Stirly privacy policy

This page is a translation. Only the German version is binding. Read the German version

Overview

Stirly is an iPhone app that turns shared posts, web pages and cookbook pages into recipes in your Library. Your recipes are stored on our server in Germany and also on your iPhone, so the app works without a connection. For Import, Scan and sorting the Grocery List we use OpenAI.

Stirly has no advertising, no tracking and no third-party analytics or crash software. We do not sell data.

Controller

Johann Borchardt
Tolkoi
c/o Galerie Borchardt
Hopfensack 19
20457 Hamburg
Germany

Privacy: info@tolkoi.com
Support: support@tolkoi.com

Sign-in and Account

You sign in only with Sign in with Apple. Apple gives us your name, your email address (or Apple's relay address if you hide yours) and an identifier for your Apple ID. You can change your name in the app. For your Account we also store a Support Reference, your Age Range, whether you want notifications and, if you add one, a profile picture (location data is removed).

We do not send you emails. We use your email address only to match support requests to your Account and to handle Apple's notices about your Apple ID.

For each signed-in device we store a session (only an irreversible hash of its key), the device model, when it started and was last used, and, if you allow notifications, the push token.

The legal basis is Art. 6(1)(b) GDPR (providing the app). Your Account stays until you delete it. A session ends when you sign out, after 90 days without use, or after 365 days at the latest.

Age check

Before you sign in, Stirly asks for your Age Range (under 16, 16–17, 18 or older), either through Apple's age declaration or by your own choice. We store only the range, where it came from and when it was given.

Under 16, every feature that sends your input to OpenAI is switched off (Import, Scan and Grocery List sorting). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to keep people under 16 away from AI features.

Recipes, Spaces and Grocery List

On our server we store your recipes (title, ingredients, steps, notes, tags, the source with link, creator and caption, a thumbnail and scanned pages), your Grocery List with its aisle assignments, your Spaces with their members, and Invite Links. A copy is kept on your iPhone.

Your Library is private. If you invite others to a Space, they see the recipes in that Space as well as your name and profile picture. An Invite Link is valid for 7 days at most and is deleted afterwards.

The legal basis is Art. 6(1)(b) GDPR. Content stays until you delete it. We remove deleted content for good after 30 days; afterwards only a technical placeholder without personal data remains, so that your devices can sync.

Import, Scan and AI processing

Import: When you share a link to Stirly, our server fetches the post or page. The platform (such as Instagram, TikTok, YouTube, Facebook or a recipe website) only sees the link and our server's address, not yours. If you share a page from Safari, the app sends the page as you see it, so it may include content that is only visible when you are signed in.

Scan: Photos of cookbook pages that you take or choose are uploaded and stored with the recipe as scanned pages.

What OpenAI receives: To turn this into a recipe, our server sends OpenAI the link, the creator's name and handle, the caption, the page text, for videos the audio track and individual frames, scanned pages and, to sort the Grocery List, the wording of your items. OpenAI receives no identifier of yours: no User, Space or device id, no email address and not your IP address.

OpenAI processes this content as our processor (OpenAI Ireland Ltd. with affiliates in the USA, on the basis of the European Commission's standard contractual clauses, Art. 46(2)(c) GDPR). OpenAI keeps requests for up to 30 days to detect abuse and does not use them for training.

We delete the audio track, frames and transcript once the Import has finished, and the full page text as well; only the page's structured recipe data stays with the recipe. A failed Import is deleted when you dismiss it, at the latest after 60 days.

The legal basis is Art. 6(1)(b) GDPR.

Notifications

If you allow notifications, our server sends them to your iPhone through Apple's push service. Visible notifications contain the title of a finished recipe, the reason an Import failed, or the name of a person who joined a Space together with the Space's name. Silent sync notifications contain no content.

Apple delivers notifications under its own responsibility (Apple Distribution International Ltd., Ireland); data may be transferred to the USA in the process. You can turn notifications off in iOS Settings at any time. The legal basis is Art. 6(1)(b) GDPR. We delete the push token when the session ends or Apple reports it as invalid.

Server and hosting

Stirly runs on servers of Hetzner Online GmbH in Germany, acting as our processor. All stored data, including images and backups, stays in Germany. Backups are deleted after 30 days.

We delete server logs after 7 days. They may contain IP addresses, source links and Import and Space ids, but never your User id, name or email address. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.

Support and troubleshooting

When you write to us, the Tolkoi privacy policy (contact form and email) applies to your message: we delete it 6 months after your request is closed.

We look at an Account's data only to answer that person's request or to fix an error in their data. Every such access is logged with its reason; we delete that log after 12 months. The legal basis is Art. 6(1)(b) GDPR for support and Art. 6(1)(f) GDPR for fixing errors and security.

Usage numbers

We only evaluate aggregated numbers from the data on our server, such as Imports per week, active Accounts or Spaces with several members; groups of fewer than 5 Accounts are not shown. For each Import we also keep an anonymous statistic (day, kind of source, AI provider, cost, outcome), with no link to your Account and no URL. There is no tracking, and nothing is read from your iPhone for this. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to improve Stirly and manage its costs.

On your iPhone

Stirly stores on your iPhone the sign-in key (in the Keychain, on this device only), a copy of your Library, settings such as sort order and timers, and shared items not yet sent (they expire after 30 days). This is strictly necessary for the features you use (§ 25(2) no. 2 TDDDG). Signing out deletes all of it.

Stirly uses the camera only when you scan cookbook pages or take a profile picture; from your photo library it receives only the images you choose. Crash reports go only to Apple, if you have allowed this in iOS Settings.

Deleting your Account and downloading your data

You can delete your Account in the app. Your data on our server is deleted at once, images and the link to your Apple ID within 24 hours. Recipes you added to other people's Spaces stay there without your name, because they belong to those Spaces. Your data remains in backups for up to 30 days; after a restore it is deleted again before Stirly goes back online.

With "Download my data" you receive all your data as a ZIP file. It is created when you request it and is not stored.

For recipe creators

This section is for people whose public posts or pages (for example on Instagram, TikTok, YouTube, Facebook, recipe websites or in printed cookbooks) someone shares to Stirly (Art. 14 GDPR).

Stirly takes the link, your name and handle, the caption, the page's title and text, and a thumbnail that may show you. Only while the Import runs does Stirly also process the audio track (your voice), frames and a transcript. The purpose is to turn this into a recipe in that person's private Library (and in Spaces they share with people they invite), with your source credited and linked.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is keeping recipes one has found and crediting you as the creator. Recipients are Hetzner (hosting in Germany) and OpenAI (processing as described above). Your details are kept as long as the recipe that cites them; audio, frames and transcript are deleted when the Import ends. We do not profile you, contact you or publish anything.

You have the rights listed below. If you object (at info@tolkoi.com), we remove everything that names or shows you (name, caption, title, thumbnail and link) from every recipe that refers to your posts, and future Imports of your posts arrive without these details. The recipe text stays with the person who saved it.

Recipients

Beyond this, we do not pass on your data.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can do much of this directly in the app; otherwise write to info@tolkoi.com.

Right to object: Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

We make no automated decisions within the meaning of Art. 22 GDPR and do no profiling.

Changes

Before Stirly processes data in a new way, for example through a new service provider, we update this privacy policy.

Last updated: November 2026