Last updated: May 29, 2026, Version: 1.1
1. Data Controller Identification
| Field | Details |
|---|---|
| Publisher | Le French Code |
| Application | Kisscooks (com.lefrenchcode.Kisscooks) |
| Website | lefrenchcode.com |
| DPO / Privacy contact | support@kisscooks.com |
| Address | Bureau 326, 59 rue de Ponthieu, 75008 Paris |
| Platforms | iOS, Android, Web |
We are committed to protecting our users’ privacy and processing their personal data in accordance with the General Data Protection Regulation (GDPR) (EU 2016/679) and applicable national legislation.
2. Scope
This policy applies to:
- The Kisscooks mobile application available on the App Store (iOS) and Google Play Store (Android);
- The web application accessible via browser;
- Any interaction with our services (API, push notifications, support).
3. Personal Data Collected
3.1 Data Provided Directly by the User
| Category | Data | Purpose |
|---|---|---|
| Identity | First name, display name (username), email address | Account creation and management |
| Culinary profile | Skill level, available time, equipment | Content personalization |
| Dietary preferences | Diets, allergens, medical restrictions | Recipe filtering and recommendation |
| General preferences | Number of people, caloric goals, language | Experience personalization |
| User content | Recipes, menus, shopping lists, photos, saved links | Service provision |
| Support | Problem description submitted via the help form | Support request processing |
Sensitive data: Medical dietary restrictions (allergies, medical diets) constitute health data under the GDPR. Their collection is based on the user’s explicit consent (Art. 9(2)(a) GDPR). The user may delete them at any time in their settings.
3.2 Automatically Collected Data
| Category | Data | Purpose |
|---|---|---|
| Device | Unique device identifier, platform, device type | Session management and notifications |
| Push notifications | Notification token, platform | Sending notifications |
| Network | Network connection status | Interface adaptation (offline mode) |
| Analytics | Usage events, page views, application version | Service improvement (under consent) |
| Authentication | JWT tokens (access and refresh), expiry date | Session maintenance |
3.3 Data Received from Third Parties upon Social Login
| Provider | Data Received |
|---|---|
| Apple Sign In | Email address (optional), first name, last name |
| Email address, first name, last name, profile photo |
Only the data necessary for account creation is imported. We do not store third-party service access tokens beyond what is necessary for authentication.
4. Legal Bases for Processing
| Processing | Legal Basis (GDPR) |
|---|---|
| Account creation and management | Performance of contract (Art. 6(1)(b)) |
| Content personalization | Performance of contract (Art. 6(1)(b)) |
| Health data / medical dietary restrictions | Explicit consent (Art. 9(2)(a)) |
| Analytics and audience measurement | Consent (Art. 6(1)(a)) |
| Non-essential cookies | Consent (Art. 6(1)(a)) |
| Push notifications | Consent (Art. 6(1)(a)) |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Legal and fiscal obligations | Legal obligation (Art. 6(1)(c)) |
| Subscription and payment management | Performance of contract (Art. 6(1)(b)) |
5. Purposes of Processing
Data collected is used to:
- Provide the service: account creation, authentication, access to recipes, menus, and shopping lists;
- Personalize the experience: recommendations based on culinary profile and preferences;
- Enable social features: subscribing to authors, content sharing, list collaboration;
- Manage subscriptions: in-app purchase processing, premium access validation;
- Improve the application: usage analysis (under consent), bug fixes;
- Ensure security: detecting abnormal behavior, protection against abuse;
- Process support requests: ticket responses, content reporting;
- Send notifications: cooking reminders, community alerts (under consent).
6. Subcontractors and Third Parties
6.1 Subcontractor Table
| Provider | Role | Location | Data Transmitted | Guarantees |
|---|---|---|---|---|
| Supabase | Authentication, database | EU / United States | Email, identity, auth tokens | Signed DPA, SCCs |
| PostHog | Behavioral analytics | EU (EU cloud option) | Anonymized events, user ID, app version | DPA, GDPR compliance |
| RevenueCat | In-app subscription management | United States | User ID, platform, subscription status | DPA, GDPR/CCPA compliance |
| Cloudflare Turnstile | Anti-bot protection (CAPTCHA) | Worldwide | Navigation data, session fingerprint | GDPR compliance |
| Apple Sign in with Apple | Apple authentication | United States | Apple identity token | Apple Privacy Framework |
| Google OAuth | Google authentication | United States | Google profile (email, name) | SCCs, Google DPA |
| Socket.io / Internal API | Real-time (list collaboration) | Own infrastructure | List content, user session | Secured (TLS, JWT auth) |
6.2 Transfers Outside the EU
Some providers (RevenueCat, Apple, Google) process data in the United States. These transfers are governed by:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- Data Processing Agreements (DPAs) concluded with each provider;
- Where applicable, the EU-US Data Privacy Framework.
