Privacy Policy

Himmelbauer Digital Innovations e.U., Hannovergasse 27/1, 1200 Vienna, Austria. Contact: support@thymetown.com

We collect the following personal data:

• Account data: Email address upon registration (via Supabase Auth)
• Recipes: Recipes and notes you save
• Payment data: Subscription status (via Stripe; we do not store card details ourselves)
• Server logs: IP address, timestamp, requested URLs (72h retention)
• Rate-limiting data: IP address (or account ID for logged-in users) to limit the number of requests per time window; deleted automatically after the respective window, at the latest after 24 hours

We use your data exclusively to:

• manage your account
• store and provide your cookbook
• bill your subscription
• prevent abuse (rate limiting)

We do not use your data for advertising and we do not pass it on to third parties.

Supabase (database & auth) — servers in the EU. Privacy policy

Google (optional "Sign in with Google" login) — If you sign in with your Google account, we receive your name, email address, and profile picture from Google to create and operate your account. Google learns that you use Thymetown when you sign in this way. If you register with email and password, no data is exchanged with Google. Legal basis: Art. 6(1)(b) GDPR. Privacy policy

Stripe (payments) — PCI-DSS compliant. Privacy policy

OpenAI (recipe generation) — search queries are processed. No directly identifying personal data is transmitted. Privacy policy

Vercel (hosting) — servers in the EU. Privacy policy

Upstash (rate limiting) — Redis database used to limit the number of requests per time window (abuse prevention). Processes your IP address or account ID; entries are deleted automatically once the window expires. Servers in Frankfurt, Germany (EU); the provider is Upstash Inc. (USA), safeguarded by a data processing agreement and EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security and abuse prevention). Privacy policy

We use only technically necessary cookies: a Supabase session cookie for authentication, and a cookie that remembers your language choice (German/English). Both are required to operate the site and therefore don't require consent. There are no tracking or advertising cookies.

You have the right at any time to: access, rectification, erasure, restriction of processing, data portability, and objection. Write to us at support@thymetown.com or delete your account directly in settings.

You can delete your account at any time under Account → Delete account. All personal data is deleted within 30 days.

You have the right to lodge a complaint with the competent data protection authority. In Austria: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna. www.dsb.gv.at