Privacy Policy

This page says, simply and completely, what Kuvajmo does with your data. We process only what is needed for the service to work, we do not sell data, we have no advertising, and we do not follow you across other websites and apps.

Version 1.0.0 · Draft, not in force yet · Last changed: 11 October 2026

This is a translation of the Serbian original. If the translation and the Serbian text differ, the Serbian text prevails.Srpski

This is a draft

This text has not been reviewed by a lawyer yet and does not apply until this notice is removed. Do not treat it as final.

In short

For an account we need only an email address and the name shown to others. There are no passwords: you sign in with a one-time code sent by email.
Health data (your allergens and your diet goal) is stored only if you explicitly allow it. It is encrypted, only you can see it, and cooks and our team never see it. You can withdraw your consent at any time, and the data is then deleted.
The exact address of a kitchen is visible only to an eater with a confirmed reservation, and only for a limited time. Everyone else sees only the neighbourhood and an approximate area.
Money for food does not pass through Kuvajmo. We do not receive contributions and we cannot see whether anyone has given one.
We do not sell your data, we have no advertising and we do not use your data for marketing. Usage statistics are anonymous and run on our own server. Crash reports go to Google only if you allow them.
You can download everything we keep about you, and you can delete your account in the app or at kuvajmo.com/delete-account/.
Some records remain after an account is deleted, anonymised, because other people rely on them (their reservations, reviews and messages). Details are below.

Who is the data controller

The controller of personal data (the one who decides why and how data is processed) is Nikola Dašić PR STRUNA, an entrepreneur (preduzetnik) (below: "we" or "the operator"). The operator provides Kuvajmo: the iPhone and Android apps, the website kuvajmo.com and the services behind them. The operator’s registration details (address, company registration number, tax identification number and activity) will be added before launch.

For all questions about privacy and to exercise your rights, write to privacy@kuvajmo.com. For everything else: contact@kuvajmo.com. We have not appointed a separate data protection officer; questions are received by the operator in person, at these addresses.

This policy is based on the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "Službeni glasnik RS" no. 87/2018, below: ZZPL). It applies to the apps, the website and the services of Kuvajmo. The Serbian text is binding; translations are for understanding.

What data we process, why and on what basis

A legal basis is the reason the law allows us to process a piece of data. Ours are: performance of a contract (without it we cannot provide the service you asked for; the contract is the Terms of Use), consent (your free and explicit choice, which you can withdraw), legitimate interest (our justified interest, where your interests and rights do not override it) and legal obligation. For each kind of data we also say whether providing it is mandatory.

Account and sign-in

Data: Email address; the name shown to others; language; the invite code you registered with and who invited you; the date the account was opened; a record that you accepted the Terms of Use and this policy (version and time) and confirmed that you are at least 18 years old; optionally a phone number.
Why: To open the account and sign you in with a one-time code we send by email (valid for 10 minutes and stored only as a hash, i.e. a one-way fingerprint), to send you messages about the account, to make invitations work, to let abuse be traced back to its source and to have proof that you accepted the terms.
Legal basis: Performance of a contract; for who invited whom, legitimate interest (preventing abuse); for the record of accepting the terms, performance of a contract and legitimate interest (proof that the contract was concluded); for the phone number, consent, which you give by entering it.
Mandatory?: Email, name, acceptance of the terms and the confirmation that you are at least 18 are mandatory: without them an account cannot be opened. The phone number is optional, it is not verified and it is never shown to other users.
Who sees it: The name is seen by users you are in a reservation, conversation or review with, and by anyone who sees your public profile or offer. Other users do not see your email or phone; authorised people in the administration do.

Invitation interest request

Data: Your email address, the language you submitted the request in, and the version of this policy that was in force when you submitted it.
Why: So that, if we open up more invitations, we can send one bound to your address, in the language you asked in, with a single-use code that only that address can use.
Legal basis: Consent, given by submitting the form, which you can withdraw at any time (see "How long we keep data" and the withdrawal page).
Mandatory?: Entirely optional. Submitting a request opens no account and promises nothing: it is only an expression of interest, never added to a marketing list.
Who sees it: Only authorised people in the administration, to send the invitation. It is never shown to other users or applicants.

Devices and sign-ins on devices

Data: A record of each device you are signed in on (a hash of the sign-in renewal token, the text the app identifies itself with: name, version and platform; time of sign-in and of last use); the token for push notifications (Apple APNs or Google FCM) and the platform (iOS or Android).
Why: To keep you signed in, to sign you out of all devices when you ask or when you change your email address, and to send you push notifications.
Legal basis: Performance of a contract. Notifications appear on the phone only if you allowed them in its settings (see "Push notifications").
Mandatory?: A sign-in on the device is needed to use the account; push notifications are not mandatory.

