Privacy Policy
Last updated: 27 July 2026
This translation is provided for convenience; in case of any discrepancy, the Slovak version prevails.
Thymelist helps you plan the week, cook, and shop. Along the way we process some of your personal data. This page explains which data that is, why we process it, where it lives, and what rights you have.
1. Who we are
The controller of your personal data is:
SoC s. r. o.
Hlaváčiková 3163/29, 841 05 Bratislava – mestská časť Karlova Ves, Slovakia
Company ID (IČO): 56326793, Tax ID (DIČ): 2122274704, VAT ID: SK2122274704
Contact for support and for all requests concerning personal data: support@thymelist.com
This policy covers the Thymelist mobile app and the thymelist.com website.
2. What we collect
- Account - your email address, name (if you provide one), and, when you sign in with Google, your Google account identifier. Sign-in credentials, including the password hash, are managed by our authentication provider Clerk - we never see or store your password in readable form.
- Your content - recipes, photos, notes, meal plans, shopping lists, collections, tags, allergen labels, and serving counts.
- Preferences - app settings (language, translations, category order, nutrition display, and similar).
- Usage and technical data - a log of AI feature usage (request counts, tokens processed, cost estimates), analytics events (only if you have consented), crash reports scrubbed of personal data (they carry only an internal account identifier), and your subscription state.
- Public content you create - pages you share by link, and ideas on the public ideas board (an idea shows your first name).
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running your account, storing and syncing your content | Contract (Art. 6(1)(b) GDPR) |
| AI features (recipe import, shopping list generation, step timers, nutrition estimates) | Contract |
| Sharing and sending content, the ideas board | Contract |
| Thymelist Pro subscription | Contract |
| Error monitoring (Sentry) and abuse prevention (rate limits, AI usage log, server logs) | Legitimate interest (Art. 6(1)(f) GDPR) |
| In-app usage analytics (PostHog) | Consent (Art. 6(1)(a) GDPR) - withdraw it any time in Settings |
| Accounting and tax records | Legal obligation (Art. 6(1)(c) GDPR) |
4. AI features
When you use one of the AI features - scanning a recipe from a photo, importing from text or a link, generating a shopping list, step timers, or a nutrition estimate - the content you submit (the photo, the text, or the linked page) and your recipe text are sent to Anthropic PBC (USA), whose models power the feature. Under Anthropic's commercial terms this data is not used to train models and is deleted within about 30 days (with exceptions for abuse prevention and legal obligations). Thymelist never trains any models on your content either. AI results can be inaccurate - review them before relying on them.
The app performs no automated decision-making that has legal or similarly significant effects on you (Art. 22 GDPR).
5. Where your data lives
Your content - recipes, photos, plans, lists - is stored in the Convex database in the European Union (AWS, region eu-west-1, Ireland).
We use these processors to provide the service:
| Provider | Role | Region | Transfer basis |
|---|---|---|---|
| Convex, Inc. | Database and file storage (all content, photos) | EU - AWS eu-west-1, Ireland | Data at rest in the EU; DPA + Standard Contractual Clauses (US parent company) |
| Clerk, Inc. | Authentication (email, name, Google identity, password hash) | US | DPA + Standard Contractual Clauses |
| Anthropic PBC | AI processing (submitted photos/text/linked pages, recipe text) | US | DPA + Standard Contractual Clauses |
| Sentry (Functional Software, Inc.) | Error monitoring, scrubbed of personal identifiers | EU (de.sentry.io) | Data stays in the EU |
| PostHog, Inc. | Product analytics (in-app only with consent; cookieless on the web) | EU Cloud | Data stays in the EU |
| RevenueCat, Inc. | Subscription state | US | DPA + Standard Contractual Clauses |
| Railway Corp. | Hosting of thymelist.com (visitor IP addresses, request logs) | EU - Amsterdam | DPA + Standard Contractual Clauses |
| Websupport, s.r.o. | Registrar and DNS for thymelist.com; email forwarding for support@thymelist.com | EU - Slovakia | EU-based processor; no third-country transfer |
Some of our processors are based in the US. We have a data processing agreement (DPA) with each of them, and transfers to third countries are safeguarded by the EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR.
Google (Google sign-in and Google Play billing) acts as an independent controller - its processing is governed by Google's privacy policy: policies.google.com/privacy
6. How long we keep data
| Data | Retained |
|---|---|
| Account, content, photos, preferences, subscription state | Until you delete your account (self-serve, immediate) |
| AI processing sessions (including a scanned photo) | 30 minutes |
| Content sent to Anthropic | Up to 30 days on Anthropic's side; never for training |
| Shared pages | Until you stop sharing, or until account deletion |
| Ideas after account deletion | Anonymized and retained (your votes are deleted) |
| Waitlist (email) | Until the launch notification is sent, or until you ask us to delete it |
| AI usage log | For the lifetime of the account; deleted with it |
| Error reports (Sentry) | 90 days |
| Analytics events (PostHog) | Up to 1 year |
| Web server logs (Railway) | Short-lived operational logs, at most 30 days |
| Accounting and tax records | 10 years (Slovak Accounting Act, Act No. 431/2002 Coll.) |
7. Sharing and public content
When you share a recipe, collection, shopping list, or meal plan by link, a public page is created that anyone with the link can open. The page stays available until you turn sharing off ("Stop sharing") or delete your account. Checking items off a shared shopping list is anonymous, shared by everyone with the link, and is not tied to any account.
If you post an idea to the ideas board, it is shown publicly - in the app and at thymelist.com/ideas - together with your first name. When you delete your account, your votes are deleted and your ideas are anonymized: the name and the link to your account are removed, the idea text remains.
8. Waitlist
Before launch, you can join the waitlist on thymelist.com. We store your email address, the language of the page you signed up from, and the time of signup - in the Convex database in the European Union. The single purpose is to send you one launch notification; the legal basis is your consent, given by submitting the form (Art. 6(1)(a) GDPR). We never share the address with third parties or use it for a newsletter. Once the launch notification is sent, the list is deleted; you can ask for earlier deletion any time at support@thymelist.com.
9. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object. Here is how to exercise them:
- Erasure - directly in the app: Settings → Delete account. Deletion is immediate.
- Withdrawing analytics consent - the toggle in the app's Settings.
- Rectification - edit your content and profile directly in the app.
- Access, restriction, objection, and portability - email us at support@thymelist.com. The request must come from the email address the account is registered to. We will respond within one month at the latest. For portability we prepare your data manually in a machine-readable format.
If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk
10. Children
Thymelist is intended for people aged 16 and over. Please do not use the app if you are under 16.
11. Cookies
The thymelist.com website sets no cookies. Web analytics (PostHog, EU) runs without cookies and without persistent identifiers, and error monitoring (Sentry, EU) stores nothing in your browser. That is why there is no cookie banner.
12. Changes to this policy
We may update this policy from time to time. We will tell you about significant changes in the app or by email. The date of the last update is shown at the top of this page.
13. Contact
For any question about your personal data, write to us at support@thymelist.com.