Privacy policy

Last updated: 23 October 2026

This is an English translation for convenience. The German version is binding.

In short: Snackofatz is your snack diary. There is no advertising, no tracking and no analytics. Your data lives on servers in Germany. It only leaves them when a feature needs it: push notifications via Google, emails via a mail delivery service, and my mailbox at a provider in Germany. Everything else is below.

1. Controller

No data protection officer has been appointed, because the legal requirements for doing so are not met.

2. Hosting

The website, application programming interface (API), database, photo storage and monitoring of Snackofatz run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Falkenstein data centre (Germany). A data processing agreement under Art. 28 GDPR is in place with Hetzner. Hetzner processes the data exclusively in Germany.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of the service.

3. Website (snackofatz.app)

Server logs

The web server (for the website and the API) keeps no access log of page views. Only when a request fails does it write an error message to the system log; this may contain the IP address, the requested address and the browser (user agent). These messages are used to fix faults and are deleted after 14 days at the latest. Legal basis: Art. 6(1)(f) GDPR.

No cookies, no tracking

The website sets no cookies, uses no analytics or advertising services and embeds no content from third parties. The fonts are served from our own server, not from Google Fonts.

Invite pages

Invite links (snackofatz.app/invite/…) show the username and profile picture of the person who invited you. To do this, the page looks up the invite link at our API. The number of such lookups is counted briefly per IP address in memory to prevent abuse; the lookup itself appears in the API's server log (section 4) and is deleted there after 14 days at the latest. If you open the link without the app installed, the button leads to Google Play; the invite ID is passed to Google Play so that the app can find it again after installation (see section 6). Legal basis: Art. 6(1)(b) and (f) GDPR.

4. The app: account

You need an account to use the app. For this, I process:

• Username – visible to all signed-in users, so that they can find you and send you a friend request, and on your invite links.
• Email address – for signing in, for confirmation codes and for resetting your password. It is not visible to others.
• Password – stored only as a salted hash (Argon2id); I cannot see the password itself.
• Profile picture (optional; visible together with the username, so in search results, on invite links and on comments), language and your notification settings.
• Time of registration and of email confirmation.

To confirm your email address, when you change it and when you reset your password, I send you a time-limited code by email (section 8). If you change your password, your email address receives a notice with the time and platform (Android or iOS). Legal basis: Art. 6(1)(b) GDPR (contract for using the app).

Sign-in and sessions

After you sign in, your device receives an access token (valid for 1 hour) and a refresh token (valid for 30 days). Only hashes of these are kept on the server. When you sign out, the tokens become invalid. Sign-in attempts are counted briefly per IP address and per account to slow down password-guessing attacks; these counters exist only in memory. Likewise, I briefly count emails to an address that is not yet confirmed, per address and in memory, so that nobody can flood someone else's mailbox with emails. Legal basis: Art. 6(1)(b) and (f) GDPR.

Server logs of the API

For every request to the API (api.snackofatz.app, for the invite pages via snackofatz.app/api/…) – from the app and from the invite pages (section 3) – a log line is stored: date and time, requested address, HTTP status code, processing time, size of the request, IP address, the identifier of the app or browser (User-Agent, e.g. “Snackofatz/35 (android)” for the app) and, if you are signed in, the internal ID of your account. The logs are used to detect faults and attacks and to investigate abuse. They are kept on the app server and on my monitoring server, both at Hetzner in Germany (section 2), and are deleted after 14 days at the latest. Legal basis: Art. 6(1)(f) GDPR.

5. The app: snack diary

The core of the app is your entries. For each entry I store:

• the photo (optional if the snack is already known) – when it is uploaded, the image is re-encoded and all metadata including GPS location is removed; the original and a thumbnail are stored;
• the snack (name, brand, barcode if any; for homemade snacks the recipe with ingredients, quantities, steps and number of servings) as well as, optionally, the rating (1–10), tags, a note and the place or shop as free text;
• the time of the entry and its visibility (“friends” or “private”).

By default, entries are visible to your confirmed friends. You can set any entry to “private” individually; then only you can see it. As long as you have not added any friends, nobody sees your entries. People you are not friends with never see your entries, only aggregated values of a snack (average and number of ratings), from which nothing can be inferred about you.

Homemade snacks and their recipes are not public: only you and your confirmed friends can find them. They can also be opened by anyone who is allowed to see an entry for that snack – for example the friends of a friend who rated it.

