Privacy Policy
Effective date: 7 August 2026
Last updated: 20 August 2026
This Privacy Policy describes how Geist 0 (“Geist 0,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use Prapp (the “Services”), including when you:
- Visit https://prapp.co or any related page that links to this Policy
- Join our waitlist or receive related emails
- Download or use the Prapp iOS or Android apps
- Contact us for support or privacy requests
Controller: Geist 0 (eenmanszaak), Hilversum, Netherlands · KVK 42050834 · BTW NL005457442B15
Privacy contact: privacy@prapp.co
If you do not agree with this Policy, do not use the Services.
Summary of key points
| Topic | In short |
|---|---|
| What we process | Waitlist email; app install and entitlement data; content you choose to import for processing; on-device preferences and recipes; support messages |
| Sensitive / special-category data | We do not intentionally collect medication or clinical health data. Meal-planning preference chips are treated as ordinary preferences, not diagnoses |
| Where recipes live | Your imported recipe library is stored on your device. We do not host a cloud library of imported recipes |
| AI | Temporary recipe text and related signals may be sent to AI processors (via OpenRouter) to parse or adapt a recipe, then deleted |
| Payments | Apple and Google process store payments. We use RevenueCat for entitlement sync. We do not store full card numbers |
| Sharing | Processors listed below; we do not sell personal data or waitlist emails |
| Your rights | GDPR and similar rights via privacy@prapp.co · NL supervisory authority: Autoriteit Persoonsgegevens |
Table of contents
- Who we are
- What information we collect
- How we process your information
- Legal bases
- Artificial intelligence
- On-device storage and cloud processing
- Waitlist email
- When and with whom we share information
- International transfers
- Cookies and tracking
- How long we keep information
- How we keep information safe
- Minors
- Your privacy rights
- United States residents
- Updates
- Contact and data requests
1. Who we are
| Field | Detail |
|---|---|
| Controller | Geist 0 |
| Legal form | Eenmanszaak (sole proprietorship) |
| KVK | 42050834 |
| BTW (VAT) | NL005457442B15 |
| Location | Hilversum, Netherlands |
| Product | Prapp — https://prapp.co |
| Publisher | https://www.geist0.com |
| Privacy | privacy@prapp.co |
| General | hello@prapp.co · contact@geist0.com |
We have not appointed a Data Protection Officer. Contact privacy@prapp.co for all privacy matters.
This Policy is in English. Where local law grants mandatory rights, those rights apply.
2. What information we collect
2.1 Information you provide
Website and waitlist
- Email address
- Confirmation that you clicked the confirm link
- Message content if you email us
Mobile apps
- Meal-planning preference and restriction chips you choose (stored on your device)
- Recipes, notes, tags, and cook-session data you create (stored on your device)
- Links, photos, documents, and share-sheet content you choose to import
- Optional Apple or Google sign-in identifiers and basic profile fields the provider shares, according to your settings
- Support messages and attachments
2.2 Information collected automatically
Website
- Device and browser technical data
- IP address (security and rate limiting — not marketing profiles)
- Bot-protection signals (Cloudflare Turnstile)
- Referral or campaign parameters when present
- Essential cookies (see §10)
Apps
- Pseudonymous install identifier (not a named account)
- Device attestation signals (Apple App Attest / Google Play Integrity or successors)
- Session tokens
- Usage counters for trial and fair-use limits
- Subscription and entitlement status
- Diagnostic and crash logs (preference-chip labels are not included)
- Device permissions you grant (for example camera or photo library) when you use import features
2.3 Information generated by the Services
Parsed recipe structure, nutrition estimates, macros, dietary conflict flags, and flavour suggestions. These outputs may be incomplete or inaccurate and are informational only — not allergen guarantees or medical advice.
2.4 Information we do not intentionally collect
- Full payment card or bank account numbers
- Medication, disease diagnosis, or clinical treatment data as a product feature
- Precise continuous location for advertising
- A public corpus built from recipes you import
We do not collect waitlist passwords. Store payments are handled by Apple or Google.
