Privacy policy

Français · English

Broccolist is operated by QJP Consult, Belgium. For privacy questions, access, correction, export, deletion or a complaint, contact info@broccolist.be. You may also contact the Belgian Data Protection Authority.

What the service processes

Account details include your name, email, sign-in identifiers and household membership. Household content includes recipes, photos, Sparks and their notes or place names, shopping lists, meal plans, votes and food preferences. The service also processes device notification tokens and operational information needed to deliver and troubleshoot these features. Optional support reports may include the text, screenshot and diagnostic information you choose to submit.

Who can see your content

Members of your household can see shared household content. Anyone with a shared shopping-list link may be able to access that list, so share links only with people you trust and revoke them when no longer needed. Imported recipes and images remain subject to their owners’ rights. Do not upload other people’s private information without permission.

Optional AI and your choice

With your explicit permission, Broccolist sends relevant recipe text, photos, Spark notes and place names, meal plans and food preferences to OpenAI to recognise, suggest, adapt or illustrate meals, and to identify shopping items from a photo, including text read on your phone. When you add a branded item from such a photo, the photo is kept with that item as your household’s label photo (deleted with the household); photos of unbranded items are not kept. Saving or editing a Spark does not request an AI draft. A member explicitly requests each draft under their own permission; the proposal stays private until they choose to share it. Other members’ individual taste preferences are excluded from planner prompts unless they have opted in. Avoid including personal or sensitive details in free text and photographs.

Choose or withdraw permission in Profile & Settings → AI privacy. Manual lists and planning remain available without AI. Withdrawal stops future requests, including queued Sparks, but cannot recall information already transmitted or stop a request in progress. Generated output already saved to the household stays with its content. AI can make mistakes: verify ingredients, allergens and instructions.

To recover requested assistance after a disconnection, Broccolist temporarily stores encrypted processing inputs for up to 24 hours and removes them when processing ends. Unsaved results are private to the requester and available for seven days. Withdrawing AI permission, leaving the household or deleting your account removes your private inputs and results from the active service. Already saved household content follows its normal lifecycle. Non-content usage receipts prevent duplicate charges.

Services involved

Hosting and database providers operate the backend. OpenAI processes permitted AI requests; Pusher carries real-time updates; Apple provides sign-in and push notifications. Product, image, location and recipe lookup features contact the relevant lookup services, which receive the query needed to fulfil the request. Reports submitted through the bug-report flow may be transferred to our GitHub issue tracker as disclosed in that flow. These providers can process information outside Belgium; this policy does not promise that all processing stays in Belgium.

Device permissions

Camera and photo access let you add the images you select. Microphone input is transcribed on your iPhone; Watch voice input is relayed to the paired iPhone. The resulting shopping-item text is shared with your household. Reminders access imports items from your chosen list. Location supports nearby-store suggestions, Spark place suggestions and optional store-arrival detection. You can change these device permissions in Settings.

Purpose, retention and deletion

We process the data needed to provide the requested service and maintain its security, and optional AI transfers use your permission. Account and household content are retained while used by the service. Operational logs, backups and provider records have separate lifecycles; deleting an account does not mean every backup or provider record disappears instantly. Contact us for information about a specific record or request.

Delete your account inside the app under Profile & Settings → your profile → Delete account. Your account and personal votes, preferences and notification token are removed from the active database. Shared household content remains for other members; the last member’s deletion removes the household and its associated content. See account deletion for the full process and requests involving shared personal content.

For Sign in with Apple, we retain an encrypted authorization token when available so that we can revoke access on deletion. If Apple is unavailable, the encrypted token is kept in a retry queue until revocation succeeds, without retaining your account identifier. Older connections without a token do not prevent account deletion; you may also remove the connection in your Apple Account settings.

Your control

You can update account information, leave a household, change optional permissions and request access, correction, export or erasure. Contact us about data concerning a child or someone who cannot exercise these choices themselves. Withdrawing consent does not change the validity of processing already performed. This notice describes the app as well as the website; reading it is not permission for optional AI processing.

Purchases and allowance records

Apple processes your subscription payment; Broccolist does not receive your payment-card details. Apple supplies subscription identifiers, product, status and dates, and account-binding information so we can activate household access, verify purchases and restore them to the correct account. We also record allowance usage and non-content operation receipts to prevent duplicate usage.

On account deletion, private AI inputs and results are erased from the active service and purchase records are disconnected from your account and household. Minimal subscription identifiers, status and dates, a technical purchase-binding token and non-content usage records remain for purchase verification and to prevent incorrect reassignment or duplicate usage. These retained records are not automatically purged after 90 days. They may remain linkable to an Apple purchase and should not be treated as anonymous. Contact us to request information or erasure; we assess the request against the records still needed for these purposes and applicable obligations.