Kitchen, dishes and offers (only for those who cook)

Data: Neighbourhood; address and notes about the address; the exact point on the map; the approximate point (the centre of a cell of about 500 × 500 m); the kitchen declaration (allergens regularly present in the household, pets, notes on cross-contact); the hygiene habits you ticked; kitchen photos; dishes (name, photos, what is in the portion, ingredients and origin, how it is made, allergens, your nutrition estimate); offers (day, meal, pickup window, number of portions, contribution, packaging, how orders are confirmed and the contribution is given).
Why: So that eaters can see what you offer and where to come for the food.
Legal basis: Performance of a contract.
Mandatory?: Only if you want to share food. If you only reserve food, you give none of this.
Who sees it: All users see the neighbourhood, the approximate point, the kitchen declaration, dishes, offers, photos and reviews. The exact address, the notes about it and the exact point are seen only by an eater with a confirmed reservation, from confirmation until 2 hours after the end of the pickup window (the current setting; we may change it). All metadata, including GPS tags, is removed from every photo you upload.

Reservations and the exchange

Data: Reservations: the offer, number of portions, contribution per portion, how the contribution is given, who brings the container, status, the times of confirmation, pickup, no-show, receiving the contribution and closing, the reservation code.
Why: So that a reservation works, so that both sides know what was agreed, and so that reviews and history can be followed.
Legal basis: Performance of a contract; keeping records to resolve reports and disputes: legitimate interest.
Who sees it: The cook and the eater see each other's name and the details of the reservation. The cook does not see your email or phone.
Note: Your meal history (calories and nutrition values of the meals you picked up) is calculated from your reservations when you open it, is not stored separately and is seen only by you.

Messages

Data: Text and photos in a conversation about an offer or a reservation; the time of sending and reading.
Why: So that the cook and the eater can agree. A conversation stays in the Kuvajmo app so that it can be checked if someone reports a problem.
Legal basis: Performance of a contract; keeping them for reports and disputes: legitimate interest.
Who sees it: Only the two sides of the conversation. Messages are not encrypted in a way that stops us reading them, but we do not read them routinely: authorised people read them when someone reports a message and it is needed to resolve the report. We can hide a message.

Reviews and reputation

Data: Reviews you write and receive (positive or negative, a comment, one public reply), marked with whether the reviewed person was the cook or the eater; counters (reviews, pickups, no-shows, cancelled offers) kept separately for the cook side and the eater side.
Why: So that people who do not know each other can rely on each other.
Legal basis: Performance of a contract and legitimate interest (trust and the safety of users).
Who sees it: Other users see reviews and totals on the profile. The counters also feed the automatic rules (see "Automated decisions and profiling").

Health data (a special category of data)

Data: The allergy profile (allergens you must avoid) and the diet goal (lose weight, maintain, build muscle) with an optional daily calorie target.
Why: Only to hide offers that contain your allergens, to warn you about "may contain" and to show how an offer fits your goal.
Legal basis: Your explicit consent, given separately for each of these two items before anything is saved. The app stores nothing until you tick the consent. Before that it shows you a text saying what is stored and why, that cooks never see it, how consent is withdrawn and what withdrawing does, with a link to this policy. Your consent is recorded (with the time) and is separate from accepting the terms.
Mandatory?: No. Kuvajmo works without it. If you enter nothing, offers are not filtered by your allergies and there is no goal-fit display. The allergens of a dish are still always shown on every offer.
Withdrawing consent: At any time, by deleting the allergy profile or the goal in the app; the data is then deleted at once. Withdrawal does not affect the lawfulness of processing up to then. The data is also deleted when you delete your account.
Protection: It is stored encrypted. Only you can see it: cooks do not see it, it is not shown in the administration, it does not enter usage statistics and it is not sent in notifications. It is included in the copy of your data you download.

Contribution (the cook's bank account)

Data: Bank account number (18 digits) and the account holder's name, only if a cook wants to receive the contribution by IPS transfer.
Why: So that the app can make an IPS QR code for a reservation. The code contains the account, the name, the amount and the purpose of the contribution.
Legal basis: Performance of a contract (you enter the account voluntarily in order to use IPS).
Mandatory?: No: the contribution can also be handed over in cash.
Who sees it: The account is stored encrypted and in the app only you can see it. When an eater with a reservation chooses IPS, the app shows them a QR code, and their banking app reads your account and name from it. The eater thereby receives that data for that contribution.
Note: Kuvajmo does not receive, hold or forward money for food and does not see whether a contribution arrived: the cook marks it as received.

