Privacy Policy
Updated 6 November 2026
Bukuresipi saves the recipes and places to eat you share from social media. This page explains what data we collect, why, and how to delete it. We do not sell your data and show no ads.
What we collect
- Account: your email, password (stored as a bcrypt hash, never as text), the name you set, and the app language.
- Sign in with Google: your Google account ID, email and name. No profile photo, contacts or anything else.
- What you share: post links, screenshots, and the text we read from them (captions, page descriptions).
- Your content: recipes, saved places, notes, shopping lists, ratings, reviews, votes, reports, and map pins you place.
- Signed-in devices: device name and model, Android and app version, and an approximate city from your IP address (for the "Signed-in devices" page).
- A notification token (Firebase), to send notifications to your phone.
- Location: only while you search for places nearby. It is used for that search and not stored.
- The tester form on this website: the email you enter.
What we use it for
- Turning the posts you share into recipes or places to eat, and showing them to you.
- Sign-in, account security (for example new sign-in alerts), and account emails (confirm email, reset password).
- Sharing with your family: members see your name, and the places and recipes you did not mark "Only me". Your email is never shown to other users.
- Recipes you publish to the community, and your reviews, can be seen by other users with your name.
Who processes data
We use these services to run Bukuresipi. Each gets only what its job needs:
- Cloudflare: servers, database, image storage, and Workers AI, which reads posts and screenshots.
- Command Code (DeepSeek models): reads post text to pull out a recipe or a restaurant's details.
- Google Firebase: sends notifications. Google Sign-In: signing in with Google.
- Resend: sends account emails.
- OpenStreetMap (Nominatim, Overpass), Photon, HERE and Parallel: find a restaurant's location from its name and address. Your location is not sent.
Keeping and deleting
- Your data is kept while your account exists. Each sign-in ends after 30 days, then you sign in again.
- You can delete your account in the app (Account > Delete account) or on the Delete account page. This deletes your account, screenshots, recipes, saved places, ratings, reviews and devices at once.
- What stays: public restaurant details (name, address, location) shared by all users, and thumbnails of public posts. They are no longer linked to you.
Security
- Every connection uses HTTPS. Passwords are stored as hashes, and email links work once.
- Your screenshots are stored privately; only you (and your family, for a shared place) can see them.
Children
Bukuresipi is not for children under 13, and we do not knowingly collect their data.
Your rights
Under Malaysia's Personal Data Protection Act 2010, you can ask for a copy of your data, a correction, or its deletion. Most of this can be done in the app; for anything else, email us.
Contact us
Questions or requests about your data: hafiz@hafizbahtiar.com
If this policy changes, we update the date above, and tell you in the app for a big change.