Privacy Policy
Last updated: August 13, 2026
BUMI is a family recipes app. This document explains, plainly, what data the app collects, why, where it goes, and how you can get it back or erase it.
Data controller
Baptiste Haond, a private individual based in California, USA,
publisher of the BUMI app.
Contact
support@bumi.recipes
— for any question about your personal data and to exercise your
rights (described in section 5 below).
Postal address
Not published. It is provided on written request sent to the address
above, and to any administrative or judicial authority that asks for
it.
Data protection officer
None has been appointed, as this appointment is not required in our
case (Article 37 of the GDPR).
1. The data you entrust to us
Your account
- Email address — identifies you and lets you recover access to your account.
- Password — we never see it. It is hashed by our authentication provider (Supabase) and stored in that form.
- Username, first name, last name, profile photo — what other users see of you.
Your content
- Recipes: title, description, ingredients, quantities, steps, prep and cooking times, category, photos.
- Cookbooks, favorites, shopping list.
- Photos you import or take, including photos of handwritten recipes submitted for automatic recognition.
For each recipe, you choose whether it is public (visible in the feed and on your profile) or private (visible to you alone).
Your interactions
- Follows: who you follow, who follows you.
- Reports of content and blocks of users.
- Corrections suggested for the ingredients matched to a recipe's steps, including on other people's recipes.
Your use of the app
- Recipes viewed and shown in the feed, with the date.
These measurements serve one purpose only: ranking the "For You" feed so that we don't show you again what you just saw, and so we can suggest recipes similar to the ones you look at. They are never sold, never shared, and never used for advertising.
2. Where your data goes
Hosting
All data is hosted by Supabase (database, authentication, image storage). Supabase acts as a processor: it hosts your content and has no right to use it.
Artificial intelligence
A few features call on outside AI providers, and only when you trigger them:
| When | What is sent | To whom |
|---|---|---|
| You photograph a handwritten or printed recipe to digitize it | The photo | Anthropic (Claude) |
| You create a recipe and its ingredients are automatically matched to each step | The text of the steps and the list of ingredients | Anthropic (Claude) |
| An illustration is generated for a recipe or an ingredient | The recipe title or the ingredient name | Google (Gemini) |
These requests contain neither your identity, nor your email address, nor your account data. Anthropic and Google process them as our processors and do not use this content to train their models under their business offerings.
Nothing else is shared with any third party.
3. What others see
- Your username, first name, last name and profile photo are publicly visible.
- Your public recipes are visible to every user of the app.
- Your private recipes, your shopping list, your favorites and your cookbooks are visible only to you.
- Your reports are never shown to the person you reported.
4. How long we keep it
Your data is kept for as long as your account exists. When you delete your account, it is erased, not archived:
- your profile, recipes, photos, cookbooks, shopping list, favorites and follows are deleted;
- the reports you filed are kept in anonymous form, for as long as needed to deal with abuse.
Deletion is done from the app: Profile → Settings → Delete account. It is immediate and permanent.
What we actually keep
In practice, the only data we hold about you is what you gave us: your email address and your account information, until the account is deleted. We keep no record of IP addresses and no connection logs on our side; our hosting provider keeps its own technical logs for just a few days, then erases them.
We answer judicial requests within the limits of what we actually hold on the date of the request.
5. Your rights
These rights come from EU law (the GDPR). We extend them to every BUMI user, wherever you live.
You have the right to access, correct, erase, restrict, object to, and port your data (Articles 15 to 22 of the GDPR, objection under Article 21). Where processing is based on your consent, you can withdraw it at any time, without calling into question what was done before (Article 7(3)).
- Correct: from the app (Profile → Edit profile, or by editing your recipes).
- Erase: from the app (Settings → Delete account).
- Access your data or get a copy in a readable format: write to support@bumi.recipes. We respond within 30 days.
You can also lodge a complaint with the French data protection authority, the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr (Article 77 of the GDPR).
6. Security
Access to the data is controlled row by row at the database level (Row Level Security): the rules ensure that a user can only read or modify what belongs to them or what has been made public. All traffic between the app and the server is encrypted (HTTPS/TLS).
No system is infallible. If a data breach is likely to put your rights at risk, we will notify you, as well as the competent authority, within the timeframes set by the applicable rules.
7. Children
BUMI is not intended for children under 13, and we do not knowingly collect their data. If you become aware that a child has given us personal data, write to us and we will delete it.
8. Changes
Any change to this policy will be published on this page, with a new update date. Substantial changes will be flagged to you in the app.