If you create a new snack in the database, the snack record (name, brand, barcode, place) is stored with a reference to your account. A bought snack remains in anonymised form after your account is deleted (section 12), because others use it in their diaries. Homemade snacks including their recipe, on the other hand, are deleted with your account – together with all entries for them, including those of your friends with their photos.

Legal basis: Art. 6(1)(b) GDPR.

Barcode lookup with Open Food Facts

When you scan a barcode, my server looks the code up in our own database and, if necessary, in the free product database Open Food Facts. Only the barcode number is sent – no account data, no location, no device information; the request is made by the server, not by your device. Responses are cached on our server.

6. The app: friends, invitations, blocking, reporting

• Friendships are stored with their status (requested, accepted) and time. You can withdraw requests and end friendships at any time.
• Invite links and QR codes contain a random ID that points to your account so that the other person can find you. IDs expire automatically; you can revoke all shared links in the settings.
• Install referrer: If you install the app from Google Play via an invite link, the app reads the install referrer provided by Google Play once, on first launch (Google Play Install Referrer API), to find the invite ID again. No other data is read in the process.
• Reactions (emoji) to friends' entries are stored linked to your account.
• Comments you leave under an entry – whether under your own or a friend's – are stored linked to your account. They are visible to everyone who can see the entry: the person who owns the entry and all of their friends, including those you are not friends with yourself.
• Blocks are stored so that blocked people cannot send you requests and you cannot see each other. The blocked person is not informed.
• Reports of entries, snacks, comments or profiles are stored by me with the reporting person, the reported item, the reason and an optional remark, in order to review them. A copy of the reported content at the time of the report is also stored with the report: for an entry, the author's username, the snack, note, rating, tags, place and references to the photos; for a comment, its text; for a homemade snack, its recipe. This way the report can still be reviewed if the content or the author's account is deleted later. I also email every report to myself through the Lettermint delivery service (see section 8): with these details, the reporting person's username and email address, and thumbnails of the reported photos or the reported person's profile picture. If I remove content or close an account, I email the person concerned at their account's email address to tell them why; the email does not name the person who reported it.
• Ban list: If I close an account for breaking the terms of use, I store a hash (SHA-256) of its email address with the time and a short note, so that nobody can sign up again with the same address. Upper and lower case and a “+” suffix before the @ make no difference. The address itself is not on the list; but because email addresses can be guessed, the hash is still personal data. When someone signs up or changes their email address, I check the new address against this list.

Legal basis: Art. 6(1)(b) GDPR; for blocks and reports additionally Art. 6(1)(f) GDPR (protecting users); for the ban list Art. 6(1)(f) GDPR (my legitimate interest in keeping people who have broken the terms of use out of the app).

7. Push notifications (Firebase Cloud Messaging)

If you wish, the app notifies you about friend requests, accepted requests, reactions to your entries, comments under your entries and in conversations where you have commented yourself, and (only if you switch it on) about a friend trying a snack right now. For this I use Firebase Cloud Messaging of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA).

• Your device receives a device identifier (token) from Firebase, which the app sends to my server and which is stored there linked to your account.
• The content of each notification (for example the person's username and the name of the snack, for comments the first characters of the comment) is delivered to your device via Google's servers. Google can technically see this content.
• Delivery may involve a transfer to the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission); the EU Standard Contractual Clauses also apply.

You only receive push notifications if you have granted the app permission to send them; you can switch off each type of notification individually in the settings. When you sign out, when you switch them off or when the device's session ends (expiry, password change or password reset), the token is deleted on my server. Legal basis: Art. 6(1)(a) GDPR (consent via the system permission), which you can withdraw in your device's system settings.

8. Sending email and my mailbox

I send confirmation codes, codes for resetting your password and notices about address and password changes to you, and feedback reports (section 9) and report notifications (section 6) to myself, through the mail delivery service Lettermint B.V., Willemsvaart 16 B, 8019 AB Zwolle, the Netherlands (processing in the EU). This processes your email address, the content of the message and the time it was sent; a data processing agreement is in place with the provider. I do not send advertising or newsletters.