Notifications

Data: Notifications in the app; the email we send you (about reservations, changes to an offer, pickup reminders, messages, warnings); your settings per type of notification.
Why: So that you know what is happening with your reservations and account.
Legal basis: Performance of a contract. We send no marketing notifications.
Note: Email (sign-in codes and notifications) is sent by the Scaleway service (country: France), which receives the recipient's address and the text of the message only to deliver it. Push notifications are described in the next card ("Push notifications"). You can turn off each type of email in the settings.

Push notifications (Apple and Google)

Data: The push token of the phone (Apple's APNs token or Google's Firebase Cloud Messaging token) and the platform (iOS or Android), kept with the record of the device; and, for each notification sent to the phone, its title and a short text (for example the dish name, the other person's name and, for a message, its first 80 characters), the type of the notification and the identifiers of the reservation or offer it is about. Never health data. On Android, Google also gives the app an installation identifier for this service.
Why: To tell you, while the app is closed, that a reservation was confirmed or declined, that an offer changed, that a pickup is near or that you have a message.
Legal basis: Performance of a contract, and your choice. The app does not ask for the notification permission when it opens: it explains in its own words what the notifications are for and asks only after your first reservation or your first offer, and "Not now" is always possible. You can turn push off at any time, in the phone's settings or in your profile in the app.
Mandatory?: No. Kuvajmo works without push: notifications still reach you in the app and by email.
Who receives it: Apple (APNs) delivers notifications to iPhone devices and Google (Firebase Cloud Messaging) to Android devices; to deliver them they see the token and the content described above, under their own terms (see "Who we give data to" and "Transfers outside Serbia"). On both iPhone and Android, nothing is registered with Apple or Google for push, and no push token is sent to our server, before you have allowed notifications. The only exception is the random installation identifier that Firebase's services may keep on their own, as described in the crash reports card.
On the lock screen: On Android our notifications are marked private: the lock screen shows only that there is a notification, not its title or text. On iPhone, the phone's own setting for previews decides what the lock screen shows, and we promise no more than that.
How long: Until you sign out on the phone, withdraw the notification permission (Android) or delete the account, or until the push service reports that the token is no longer valid (see "How long we keep data").

Reports, warnings and bans

Data: Reports (category, description, photos, the link to a reservation, offer, message or review, the outcome); warnings; bans and the reason for a ban; blocked email addresses and phone numbers, as keyed hashes with a shortened hint; a hashed history of an account's earlier email addresses; a log of actions in the administration (who changed what and when).
Why: To protect people from unsafe food and from abuse: we pause a cook after a report of illness, we warn, we ban, and we stop a banned person from opening an account again.
Legal basis: Legitimate interest (the safety of users' health and property, preventing abuse); legal obligation when a competent authority lawfully requests data. For health data in a report: consent, as below.
Mandatory?: You send a report only if you want to. We keep the record of a ban without your consent, because otherwise a ban would have no effect.
Note: If you report an allergic reaction or an illness, the description you write may be health data. You send it by your own decision so that we can handle the report, which is your explicit consent, and we keep it in the record of reports. If you withdraw consent we will delete it, unless we need it to protect other people or to establish or defend legal claims. The person who made a report does not appear in the data copy of the person they reported.

Blocking people

Data: If you block a person: who blocked whom.
Why: So that the block works: neither of you can message the other, neither sees the other's offers in Discover or on a cook's page, and the blocked person cannot reserve the blocker's offers. It protects people from unwanted contact.
Legal basis: Performance of a contract (a function you ask for) and legitimate interest (the safety of users).
Mandatory?: No. Only if you choose to block someone.
Who sees it: Only you: in Settings you see the list of people you blocked and can unblock them. The blocked person is not told and notices only the effects. People in the administration do not see who blocked whom.
Reservations in progress: A block does not cancel reservations already in progress (you are asked whether to cancel them too), so that nobody is left waiting at a door with no way to say so.
How long: Until you unblock the person, or until the account of either of you is deleted: blocks in both directions are deleted with an account. A ban does not change blocks.

Location for search

Data: The place you search from (the device location if you allow it, a point you pick on the map, or Belgrade as the default) and the search radius.
Why: To show offers nearby and the distance (in a straight line, on foot or by car).
Legal basis: Performance of a contract. We use the device location only if you allowed it in your phone settings.
Note: We send the location to the server with each search, but we do not tie it to your account and do not keep it as your location. You can also pick another point on the map. Distances on foot and by car are calculated by our own routing server, with road data from OpenStreetMap. The server's technical logs do not keep the coordinates of a search. The map in the Android app is drawn from tiles that OpenFreeMap serves, so OpenFreeMap sees the part of the map you look at and your IP address; the iPhone app uses Apple Maps.

