Privacy policy

Last updated: 9 October 2026

The short version

• Potlet works on your phone without an account. Your recipes stay there unless you sign in.
• When you import a post, our server reads it and sends its text and pictures to Google's Gemini, which turns it into a recipe.
• There are no ads, no tracking and no analytics in Potlet.
• You can delete your account, and everything we keep about you, at any time.
• We never sell your data.

Who we are

Potlet is made by Kris Cem Bulent Saran in Sweden. Kris is responsible for your data under the EU's data protection law (GDPR). For questions or requests, write to [email protected].

What stays on your phone

Your recipes, pictures, collections, cooking history, settings and the imports waiting to be sent are stored on your phone. None of it leaves the phone unless you import, sign in and sync, or export a backup.

Android's own backup can copy the recipes in "On this phone" and your settings to your Google account. Your account's recipes and your sign-in are left out of it.

Uninstalling Potlet, or App info › Storage › Clear storage, deletes all of it from the phone.

What we get and why

• An import sends us the link you share or the text you paste. A photo import sends up to five photos of the recipe.
• An account needs a username and password, or your Google sign-in. We only keep a scrambled form of the password. Google gives us its ID for you and your email address.
• Sync sends your recipes, their pictures and the steps you've ticked, so they reach your other phones.
• A problem report sends the import's link, your note and, for a saved recipe, your version of it. We add what we already have about that import: the text we read, the AI's answer and the recipe we made. We only use reports to fix imports.

We use all this to do what you asked for. We also count a few things, like how many imports you've used and failed sign-in attempts, to keep the service fair and safe. Under GDPR that is our legitimate interest.

Who else gets it

• Google (Gemini). To turn a post into a recipe, we send its link, text and pictures to Google's Gemini AI. Photos from a photo import go there too. Gemini never gets your name, email, account or IP address. We use Google's paid service, which doesn't use what we send to train its models.
• Pexels. When a post has no picture, we search Pexels for a photo by the recipe's title. Pexels gets the title and nothing else.
• The site the post is on (Instagram, TikTok, YouTube, Pinterest, Facebook or a recipe site) sees our server asking for the page, without any account. It never sees you.
• Cloudflare carries the traffic to our server and stores our backups. The backups are encrypted before they leave the server, so Cloudflare can't read them.
• Google (sign-in and updates). If you sign in with Google, Google knows you signed in to Potlet. Once per new version, the app asks Google Play whether an update is ready.

We don't share your data with anyone else, and there are no ads or trackers in the app.

How long we keep it

• An import stays 30 days after it finishes, with the text we read, the AI's answer and which AI model made it. Photos from a photo import are deleted as soon as the import is done.
• Your account, sign-ins, synced recipes and pictures stay until you delete them or the account. A recipe you delete waits 30 days in Recently deleted first.
• A phone stays signed in for 180 days, or until you sign out.
• A report stays 30 days after we've dealt with it, and never more than 180 days.
• Server logs are kept briefly and overwritten as new ones come in. They hold no IP addresses.
• Backups keep a copy on the server for 7 days and an encrypted copy elsewhere for up to 6 months. Deleted data stays in them until they age out.

Your rights

You can ask to see the data we have about you and get a copy of it, to have it corrected or deleted, and to object to how we use it. Write to [email protected] and we'll answer within a month. You can export your recipes yourself at any time in Settings › Your data › Export backup.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (imy.se) or to the authority where you live.

Deleting your account

In the app, go to Settings › Account › Delete account. Without the app, see potlet.app/delete-account.

Children

Potlet is not for children under 13.

Home servers

Some people run their own Potlet server at home and connect the app to it. That server's owner decides what it keeps and which AI services it uses, and the app names those services before your first import. This policy covers the public Potlet server.

Changes

When we change this policy, we update the date at the top. If a change matters to you, the app tells you.