The privacy notice

Who we are

Vurna is provided by Tom Cragg, trading as CRAGG Studios, Mainstraße 12A, 65474 Bischofsheim, Germany. He is the controller responsible for your data under the GDPR; the same details are in the legal notice (Impressum). Write to support@vurna.app about anything on this page, including a request to see, correct or erase what we hold. Most days you'll hear back within one working day, and never longer than three.

What we keep

• Recipes and photos — what you wrote, imported or scanned, and the pictures with them.
• Plans, lists and kitchen — weeks you planned, what you shopped for, what's in the fridge and pantry.
• Household — for each person you cook for: their name, whether they are an adult, teen, child or toddler, how they eat, and their dislikes. With their permission (or yours, as their parent or guardian), also their allergies, health goals, activity level, age range and biological sex. They are records in the account holder's kitchen, not separate accounts. A household member does not need a Vurna account to contact support about information held about them.
• Your conversations — what you and Vurna said, so she can remember.
• Name, email and Kitchen № — how you sign in, and how other kitchens find yours.
• Subscription status — whether you're on Premium and which provider billed you. Paddle handles web checkout, while Apple or Google handles store purchases. Vurna receives purchase and subscription references, not the full card details you enter with those providers.
• Your 18+ answer — Yes or No to "Are you 18 or older?", and when you answered. We don't check it, and the question asks for no date of birth or ID. A No closes Vurna except managing your subscription, downloading your data, deleting your account, support and signing out.

Why age range and biological sex. For you, together with your activity level, they set the daily calorie and protein guide Vurna measures your meals against. For the other people at your table they are not used today: we keep them, only with permission, so that meals can be portioned per person when that feature arrives. They are always optional, and you can clear them at any time on the person's card or in About you.

Vurna's main Supabase database and file storage are hosted in the EU. This does not mean every recipient or subprocessor is confined to the European Economic Area. None of this information is sold or shared with advertisers. The same list is in the app, under Privacy → What Vurna keeps.

Health details, and our legal basis

Allergies, health goals, dietary restrictions and body details such as activity level, age range and biological sex are health data under Art. 9(1) GDPR. Vurna stores and uses them only as follows:

• You — your allergies, health goals and free-text dietary restrictions, with the explicit consent you give in the app. Your own activity level, age range and biological sex are optional and are not covered by that consent today.
• The other people at your table — their allergies, health goals, activity level, age range and biological sex, with their permission (or yours, as their parent or guardian), recorded for each person.

The legal basis is consent, Art. 6(1)(a) GDPR, and, because these are health data, explicit consent, Art. 9(2)(a) GDPR. Consent can be withdrawn at any time: yours in Vurna, a household member's on their card, through the account owner or by writing to support@vurna.app. Withdrawing stops future use and clears the details it covered.

Vurna gives general nutrition information and wellness guidance. It isn't medical advice and doesn't replace a doctor or dietitian, especially if you have a diagnosed condition, are pregnant, or take medication.

The three switches, and what they really do

Profile → Privacy contains choices for usage analytics, crash reports and email. A changed choice applies to future collection after the device has received and applied it. An offline device or an older app version may apply it later.

• Usage analytics — off unless you turn it on. Turning it off stops the relevant future collection after the device applies the change; it does not delete events already sent.
• Crash reports — on by default, and you can turn them off. We use them to find and fix faults. The setting controls Vurna's ordinary crash reporting after the device applies it; it does not erase a report already created or held by Sentry. Contact support if you want us to address reports already stored.
• Email from us — off unless you turn it on.

What leaves your phone, and when

Reading a recipe card starts on the phone. The text is recognised by Apple's own recogniser on an iPhone and Google's on an Android. That step needs no connection, and neither the photo nor its text leaves the phone. On an Android, Google's recogniser (ML Kit) does send Google metrics about how well and how often it works, which Google uses to maintain and improve it and to detect misuse.

Talking to Vurna with your voice also starts on the phone. Apple's speech recogniser on an iPhone and Google's on an Android turn what you say into text, on the phone itself wherever it can. Where it can't, the recording goes to Apple or Google to be transcribed, under their own privacy terms. Vurna receives only the text and keeps no recording.

What comes after does leave. Turning recognised text into a recipe, translating one, talking with Vurna, drafting a week, and drawing a photograph are all done by language and image models we don't run ourselves. That can mean your question, recipe text or a photo, and the conversation so far. To answer a request, Vurna sends what it needs, which can include household dietary preferences and allergies, to AI service providers that process it on our behalf. They may process it outside the EU, and they don't use it to train their models.