Technical data and security

Data: IP address, time, the requested address and the server's response; counters of requests per IP address and per account to limit the number of attempts (in working memory, briefly); app version and platform; error messages.
Why: To protect the service from abuse and overload (for example, the number of sign-in codes is limited), to find and fix errors and to keep the service secure.
Legal basis: Legitimate interest (the security and stability of the service).
Mandatory?: You cannot use an internet service without the server seeing the IP address of the request.

Usage statistics in the apps

Data: Anonymous events from a fixed list: that the app was opened; which screens were shown (for example "discover", "offer", "orders", "messages"); the steps of signing in (that a code was asked for, that you signed in, signed up or signed out); searches (only which kind of filter was used and a rough count of results, never the words typed or the place); offers opened; reservations started, placed or cancelled (only coarse choices such as how the contribution is given and who brings the container, and the number of portions as a range); for cooks, that a dish or an offer was published, copied or cancelled, a request answered or a pickup marked; that a message, a review or a report was sent (never its content); that a notification was opened or the notification permission answered; the language chosen; and the code of an error shown. Each event carries the platform (iOS or Android), the version of the system and of the app, the language and a random session identifier that lives only in the phone's memory, is never stored and is never tied to the account. Never a name, email, account, location, the content of reservations or messages, allergies, diet goal, diet, IP address, advertising identifier or device identifier.
Why: To see where people give up on sign-up or reserving and which errors they get, so the app can be better. We are not interested in any individual person.
Legal basis: Your choice: the app sends nothing until it has shown you the notice, and in the privacy settings you can turn statistics off. The app works the same without it.
Note: We use Aptabase, open-source software that runs on our own server (events.kuvajmo.com): events go only to that server, which is at DigitalOcean in Frankfurt (country: Germany); we use no separate analytics provider for them and only we read them. Because the server is outside Serbia, the events are transferred outside Serbia (see "Transfers outside Serbia"). We set it up not to store IP addresses, not to look up a country and not to follow you between apps and websites. Nothing is sent before the app has shown you the notice, nor after you turn statistics off in the privacy settings, and nothing is kept to be sent later. The screens for deleting the account, downloading data, changing email, the bank account, the allergy profile, the diet goal and the meal history send no events at all. How long Aptabase keeps events is in "How long we keep data".

Crash reports in the apps (Firebase Crashlytics)

Data: If the app crashes: what crashed (the technical trace of the crash), the version and build of the app, the version of the operating system, the model of the phone and whether the app was in the foreground. Never your account, name, email, phone number or anything you wrote or entered in the app, and never health data. Firebase's services (crash reports and push) may give each installation of the app a random identifier of their own, so that reports from the same installation can be grouped; we do not link it to your account, but it is an identifier that Google can read, so we treat a report as personal data.
Why: To find and fix what makes the app crash, so that it works for everyone. We are not interested in any individual person.
Legal basis: Your consent. Nothing is collected until you choose: at first launch the app shows a notice with a switch for anonymous crash reports, in this version the switch starts off, and you can change it at any time in the privacy settings of your profile. If you do not agree, nothing is sent and the app works the same. A crash that happens before you have chosen is not sent: such reports are deleted.
Mandatory?: No.
Who receives it: Google, which runs Firebase Crashlytics. Google receives the report and stores it on its servers, which may be outside Serbia, including in the United States of America (see "Transfers outside Serbia"). We read the reports in Google's console. Besides push notifications on Android, we use no other Firebase service: no Firebase or Google analytics, no performance monitoring and no advertising.
Turning it off: Switch off crash reports in the privacy settings of your profile: collection stops at once and reports not yet sent are deleted from the phone. Reports already sent stay with Google, under its terms, for the time they set. Because reports are not linked to your account, we cannot tell which ones are yours.

The website kuvajmo.com and cookies

We use no cookies, neither on the website nor in the apps, and we do not track you between sites. The website is static; it is hosted by GitHub Pages (GitHub, Inc., a Microsoft company, USA). Like any web server, they process the visitor's IP address in order to deliver the page and may log it under their own rules; we do not see those logs.

The only thing the website stores in your browser is your choice of light or dark theme (in the browser's local storage), and only once you click the theme switch. It stays in your browser and is not sent to us.
The delete-account and service-status pages send a request to our server (api.kuvajmo.com) from your browser: the deletion form sends the email address you enter and the code from the message, and the status page asks for the state of the service. These pages store nothing and are never measured.

