Servi

Privacy Policy

Servi · Last updated 26 October 2026

Servi is a personal, family-scale app. This policy describes every category of information it handles and where that information goes. It is short because the app does little: there is no advertising, no tracking, no analytics broker, and nothing is sold or shared with third parties for their own purposes.

What is stored on your device and in your iCloud

Your recipe library, week plan, shopping list, cooking notes and family roster (including any photos you add of family members) are stored on your device. They are never sent to our server for backup. Two things can reach it: a shopping list you choose to share, and the text or photo of a list you ask Servi to read, both below. Deleting the app removes the copy on that device; if iCloud sync is on, the copy in your own iCloud remains, and reinstalling restores it. To remove that copy as well, delete the app's data in iOS Settings under your name → iCloud → Manage Account Storage.

With Servi Plus, if you are signed in to iCloud, this information also syncs to your other Apple devices through your own iCloud account, using Apple's CloudKit private database. This is between you and Apple: we have no access to it, cannot read it, and receive no copy. Recipe photos sync too and count towards your iCloud storage. Apple's handling of it is covered by Apple's privacy policy. You can turn it off at any time in iOS Settings, under your name → iCloud; the app keeps working and your data stays on the device.

Recipe titles, their ingredient names and categories, and the meals planned for the coming fortnight are also offered to your device's own search index, so that a recipe can be found from the Home Screen. That index is built and held by iOS on the device itself; it is not sent to us or published beyond the device. Your cooking notes and the recipe steps are deliberately excluded from it. You can switch this off in the app under Settings → Library, which removes what was indexed.

What is sent to our server

Servi uses a server we operate to read recipes and answer questions. The following is sent to it, only when you take an action that requires it:

Recipe reading, question answering and image generation are performed by Google's Gemini API, and a search of the web from Discover or Ask uses Google Search through the same API. Content sent for those purposes is processed under Google's terms for paid API customers and is not used to train their models. These AI features are part of how the app works and are for people 18 or older. Content is sent only when you use one of them; if you would rather nothing reach Gemini, don't use them, or delete your data.

Your Apple Account, and no Servi account

Servi has no sign-in, no password and no account to create, and it does not ask for your name or email address. Instead, the first time you open the app it sends our server Apple's signed record of the app's installation on your Apple Account (an AppTransaction), together with your device's vendor identifier, which is used to check Apple's signature against the device and is itself never stored (see the misuse check below). The record carries an identifier, the appTransactionId, that is the same for one Apple Account, whichever iPhone or iPad it is used on, and after a reinstall. It identifies the installation of Servi on your Apple Account; it does not tell us who you are, and we cannot look up your name, email address or Apple Account from it.

Our server keeps that identifier, and an account identifier built from it, as the key to everything it holds for you, and answers with a session token that lasts one hour. The token is signed rather than stored, and the app asks for a new one when it expires. This is what keeps your credits, your family links and a shared shopping list working, also after a reinstall. The same identifier is shown in Settings as the Support ID, so you can give it to us if you need help. If you never use a feature that needs the server, nothing else is kept for you.

To spot misuse, for up to two days we keep a shortened one-way hash of the identifier of each device that uses Servi with your Apple Account; the identifier itself is never stored.

For that identifier our server keeps what you bought — Apple's transaction identifiers, never payment details — and how many AI credits you have used, with a daily total of what each AI feature cost to run for the last 90 days. So that restoring a purchase after you delete your data does not reset what was spent from it, the number of credits used against each Apple purchase is kept after deletion, without any account identifier.

The name you type to join or share a list with Shop Together is sent to our server and shown to the other person; it is not linked to your Apple Account beyond that list.

If you used Servi before 21 October 2026 you had an account with an email address (and, if you signed in with Google or Apple, the name that service provided). Your purchases, credits and family links were carried over to the new identifier. Our server deletes that email address the first time the updated app talks to it. Google's Firebase Authentication, our sign-in provider at the time, still holds the old account. On 15 November 2026 we delete those old accounts, and our server forgets the email address of any account whose app was not updated by then. If you want yours removed sooner, ask us at the address below.

Diagnostics

The app reports crashes (Firebase Crashlytics) so they can be fixed. A crash report describes the app and the device at the moment of the crash; it does not carry the identifier our server uses for your data. (Versions of the app before November 2026 did add it; Google deletes those reports on the same schedule as the rest.) Basic usage events such as "a recipe was added" or "the week was changed" (Firebase Analytics) are sent only if you allow them: the app asks once, after its welcome screen, and you can change your answer any time under Settings → Privacy → Share Usage Analytics. Until you allow them they are off. No advertising identifier is read, no profile is built, and nothing is used for advertising or shared with data brokers. The app does not track you across other apps or websites.

To keep the paid AI features from being abused by scripts, the app proves to our server that a request really comes from the genuine Servi app on a real Apple device. This uses Firebase App Check with Apple's App Attest: Apple vouches for the app and the device, Firebase turns that into a short-lived token, and the app sends the token with its requests. Our server checks the token and keeps nothing from it. It contains no recipes, names or allergies, and it is not used to identify you or to build a profile.

Our server also writes request logs, which Cloudflare keeps for us. A log line records that a request happened — the address requested, the time and the outcome — and technical details Cloudflare adds, such as the country the request came from. Our own code adds a few lines: how many AI tokens a request used, and, for a few account and purchase events, your account identifier (which is built from the Apple identifier above). We never write recipes, names or allergies to them. They are used to find and fix faults and abuse, and Cloudflare keeps them for no more than seven days.

For each AI request our server also sends Cloudflare a usage record: your account identifier, which AI feature and model ran, whether it was paid for or free, how many AI tokens it used and what it cost us. It never contains the request itself, recipes, names or allergies. We use these records to see what running the AI costs per account and to spot misuse. Cloudflare keeps them for three months, after which they expire.

