Legal

Privacy Policy

01Who we are

mabor (“we”) is the app and this website, run by Máté Magyar, an independent developer in Hungary, who is the controller of the processing described here. You can reach us with any privacy question at info@mabor.hu; it is also the fastest way to exercise the rights below.

02What data we handle

Email: used only to log you in, for the emails that belong to your account (the codes you ask for, the welcome email, security notices) and - if you write to us - for our reply. You can change it in the app any time.
Your password: never reaches us. The app works out a separate sign-in key from it on your phone, and we store only a bcrypt hash of that key. Neither the key nor the hash opens your encrypted recipes.
Your name: optional; if you give it, it's only used to greet you in the app. End-to-end encrypted.
Your recipes and categories: the recipe's name, parts, ingredients, steps, notes, categories, favorite mark and timestamps, so they sync between your devices. All of it is end-to-end encrypted.
Your photos: the pictures you attach to recipes and their notes are shrunk and encrypted by your phone before they are uploaded. The server only holds the encrypted file and its size.
Technical data: like every server, ours briefly handles your IP address to deliver its responses and to limit sign-in attempts. The app's and the website's traffic passes through Cloudflare, which handles the IP address and the usual request data (the address requested, browser type, time) on our behalf, to deliver the traffic and filter out attacks. Every request from the app and the website's forms also says which language you use (English or Hungarian), so that our answers and emails come in it; we don't store it.
Your messages: if you write to us through the contact form or by email, we receive your message and the email you wrote from.
The website uses no cookies, analytics or ad trackers. If you pick a language with its switch, only your browser remembers that choice (in its local storage); it never reaches us. If you use the account deletion form, we receive the email and the code you enter there.

That is the complete list. We don't collect location, contacts or device identifiers, and we never use any of the above for profiling or personalized ads.

An account needs an email and a password, because without them we couldn't sync your recipes. Everything else is optional: you can leave the name empty, save recipes without photos, and still use every feature.

03Why, and on what legal basis

We use your data only to provide the service. The legal bases under the GDPR:

Running the app and syncing (email, sign-in data, recipes, photos, name): performance of a contract (GDPR Article 6(1)(b)).
Emails that belong to your account (codes for resetting your password, changing your email and deleting your account; the welcome and the deletion confirmation): also performance of a contract. Security notices (a password changed or reset, a new recovery key, a changed email, sent to the old address) rest on our legitimate interest in keeping accounts safe (Article 6(1)(f)).
Security and preventing abuse (IP address and request data): legitimate interest, for example limiting sign-in attempts (Article 6(1)(f)).
Replying to your messages: legitimate interest, or performance of a contract when you write about your account (Article 6(1)(f) and (b)).
Legal obligation: in the rare case that the law requires us to keep or hand over data (Article 6(1)(c)).

We don't ask for consent for anything, so there is nothing to withdraw, and we make no automated decisions about you.

04Where we store it

Your account, recipes and photos are stored on a server we run ourselves, rented from Hetzner Online GmbH in the European Union. Hetzner only provides the hardware and the network, as a processor. Emails are sent by our own mail server running on the same machine. Apart from Hetzner and Cloudflare, no third party receives, buys or handles personal data from us, except in the two cases described under When we share data.

The app also keeps a copy of your recipes on your phone, so it works without internet; the photos are stored encrypted on the phone too. The website and the app run behind Cloudflare for security and performance. Cloudflare acts as a processor under a data processing agreement; as a US company it may handle network-level data outside the EU, which is covered by its certification under the EU-US Data Privacy Framework and the EU standard contractual clauses.

You install and update the app through Google Play, and the app asks Google Play whether a newer version exists. Google handles this under its own privacy policy; we send nothing from your account to Google. If the app once offers to let you rate it on Google Play, only your phone remembers that it has asked.

Several features work entirely on your phone and send us nothing new. You add photos with the system's own picker or camera, so the app needs no camera or gallery permission and only sees the pictures you choose. Search, ticking off ingredients and steps, the cooking timers (their names included, which last only as long as the timer and are never saved to the recipe), and your choice of language, light or dark appearance and the recipe on one page view all live only on your phone. While a timer runs, the app keeps the screen awake so you don't have to unlock it mid-cooking; when it's up, it sounds and vibrates. The vibration permission comes with the installation, we don't ask for it separately, and we send no notifications.

The export is made from your own decrypted copy, so the ZIP file is not encrypted: anyone who gets it can read it. The app opens your phone's share menu, and you decide where it goes (for example your phone's storage or a cloud); we receive nothing from it.

05When we share data

When the law requires it. We hand data to an authority only under a legal obligation, after checking that the request is lawful, and only as much as is required. Since your recipes are encrypted, we couldn't hand over their contents even if asked: we don't have the key.
If the service changes hands. Your data could only move together with the promises of this policy, and we would tell you in advance, so you could export your recipes and delete your account first.

06What we never do

We don't sell your personal data or your recipes to anyone.
We don't use your account or your use of the app to target ads.
We don't build a profile of you, and we don't track you on the web.
We don't send newsletters or marketing emails: only the emails your account needs (codes, the welcome, security notices, deletion confirmations, advance notice of important changes) and our replies to your messages.