The home pages of the website are counted anonymously with Umami, which runs on our own server (stats.kuvajmo.com): no cookies, no local storage, no IP address kept, and nothing is counted for a browser that sends "Do Not Track" or Global Privacy Control. What is counted, why and how to switch it off is in the next section.

Counting visits on the website (Umami)

The controller for this counting is Nikola Dašić PR STRUNA, an entrepreneur (preduzetnik): the operator named in the section "Who is the data controller". The operator's registration details (address, company registration number, tax identification number and activity) will be added before launch.

We count visits to the home pages of kuvajmo.com, in all four languages, with Umami, an open-source tool that runs on our own server (stats.kuvajmo.com). The numbers are anonymous and aggregate: we want to see how many people come, not who they are.

What is counted:

Where visitors come from: the domain of the website you followed a link from, and the campaign tags in the address (utm_source, utm_medium, utm_campaign, utm_content and utm_term), so that we can tell, for example, a poster from a post. Any other part of the address, such as the identifiers advertising platforms add to links, is removed in your browser before anything is sent.
What visitors use, roughly: the kind of device, the browser, the operating system and the size class of the screen (which Umami reads from the browser), the language you chose for the page and your browser's language.
What visitors do: the page you arrived on and the pages you view; how far down a page you scroll (a quarter, half, three quarters or all of it); which sections of the page you reach; clicks on the links for invitations, on the link to the service status page, on the buttons for the app stores (once there are any) and on the choice of language (only which language); the app screenshots being browsed, where the page offers that; and, if the page ever has an invitation form, only that it was started, sent or failed, with a coarse reason such as "network error", never what is typed into it.

What is not stored: no IP address, no country, region or city, no cookie and nothing in the local storage of your browser. Nothing identifies you, and a visitor cannot be recognised from one day to the next or on other websites. Nothing is linked to an account. The pages for deleting an account, the service status and the legal texts (this one included) are never counted.

Purpose and legal basis: we do this to understand how people find and use the website, for example which poster or post brings visitors and where visitors stop reading, so that we can improve it. We never use it for advertising, and never to profile or follow anyone. The legal basis is our legitimate interest in understanding and improving the website; because nothing identifies you, the effect on you is minimal.

Who hosts it: Umami runs on our own server at DigitalOcean in Frankfurt (country: Germany). We use no separate analytics provider for it: only we read these data. Because the server is outside Serbia, the data are transferred outside Serbia (see "Transfers outside Serbia").

How long it is kept: the anonymous counts are kept until they are deleted by hand; there is no fixed period.

Your rights: you have the rights described in the section "Your rights". Because the counts are anonymous, we cannot tell which of them are yours, so we cannot look them up, correct them or delete them for you; but you can object at any time, simply by switching on a signal in your browser (next paragraph), and then nothing is counted. For questions or an objection write to privacy@kuvajmo.com. You can also complain to the Commissioner, as described in that section.

How to switch the counting off: the website honours two signals your browser can send, "Do Not Track" and Global Privacy Control. With either of them on, nothing is counted for you, on any page. In most browsers they are in the privacy settings (the names of settings differ between browsers and versions): for example, Firefox (Settings, Privacy & Security) and Chrome (Settings, Privacy and security) have a "Do Not Track" option; Firefox also has an option telling websites not to sell or share your data, which sends Global Privacy Control; Brave and the DuckDuckGo browser send Global Privacy Control by default. Blocking the address stats.kuvajmo.com in a content blocker has the same effect.

Test accounts and the test environment

The test environment. While closed testing lasts, the testers' apps work with a separate test server (dev.api.kuvajmo.com), which runs on a home server in Serbia (not at DigitalOcean), has its own database and sends email through its own mail server (Postal), with no outside sending service. Testers' data in it (email address, name, reservations and the rest described above) is real personal data and is processed under this policy. Data from the test environment is never copied into production, and test versions of the app stop working when the test environment is switched off. Testers' data stays in the test environment until the operator deletes it by hand, and it has no backups, so the data may also disappear.
Accounts for the app store reviews. Apple and Google check the app through two of our accounts, which sign in with a fixed code instead of a code sent by email (because a reviewer has no mailbox of ours). These accounts hold no real personal data. The fixed code works for no other account. Actions on these accounts are logged like any other.
Demo content. The test environment has a fictional demo cook with a few demo offers (marked "Demo"), visible to every tester. They describe no real person and no real address, orders on them are confirmed automatically so that a tester can see the whole flow, and no real email is sent for them. They are not personal data and are never copied into production.
For testing through TestFlight (Apple) and Google Play closed testing, Apple and Google process the testers' data under their own terms.