7. Cookie and Tracker Management
7.1 Types of Cookies Used
| Category | Examples | Duration | Consent Required |
|---|---|---|---|
| Essential | Session, CSRF, language preferences | Session / 1 year | No (always active) |
| Functional | Saved filters, dark mode | 1 year | Yes |
| Statistics | PostHog (in-memory events) | Session | Yes |
| Marketing | Advertising personalization | 1 year | Yes |
7.2 Consent Management
On first use, a consent banner is displayed. The user can accept all, reject all (except essentials), or configure their preferences by category.
The choice can be modified at any time in Settings > Privacy.
PostHog is configured in persistence: 'memory' mode: no cookie is written to disk until consent to statistics is granted.
8. Push Notifications
Sending push notifications is subject to your explicit consent, requested during onboarding or in the app settings.
You can revoke this consent at any time:
- iOS: Settings > Notifications > Kisscooks
- Android: Settings > Apps > Kisscooks > Notifications
- In the app: Settings > Notifications
9. Access to Device Features
| Feature | Usage | When Requested |
|---|---|---|
| Camera | Taking photos for recipes or assisted input | On user request |
| Photo library | Selecting an existing image | On user request |
| Push notifications | Cooking reminders, alerts | Onboarding or settings |
All these permissions can be revoked in your device’s system settings. Denying a permission does not prevent the use of other features.
10. Retention Periods
| Data | Retention Period |
|---|---|
| Active account data | Duration of account lifetime |
| User content (recipes, menus, saved links) | Account lifetime + 30 days after deletion |
| Technical and security logs | 12 months |
| Analytics data | 13 rolling months |
| Payment / subscription data | 5 years (accounting obligations) |
| Support tickets | 3 years |
| Consent data | 3 years from consent |
| Push tokens (after revocation) | Immediate deletion |
After account deletion, all personal data is erased within 30 days, except for data subject to a legal retention obligation.
11. User Rights (GDPR)
| Right | Description | How to Exercise |
|---|---|---|
| Access (Art. 15) | Obtain a copy of your data | Settings > Account > My data |
| Rectification (Art. 16) | Correct inaccurate data | Profile editing directly in the app |
| Erasure (Art. 17) | Delete your account and data | Settings > Account > Delete account |
| Restriction (Art. 18) | Temporarily restrict processing | Contact support@Kisscooks.com |
| Portability (Art. 20) | Export your data in a readable format | Settings > Account > Export my data |
| Objection (Art. 21) | Object to processing based on legitimate interest | Contact support@Kisscooks.com |
| Withdrawal of consent | Withdraw a previously given consent | Settings > Privacy |
Response time: 30 days (extendable to 3 months for complex requests, with prior notification).
Complaint: You may lodge a complaint with the CNIL (www.cnil.fr (http://www.cnil.fr/)).
12. Data Security
Technical Measures
- Encryption of data in transit (TLS 1.2+) on all communications
- Encryption of data at rest in the database
- JWT token authentication with automatic expiry and secure refresh
- Anti-bot protection via Cloudflare Turnstile on sensitive forms
- API access protected by Bearer tokens
- API architecture separate from the application backend
Organizational Measures
- Data access limited to authorized personnel
- Subcontractors subject to DPAs (data processing agreements)
- Regular audits of access and permissions
Data Breach
In the event of a data breach likely to pose a risk to your rights and freedoms, we will notify:
- The competent supervisory authority within 72 hours;
- Affected users as soon as possible.
13. Minors
The Kisscooks application is intended for persons aged 13 and over (or the applicable digital age of consent in your country, up to 16 in certain EU Member States).
We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with data without parental consent, please contact us at privacy@Kisscooks.com.
14. Third-Party Content and External Links
The application allows saving links to external URLs (“Web Favorites” feature). These third-party sites are subject to their own privacy policies. Kisscooks is not responsible for the practices of these sites.
Links to external services (sharing, social networks) redirect you outside our application. We invite you to consult the privacy policies of these services.
15. Amendments to This Policy
In the event of a material change:
- A notice will be displayed in the application;
- A notification email will be sent to registered users;
- The “Last updated” date will be updated.
Continued use of the application after a change constitutes acceptance of the new policy.
16. Contact
- Email: support@Kisscooks.com
- In-app form: Settings > Help & Support
- Postal address: Le French Code, Bureau 326, 59 rue de Ponthieu, 75008 Paris
17. Supervisory Authority
France, CNIL
Commission Nationale de l’Informatique et des Libertés
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
www.cnil.fr (http://www.cnil.fr/)
This privacy policy was drafted in accordance with the GDPR (Regulation EU 2016/679), the amended French Data Protection Act (loi Informatique et Libertés), and the guidelines of the European Data Protection Board (EDPB).