Privacy Policy

This website

This first section covers chefdrago.app only. The privacy policy of the Chef Drago app follows below.

Hosting. The site is served by Cloudflare Pages (Cloudflare, Inc.). To deliver pages and protect the site against abuse, Cloudflare processes technical data such as your IP address, browser type, the page requested and the time of the request.
Audience measurement without cookies. We use Cloudflare Web Analytics, which does not set cookies, does not use local storage to identify you and does not follow you across other websites. It gives us aggregate figures (pages viewed, referring sites, country, page speed).
No cookies, no ad trackers. This site sets no cookies and loads no advertising or social-media trackers, which is why there is no cookie banner.
The demo deck. The playable deck on the home page keeps one number in your browser’s local storage: how many dinners you decided on the page. It never leaves your device and you can clear it from your browser settings at any time.
App Store links. Download links carry a campaign label (ct, and pt for our App Store account) so that Apple’s App Analytics can tell us, in aggregate, which page led to a download. Apple’s own privacy policy applies on the App Store.
Contact. For any question about this website or your data: [email protected].

Chef Drago app — privacy policy

Last updated: October 17, 2026 (same text as in the app).

This Privacy Policy describes how Chef Drago collects, uses, retains, and protects the personal data of its users.

Chef Drago is an iOS cooking and meal-planning application offering recipes, batch-cooking features, and shopping lists.

We take the protection of personal data seriously and apply the principles of the General Data Protection Regulation (GDPR), in particular for users located in the European Union.

1. Data Controller

The controller of the personal data collected through your use of Chef Drago is:

Félix Bécu
Sole trader (entrepreneur individuel / auto-entrepreneur)
Activity: publishing and commercialising a consumer mobile application on a subscription basis.
SIREN: 922 490 891
SIRET: 92249089100046
RCS Nanterre: 922 490 891
Address: 38 rue des Mathurins, 75008 Paris, France
Email: [email protected]

Chef Drago is published by Félix Bécu (EI, SIREN 922 490 891), the data controller (“we”, “us”).

2. Data We Collect

We only collect the data necessary to operate Chef Drago and to improve the experience we provide.

2.1 Account and authentication data

When you create or use a Chef Drago account, we may collect:

your name
your email address
your age range, if you provide it
your unique user identifier
your authentication method — for example, Sign in with Apple
the information strictly necessary to manage your account

This data is used to create and secure your account, authenticate you, and keep your progress when you use the app on your device.

Legal basis: performance of the contract (providing the service you requested).

2.2 Dietary preferences

To personalise recipes and recommendations, Chef Drago may store certain preferences you provide, such as:

dietary preferences
foods you like or avoid
recipe preferences
constraints or criteria you enter in the app
meal-preparation preferences

This information is used to personalise recipes, recommendations, meal suggestions, and planning features.

Depending on their nature, some dietary preferences may reveal information relating to health or other special categories of data within the meaning of Article 9 GDPR. We therefore recommend that you do not enter medical or health information in Chef Drago that is not necessary for the app to function.

Where the information you enter does constitute health data within the meaning of the GDPR, it is processed only on the appropriate legal basis — in particular your explicit consent where consent is required.

Legal basis: performance of the contract for the personalisation necessary to the service and, where special-category data is actually processed, your explicit consent where the GDPR requires it.

2.3 Recipe history and interactions

We may record:

recipes you view
recipes you select or save
actions you take on recipes
preferences inferred from your interactions with recipes
recipes used in your planning
information needed to improve our recommendations

This data is used to improve the relevance of the recipes we suggest and to progressively personalise the experience.

Legal basis: performance of the contract and our legitimate interest in improving and personalising the service.

2.4 Shopping lists and user-created content

Chef Drago may store the content you generate or create in the app, such as:

shopping lists
meal plans
saved recipes or adaptations
other content you create or save in the app

This information is used to operate the corresponding features and to synchronise the data associated with your account.

Legal basis: performance of the contract.

2.5 Progress and gamification data

To operate Chef Drago’s gamification features, we may record — depending on the features available:

level and XP
completed quests
progress
ranking and league
results or statistics needed for game features
rewards and progression items

This data, depending on the features available, is necessary to operate the progression system and the social or competitive features offered in the app.

Legal basis: performance of the contract.

2.6 Purchase and subscription data

This app may offer optional in-app subscriptions. Where subscriptions are available, pricing, billing, and cancellation terms are presented at time of purchase and are billed through Apple’s App Store. Subscriptions, when offered, are managed via RevenueCat.

Where subscriptions or in-app purchases are active, we may process information needed to manage your subscription, such as:

a purchase or subscription identifier
the status of the subscription
information about the subscription period
information needed to restore or verify a purchase

Payments are made through Apple’s in-app purchase systems. Chef Drago does not directly receive your full payment-card details.