Who we give data to

Other users of the Kuvajmo app, only as described above (for example, the cook and the eater see each other's name and the details of the reservation).
Our team: the operator and people the operator authorises for support and handling reports. They have access only to what they need for the job, and their actions in the administration are logged. Health data is not shown in the administration.
Service providers: Apple (push notifications on iPhone devices through APNs; maps in the iPhone app through Apple Maps), Google (push notifications on Android devices through Firebase Cloud Messaging; and, only if you allow them, crash reports from the apps through Firebase Crashlytics), GitHub (hosting of the website; and, once a month, for a few minutes, a computer that GitHub provides decrypts a backup of the database to check that backups can be restored), Cloudflare (management of the DNS records of the domain kuvajmo.com and forwarding of incoming email from the addresses office@, contact@, privacy@ and support@ on the domain kuvajmo.com through Cloudflare Email Routing, so Cloudflare sees the messages you write to us; app traffic does not pass through it), OpenFreeMap, run by Hyperknot Software Kft. in Hungary (the Android app loads its map tiles from tiles.openfreemap.org, which sees your IP address and the part of the map you look at; according to its own privacy policy, as of 4 October 2026, it keeps no IP addresses in its access logs, deletes error logs, which may contain an IP address, after 7 days, and switches IP logging on for at most 30 days if there is an attack or abuse).
The hosting provider, DigitalOcean (a company from the United States of America; our servers are in its data centre in Frankfurt, country: Germany): this is where the app server, the managed database (PostgreSQL) with all account data, the photo storage and the servers of our statistics run. DigitalOcean stores and processes them for us under the data-processing terms it offers.
The email-sending service, Scaleway (country: France): it receives the recipient's address and the text of the message (for example a one-time sign-in code or a reservation notification) to deliver it.
Tools on our own server at the hosting provider, with no additional processor: the routing server for distances and Aptabase for the anonymous usage statistics of the apps. Nothing from them goes to anyone else.
Competent authorities (court, prosecutor, police), only when they lawfully ask and with a legal basis. We give personal data to nobody else.

Encrypted backups of the database (every night) are held by Backblaze B2, a company from the United States of America, in a data centre in Amsterdam (country: Netherlands). We encrypt the copies before they are sent, so Backblaze B2 cannot read them.

We do not sell data, we do not share it with advertisers and we have no advertising. Our relationship with service providers rests on the standard data-processing terms they offer. The email we send you travels over the internet to your email provider, which is the ordinary way email works and outside our control.

Transfers outside Serbia

Our servers are not in Serbia: Kuvajmo runs at DigitalOcean, in a data centre in Frankfurt (country: Germany), and email is sent by the Scaleway service (country: France). In addition, some of the providers in the previous section are companies in the United States of America (DigitalOcean, Apple, Google, GitHub, Cloudflare) and in Hungary (Hyperknot Software Kft., which runs OpenFreeMap; Hungary is a member of the European Union). Sending data to them is a transfer of personal data outside Serbia.

Backblaze B2 is also a company from the United States of America. It holds only the encrypted copy of the database, in a data centre in Amsterdam (country: Netherlands); we rely on the data-processing terms it offers, with the data kept in the European Union.

ZZPL allows such a transfer where the country or organisation ensures an adequate level of protection, or with appropriate safeguards (for example standard contractual clauses), or, in limited cases, with your explicit consent after you have been told of the risks. We base the transfer on the standard data-processing terms those providers offer and try to keep it in line with ZZPL. For DigitalOcean we rely on the data-processing terms it offers, with the data kept in a data centre in the European Union. American companies are subject to American law, which differs from Serbian and European law. A lawyer has not yet reviewed the safeguards for these transfers.

What is sent to providers other than our hosting is small and mostly optional. Crash reports leave the app only if you allow them, in the notice at first launch or in the privacy settings of your profile; they go to Google, which may store them in the United States of America. Push notifications go through Apple and Google: on both iPhone and Android nothing is registered with Apple or Google for push until you allow notifications (apart from the random installation identifier that Firebase's services may keep on their own, see the crash reports card). The map in the Android app loads its tiles from OpenFreeMap in Hungary, which sees only your IP address and the part of the map you look at, nothing from your account. All account data, the usage statistics of the apps and the counts of the website are kept on our servers at DigitalOcean. Health data is kept there encrypted, and we send it to no other provider.

