Privacy Policy

Version 1.1 — In force as of 10 September 2026

This Privacy Policy describes how the publisher of the Youmiamiam mobile application collects, uses, shares and protects your personal data.

This Policy complies with Regulation (EU) 2016/679 (GDPR) and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

It is accessible at any time from the Application (Profile › Legal documents section) and online at https://youmiamiam.be/documents.

Language of this document. This English version is an automatic translation produced by an artificial-intelligence tool, provided solely for your convenience. Only the French-language version of this Privacy Policy has legal force. In the event of any divergence, ambiguity or contradiction between this translation and the French version, the French version prevails. The French document remains available at https://youmiamiam.be/documents.

1. Data controller

The data controller is:

• Publisher: Patrick Langlois, self-employed (secondary occupation)
• Banque-Carrefour des Entreprises: BE 0886.405.301
• VAT number: BE0886405301
• Registered office: Rue Collebrine 7, 1325 Chaumont-Gistoux, Belgium
• Email (general contact, privacy and reports): youmiamiam@tuta.com
• Website: https://youmiamiam.be

Data Protection Officer (DPO): given the volume of data processed, the nature of the activities and the absence of large-scale processing of sensitive data or systematic monitoring, the Publisher is not required to appoint a DPO within the meaning of Article 37 GDPR and has not appointed one. Any request relating to data protection may be addressed to youmiamiam@tuta.com.

2. Definitions

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data (collection, storage, consultation, modification, deletion, etc.).
• Processor: service provider that processes data on behalf of the data controller, on the latter's instruction.
• Logged-in user: user with an Account (email or Google/Apple identity provider).
• Guest user: user of the anonymous mode, without an Account.

3. Data collected and purposes

3.1 Summary table

3.2 Data derived from third-party content — immediate deletion

When you submit a video link, the Application retrieves the text needed to analyse the recipe. Depending on the platform and on the elements available:

• where a text transcription is already available (for example automatically generated subtitles), that transcription is retrieved: no video or audio file is processed;
• otherwise, the audio track is extracted and then transcribed into text.

This text, together with the public title and description of the video, is then submitted to a language model in order to structure a recipe from it.

All intermediate data derived from the third-party content is deleted immediately after its technical use: no file is retained, archived or backed up.

Only the final Structured Recipe, the public metadata of the video (title, description, author, source URL) and a copy of the video's thumbnail are kept. This copy is necessary because the thumbnail addresses provided by the platforms expire after a few days. It is associated with the source video and not with your Account, and it is kept for as long as the source video is referenced in the Service.

3.3 Data derived from your photos

When you photograph a page of a cookbook, a magazine or a handwritten recipe, or when you add a photo to a recipe:

• If you are a logged-in user: the photo (in its original version or as you cropped or edited it in the Application) is kept on our servers located in France. This retention is necessary for the synchronisation of your library across your devices and for the display of the recipe thumbnail. It is kept only for as long as the associated recipe exists, and deleted as soon as you delete that recipe or your Account.
• If you are a guest user: the photo is never transmitted to our servers. It remains stored exclusively on your device.

Each user's files are logically isolated: each Account has its own storage space.

3.4 Guest mode (without an account)

In guest mode, no recipe, no photo and no identifying data is stored on our servers. Your recipes and photos are saved exclusively on your device.

The only data kept server-side is a pseudonymous device identifier, used solely to apply the free extraction quota and prevent its circumvention. This identifier is not associated with any identifying data (no email, no name, no telephone number). It is automatically deleted after 1 year without activity.

Practical consequence: uninstalling the Application results in the permanent deletion of all your local data. No recovery is possible.

3.5 Audience measurement — pseudonymised logs

In order to understand the actual use of the Application (number of daily and monthly active users, features used, error rate), the Publisher records pseudonymised usage logs.

• The account or device identifier appears there in hashed form by means of a cryptographic hash function. It allows several actions to be linked to the same user over time, without allowing you to be identified directly from the log.
• These logs are hosted and processed exclusively on the Publisher's servers at OVH, in France. No third-party audience-measurement tool (Google Analytics, Firebase Analytics, Amplitude, PostHog or equivalent) is integrated into the Application. No usage data is transmitted to a third party for statistical or advertising purposes.
• The processing is based on the Publisher's legitimate interest in measuring and improving its service. You have a right to object (Article 9.6).
• The hashed identifiers are kept for 13 months maximum. Beyond that, only aggregated statistics remain that no longer allow any re-identification, and which no longer constitute personal data.

3.6 Sharing a recipe by link

The Application allows you to generate a share link to one of your recipes, viewable in a web browser without installing the Application.

• The link is secret: it relies on a random, non-guessable identifier and is accessible only to the people to whom you communicate it.
• The corresponding page is configured not to be indexed by search engines.
• You can revoke this link at any time from the Application. The link is also automatically deactivated if you delete the recipe or your Account.
• The shared page displays the Structured Recipe, the attribution to the source and the photo you provided or, failing that, an illustration loaded directly from the original source (Article 13.2) or a generic illustration. It displays neither your email address, nor your name, nor any data allowing you to be identified.