Promoting the app is always general, and never uses anything from your account.

07Security

Your password never leaves your device; we store only a bcrypt hash of a sign-in key derived from it. Sign-in tokens are stored only as SHA-256 hashes, so even a copy of the database can't be used to take over a session. Codes sent by email expire after 15 minutes, allow only a few attempts an hour, and sign-in attempts are limited both per network and per account. Changing your password automatically logs out every other device.

If a security incident affected your personal data in a way that put your rights at risk, we would tell you without undue delay, explain what happened and what to do, and report it to the Hungarian National Authority for Data Protection and Freedom of Information as the law requires.

08Encryption

Your recipes, categories, photos and name are encrypted on your phone (AES-GCM) before they reach our server, with a key that only your password unlocks. We store only the encrypted result and the key locked with your password - we can open neither, and neither could anyone who copied our database or our network traffic.

Every recipe is encrypted as a whole: not just its text, but its parts, categories, favorite mark and timestamps too. Only what the service can't work without is unencrypted: your email, the date you signed up, when your sign-ins were last used (for the twelve-month expiry), when photos were uploaded, and the number and size of the stored items and photos (the latter for the storage limit).

A recipe collection can sometimes reveal personal things, such as a food allergy or a diet. We never ask about such things, and whatever you write is encrypted on your phone before it leaves it, so we can't read it and don't use it for anything.

One important consequence: since we can't read or recover the encrypted content either, resetting a forgotten password doesn't by itself bring your recipes back. That's why, when you sign up, the app gives you a recovery key that is shown once: with it you can set a new password without losing data. On Android the app also keeps this key on your phone, in the protected storage of Google Play services (Block Store), so “Forgot password?” can fill it in by itself. If Google backup is turned on on your phone, this copy survives uninstalling and reinstalling the app, and if you move to a new phone directly, phone to phone, it may come along. We don't save it to the cloud, it is never uploaded to us, and only our app can read it. When you change your email it moves to the new address; it is deleted if you delete your account in the app, or reset your password without the key. Logging out keeps it, so it's at hand next time; after the account is deleted, it no longer opens anything. Without the key, a reset starts with an empty account - there is no back door, because it would break the very protection.

09Sign-ins

Once you log in, you stay logged in on that device until you log out, change your password, or clear the app's data. For security, a sign-in that hasn't been used at all for twelve months is deleted on the server; the device then simply asks you to log in again.

10How long we keep it

Account, recipes, photos: until you delete them. Deleting a recipe or a photo in the app deletes it from the server too, and deleting the account deletes everything that belongs to it at once.
Backups: for disaster recovery we keep daily backups for at most 14 days, so deleted data disappears from them within two weeks at the latest. The backups hold your recipes and photos only in encrypted form too.
Codes sent by email: expire and are deleted after 15 minutes, together with an unconfirmed new email. Each code only works on the device or page that asked for it, and a newer request from there replaces the old one.
Sign-ins: those unused for twelve months are deleted.
Technical data: sign-in and code limits are counted only in memory, for as long as the limit lasts (at most a day); our server doesn't log IP addresses, and technical logs are overwritten automatically. Cloudflare keeps logs briefly under its own terms.
Your messages: deleted within 24 months of the last message of the conversation, unless we need to keep them for a pending legal claim.

11Your rights

You have the right to access the personal data we hold about you, to correct it, to receive it in a portable format, to have it deleted, to restrict its processing, and to object to processing based on legitimate interest. We grant these rights to everyone who uses the service, wherever they live.

You can do most of it yourself, right away, on the app's Settings page:

Change your email: Profile, then Email. We confirm the new address with a code, and notify the old one. This opens after your account's first day; until then, write to us and we'll fix it.
Export: Account and security, then Export recipes. All your recipes, categories and photos go into one ZIP file: the recipes in a readable, machine-processable JSON file, the photos as JPEG images. It's made from your own decrypted copy, not by us (we couldn't decrypt it even if we wanted to).
Delete your account: at the bottom of the page. After you confirm your password, your account is deleted immediately and for good, with all your recipes, photos and categories.

Don't have the app at hand, or can't get to your phone? You can delete your account on the mabor.hu/en/delete-account page with a code sent by email, or write to info@mabor.hu. For any other request, write from the email you signed up with, so we can be sure it's you. Requests are free, and we reply within a month at most (for an unusually complex request this can be extended by up to two more months, and we'll tell you why).

If you feel we handled your data badly, please tell us first so we can put it right. You can also lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11., ugyfelszolgalat@naih.hu, www.naih.hu), or with the data protection authority of the EU country where you live or work, and you can also go to court.

12Children

The service is not meant for anyone under 16, and we don't knowingly collect data from them. If you think a child has created an account, write to us and we'll delete it.

13Changes

When this policy changes, we update the date above. For an important change - for example a new kind of data, a new processor, or anything that reduces your rights - we tell you at least 30 days in advance on this page, on the app's store page and by email, so you can decide whether to keep using the service. We send earlier versions on request. The principle that your data is yours won't change.

This policy is available in Hungarian and English. If the two versions differ, the Hungarian version prevails.

14Contact

Send your questions about this policy and your data requests to info@mabor.hu.