How long we keep data

We keep data for as long as is needed for the purpose it was collected for. For each kind it looks like this:

Account (email, name, language, phone, invite code, record of accepting the terms): while the account exists. When you delete it, the email, name and phone are removed from the account at once.
Invitation interest request (email address, language): if it was never invited, deleted 90 days after you submitted it; if an invitation was sent, 90 days after it was sent, whether or not the code was used. The unused code is revoked the moment the request is deleted. You can withdraw it at any time with a one-time code emailed to you, on the withdrawal page, whatever the invitation flags say.
Sign-in code: 10 minutes, and only as a hash. A sign-in on a device lasts up to 30 days and the access token 15 minutes; a sign-in ends by signing out, by deleting the account or by changing the email address.
Health data (allergy profile, diet goal): until you delete it or delete your account; it is then deleted at once.
Bank account: until you remove it or delete your account; it is then deleted at once.
Push notification tokens: while you are signed in on the device or until the push service reports that the token is no longer valid; they are deleted by signing out and by deleting the account.
Blocks (who blocked whom): until you unblock the person, or until the account of either of you is deleted; blocks in both directions go with the account.
Crash reports: held by Google, under its terms, for a limited time; reports not yet sent are deleted from the phone when you switch crash reports off. They are not linked to your account.
Photos you upload but do not attach to a kitchen, dish, message or report: 24 hours.
Notifications in the app: 90 days.
Messages: 24 months after the reservation ended, then deleted. Messages in an open report are kept with the report. On your request they can be deleted earlier, together with the other personal data of the account.
Reservations and reviews: while the account exists. After the account is deleted they remain anonymised (no name, email, phone or address), without a time limit, because other people's history and reputation rest on them.
Reports, warnings and moderators' decisions: 5 years after the report is closed.
Log of actions in the administration: 3 years, without the email address.
Hashes of the blocked email addresses of banned persons: while the ban stands, so that deleting an account is not a way round a ban.
Records of accepting the terms and the policy: while the account exists they carry the account's id. After the account is deleted they remain without identity (only the version and the time), as proof that the terms were accepted.
Technical logs of the web server (IP address, time, requested address): 30 days. We do not keep the coordinates you search from in the requested address.
Backups: encrypted copies of production on our server are kept for 30 days. A deleted account's data stays in them until they expire; we do not edit backups one by one.
Backups at the hosting provider: DigitalOcean makes its own daily copies of the database and keeps them for 7 days (point-in-time recovery). A deleted account's data stays in them until they expire.
Old versions of photos: when a photo is deleted or replaced, its previous version stays in the storage for another 30 days and is then deleted. This also applies when you delete your account.

Anonymous usage statistics of the apps (Aptabase) are kept for 5 years from production (release) builds, and for 182 days from test builds, and then deleted.

The encrypted nightly copy of the database at Backblaze B2 is kept for 30 days and then deleted. A deleted account's data stays in it until the copy expires.

When the period ends, we delete the data or anonymise it so that, as far as reasonably possible, it can no longer be linked to you. If the law requires us to keep something longer, or we need it to establish or defend legal claims, we keep only that, and only as long as needed.

Deleting an account and what remains

You can delete your account in the app or on the Delete account page, with a code sent to the account's email address. Deletion is the same in both places. You must first finish or cancel open reservations, because the other side relies on them.

Deleted at once: name, phone and email address are removed from the account; the allergy profile and the diet goal; the bank account; sign-ins on all devices, push tokens, notifications and settings; blocks you made and blocks against you; recurring offers and dishes you never published; unused invite codes; the kitchen address, notes about the address, the exact location, notes about pets and cross-contact, and the kitchen photos. Your public profile disappears.
Remains, anonymised, because other people rely on it: reservations, reviews you wrote or received, messages, reports, archived dishes (and their versions), and the kitchen's neighbourhood and approximate point. The account stays as a row with no name, email or phone, and to others it looks like a "deleted account".
The email address is kept only as a one-way hash with a shortened hint, so that a ban still holds after deletion. If the account was not banned, the address is free for a new registration.

Messages and reviews remain as you wrote them, but with no link to your name. If a message or review still reveals who you are after deletion, write to privacy@kuvajmo.com and we will consider removing it. Messages and reports are also deleted after the account is deleted, within the periods in the section on how long we keep data.

Your rights

Under ZZPL you have the following rights. You can exercise most of them yourself in the app, and for everything else write to privacy@kuvajmo.com.