RevenueCat also sends us the dated history of your subscription (trial start, renewal, cancellation and its technical reason, expiry, refund). We use it to manage your access and to understand, alongside how you use the app, why subscriptions are cancelled, so we can improve Chef Drago. For this cancellation analysis, the legal basis is our legitimate interest in improving the service.

Legal basis: performance of the contract and compliance with our obligations relating to purchase management.

3. Data We Do Not Collect

In Chef Drago’s current configuration, we do not directly collect:

your precise or approximate location
your contacts
the photos on your device
your address-book data
health data from Apple Health
biometric data

If new features requiring access to this kind of data are added, we will update this policy and request the necessary permissions before any collection.

4. How We Use Your Data

We use the personal data we collect to:

create and manage your account
authenticate you
provide Chef Drago’s core features
save your progress
personalise recipes and recommendations
generate and manage your shopping lists
keep your history and preferences
manage quests, XP, levels, and leagues
manage subscriptions and in-app purchases
secure and maintain the app
detect and prevent abuse
improve the quality and relevance of Chef Drago
respond to your support requests
occasionally ask for your feedback on Chef Drago by email — you can opt out at any time by replying (legal basis: our legitimate interest in improving the service; never marketing without your consent)
comply with our legal obligations

We do not sell your personal data. We do not use users’ personal data to build or feed third-party advertising databases.

5. Third-Party Services and Processors

To provide Chef Drago, we rely on several technical providers. Where these providers process personal data on our behalf and on our instructions, they act as processors within the meaning of Article 28 GDPR. We select providers that offer appropriate safeguards for data protection and security.

5.1 Google Firebase

We use several Firebase services provided by Google:

Firebase Authentication — to manage user authentication
Firebase Firestore — to store the data needed to run the app (preferences, history, shopping lists, progress, and account-related content)
Firebase Cloud Functions — to run certain server-side operations, including the secure processing of certain features such as account deletion
Google Analytics for Firebase — to measure how the app is used (for example app opens, sessions, recipes swiped or cooked, and use of features such as the meal planner or shopping list), including how a single device uses the app over time, under a random identifier that is not linked to your name or email address, so we can improve Chef Drago. We use a configuration that does not collect the advertising identifier (IDFA), does not track you across other companies’ apps or websites, and is not used for advertising. Legal basis: our legitimate interest in understanding and improving the app.

Google acts as a processor for personal data processed on our behalf through Firebase, and provides contractual mechanisms — including the European Union’s Standard Contractual Clauses where applicable — to frame international transfers.

5.2 Firebase Crashlytics

We use Firebase Crashlytics (Google) to collect crash and diagnostic reports — such as stack traces, device model, and operating-system version — in order to detect and fix stability issues. Crash reports are not linked to your account identity.

Legal basis: our legitimate interest in maintaining a stable, reliable app.

5.3 OpenAI

We use OpenAI’s API services, server-side, for certain visual-content-generation features — in particular generating recipe or ingredient images.

In Chef Drago’s current configuration, we do not intentionally send users’ personal data to OpenAI to generate these visuals. Requests sent to OpenAI are designed to contain only the information needed to generate the requested content.

Where OpenAI processes data on our behalf through the API, OpenAI acts as a processor. Its Data Processing Addendum provides for processing in accordance with the client’s instructions and for mechanisms framing international transfers, including the European Union’s Standard Contractual Clauses where necessary.

5.4 RevenueCat

Where subscriptions are enabled in Chef Drago, we use RevenueCat to technically manage subscriptions and verify their status.

RevenueCat may process certain data associated with the user and their purchases, in particular technical identifiers and subscription information. RevenueCat acts as a processor where this data is processed on our behalf, and provides a Data Processing Addendum that includes GDPR-compliant transfer mechanisms, including the European Union’s Standard Contractual Clauses where necessary.

6. Legal Bases for Processing

Under the GDPR, we process your personal data on different legal bases depending on the purpose.

Performance of the contract — where processing is necessary to provide the features you requested, including: account creation and management; authentication; saving your preferences; recipe personalisation; shopping lists; history; progress; quests and leagues; subscription management.

Legitimate interests — where processing is necessary for our legitimate interests, provided those interests do not override your rights and freedoms. This may include: improving the service; security; abuse prevention; analysing technical issues; improving the relevance of recommendations.

Consent — where consent is the appropriate legal basis or is required by applicable law, we will ask for your consent before the relevant processing. You can withdraw your consent at any time where processing relies on it; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law.

As a rule:

Account data — kept for as long as the account exists
Preferences, history, shopping lists, and progress — kept while you use the service and while the account remains active
User-created content — kept while associated with the account or until you delete it
Subscription data — kept for as long as needed to manage the subscription, for accounting, and to meet legal obligations
Data needed for security and abuse prevention — kept for a period proportionate to those purposes
Requests relating to the exercise of your rights — kept for as long as needed to handle the request and, where necessary, to demonstrate that it was handled

When you delete your account, the associated personal data is deleted immediately (see Section 8), subject to data that must be retained to comply with a legal obligation, prevent fraud, or establish, exercise, or defend legal claims. Technical deletion times may vary across systems and providers.