A diagnostics provider receives technical records about AI requests, such as the model used, cost, speed and errors, so we can measure and fix the service. These records contain no prompts or answers, but they can be linked to an account.

If notifications are already on for Vurna on your phone, the app registers that phone's push address (a device token) with your account, so that "Send to my phone" on vurna.app can reach it. Sending a recipe passes the token, the recipe's title and one short line through Expo's push service to Apple or Google, who deliver it. Signing out of the app on that phone stops pushes to it, but the token is kept, tied to that phone, so nobody else can take it over. Tokens are deleted when Apple or Google report that they no longer work. Deleting your account deletes the tokens in use on it and removes your link to any others.

Who else touches it

• Supabase — the database and the file storage, in the EU. This is where your kitchen actually lives.
• Paddle — handles web checkout and payment details. RevenueCat helps Vurna recognise subscription access. Vurna does not store the card details you enter with payment or store providers.
• PostHog — usage analytics, and only if you turned that switch on.
• Sentry — crash and fault reports. The device privacy choice controls Vurna's ordinary future reporting after the device applies it; changing it does not erase reports already created or held by Sentry.
• Resend — sends Vurna's emails, and keeps the address you leave on the countries page or at checkout so we can write once when the app reaches your country.
• Cloudflare — the human check on that same form, to keep automated sign-ups out. It sees details of your browser and connection while it runs, not your email address.
• AI service providers — the models described above, working on our behalf.
• A diagnostics provider — the technical record of those model requests.
• Expo — the push service that hands "Send to my phone" notifications to Apple or Google. It sees the phone's push token and the notification itself, and is based in the US.
• Apple and Google — provide sign-in and platform services and handle App Store or Google Play purchases. Vurna receives identifiers and purchase status needed for the selected service, not your store password or full card details.

Cookies and local storage

The phone app sets no cookies. When you use vurna.app in a browser, it stores only what the site needs to work, and two answers you give it:

• Sign-in cookies — set by Supabase once you sign in, to keep you signed in. Signing out removes them.
• vurna-tz — your browser's time zone, so "today" and your week show the right day. Set only on pages you see when signed in, and kept for a year.
• vurna-identity-attempt — set only while you link Apple or Google to your account. It lasts at most ten minutes and is deleted when you come back.
• Paddle — Paddle's payment script loads only on the Premium offer, checkout and payment pages, to show prices and take payment. It may store what it needs to do that, under Paddle's own privacy notice.
• Cloudflare Turnstile — loads only where that email form is: the countries page, and the checkout outside the app's countries. It is the human check on the form. It may store what it needs to do that, under Cloudflare's own privacy notice.
• vurna-consent — your two answers to the privacy choices on vurna.app while you are not signed in: usage analytics yes or no, and crash reports yes or no. Kept for six months, then you are asked again.
• vurna-lang — English or German, set only when you pick a language with the switch on vurna.app, so it opens in that language next time. Kept for a year.

Usage analytics (PostHog) and crash reports (Sentry) also run on vurna.app, under the same rules as in the app. Signed in, your account's Usage analytics and Crash reports switches decide, and you can change them under Account → Privacy. Not signed in, the privacy choices ask about each separately, and each stays off until you switch it on: nothing is measured for a purpose you did not say yes to. Neither stores anything in your browser: PostHog keeps nothing from one page load to the next, and Sentry sets nothing. vurna.app sets no advertising cookies and uses no other local or session storage. Change your privacy choices.

Taking it with you, and getting rid of it

You can use Vurna's export and account-deletion controls or contact support@vurna.app. Export information you wish to keep before deletion. The deletion process removes the active Vurna account and associated product records and attempts to remove its uploaded files. A failed step must be retried or resolved by support. The Kitchen number is retired to prevent reassignment.

Deleting Vurna, revoking Google or Apple sign-in, deleting the Vurna account and cancelling Premium are different actions. Account deletion does not by itself prove erasure of provider-controlled billing records, historical analytics or AI diagnostic records. Information deleted from the active Supabase database may remain until the relevant daily backup rotates out and can reappear if a backup is restored for disaster recovery, requiring the deletion to be reconciled again.

Your rights

You can ask to see what we hold, to have it corrected, to have it erased, and to take it elsewhere in a form a machine can read. The first and the last two are buttons in the app. For anything else, or if a button doesn't do what you needed, write to support@vurna.app — a person reads it.

When this changes

If what the app does changes, this page changes with it and the date below moves. It is checked against the app rather than maintained alongside it, which is the only version of this promise that survives contact with a release.