Point of attention: anyone holding the link can view and forward it. By generating a share link, you accept this consequence. This processing is based on the performance of the contract, on your express instruction.

3.7 What we never do

• Your login credentials (email address, password) are never communicated to a third party, sold, rented, or used for advertising or prospecting purposes.
• The password is never stored in plain text and is never accessible, including to the Publisher.
• No data is acquired from data brokers.
• No marketing or behavioural profiling is carried out (see Article 12).

4. Origin of the data

The data processed comes from:

• directly from you, when you enter it in the Application (email, recipes, photos);
• from your device, when it automatically transmits technical information (device identifier, operating system version);
• from Google and Apple, when you use Sign in with Google or Sign in with Apple (email address, technical identifier);
• from third-party platforms, when you submit a URL for extraction (public metadata of the source video).

Sign in with Apple: if you choose the "Hide My Email" option, Apple transmits an anonymous relay address to us. We then never know your real email address.

5. Recipients and processors

Your data is processed by the Publisher and by the processors listed below, strictly to the extent necessary for the provision of the Service. Each is bound by a data processing agreement (DPA) compliant with Article 28 GDPR.

5.1 Processors

Network infrastructure. The Publisher uses infrastructure providers to route its outgoing requests. These providers receive no data allowing you to be identified and are not recipients of your personal data.

Artificial intelligence models: the Mistral AI and Google Gemini services are used in their paid offer. The content you submit is not used to train or improve these models and is not retained by these providers beyond the technical processing of the request.

5.2 No reselling, no commercial sharing

Your data is never sold, rented, or shared for commercial, advertising or prospecting purposes, outside the strict technical scope described above.

5.3 Communication to authorities

Your data may be communicated to a competent judicial or administrative authority upon legal request, within the limits and in accordance with the procedures provided for by law.

6. Data transfers outside the European Union

Some processors (Google, Resend, RevenueCat, Apple) are established in the United States or likely to transfer data there. These transfers are governed by:

• the standard contractual clauses approved by the European Commission (Implementing Decision 2021/914), together with additional technical measures (encryption in transit, minimisation of the data transmitted); and/or
• the EU–US adequacy decision (EU-US Data Privacy Framework) of 10 July 2023, where the processor is certified under it.

The storage of your recipes, your photos and your credentials takes place exclusively on servers located in France. Transfers outside the EU are limited to the occasional processing described in the table above.

You can obtain a copy of the applicable safeguards by writing to youmiamiam@tuta.com.

7. Data security

The Publisher implements appropriate technical and organisational measures to protect your data:

• encryption of communications in transit (HTTPS / TLS);
• encryption of the database at rest;
• robust hashing of passwords by means of an adaptive algorithm (such as bcrypt or argon2);
• logical isolation of each user's files;
• strict management of administrator access and logging of sensitive access;
• pseudonymisation of identifiers in the usage logs;
• regular, encrypted backups, kept within the EU zone.

In the event of a data breach likely to result in a risk to your rights and freedoms, the Publisher will notify the incident to the Autorité de protection des données (APD) within 72 hours, and will inform you directly if the risk to you is high.

8. Retention periods

The retention periods applicable to each category of data are indicated in the table in Article 3.1.

8.1 Account deletion

You can delete your Account at any time, directly from the Application (Profile section), without having to justify the reason and without going through a written request. The procedure, including if you no longer have access to the Application, is detailed at https://youmiamiam.be/documents/aide.

Deletion of the Account results in the immediate and irreversible deletion of:

• all your recipes;
• all associated photos stored on our servers;
• your account credentials (email, hashed password, OAuth identifier);
• your token balance;
• your share links, which become immediately inaccessible.

Copies present in the encrypted backups are eliminated by rotation within a maximum of 30 days.

Kept beyond that, in isolation: data subject to a legal retention obligation (accounting and tax documents, 7 years) and the proof of acceptance of the legal documents (5 years).

8.2 Guest users

Guest users have no personal data stored on our servers, except for the pseudonymous device identifier used for the quota. Uninstalling the Application deletes all local data (recipes, photos). The quota identifier automatically expires after 1 year of inactivity.

9. Your rights

In accordance with the GDPR, you have the following rights:

9.1 Right of access (Art. 15 GDPR)

You may request to know the personal data we hold about you and obtain a copy of it.

9.2 Right to rectification (Art. 16 GDPR)

You may request the correction of inaccurate or incomplete data. Most information can be modified directly from the Application.

9.3 Right to erasure / "right to be forgotten" (Art. 17 GDPR)

You may request the deletion of your data. You may also delete your Account at any time from the Application, which results in the immediate deletion of all your data, subject to legal retention obligations (Article 8.1).

9.4 Right to restriction of processing (Art. 18 GDPR)

You may request the suspension of the processing of your data in certain cases (contesting accuracy, unlawful processing, etc.).

