Privacy Policy

Controller

The controller for the processing of personal data in OctoCook and OctoCash under the GDPR is:

What is processed

When you sign in with Google, we receive your email address, the name on your Google account, your profile picture and a technical user id. We request nothing beyond that.

On top of that comes whatever you create in the apps: recipes, meal plans and shopping lists in OctoCook; accounts, transactions, categories and shared expenses in OctoCash. If you belong to a household, that content is shared with the other members of it.

The servers keep technical logs: timestamp, requested path, status code and internal ids. Email addresses, tokens and session ids are never logged.

Why, and on what basis

The data is processed for one purpose only: running the apps. Sign-in, households, and the content you put there. The legal basis is Art. 6(1)(b) GDPR, performance of the usage relationship. For the technical logs it is Art. 6(1)(f) GDPR, the legitimate interest in a working and secure service.

There is no advertising, no tracking, no profiling and no automated decision-making. No analytics service is embedded.

Cookies

One cookie holds your signed-in session, plus short-lived cookies that protect the sign-in flow against tampering. There are no advertising or analytics cookies, and therefore no consent banner.

Recipients and hosting

The data sits on a server operated by Hetzner Online GmbH in Germany, under a data processing agreement.

Signing in redirects you to Google, which processes your data there as its own controller under its own privacy policy.

If you connect a bank account or brokerage in OctoCash, your credentials are sent to that institution to fetch the transactions. Beyond this, data is neither shared nor sold.

Retention

Your content stays as long as your account exists. After deletion, the account and its content are removed within 30 days, except for entries in shared households that still belong to other members. Technical logs are deleted after 30 days at the latest. Backups expire within 90 days.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). An informal message to the address above is enough.

You may also lodge a complaint with a data protection supervisory authority.

Google user data

Data received from Google is used only to sign you in and keep your account in the apps. It is not transferred to third parties, not used for advertising, and not used to train AI models. You can revoke access at any time in your Google account settings.