Privacy policy

Who we are

Nibbla is a meal-planning app run by Erik Hellström, who is responsible for your personal data ("we"). Email erikhellstrom94@live.se or use the feedback form in the app.

If something important changes in this policy, we will say so in the app.

What we collect, and why

• Without an account: nothing is sent to us. Your recipes, meal plans and shopping lists stay in your browser on your device.
• With an account: your email address and a password (stored in scrambled form, never readable by us). We use these to sign you in. Legal basis: providing the service you asked for.
• Your content: recipes, planned meals, shopping items and "already have it" marks, saved to your account so you can use them on several devices. Legal basis: providing the service.
• Households: if you create or join one, the people in it see the shared recipes, calendar and shopping list, and a partly hidden version of each other's email address (for example "a***@example.com"). Legal basis: providing the service you asked for.
• Email choices: whether you agreed to occasional emails, with the date. We only send them if you agree, and you can change your mind on the Account page. Legal basis: your consent.
• Links you import: the address you paste is opened by our servers to read the recipe. We do not keep the page; we keep the recipe you save.
• Feedback: the message you write, your email if you add it, the page you were on and your language. If you are signed in, it is linked to your account so we can follow up. Legal basis: our interest in improving the service, or your consent when you give your email.
• Anonymous counts: we add 1 to a daily counter when, for example, a recipe is saved or a page is opened. There is no user ID, IP address, cookie or device ID in these counts, so they cannot be traced to you. Browsers that send "Do Not Track" or "Global Privacy Control" are not counted.
• Technical logs: when you use the service, our hosting provider handles your IP address and browser details briefly to deliver pages and protect against misuse. We also keep short-lived counters to limit abuse. Legal basis: our interest in keeping the service secure.

Who else handles your data

We use Supabase (sign-in and database) and Cloudflare (hosting and delivery) to run Nibbla, and Resend (email delivery) to send sign-in, confirmation and reset emails; Resend sees your email address and the message. They process data only on our behalf. Our data is stored in the EU (Ireland). Some providers may handle data outside the EU/EEA; where that happens we rely on the safeguards required by law, such as the EU Standard Contractual Clauses.

We do not sell your data and do not use it for advertising profiles. If we show ads in the future, we will ask for your consent first (see "Cookies and storage").

How long we keep it

• Account and content: until you delete your account. Deleting it on the Account page removes your account and the content in it straight away. If you shared a household, the shared content stays with the others.
• Feedback: until we have handled it, and no longer than about 12 months.
• Anonymous counts: as long as they are useful. They contain no personal data.

Your rights

You have the right to see your data, correct it, delete it, receive a copy, object to how we use it and withdraw consent at any time. On the Account page you can download everything you saved, change your email choice and delete your account. For anything else, contact us.

You can also complain to the Swedish Authority for Privacy Protection, IMY (imy.se), or to the data protection authority in your country.

Children

Nibbla is not meant for children under 13. If you think a child has made an account, contact us and we will delete it.

If something goes wrong

If a security incident puts your personal data at risk, we will tell the authority within 72 hours as the law requires, and tell you without undue delay when the risk to you is high.