in the same way. Cloudflare, which serves this website and forwards support email, Google again as the provider of the mailbox that support email lands in, and Resend, which sends Tare's confirmation and password-reset emails — and our replies to support email — from servers in Ireland, are also United States companies. Each of these companies is either certified under the EU–US Data Privacy Framework or bound by the European Commission's standard contractual clauses in its data processing terms, which is the legal basis for those transfers under Articles 45 and 46 GDPR.

There is no European Commission adequacy decision covering the United States generally. For the companies certified under the EU–US Data Privacy Framework, the Commission's adequacy decision of 10 July 2023 applies to them, and their certification can be looked up by name on the Data Privacy Framework list at dataprivacyframework.gov/list. For the rest, the safeguard is the European Commission's standard contractual clauses in that company's data processing terms. If you would like a copy of the clauses that apply to a particular company, email support@tare.cooking and you will be sent one.

Who else is involved

Who	What for
Supabase	Hosts the database, the accounts and the photographs Tare holds.
Expo (EAS)	Delivers updates to the app, and carries the notifications you switched on to Google for delivery. Tare asks Expo whether a newer version exists, so Expo sees that a phone running Tare asked, which build it was on, and the ordinary technical details any server receives from a request. It is not told who you are, and nothing about your account or your recipes goes with the question.
Google Play	Distributes the app, once it is listed. Once a subscription can be bought, Google Play sells it: it takes the payment, holds your card and the invoice, renews and cancels, and tells Tare which account subscribed and until when. Tare never sees a card, a name on a card or a price paid.
Google (Sign-in)	Only if you choose Continue with Google: Google's sign-in service sees that you signed in to Tare and hands our host the email address, name and profile-picture link it holds for you. Signing in with your email never involves it.
Apple (Sign in with Apple)	Only if you choose Continue with Apple: Apple's sign-in service sees that you signed in to Tare and hands our host the email address it holds for you — or, if you chose Hide My Email, a relay address that Apple forwards to you — and, the first time only, your name, which is kept in your sign-in record on an Android phone and not kept on an iPhone. Signing in with your email never involves it.
Google (Firebase Cloud Messaging)	Delivers notifications to Android phones — the only way an Android phone can receive one. It sees the push token for your phone and the sentence being delivered, which names a cookbook and nothing else. This is the one Google component inside the app, and it does nothing unless you turn a notification on.
Cloudflare	Hosts this website and forwards mail sent to support@tare.cooking.
Resend	Sends the emails Tare needs to send you — confirming your address when you sign up, and the code for resetting a forgotten password. It receives your email address and the contents of those messages. Nothing else is sent through it: there is no newsletter and no marketing email. If you write to support@tare.cooking, our reply goes out through Resend too, so it also receives your address and what we write back. The sending servers are in Ireland; Resend's own records of what it sent (address, contents, delivery log) are kept in the United States under the safeguards described above.
DuckDuckGo	Only when you use the Find one page or Just browse, which open DuckDuckGo's search in Tare's own browser, as described above. DuckDuckGo then receives the search and your device's request exactly as it would from any browser. Nothing about it goes to Tare's server.
Recipe websites	Only as described above — when Tare's server fetches a page you asked for, when you visit a site in Tare's own browser, and when your phone fetches a captured recipe's photograph from the site it came from, which happens about once a month for each photograph, because the phone keeps what it has fetched.

That is the entire list. There is nobody else.

What Tare does not do

No analytics. Nothing measures how you use the app.
No advertising, and no advertising or tracking SDKs. Two third-party components sit inside the app and neither measures anything: Google's Firebase Cloud Messaging, which delivers the notifications you switched on, and Expo's updater, which asks whether a newer version of Tare exists.
No location, no contacts, no microphone.
The camera and photo library are used only at the moment you add a photograph to a recipe. On Android 12 and older, Android grants access to your photos through its storage permission, so that is what Tare asks for there; it opens only the picture you choose.
Tare never goes looking through your files. It reads a file only when you hand it one through Android's own picker, and only that file.
Nothing is sold, rented or shared with anybody for marketing, ever.
No profiling and no automated decision-making.

Why we are allowed to hold it

To give you the app you signed up for — your account, your recipes, your cookbooks and everything in them. Article 6(1)(b) GDPR: performing a contract with you.
To keep the service working and safe, and to improve the ingredient library from words it could not read. Article 6(1)(f) GDPR: our legitimate interest in running a working, secure app. You can object to this at any time.
To send you the notifications you switched on — the push token and your two switches. Article 6(1)(a) GDPR: your consent, which you give by turning a notification on and withdraw by turning it off again. Withdrawing it deletes the token; it does not affect anything done while it was on, and it does not affect the rest of your account.

