Privacy Policy
Last updated: November 10, 2026
1. Data Controller
Marco Waltenberger
Eselsbergsteige 137
89075 Ulm
Germany
Email: support@marble-app.de
See also our Impressum (legal notice, German).
2. Data We Collect
When using the "MARBLE" app, the following personal data is processed:
- Account data: Email address, display name, and user ID (during registration and login)
- Third-party authentication data: When signing in via "Sign in with Google" or "Sign in with Apple", the data released by the respective provider (typically email address and name) is transmitted to our authentication service Firebase Authentication
- Usage data: Recipes, shopping lists, meal plans, categories, and group memberships that you create in the app
- Images: Recipe images and profile pictures that you upload
- Subscription and purchase data: When taking out a paid subscription, an anonymized purchaser ID, the subscription status, purchase receipts, and technical platform information (App Store / Google Play) are transmitted to our billing service provider RevenueCat
- Text recognition (OCR): If you use a photo for automatic recognition of ingredients or instructions, the image is processed exclusively locally on your device using Google ML Kit. No upload to an external service takes place.
- Recipe import via link: When you paste a link to a recipe page, your device loads that page directly from the site's operator, without passing through our servers. As with any page visit, the operator receives your IP address and the app's name and version (MARBLE), but no account or usage data. The recipe site's operator is responsible for its own processing of that data. We store the page address together with the recipe in your group; if you share the recipe via a link, the address is shared with it. If an import fails and you have agreed to app analytics, Firebase Analytics records the site's name (e.g. “example.com”, never the full address) and the reason for the failure, so we can improve the import.
- Sharing a recipe via link: When you share a recipe via a link, we store a copy of the recipe (content, image link and, if present, the source address) on our server (Supabase, EU). Anyone who has the link can retrieve this copy. It is deleted as soon as someone has saved the recipe via the link, and at the latest shortly after the link's 3-day validity ends.
- Visibility within your group: Members of your group see your display name and profile picture as well as the group's content, including the cooking history (who cooked which recipe when) and the statistics per member derived from it, and, if you bought Premium for the group, your display name as the buyer.
- Product statistics: The time at which you first use core features (first recipe saved, first meal plan entry, first shopping list item, first cooking entry logged, group created or joined, first invitation created) — only during the first 90 days after registration, stored with your user and group ID in our database (Supabase, EU)
- Device data: Device type, operating system, app version (for crash reports and analytics)
- Push notifications: Device token for sending notifications (e.g., timers)
3. Minimum Age
The app may only be used by persons aged 16 and older. If you believe a person under 16 has created an account, please contact us at support@marble-app.de so we can delete the account promptly.
4. Purpose of Data Processing
- App functionality: Providing core features (recipes, meal plans, shopping lists, groups)
- Authentication: Secure login and association of your data — optionally via email/password, "Sign in with Google", or "Sign in with Apple"
- Synchronization: Cross-device data synchronization and group collaboration
- Subscription management: Management of paid subscriptions (Premium tier), reconciliation of purchase status with the app stores
- Bug fixing: Detection and resolution of app crashes (Crashlytics)
- Improvement: Anonymized usage analysis to improve the app (Analytics)
- Product statistics: Analysis of the first steps new users take in the app, to improve getting started — only in aggregated form, without disclosure to third parties and without profiling
- Advertising: Display of personalized ads in the free tier (AdMob)
5. Legal Basis
- Art. 6(1)(b) GDPR — Contract performance: Providing app features (recipes, recipe import via link, meal plans, shopping lists, groups, authentication) as well as processing paid subscriptions
- Art. 6(1)(f) GDPR — Legitimate interest: Bug fixing and crash analysis (Crashlytics), protection against misuse, product statistics to improve getting started with the app, checking for new app versions, handling email enquiries (see section 13)
- Art. 6(1)(a) GDPR — Consent: Usage analytics (Firebase Analytics), personalized advertising (AdMob), and notifications (consent via your device's permission dialog)
Balancing of interests for the product statistics: Our legitimate interest is to see where new users get stuck when starting with the app and to improve the app there. For this we store only a few timestamps, no content of your recipes, plans or lists, and only during the first 90 days after your registration. Our server derives the data from entries that are stored anyway (no additional access to your device); it stays in our database in the EU, is analysed only in aggregated form, is not disclosed and is not used for advertising or profiling. You can object at any time without giving reasons (section 9). In our assessment, your interests therefore do not override ours.
