Privacy policy

Version 2026-10-12.

1. Data controller

Joan Ramon Vilaplana (tax ID 47419606T), 08254 Barcelona (España). Privacy contact: joan.rra2@gmail.com.

2. What data we process

  • Account: name, email address and password (stored encrypted).
  • Sign in with Google: if you choose "Continue with Google", Google gives us your name, your email address and an identifier of your Google account. We never receive your Google password or access anything else in your account.
  • Profile and preferences: people at home, cooking time, goals, budget, favorite cuisines, language, unit system and what you do not like.
  • Intolerances and allergies: these are health data. We only process them if you choose to provide them, to filter recipes and warn you. You can delete them whenever you want.
  • Your content: recipes, photos, comments, collections, plans, shopping lists and pantry.
  • Public profile: only if you turn it on (display name, bio, links).
  • Technical data: sessions, IP address and browser when you accept legal documents (as proof of consent), and your phone's identifier if you turn on push notifications.
  • Advertising: to show ads, Google (AdSense on the web and AdMob in the app) processes cookies or your phone's advertising ID, your IP address and data about the ad shown. See sections 4 and 7.

3. Why and on what legal basis

  • Providing the service you ask for (contract): account, plans, lists, recipes and in-app notifications.
  • Your intolerances, push notifications and public profile: your consent, which you can withdraw at any time.
  • Security, moderation and aggregated statistics to improve the service: legitimate interest.
  • Keeping proof that you accepted these documents: legal obligation and defense against claims.
  • Showing ads to fund Cocinoa: personalized ads and advertising cookies, your consent; non-personalized ads, legitimate interest.

We do not sell your data or share it with advertisers.

4. Who we share it with

  • The server hosting provider.
  • Firebase Cloud Messaging (Google) to deliver push notifications, only if you turn them on. This may involve transfers outside the European Economic Area with appropriate safeguards.
  • Google, only if you choose "Continue with Google": you sign in on its page and it confirms your name and email address to us. Google knows you have signed in to Cocinoa. This may involve transfers outside the European Economic Area with appropriate safeguards.
  • Machine translation services (DeepL and our own server) only for recipe texts, never for your personal data.
  • Open Food Facts to estimate prices: only product lookups, with no personal data.
  • YouTube (Google), only if you accept third-party content or play a video: it receives your IP address when the thumbnails or the player load. This may involve transfers outside the European Economic Area.
  • Instagram (Meta), only if you accept third-party content or open a post: it receives your IP address when the preview or the post loads. This may involve transfers outside the European Economic Area.
  • Google AdSense (on the web) and Google AdMob (in the app), to show ads, except during the first 7 days of your account. Google acts as an independent controller of the data it collects (how Google uses information from sites that use its services). This may involve transfers outside the European Economic Area with appropriate safeguards.
  • Resend, to send the service's emails (password reset, notices): it receives your email address and the message content. We use its European Union region; this may involve transfers outside the European Economic Area with appropriate safeguards.

5. How long

For as long as you have an account. When you delete it we erase your data, except the consent records, which we keep for up to 5 years so we can prove it, and whatever the law requires us to keep.

6. Your rights

You can access your data, correct it, delete it, object to or restrict its use, and take it with you: in your profile you will find "Download my data" and "Delete account". For any other request write to joan.rra2@gmail.com. If you think we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es).

7. Cookies and local storage

We use technical cookies needed to log in and protect forms, and the browser's local storage to remember the theme, the recipe view, the accessibility options and your cookie choice. These do not need your consent.

With your consent we show third-party content: the thumbnails of YouTube videos related to a recipe load from Google's servers, which receive your IP address and may use their own cookies (Google privacy policy). If you do not accept, videos appear without a thumbnail and the YouTube player (in its privacy-enhanced mode) only loads when you click to watch.

In the same way, the previews of Instagram posts related to a recipe load from Meta's servers through its official embed, which receives your IP address and may use its own cookies (Instagram privacy policy). If you do not accept, the post only loads when you click to view it.

If you click "Continue with Google", the Google page that opens uses its own cookies (Google's privacy policy). We do not contact Google until you click the button.

Advertising. To fund Cocinoa we show an ad every so many recipes in the catalog and, in the app, a full-screen ad after finishing some guided recipes; never while you cook. They are served by Google, which uses cookies (on the web) or your phone's advertising ID (in the app) to show them, limit how often you see the same one, measure them and prevent fraud and, only if you consent, to personalize them to your interests. Before showing ads we ask for your consent with Google's privacy message; if you refuse, you will see non-personalized ads. You can change your choice at any time from "Cookies" on the web or "Ad privacy" in the app, and manage Google's ads in My Ad Center. New accounts see no ads during their first 7 days.

We remember your choice for 12 months. You can change or withdraw it at any time from "Cookies" in the footer. We do not use analytics cookies.

8. Minors

Cocinoa is not intended for children under 14.

9. Security

We apply reasonable technical and organizational measures: encrypted connections, encrypted passwords, role-based restricted access and audit logs of administrative actions.

10. Changes

If we change this policy in a significant way we will publish a new version and ask you to accept it.