My mailbox hi@snackofatz.app is also hosted by Hetzner Online GmbH (section 2, processing in Germany); emails to hello@snackofatz.app are forwarded there. Your emails to me, feedback reports and report notifications arrive there; from there I answer them and write to people whose content I removed or whose account I closed (section 6). This processes the email addresses, the content of the messages including attachments, and the time; the data processing agreement with Hetzner (section 2) also covers the mailbox.

Emails you send to hi@snackofatz.app are kept by me for as long as necessary to deal with your request. Legal basis: Art. 6(1)(b) GDPR.

9. Feedback from the app

In the app you can send me feedback (Settings → “Send feedback” or shake your phone). This transmits a screenshot of the current screen (which you can mark up beforehand), your message and device details: device model, operating system version, screen size, text size, language, app version, the screen currently open, and the username and email address of your account. The screenshot may show content of other users that is visible on that screen.

The report is not stored in the database but is emailed to me through the Lettermint delivery service (see section 8); your address is set as the reply address so that I can answer you. I keep the report until the matter is resolved, for six months at most. Legal basis: Art. 6(1)(f) GDPR (my legitimate interest in improving the app). Feedback is voluntary; by sending it, you decide whether the screenshot is transmitted.

10. Recipients and transfers to third countries

Your data is not passed on any further, unless I am legally required to do so.

11. Retention

• Account and entries: until you delete your account. An entry for another person's homemade snack is also deleted when that person deletes their account.
• Confirmation codes: valid for 15 minutes, deleted two hours after sending at the latest.
• New, not yet confirmed email address: until confirmation or until you cancel the change; if unconfirmed, it is deleted after seven days (an hour later at the latest).
• Wrong code entries: counted per account for 24 hours (without IP address) and then deleted.
• Invite links and QR codes: until expiry (invite links after 30 days, QR codes after 5 minutes), deleted an hour later at the latest.
• Sign-in tokens: until expiry (access 1 hour, refresh 30 days) or until sign-out.
• Push token: until sign-out, until the device's session ends (expiry, password change or password reset) or until notifications are switched off.
• Web server error messages and API server logs: 14 days at the most.
• Reports: kept until they are handled; after that they are deleted six months after receipt at the latest – along with them the stored copy of the reported entry, comment or recipe. I delete the email about a report, and my email to the person concerned (section 6), from my mailbox once the report and any objection to my email are dealt with, six months after the report arrived at the latest.
• Ban list: two years from the closing of the account; after that the entry is deleted automatically.
• Feedback reports: until the matter is resolved, six months at most (see section 9).
• Database backups: encrypted, overwritten on a regular cycle; deleted data disappears from them after 30 days at the latest.

12. Data export and account deletion

In the app under Profile → Settings you will find:

• Export my data (in the “Privacy & data” section): a ZIP file with your profile, all entries, reactions, comments, your homemade snacks with recipes, the bought snacks you created or last edited, friendships, open friend requests, blocks, reports and your active sign-ins (start, last renewal and, if push is enabled, platform) as JSON, plus all photos in original size (Art. 20 GDPR).
• Delete my account (at the very bottom, below “Log out”): after you confirm with your password, your account, entries, photos, reactions, friendships, blocks, reports, tokens and push registrations are deleted immediately and permanently. Bought snacks you created remain in the database without any reference to you; your homemade snacks are deleted including their recipe and all entries for them, including other people's entries and photos; the averages are recalculated without your ratings. Your comments are deleted with your account – both those under your own entries and those under other people's entries. If an entry, a comment or a homemade snack of yours was reported, the stored copy of the reported content stays with that report until it is handled; after that the report and the copy are deleted six months after receipt at the latest (section 11).

Both can also be done by email to hi@snackofatz.app. Instructions are at Delete your account.

13. Your rights

You have the right to request from me access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw consent you have given at any time with effect for the future. Just write to hi@snackofatz.app.

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for me, the Landesbeauftragte für den Datenschutz Niedersachsen (the data protection authority of Lower Saxony), Prinzenstraße 5, 30159 Hannover, lfd.niedersachsen.de.

14. Minimum age

Snackofatz is intended for people aged 16 and over. Anyone younger may not create an account. If I learn of an account belonging to a younger person, I delete it.

15. No automated decisions

There is no automated decision-making and no profiling within the meaning of Art. 22 GDPR. The snack average is a plain calculation over the ratings submitted.

16. Changes

I update this policy when the app or the law changes. You can always find the current version at snackofatz.app/privacy; the date above shows when it was last updated.