6. Third-Party Services and Data Transfers
We use the following third-party services as data processors or as independent controllers:
- Google Firebase (Google LLC, USA) — Authentication, file storage, crash reports, analytics, push notifications. Privacy information
- Google Sign-In (Google LLC, USA) — Optional authentication method when signing in via a Google account. Privacy information
- Sign in with Apple (Apple Inc., USA) — Optional authentication method when signing in via an Apple account. Privacy information
- Supabase (Supabase Inc.) — Cloud database for recipes, shopping lists, meal plans. Data is stored exclusively in the EU (Frankfurt, Germany). Privacy information
- RevenueCat (RevenueCat, Inc., USA) — Processing and status management of paid subscriptions. Privacy information
- Google AdMob (Google LLC, USA) — Advertising in the free tier. Privacy information
- Apple App Store (Apple Inc., USA) — iPhone only: to check whether a new app version is available, the app queries Apple's public interface (itunes.apple.com). Apple receives your IP address and the app's identifier, but no account or usage data. On Android devices this check runs through the Google Play Store on your device. Privacy information
Providers based in the USA (Google LLC, Apple Inc., RevenueCat, Inc.) are certified under the EU-US Data Privacy Framework; data transfers are carried out on the basis of the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) additionally apply as a supplementary safeguard. Supabase stores data exclusively in the EU and is not subject to third-country transfers.
7. Data Retention
Your data is stored as long as your account exists. When you delete your account, all personal data will be removed within 30 days. Crash reports and anonymized analytics data are retained for up to 90 days. Product statistics are deleted 24 months after the respective event, and at the latest when your account is deleted. Subscription billing data may be retained for up to 10 years beyond account deletion due to commercial and tax law retention obligations (§ 147 AO, § 257 HGB).
8. App Permissions
Depending on the feature in use, the app requires the following device permissions:
- Camera — for taking recipe or profile pictures and for text recognition (OCR) of ingredients and preparation steps. Recordings are only processed upon your active selection.
- Photo library / storage — for selecting existing images as recipe or profile pictures
- Notifications — for displaying timer and reminder notifications (only after consent)
- Internet access — for synchronizing your data and logging in
You can revoke these permissions at any time in your device's system settings.
9. Your Rights
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR) — Information about data stored about you
- Rectification (Art. 16 GDPR) — Correction of inaccurate data
- Erasure (Art. 17 GDPR) — Deletion of your data
- Restriction (Art. 18 GDPR) — Restriction of processing
- Data portability (Art. 20 GDPR) — Export your data directly in the app via Settings → "Export my data" in a common, machine-readable format (JSON); alternatively still available upon request by email
- Objection (Art. 21 GDPR) — Objection to processing, in particular to the product statistics: after your objection by email we delete your entries and record no new ones
- Withdrawal of consent — At any time with effect for the future, e.g. within the app in the settings for analytics and advertising, and for notifications in your device's system settings
To exercise your rights, contact us at support@marble-app.de.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular the:
Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de
10. Reporting Infringing Content (Notice and Takedown)
Rights holders and other affected parties can report content that infringes their rights (e.g., copyright infringements) directly in the app via the "Report" function or by email to support@marble-app.de. Please identify the affected content and your ownership of the rights as specifically as possible. Reports are reviewed in a timely, diligent and objective manner; infringing content is removed or blocked.
11. Automated Decision-Making
We do not make automated decisions within the meaning of Art. 22 GDPR that produce legal effects or similarly significantly affect you. No profiling takes place.
12. Data Protection Officer
Due to the size and structure of the operation, there is no legal obligation to appoint a data protection officer (§ 38 BDSG, Art. 37 GDPR). For data-protection-related concerns, please contact the controller named in Section 1 directly.
13. Contact
For privacy-related questions, reach us at:
support@marble-app.de
Contact by email: When you email us — directly or from the app via "Send feedback", "Report content / Contact" or by reporting a recipe — we process your email address, your name (if provided) and the content of your message. The app prefills part of the email: feedback with the app version and operating system, a recipe report with the recipe ID, recipe name, group ID and your user ID, so that we can find the content. You see the text in your email app before sending and can change it. We use this data only to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns the use of the app or your subscription, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries and reviewing reported content). Emails to support@marble-app.de are forwarded by the forwarding service of our domain provider Namecheap (Namecheap, Inc., USA) to a mailbox at Google (Gmail, Google LLC, USA) and stored there. We delete your emails once your request has been fully handled, at the latest after three years, unless statutory retention obligations apply.
Deutsche Version