9.5 Right to portability (Art. 20 GDPR)

You may request to receive your data in a structured, commonly used and machine-readable format (JSON), or request its direct transmission to another data controller, where technically possible.

9.6 Right to object (Art. 21 GDPR)

You may object, on grounds relating to your particular situation, to any processing based on legitimate interest — in particular the pseudonymised usage logs (Article 3.5) and the attribution metadata.

9.7 Right to withdraw your consent

Where processing is based on your consent (in particular the advertising identifier for AdMob), you may withdraw it at any time from the Application settings. This withdrawal does not affect the lawfulness of processing carried out beforehand.

9.8 How to exercise your rights

Send your request by email to youmiamiam@tuta.com, specifying the subject of your request and any information allowing your identity to be confirmed (typically, the email address associated with your Account).

We respond within a maximum of one month, extendable by two months for complex or numerous requests, with prior information from us.

9.9 Right to lodge a complaint with the APD

If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the Belgian data protection authority:

Autorité de protection des données (APD) Rue de la Presse 35, 1000 Bruxelles contact@apd-gba.be — www.autoriteprotectiondonnees.be

You may also refer the matter to the supervisory authority of the Member State of your habitual residence or place of work.

10. Data concerning minors

The Application is rated 16 and over on the App Store and the Google Play Store, and its use is reserved for persons aged at least 16. No processing is knowingly carried out on the data of persons below this age.

The Application is not intended for children within the meaning of the "Families" policies of Apple and Google, and does not fall within the specific regimes applicable to services intended for those under 13.

If you become aware that a person under 16 is using the Application, contact youmiamiam@tuta.com so that the data concerned can be deleted.

For users aged 16 or 17: we recommend seeking the prior agreement of a holder of parental authority, in particular before activating personalised advertising and before any paid subscription.

11. Advertising (AdMob)

If you are a Free or guest user, the Application may allow you to view an advertising video provided by Google AdMob in exchange for tokens.

11.1 Advertising solely on your initiative

No advertising is displayed spontaneously in the Application: there is no banner, no interstitial, no imposed advertising. An advertising video is triggered only if you explicitly request it, by choosing to obtain additional tokens. No advertising element is loaded until you have expressed this choice.

11.2 Prior consent

Before any advertising is loaded, a consent management mechanism (CMP — Google User Messaging Platform) allows you to:

• accept the collection of your device's advertising identifier (IDFA on iOS via the App Tracking Transparency framework, AAID on Android) for the purposes of personalised advertising;
• refuse it, in which case only non-personalised advertising will be offered to you.

Your choice can be modified at any time from the Application settings.

11.3 Data shared with Google AdMob

In the event of acceptance, the following may be transmitted to Google AdMob: the advertising identifier, the approximate IP address, the device type, the operating system version, the language and the ad-viewing data. This processing is governed by Google's Privacy Policy and by the AdMob rules.

No data from your Account (email address, recipes, photos) is transmitted to Google AdMob.

12. Automated decision-making and profiling

The Application implements automated processing in order to structure a recipe from a link or a photo. This operation produces no legal effect nor any similarly significant impact concerning you within the meaning of Article 22 GDPR: it is limited to transforming content that you have submitted yourself, at your request.

The Publisher carries out no marketing, behavioural or risk profiling.

13. Cookies and trackers

13.1 In the Application

The mobile Application does not use cookies in the web sense. It uses technical local storage necessary for its operation (session, preferences, cache, recipes in guest mode). Advertising trackers are activated only in the context described in Article 11, subject to your consent and your explicit request to view a rewarded video.

13.2 On the youmiamiam.be website

The youmiamiam.be website — which hosts the legal documents and the recipe pages shared by link — places no cookie or tracker that is not strictly necessary for the provision of the requested service. No third-party audience-measurement tool, no advertising network and no social-media button is integrated into it. No consent is therefore required within the meaning of Article 129 of the Belgian Law of 13 June 2005 on electronic communications, transposing Directive 2002/58/EC (ePrivacy).

Where a shared recipe has no photo provided by its author, the page may display an illustration loaded directly from the servers of the video's original platform (for example YouTube, TikTok, Instagram or Facebook). As with any image loaded from a third-party site, your browser then transmits your IP address to that platform, which processes it under its own privacy policy. No information about the page viewed (referrer) is transmitted to it. This loading is neither an audience-measurement tool, nor advertising content, nor a social-media button.

The web server connection logs (IP address, timestamp, requested page) are kept for 12 months for security purposes, in accordance with Article 3.1.

14. Modifications to this Policy

The Publisher may amend this Policy. Any substantial modification will be notified to you via the Application at least 30 days before it takes effect, and will be subject to fresh acknowledgement on your next connection.

The version history and the date of the last update are indicated at the top of the document and at https://youmiamiam.be/documents.

15. Contact

For any question relating to this Policy or your personal data:

• Email: youmiamiam@tuta.com
• Post: Patrick Langlois, Rue Collebrine 7, 1325 Chaumont-Gistoux, Belgium

Document updated on 10 September 2026. Version 1.1.