How long it is kept

For as long as you have an account. When you delete your account, the deletion is immediate and is described in full on the delete your account page — including the parts that stay behind because they belong to a shared cookbook rather than to you. Ordinary backups may hold a copy for a short period before they roll over.

What you have to give, and what happens if you do not

None of this is required of you by any law. It is what Tare needs in order to be Tare:

An email address and a password — or a Google account, if you would rather sign in that way. Without one of the two there is no account, and without an account there is nowhere to keep your recipes, so Tare cannot be provided to you at all. It is a requirement of the agreement between us rather than of the law.
Everything else is yours to give or not. A display name, a photograph on a recipe, a cookbook shared with somebody else, a note written while cooking — leave any of them out and the rest of Tare works exactly as before.
Notifications are the clearest case: nothing at all is stored for a phone that never turned one on, and turning one off again deletes what was stored.

Why what is kept on your phone needs no consent

German law (§ 25 TDDDG) says that storing things on your device needs your consent unless it is strictly necessary for providing the service you asked for. Everything in what is stored on your phone, further up, is in that second category: your settings, the copy of your recipes that makes the app work in a kitchen with no signal, anything you wrote while offline and that has not been sent yet, and the temporary copy of photographs described above. Working without a signal is one of the things Tare is for, not something added on the side, and none of it measures you or is shared with anybody. Tare does not read or store an advertising identifier, and nothing it keeps follows you into another app or onto a website — which is the other reason nothing on this list is ever put to you as a choice. The one identifier that exists at all is the push token described above, which belongs to a phone whose owner switched a notification on, and which is deleted when they switch it off. All of it is deleted when you sign out or delete your account.

Notifications are the one thing in Tare you are genuinely asked to agree to, and they are asked for separately, at the switch. Everything in this section is the app storing its own work on your own phone so that it can be the app you installed.

Your rights

Under the GDPR you may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how it is used, and to receive it in a portable form. Two of those you can do yourself without asking anyone:

A copy of everything — open Tare, tap the button in the top-right corner, and choose Download my data. It is written as one file into a folder you choose on your phone.
Deletion — see delete your account.

For anything else, email support@tare.cooking. You will get an answer within a month, which is what the GDPR allows; in practice it will be much sooner. Asking costs you nothing.

You also have the right to complain to a data protection supervisory authority, and you can do that in the EU country where you live or work, or where you think something has gone wrong. You do not have to write to us first, although we would rather you did, because we can usually fix it faster than anybody else can.

Tare has no data protection officer, and is not required to have one: it is one person, it holds nothing in the GDPR's special categories, and it does not monitor anybody. Write to the address above and you reach the person responsible directly.

This website

This website sets no cookies, runs no JavaScript, loads nothing from any other company, and has no analytics. That is why there is no cookie banner — there is nothing to consent to.

The pages are served by Cloudflare, which processes the ordinary technical information any web server receives — the address of the page requested and the requesting IP address — in order to deliver the page and to protect the site from abuse. That is Article 6(1)(f) GDPR, legitimate interest. We do not build profiles from it and we do not keep our own copy.

Email to support@tare.cooking

Mail sent to that address is forwarded by Cloudflare Email Routing into Tare's own Google account, so Google holds it. Our reply is sent from the same address through Resend, which therefore sees your address and what we write back. If you email us, we hold your message and your address for as long as it takes to deal with what you wrote about, and for a reasonable period afterwards in case you write again. That is Article 6(1)(f) GDPR — our legitimate interest in answering the people who write to us — or Article 6(1)(b) where your message is about your own account.

Reports. Report this recipe, at the foot of a recipe, and Report on a person in a cookbook open an email to this address in your own mail app, already filled in: for a recipe, its title and the identifiers we need to find it; for a person, the name the cookbook shows for them, their account identifier and the cookbook's name. Nothing is sent unless you send it, and Tare stores nothing about a report. A sent report is support mail like any other. Because it names somebody who did not write it, we use those details only to look into what was reported. That is Article 6(1)(f) GDPR — the legitimate interest of everybody in a shared cookbook in being able to raise content or conduct with us, and ours in acting on it.

Children

Tare is not directed at children. You need to be at least 16 to have an account — the age at which, in Germany, a person can agree to this sort of thing for themselves. Tare does not knowingly hold data about anybody younger. If you believe a child has created an account, email support@tare.cooking and it will be removed.

Nothing in Tare advertises to anybody, recommends anything based on what they do, or shows what they have written to anyone outside the cookbooks they were invited into. That is true of every account, and it is the reason there is not a separate set of rules for younger ones.

Changes to this policy

If what Tare stores changes, this page changes with it and the date at the top is updated. If a change is significant, you will be told in the app rather than left to notice it here.

Contact

support@tare.cooking reaches a person. It is the only support address Tare has, and it is the same one shown in the app.