3. How we process your information
We process personal information to:
- Operate the website, waitlist, and apps
- Create and manage waitlist subscriptions and send confirmation emails
- After double opt-in, send early-access and launch updates matching the waitlist purpose
- Deliver import, review, adapt, cook, save, and related features
- Meter trials and enforce subscription entitlements
- Protect the Services (security, fraud, abuse prevention)
- Attribute invites or campaigns when enabled
- Respond to support and privacy requests
- Improve reliability through diagnostics
- Comply with law and enforce our Terms
We process information only when we have a valid legal basis (see §4).
4. Legal bases
For users in the EEA, United Kingdom, and Switzerland, we rely on:
| Purpose | Legal basis |
|---|---|
| Waitlist confirmation and operation | Consent and/or steps prior to a contract (Art. 6(1)(a)/(b) GDPR) |
| Launch emails after confirmation | Consent (Art. 6(1)(a)) — double opt-in |
| Providing requested app features | Performance of a contract / steps at your request (Art. 6(1)(b)) |
| Preference and restriction chips | Performance of a contract / your request to personalise meal-planning features (Art. 6(1)(b)). We treat these as ordinary meal-planning preferences and do not intentionally process special-category data under Art. 9 |
| Security, attestation, rate limiting, abuse prevention | Legitimate interests (Art. 6(1)(f)) — securing and operating the Services |
| Essential cookies / strictly necessary storage | Strictly necessary / legitimate interests |
| Optional analytics (if introduced later) | Consent only |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
You may withdraw consent where processing is based on consent. Withdrawal does not affect prior lawful processing. You may object to processing based on legitimate interests where applicable law allows.
5. Artificial intelligence
Prapp offers AI-assisted features, including recipe import (text and image analysis), recipe adaptation, nutrition estimation, and suggestions.
How it works. When you use an AI feature, we may send temporary recipe text and related signals needed for that request to AI service providers through OpenRouter, Inc., which routes the request to allowlisted cloud model hosts under our configuration and contracts. We use these outputs to return a draft or estimate to you.
What we do not do. We do not use AI processing to build a hosted public library of your imports. Temporary processing data is deleted after the request completes. We do not send your preference-chip labels to AI providers as user attributes; adapt requests use de-identified dietary instructions (for example “more protein, smaller portion”).
Your responsibility. AI outputs may be wrong or incomplete. Review them before cooking or eating. See our Terms of Use.
No significant automated decisions. We do not use AI for automated decisions that produce legal or similarly significant effects concerning you (such as credit, employment, or insurance). Security automation may block abuse.
6. On-device storage and cloud processing
| Topic | Practice |
|---|---|
| Recipe library | Stored on your device. We do not host a cloud archive of imported recipes |
| Preference chips | Stored on your device |
| Import / adapt | Temporary cloud AI processing only as needed to deliver the feature, then deleted |
| Source media | Processed for extraction; not retained as a redistributable media library |
| Optional sync | If we later offer cross-device sync, we will update this Policy before enabling it |
7. Waitlist email
| Step | Processing |
|---|---|
| You submit the form | Email (normalised), pending record, security signals |
| We send confirmation | One-time confirm token via our email provider |
| You confirm | Status becomes confirmed; token consumed |
| You do not confirm | Pending data deleted or suppressed after about 30 days |
Purpose: emails about Prapp early access and launch updates (“We’ll email you about early access.”).
Joining is not consent for third-party marketing, list rental, or partner campaigns. It does not guarantee access, pricing, or features.
Consent: form disclosure + Privacy/Terms links + email confirmation (double opt-in). Unsubscribe via email links or privacy@prapp.co. We follow applicable Dutch ePrivacy / Telecommunicatiewet rules for commercial electronic mail.
8. When and with whom we share information
We do not sell personal data. We do not sell waitlist emails or share them for cross-context behavioural advertising.