8. Account and Data Deletion

You can request the deletion of your account and the personal data associated with it. You can do this directly from the account-deletion feature in the app, or by contacting us at [email protected].

When you delete your account from the app, the request is executed immediately: a server-side Cloud Function (deleteUserAccount) runs a synchronous cascade that removes your account record, profile, meal plans, saved recipes, shopping-list data, cooking history, and other account-associated data from our database, and deletes your authentication account. If you signed in with Apple, your Sign in with Apple token for Chef Drago is also revoked as part of this process.

Deleting your account permanently removes your progress, preferences, history, and account-associated content. A limited set of data may be retained only where required to comply with a legal obligation, prevent fraud, or establish, exercise, or defend legal claims.

Subject to the conditions and exceptions in applicable law, you have the following rights:

Right of access — confirm whether we process your personal data and obtain a copy of it
Right to rectification — correct inaccurate or incomplete personal data
Right to erasure — request deletion of your personal data under the conditions set by the GDPR
Right to restriction of processing — request that certain processing be temporarily restricted in the situations set by the GDPR
Right to data portability — where the conditions are met, receive the personal data you provided in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible
Right to object — object to certain processing based on our legitimate interests
Right to withdraw consent — where processing relies on your consent, withdraw it at any time

Users located outside the European Economic Area may have similar rights under their local law and can contact us using the same details.

10. How to Exercise Your Rights

To exercise your rights, contact us at [email protected].

Where possible, your request should specify:

your identity or the identifier associated with your account
the right you wish to exercise
the information needed for us to handle your request

We may ask for additional information where necessary to verify your identity and protect your account against a fraudulent request. We will respond within the timeframes set by the GDPR. Exercising your rights is in principle free of charge; exceptions may apply in the cases provided for by law.

11. Right to Lodge a Complaint

If you believe that the processing of your personal data does not comply with the GDPR, please contact us first so that we can look into your request.

You also have the right to lodge a complaint with the competent supervisory authority. For users located in France, this is generally the Commission Nationale de l’Informatique et des Libertés (CNIL). You can find more information about how to complain directly from the CNIL.

12. International Data Transfers

Some of our technical providers may process personal data outside the European Economic Area, in particular where their infrastructure or some of their sub-processors are located in third countries.

We put in place the legal mechanisms required by the GDPR to frame these transfers. Depending on the provider and the transfer, these mechanisms may include:

an adequacy decision by the European Commission — such as the EU-US Data Privacy Framework where applicable
the Standard Contractual Clauses adopted by the European Commission
additional contractual and organisational safeguards where necessary

Google, OpenAI, and RevenueCat each provide for such mechanisms — including the European Union’s Standard Contractual Clauses and, where applicable, an adequacy decision such as the EU-US Data Privacy Framework — in their data-processing terms.

We aim to limit international transfers to what is necessary for the services used by Chef Drago.

13. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, unauthorised alteration, unauthorised disclosure, and other unlawful forms of processing.

These measures include access controls, protection of the infrastructure used to store and process data, and measures to secure communications between the app, our servers, and our providers.

No method of electronic transmission or storage can guarantee absolute security. We work to maintain a level of security appropriate to the risks associated with the data we process.

14. Children

This app is intended for users aged 13 and older. Users in the European Economic Area must also meet their country’s legal age of digital consent, which may be higher than 13.

Chef Drago is a general-audience app and is not specifically directed at children. We do not knowingly collect personal data from children under 13. If we learn that an account was created, or that personal data was collected, from a child under 13 without an appropriate legal basis or the required authorisation, we will take reasonable steps to delete that information.

Parents or legal guardians who believe a child has provided us with personal data can contact us at [email protected].

15. AI-Generated Content

Some Chef Drago features may use artificial-intelligence services to generate content, in particular visuals associated with recipes or ingredients.

In the app’s current configuration, users’ personal data is not intentionally sent to the AI services used to generate these visuals. The data sent to these services is limited to the information needed to generate the requested content.

16. No Sale of Personal Data

We do not sell our users’ personal data. We do not provide your personal data to advertising networks for the purpose of building advertising profiles from your use of Chef Drago.

If this were to change, we would update this policy and provide the information and consent mechanisms required by law.

17. Changes to This Policy

We may update this Privacy Policy to reflect changes to Chef Drago, the addition or modification of features, changes to our providers, regulatory developments, or improvements to our data-protection practices.

The most recent version is always available from within the app. The date of the last update appears at the top of this policy. Where changes are material and the law requires it, we will inform you in an appropriate way.

18. Contact

For any question about this Privacy Policy, or to exercise your rights regarding your personal data, you can contact us:

Chef Drago
Data controller: Félix Bécu
Email: [email protected]
SIREN: 922 490 891
SIRET: 92249089100046

We recommend contacting us before lodging a complaint with a supervisory authority, so that we can address your request directly.\