For every request to our server we also send Cloudflare a request record: your account identifier (if you are signed in), which feature or endpoint was called, the result (success or the kind of error), how long it took and the version of the app. It never contains the content of the request, recipes, names or allergies. We use these records to see how the service is used and how fast it is, and to find faults. Cloudflare keeps them for three months, after which they expire.

Family rating links

With Servi Plus, each family member gets a private web link for rating meals, which needs no account and no app. That page shows the household's first names, the meals planned for the next few days, and the ratings already left. Anyone holding the link can see that much and can leave ratings as that member, so treat it as you would a shared photo album link. A link can be replaced at any time from that person's page under Plan → Family (Reset Link), which immediately invalidates the old one.

Children

The app is intended for the adult who plans the household's meals, and its AI features are for people 18 and older. Children may use the rating links, which collect only what they tap or type there — a rating, an optional short note, and whether they intend to eat. No account, email address, or device identifier is collected from them.

If you record a child's allergies in the app, you are providing that information on their behalf. It is stored on your device, and the "Names are not sent" rule above applies to them exactly as it does to everyone else — an allergy may be sent to answer a question, attached to a placeholder rather than to a child's name. You can remove any family member, or delete all of your data, at any time in Settings.

Deleting your data

Settings → Delete My Data removes everything our server holds for your Apple Account: your family roster, every outstanding rating link, the published meal window, all ratings and responses, a shopping list you shared, your credit balances and, for accounts that had one, the stored email address. It also removes the link between your Apple Account and that data, and then removes the recipes and plans on the device you do it from. That is permanent and cannot be undone. Servi Plus is not lost: Restore Purchases, on a device signed in to that Apple Account, brings it back to a fresh account (without refilling credits already spent). To stop our server making a new, empty record for you, delete the app afterwards. A few request counters (counts of the day's requests and a complimentary month's use, never your email address or purchases) are kept for up to 31 days after deletion, so that deleting is not a way round a daily limit. The AI usage records and request records Cloudflare keeps for us are not removed either: they cannot be deleted one by one, and each expires three months after its request. Complimentary or test access we gave you stays tied to your Apple Account's identifier, so it is there again if you come back. Deleting the app removes the recipes and plans stored on that device; with iCloud sync on, the copy in your own iCloud survives and returns if you reinstall, so removing it there is a separate step — see "What is stored on your device and in your iCloud" above.

Retention

Recipe page contents sent for import are used to produce that recipe and are not stored on the server afterwards — the finished recipe is saved only on your device. Recipes sent to be enhanced, sample recipes sent to check or learn an export format, and the text of documents (PDFs, text files) sent to find and read the recipes in them, are used for that and not stored afterwards. A learned format description holds no recipe content and is deleted after a year without use, together with, if you report a format as wrong, a pseudonymous tag derived from your account so a report is counted once. Rate-limiting counters expire within 48 hours. Family participation data is held until you delete your data; a family member's ratings, notes and responses are removed from our server when you remove that member. What you bought is held until you delete your data; the credits used against each Apple purchase are kept without an end date, because a purchase can be restored at any time. A notification token is held until you delete your data, or until Apple tells us the device no longer accepts notifications. The link between your Apple Account's identifier and your data is held for as long as you use Servi, and removed when you delete your data. A session token is valid for one hour and is not stored. A shared shopping list is removed after 60 days unused, deleted items after 30 days. The daily AI cost totals are kept for 90 days, and the AI usage records and request records Cloudflare keeps for us for three months. Server request logs are kept by Cloudflare for no more than seven days. Google keeps crash reports for 90 days, and usage events, if you allowed them, for two months; the copies of crash reports and of those usage events that we export into our own Google BigQuery storage are deleted after 60 days. Signing in to this website's invite-only pages sets one cookie, which keeps you signed in for up to 30 days; the site sets no other cookies. Email you send us is kept for as long as we need it to help you, and no longer than two years.

Legal basis

Under the EU General Data Protection Regulation (GDPR), we rely on:

Who processes your information for us

Apart from TikTok and the recipe sites described above, which receive only a link from our server and nothing about you, nobody else receives your information, and none of it is sold.

Transfers outside the EU

Google, Cloudflare and Apple may process information in the United States and other countries outside the European Economic Area. Those transfers rely on the EU–US Data Privacy Framework, under which these companies are certified, and on the European Commission's standard contractual clauses.

Your rights

You can ask us for a copy of your information, ask us to correct or delete it, ask us to limit how we use it, object to our using it, and take it with you. Much of this you can do yourself: Settings → Export Data gives you a copy of your library and family, editing a family member corrects their details, and Delete My Data removes everything our server holds. For anything else, email us at the address below and we will answer within a month. Because there is no account, include the Support ID from Settings so we can find your information; we may ask you to confirm the request from the app. If someone else entered your information — as a family member — you can ask them to change or remove it, or ask us.

You do not have to give us any information. Without the Apple identifier described above, the features that need our server — purchases, credits and the AI features, family links and Shop Together — cannot work; the rest of the app works on your device alone. Servi makes no decisions about you based solely on automated processing that have legal or similarly significant effects. We are not required to appoint a data protection officer; questions about your information go to the address below.

If you think we have handled your information wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.

Who is responsible

The controller of your personal information is Slipstream Development, Rembrandtlaan 12, 1213 BH Hilversum, the Netherlands (Chamber of Commerce number 42157958). You can reach us at the address below.

Changes

If this policy changes materially, the updated date above will change and the new version will be published here before the change takes effect in the app.

Contact

Questions about this document, or anything else about the app: support@serviapp.net.