We share information with processors that act on our instructions:
| Category | Providers |
|---|---|
| Website hosting, DNS, security, email routing | Cloudflare, Inc. |
| Transactional email | Resend, Inc. |
| App distribution, attestation, store billing | Apple Inc. · Google LLC |
| Subscription entitlement sync | RevenueCat, Inc. |
| AI request routing | OpenRouter, Inc. (to allowlisted model hosts) |
| Application database | MongoDB Atlas (MongoDB, Inc.) |
| Application hosting (EU) | Our EU servers, including Redis-backed metering |
Apple and Google are independent controllers for App Store and Google Play billing. We receive entitlement status, not your full card number.
We may also disclose information if required by law, to protect rights and safety, or in a corporate transaction with appropriate safeguards.
9. International transfers
Geist 0 is established in the Netherlands. Some processors may process data in the United States or other countries outside the EEA/UK.
Where required, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and UK addendum where applicable) and the processor’s data processing terms. Request details at privacy@prapp.co.
10. Cookies and tracking
We currently use essential cookies and similar storage only: to run the site, maintain security, remember your cookie preference, and prevent abuse.
Optional analytics and advertising cookies are not in use on the website. Until we enable a named analytics provider and update this Policy, Accept all does not load additional trackers — it only stores your consent preference for that future use.
Details, named storage keys, banner choices, and Change cookie preferences: Cookie Policy.
If we introduce optional analytics later, we will name the provider, describe the purpose, and obtain consent where required.
11. How long we keep information
| Data | Retention |
|---|---|
| Unconfirmed waitlist emails and tokens | About 30 days |
| Confirmed waitlist emails | Until unsubscribe or deletion request, or end of waitlist purpose, unless law requires longer |
| Security and rate-limit logs | Typically up to 30 days |
| Consent / confirmation records | Typically up to 24 months after the consent event, unless longer is required |
| Session tokens | Hours; reissued during active use |
| Trial and entitlement records | While active, then up to 24 months after expiry or cancellation for accounting, fraud prevention, and disputes, unless law requires longer |
| Temporary AI processing data | Deleted after the request completes (typically within hours) |
| On-device library and chips | Under your control on the device |
| Support correspondence | Typically up to 24 months after closure, unless legal needs require longer |
12. How we keep information safe
We use organisational and technical measures including HTTPS, access controls, processor agreements, rate limiting, bot protection, device attestation where available, short-lived tokens, and one-time waitlist confirmation tokens.
No electronic transmission or storage is 100% secure. We cannot guarantee that unauthorised parties will never defeat our security. Protect your devices and accounts.
13. Minors
The Services are for persons aged 18 or older. We do not knowingly collect personal information from anyone under 18. Contact privacy@prapp.co if you believe a minor has provided data; we will delete it promptly.
14. Your privacy rights
Depending on where you live, you may have rights to access, rectify, erase, restrict, or object to certain processing, to withdraw consent, to data portability, and to lodge a complaint with a supervisory authority.
In the Netherlands: Autoriteit Persoonsgegevens — https://autoriteitpersoonsgegevens.nl
In the UK: the ICO. Elsewhere: your local authority.
How to exercise: email privacy@prapp.co. Include the waitlist email you used, or enough detail to identify your app install or optional account. We respond within one month (or sooner if required) and may verify your identity. Deleting records we control does not erase data only on your device or in backups you control.
15. United States residents
We do not sell personal information and do not share it for cross-context behavioural advertising. We honour Global Privacy Control (GPC) signals as an opt-out of sale/share where required.
You may request to know, delete, or correct personal information by emailing privacy@prapp.co. We do not use or disclose sensitive personal information for purposes that require a “Limit the Use” link beyond what is necessary to provide the Services you request.
16. Updates
We may update this Policy and will revise the effective date. For material changes, we will provide additional notice (email to confirmed waitlist subscribers, website notice, and/or in-app notice).
17. Contact and data requests
privacy@prapp.co — privacy and data-subject requests
hello@prapp.co — product and waitlist
contact@geist0.com — publisher
Geist 0
Hilversum
Netherlands
KVK 42050834