Privacy Policy

1. Who we are

Kista is an iPhone app made by asa ehf, a private limited company registered in Iceland ("we", "us"). This policy covers the Kista app, its share extension and this website, thekistaapp.com. For the purposes of the EU General Data Protection Regulation (GDPR) and the Icelandic Data Protection Act (No. 90/2018), asa ehf is the controller of the personal data described here. You can reach us at hello@thekistaapp.com.

2. What Kista stores

Kista only stores what it needs to keep your recipes and lists working across devices:

Data	What it is	Why
Account	A random user ID and how you signed in. If you use Sign in with Apple or Google, we receive the email address and name that the provider shares (with Apple this can be a private relay address). If you sign in with email, we store your email address and a securely hashed password. Signing in with an email address is optional.	To give you an account and keep your data in it.
Guest accounts	If the app lets you start without signing in, it creates an anonymous account with a random ID and no email address. You can add an email later and keep everything.	So you can try Kista before creating an account.
Recipes	Titles, ingredients, steps, servings, times, tags, notes, ratings, favourites, how often you've cooked something, your cookbooks, and the link and creator name of the post a recipe came from.	That's the app.
Photos	The image from the post you imported, copied into Kista's storage, and any photo you add to a recipe yourself.	To show the recipe even after the original post changes or disappears.
Meal plan and grocery list	Which recipes you planned for which day and meal, and the items on your grocery list.	To plan your week and build your shopping list.
Preferences	Language, the first day of your week, metric or imperial units, and whether you've finished the welcome tour.	To show the app the way you set it up.
Import details	The link you shared, its status, and the public text Kista read from it (such as the title, caption and page text).	To show progress, explain a failed import and avoid importing the same link twice.

Kista doesn't ask for your location, contacts, health data or advertising identifier, and it doesn't read your other apps. The app never sees anything you don't share to it.

3. How importing a recipe works

When you share a link to Kista, our server (a function running on Supabase, see section 8) fetches the public post or page behind it — for Instagram, TikTok and YouTube that means the public information those services provide about a post, such as its title, caption, creator name and preview image. If you paste text instead of a link, that text is used.

The text is then sent to an AI provider — OpenAI or Anthropic, depending on which one we use at the time — which turns it into a structured recipe. We send the content of the post, not your name, email address or user ID. Kista doesn't send your photos to the AI provider, and it doesn't watch or listen to videos. Both providers' API terms say they don't use this data to train their models; they may keep it for a limited time for abuse and safety monitoring, as described in their own policies (OpenAI, Anthropic).

Kista then matches each ingredient to a product in a copy of a supermarket's product range that we keep in our own database. That matching, and the nutrition estimate per serving, happen entirely on our side; nothing is sent to the supermarket.

4. Sending your list to a supermarket

Kista is not run by or affiliated with any supermarket. When you tap the Buy button on your grocery list, Kista opens a link to the supermarket's website that contains the store's product numbers and the quantities on your list. That link is all Kista passes on: no name, email or account information. It opens in the supermarket's app if you have it, otherwise in your browser. From there, ordering, payment and delivery happen with the supermarket under its own terms and privacy policy, and Kista receives nothing back about your order.

5. Kista Plus and payments

Kista Plus is sold as an in-app subscription through Apple. Apple handles the payment; we never see your card or payment details, and Apple's privacy policy applies to the purchase. The app asks Apple, on your device, whether you have an active subscription and uses only that answer (subscribed or not) to unlock unlimited recipes. That status isn't sent to our servers.

6. Notifications

If you allow notifications, Kista shows them for things like "your recipe is saved" or "your free trial ends soon". They are scheduled on your phone itself; Kista doesn't use a push notification server and doesn't store a device token.

7. What we don't do

• No advertising, and no ad networks in the app.
• No analytics or tracking SDKs, and no tracking across other companies' apps or websites.
• We don't sell or rent your personal data, or share it for anyone's marketing.
• Other users can't see your recipes. Kista has no public profiles or feeds.

8. Who processes your data

We use a small number of service providers, each only for the job described:

• Supabase — the database, sign-in, photo storage and the import function. Your data is stored in Supabase's EU region in Ireland (AWS eu-west-1).
• OpenAI or Anthropic — reading the text of a shared post and returning a recipe (section 3). Both are based in the United States.
• Apple — Sign in with Apple, and Kista Plus subscriptions.
• Google — Sign in with Google, only if you choose it.
• Netlify — hosting for this website (section 13).

Where a provider processes data outside the European Economic Area, the transfer is covered by safeguards recognised under the GDPR, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Our legal basis for processing your account, recipes, lists and imports is that it's needed to provide the app you asked for (GDPR Article 6(1)(b)). Security measures and handling support emails rest on our legitimate interest in running a safe service and answering you (Article 6(1)(f)).

9. How long we keep it, and deleting it

We keep your data for as long as you have an account. You can delete a single recipe, photo or list item at any time in the app.

To delete everything, open the app and go to More → Delete account. That permanently deletes your account together with your recipes, photos, cookbooks, meal plan, grocery list and preferences. It can't be undone. Copies in our hosting provider's encrypted backups are overwritten within a short period afterwards.

A guest account is tied to the app on your phone: if you log out or delete the app without adding an email address, its recipes can't be recovered. If you can no longer sign in and want your account deleted, email us from the address on the account.

Deleting Kista doesn't cancel a Kista Plus subscription; that is managed in your Apple ID settings.

10. Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a portable format, and to object to or restrict how it's processed. Email hello@thekistaapp.com and we'll answer within a month. You can also complain to the Icelandic Data Protection Authority, Persónuvernd, or the data protection authority where you live.

11. Security

Data is encrypted in transit (HTTPS) and at rest. Each account can only read and change its own rows in the database, enforced by the database itself. Your sign-in session is kept in the iOS keychain on your phone. Recipe photos are served from storage by direct link so the app can load them quickly; those links contain random identifiers and aren't published anywhere.

12. Children

Kista isn't directed at children under 13, and we don't knowingly collect data from them. If you believe a child has given us personal data, email us and we'll delete it.

13. This website

thekistaapp.com is a static website. It sets no cookies, runs no analytics and loads no third-party scripts or fonts. It is hosted by Netlify, which, like any web host, may keep short-lived server logs (such as IP address, browser type and the pages requested) to run and secure the service. We don't use those logs to profile visitors. If you email us, we use your message only to reply and handle what you asked about.

14. Changes to this policy

If we change how Kista handles personal data, we'll update this page and the date at the top. For significant changes we'll also tell you in the app before they take effect.

15. Contact

asa ehf, Iceland · hello@thekistaapp.com