Last updated: 11 September 2026
Mixit ("we", "us", "our") is the data controller responsible for processing your personal data. For privacy-related inquiries, contact us at privacy@mixit.app.
We collect data you provide directly: email address, name, dietary preferences, equipment preferences, and household composition. Household composition (including any number of children) is used solely to size recipe portions — we do not build profiles of, or knowingly process data about, individual children. We also collect data generated through your use of the app: meal plans, shopping lists, favourites, recipe notes, reviews and ratings you post (including the display name shown on them, and any photos you attach to a review), achievement progress, and device identifiers (used to enforce the device limit on your account). Any photos you add to a review are user-generated content that is stored and displayed publicly alongside your review, visible to other users of the app — do not include anything private or sensitive in them. We do NOT collect or store payment card numbers — all purchases are processed by Apple (App Store) or Google Play, and subscriptions are managed through RevenueCat.
We process your data on the following bases: (a) Contract performance — to provide our recipe, cooking-guide, and meal-planning features; (b) Consent — for marketing communications and non-essential cookies; (c) Legitimate interest — for service improvement, analytics, and fraud prevention; (d) Legal obligation — for accounting records related to subscriptions.
We use your data to: provide personalised meal plans and recipe recommendations based on your preferences; manage your account and sync your favourites, planner, and notes across your devices; enforce the account device limit; send transactional emails (such as account verification); and improve the app through aggregated analytics.
We share data with the following categories of processors: Supabase (EU region, eu-west-1 — database, authentication, and file storage — including the public storage bucket that hosts photos you attach to a review); Vercel (hosting and edge delivery of the web app — request logs); PostHog (product analytics, EU-hosted — only when you grant analytics consent); RevenueCat (subscription entitlement management, used when an in-app purchase is active); Apple App Store / Google Play (purchase processing); Resend (transactional email delivery, e.g. account verification); Sentry (crash reporting and diagnostics, EU-hosted in Germany — error and device-state data used to detect and fix app crashes, and only when you grant analytics consent); Cloudflare Turnstile / hCaptcha (bot protection on sign-in, where enabled); Google (Gemini generative AI — used only for admin-side recipe creation, never on your personal content). Each processor operates under a Data Processing Agreement (DPA) and processes data only on our instructions. We do not sell your personal data to any third party.
Our primary database is hosted in the EU (Supabase eu-west-1, Ireland), and our analytics and crash-reporting processors are configured to EU regions. Where a processor transfers data outside the EEA (for example email delivery, app hosting, or purchase processing by Apple or Google), we rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs).
Account data: retained for the duration of your account plus 30 days after a deletion request. Subscription records: retained as required for tax and legal compliance. Recipe notes, favourites, and planner entries: retained until you delete them or your account. Analytics data: aggregated and anonymised.
You have the right to: (a) Access — request a copy of your personal data; (b) Rectification — correct inaccurate data; (c) Erasure — request deletion of your data ("right to be forgotten"); (d) Portability — receive your data in a machine-readable format (JSON); (e) Restriction — limit how we process your data; (f) Objection — object to processing based on legitimate interest; (g) Withdraw consent — at any time, without affecting prior processing. To exercise any right, contact privacy@mixit.app. We will respond within 30 days. You can also delete your account and all associated data directly in the app under Account → Delete Account, or — if you no longer have the app — request deletion at mixit-app.com/delete-account.html.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with your national supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP): kzld.bg. You may also contact the supervisory authority in any EU member state where you reside or work.
We use strictly necessary cookies for authentication and session management. Non-essential cookies (analytics, marketing) are only set with your explicit opt-in consent. You can manage your cookie preferences at any time. Consent is valid for 6 months and can be withdrawn at any time.
Our service is available to users aged 14 and above (in accordance with Bulgarian data protection law). Users under 14 require verifiable parental consent. We do not knowingly collect data from children under 14 without such consent.
We implement appropriate technical and organisational measures to protect your data, including: encryption in transit using TLS; server-side encryption at rest provided by the Supabase platform (managed disk encryption); row-level security on our database; authentication via Supabase Auth with secure session handling; and regular security reviews. Payment data is handled exclusively by Apple and Google — it never touches our servers.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected users without undue delay, in accordance with GDPR Articles 33 and 34.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before they take effect.
Mixit is committed to making its app and website usable by everyone, in line with the European Accessibility Act (Directive (EU) 2019/882) and its Bulgarian transposition. We aim for WCAG 2.1 level AA: every control is labelled for screen readers, text follows your system text size, motion can be reduced, a high-contrast mode is available, and the cooking guide never relies on colour alone. Known limitations: some recipe photographs carry generic descriptions, and a few animated surfaces still ignore the in-app reduce-motion switch. If you hit a barrier, write to support@mixit.app with the screen and what happened — we answer within 30 days. If you are not satisfied with our response, you may contact the competent Bulgarian supervisory authority (Commission for Consumer Protection, kzp.bg).
Български
Mixit („ние“) е администратор на данни, отговорен за обработката на вашите лични данни. Събираме: имейл адрес, име, хранителни предпочитания, състав на домакинството, предпочитания за оборудване, както и данни от използването на приложението — планове за хранене, списъци за пазаруване, любими, бележки към рецепти, ревюта и оценки, които публикувате (включително снимките, които прикачите към ревю — потребителско съдържание, което се съхранява и показва публично заедно с ревюто ви, видимо за други потребители; не включвайте нищо лично или чувствително) и идентификатори на устройства. НЕ съхраняваме номера на платежни карти — всички покупки се обработват от Apple (App Store) или Google Play, а абонаментите се управляват чрез RevenueCat. Споделяме данни и с PostHog (продуктови анализи, хоствани в САЩ — само при дадено съгласие за анализи, под SCCs), Sentry (докладване на сривове и диагностика — данни за грешки и състоянието на устройството, обработвани в САЩ под SCCs, само при дадено съгласие за анализи), Resend (транзакционни имейли) и Google Gemini (генеративен AI — само за администраторско създаване на рецепти, никога върху личното ви съдържание); всеки обработващ работи по Споразумение за обработка на данни (DPA). Базата ни данни е хоствана в ЕС (Supabase, Ирландия). Имате право на достъп, коригиране, изтриване, преносимост, ограничаване и възражение по GDPR — пишете на privacy@mixit.app или изтрийте акаунта си директно в приложението (Акаунт → Изтриване на акаунт). Жалби: Комисия за защита на личните данни (kzld.bg). Пълният текст на политиката е достъпен в приложението в раздел „Правни документи“.