Effective date: April 2026
Toefje ("we", "us", or "our") is developed by Dutch Philomath. This Privacy Policy explains what information we collect when you use the Toefje mobile application (the "App"), how we use it, and the choices you have.
By using the App you agree to the collection and use of information as described here. If you do not agree, please do not use the App.
Account information. When you sign in with Apple or Google, we receive your name and email address as provided by the identity provider. We do not see or store your password. We process this data because it is necessary to provide the service you requested (Article 6(1)(b) GDPR - contractual necessity).
Dietary and household preferences. During onboarding you share your household size, cooking confidence, preferred cuisines, and available kitchen equipment. This data is used solely to personalise your meal plans. We process this data because it is necessary to provide the service you requested (Article 6(1)(b) GDPR - contractual necessity).
Allergy and health-related dietary restrictions. During onboarding you may share food allergies (such as nuts, dairy, or shellfish) and health-related dietary restrictions (such as gluten-free or low-cholesterol requirements). This data constitutes special category data under GDPR Article 9 because it can reveal information about your health. It is collected and processed only with your explicit, separate consent granted during onboarding, independent of accepting this Privacy Policy (Article 9(2)(a) GDPR - explicit consent). You may withdraw consent at any time by updating your preferences in the App under Settings and removing this information.
Recipe interactions. We store the recipes generated for you, your ratings, favourites, completed cooking steps, grocery lists, and ingredient substitution choices. We process this data because it is necessary to deliver the core features of the service and to improve the quality of recommendations (Article 6(1)(b) GDPR - contractual necessity; Article 6(1)(f) GDPR - legitimate interest).
Device and usage data. We collect your app version for compatibility checks. We do not track your location or collect device identifiers for advertising purposes. We process this data on the basis of our legitimate interest in maintaining and improving the App (Article 6(1)(f) GDPR - legitimate interest).
Error and performance data. We use Sentry to collect crash reports and performance diagnostics. Sentry may capture stack traces, app state at the time of an error, device operating system version, and app version. This data is used solely for debugging and improving the stability of the App; it is not used for advertising or profiling. We process this data on the basis of our legitimate interest in maintaining a reliable service (Article 6(1)(f) GDPR - legitimate interest).
Toefje uses AI-powered services to generate personalised recipes, food photography, and ingredient substitution suggestions. Your dietary preferences and recipe context are sent to our AI service providers so they can produce relevant results. No other personal data (name, email, account details) is sent to AI services.
AI-generated content may not always be accurate. If you have food allergies or medical dietary requirements, always verify ingredients before cooking. You can report any problematic recipe directly from the App.
We do not sell your personal data. We share data only with the following named service providers, strictly to operate the App. We have entered into Data Processing Agreements (DPAs) with all service providers that process personal data on its behalf, in accordance with GDPR Article 28.
We may also disclose data if required by law or to protect our legal rights.
We keep your data for as long as your account is active. When you delete your account (available in the App under Settings), all your personal data - preferences, meal plans, recipes, grocery lists, and subscription records - is permanently deleted from our systems.
Depending on your jurisdiction you may have the right to:
To exercise any of these rights, please contact us at the email address below.
We use industry-standard measures to protect your data, including encrypted connections (TLS), secure authentication tokens, and row-level database security so each user can only access their own data. However, no method of transmission or storage is 100% secure.
Some of our service providers are based outside the European Union / European Economic Area (EU/EEA). When personal data is transferred to countries that do not benefit from an EU adequacy decision, those transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission, or equivalent safeguards, ensuring your data receives protection consistent with the GDPR.
The following service providers are US-based or involve US data flows: Google LLC (AI services), Sentry / Functional Software, Inc. (error monitoring), RevenueCat, Inc. (subscription management), Railway Corp. (backend hosting - EU region selected, but US-based subprocessors apply), and Cloudflare, Inc. (email routing). Transfers to these providers are covered by SCCs or equivalent safeguards. Supabase is hosted in an EU region (Ireland) and does not involve an international transfer.
Toefje is not directed at children under 16. By creating an account, you confirm that you are 16 years of age or older. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it as soon as possible.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email to your registered address before the changes take effect. The "Effective date" at the top of this page indicates when the policy was last revised.
If you have any questions or concerns about this Privacy Policy or your data, please contact us by email on privacy [at] toefje [dot] app
Toefje is developed by Dutch Philomath in Duiven, Gelderland, The Netherlands