Access and a copy. The right to learn whether we process your data and to receive a copy. In the account settings of the app you can download everything we keep about you as one JSON document (health data and the record of accepting the terms included). If you cannot sign in, write to us.
Rectification. You change your name, language, phone, kitchen, dishes and the rest yourself in the app. You change your email address in the app, with a code sent to the new address.
Erasure. You delete the account in the app or at kuvajmo.com/delete-account/; some records remain anonymised, as explained above. To have particular data deleted, write to us.
Restriction of processing, when you contest the accuracy of data, when processing is unlawful but you do not want erasure, or when you need the data for a legal claim, or while your objection is considered.
Portability. Data you gave us and which we process on the basis of a contract or consent you receive in a structured, commonly used and machine-readable form (the JSON of the data download), and you can ask us to transmit it to another controller where technically feasible.
Objection. Where we base processing on legitimate interest, you can object. We will stop processing unless we have compelling legal grounds that override your interests or the processing is needed for legal claims.
Withdrawing consent at any time: you delete health data in the app, you turn statistics and crash reports off in the privacy settings, you turn push notifications off in your phone settings, and you remove the phone number from your profile.
Automated decisions: see the next section.

To protect you from impersonation, we may ask you to confirm that the account is yours, for example with a code sent to the account's email address. A request is free of charge. If it is manifestly unfounded or excessive, we may charge the necessary costs or refuse it, with reasons, as the law allows.

We reply without delay and at the latest within 30 days of receiving the request. Where the law allows (for example when a request is complex or there are many), that period can be extended; we will tell you about the extension and the reasons within the first 30 days.

The copy of your data does not contain reports other people made about you, in order to protect the people who report, nor the data of other people (they appear only by the name shown). The law allows access to be limited where it would harm the rights and freedoms of others.

Complaint. If you think we process your data contrary to the law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti; poverenik.rs). You have the right to judicial protection in accordance with the law. We would be glad if you came to us first, so we can try to solve the problem.

Automated decisions and profiling

Some things in the Kuvajmo app work automatically, by simple rules that do not change without notice. We use no artificial intelligence for any of them:

Automatic confirmation of reservations. An eater with enough positive reviews as an eater and no no-shows can get an automatically confirmed reservation with a cook who set the offer up that way; for others the cook confirms by hand.
Automatic pause of offers. When a cook receives several reports or negative reviews as a cook in a short time, their offers are paused automatically until a person has looked at them.
An automatic warning to a person whose reports were again found to be unfounded.
A recommendation to give the contribution at pickup, while the cook or the eater has few reviews. It is a recommendation, not a ban.
Allergens and goal. Offers with allergens from your profile are hidden or marked with a warning, and the fit with your goal is calculated by simple, public rules from the cook's estimate. Nothing is decided about you by it.

A ban of an account is always decided by a person, never automatically. If you disagree with one of these automatic decisions, write to us: a person will review it and we will hear your view. A banned person can appeal once by email.

How we protect data

The connection between the app and the server is encrypted (HTTPS).
Health data and bank accounts are stored encrypted (AES-256), and the keys are kept apart from the database.
There are no passwords. Sign-in is by a one-time code valid for 10 minutes, with a limited number of attempts. Sign-in codes and the addresses behind bans are stored only as hashes.
The sign-in renewal token changes on every use; reuse of an old token cancels the sign-in.
Photos are re-encoded with no metadata at all (GPS included), and links to photos are signed and short-lived.
The number of requests is limited per IP address and per account to prevent abuse.
Only authorised people access the administration, and their actions are logged.
Backups are encrypted.

No system is completely secure. That is why the next section says what we do when something happens.

Data breaches

If a data security breach occurs that may endanger your rights and freedoms, we will report it to the Commissioner without undue delay and, where possible, no later than 72 hours after becoming aware of it. If the breach is likely to create a high risk for you, we will tell you too, without undue delay, and say what happened, which data is involved and what you can do.

Children and the minimum age

Kuvajmo is meant for people who are at least 18 years old. When you open an account you must accept the Terms of Use and this policy and confirm that you are at least 18 years old; this is recorded (version and time). Beyond that we do not check age and do not ask for a date of birth. People under 18 cannot have an account; Kuvajmo has no way to receive a parent's consent. If we learn that an account belongs to a person under 18, we will close it and delete their data. If you are a parent and think your child opened an account, write to privacy@kuvajmo.com.

Changes to this policy

We will change this policy when the way we work changes. The version and the date it takes effect are at the top of the page, and we send earlier versions on request. We will tell you about important changes in the app or by email before they apply. If a change concerns processing based on consent, we will ask for your consent again. When the terms or this policy change in a way that requires it, the app will ask you to accept them again before you go on, and the new acceptance is recorded. Voluntary donations to the operator are welcome, but no way of receiving them exists yet; if we introduce one and it brings new data (for example about the person sending a contribution), we will update this policy before we start processing it.

Contact

Nikola Dašić PR STRUNA. Privacy: privacy@kuvajmo.com. General questions: contact@kuvajmo.com. Details about the provider are also in the legal notice.