Privacy policy

Last updated: 26 October 2026. This is a translation; the German version is the binding one.

1. Controller

The controller responsible for processing personal data in Greezy (greezy.app) is:

Questions about data protection and requests regarding your rights are best sent to this e-mail address.

2. In short

  • Greezy processes personal data only as far as the features you use need it.
  • There is no tracking, no analytics or advertising services, and no data is passed on for advertising.
  • Cookies and your browser's storage only keep the app running: signing in, protection against attacks, language, appearance and shopping lists without reception. That is why there is no cookie banner.
  • Shops and apps such as Picnic, Knuspr, Flotte Karotte, Ökullus, Bring!, flaschenpost, REWE and dm only get data from you when you connect and use them yourself.
  • The assistant sends your questions to Anthropic's AI Claude, or to Cloudflare's AI service when Claude can't answer, only when you ask it something.
  • Sorting a shopping list with AI sends the names of its items to Anthropic's AI Claude only when you press the button.

3. Hosting and server logs

Greezy runs on Heroku, a service of Salesforce, Inc., 415 Mission Street, San Francisco, CA 94105, USA, on servers in the USA. Heroku processes the data on our behalf (Art. 28 GDPR).

With every request the server processes technically necessary data: your IP address, the time, method and address of the request, status code, amount of data and response time. They are in Heroku's logs together with the app's error messages, which may in individual cases include details of your account. Heroku keeps only the latest 1,500 lines of them, for a week at most; we don't store the logs permanently. To protect the app against overload and abuse, the server also counts requests per IP address over five minutes. This counter is held in memory only and is lost at the server's next restart at the latest, which Heroku carries out at least once a day.

Heroku also asks browsers to report connection errors (Network Error Logging): for some failed and a small share of successful requests, your browser sends a report with the address requested, the outcome and the time to Heroku (nel.heroku.com), which also receives your IP address.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Salesforce is certified under the EU-U.S. Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR); in addition, Salesforce's data processing agreement with the EU Standard Contractual Clauses applies.

4. Database

Your account, your recipes, plans and lists and your connections to shops are stored in a database at Host Europe GmbH, Cologne, Germany, on servers in the European Union. Host Europe processes the data on our behalf (Art. 28 GDPR).

5. Your account

For your account we store your e-mail address, your password (only as a hash, never in plain text), a name if you give one, the language you picked, your role and when the account was created and approved. The name shows others who you are: your family, on links you share something with, and on shared lists you add to. Without a name, your family sees your e-mail address.

When you sign in with your password, you confirm the sign-in with a six-digit code sent by e-mail or with a passkey. We store the code only as a hash; it works for ten minutes. For a passkey we store its public key and its id, the name you give it, the transports your browser reports, and when it was created and last used. The private key stays on your device or with your password manager. When you reset your password, we store a hash of the link, which works for an hour.

Admins see the accounts with their e-mail address, name and sign-up date, to approve new accounts and run the app. They may also let an AI assistant do this, with an admin token or by signing it in with OAuth (see section 14); that assistant then reads the same account data, which its provider processes under their terms.

The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR). We keep the data as long as your account exists. To delete your account, write to the e-mail address above from your account's address. We then delete your recipes, pictures, plans, lists, connections and tokens; what you added to other people's shared lists stays there without your name.

6. Signing in with Google

While Greezy offers signing in with Google, your browser loads a script from Google (accounts.google.com) that shows the Google button when you open the sign-in and sign-up pages and your account (to link Google). Google receives your IP address and details of your browser and can read its own cookies, for example to show your Google account in the button when you are signed in to Google.

When you sign in with Google, Google passes us your e-mail address, your name and your Google account's id. We store the id to recognise you the next time and check the sign-in with Google's public keys.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also transfer data to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. The legal basis for signing in is Art. 6(1)(b) GDPR, for showing the button our legitimate interest in offering you to sign in with Google (Art. 6(1)(f) GDPR). More in Google's privacy policy. If you'd rather not use Google, sign in with your e-mail address and password.

7. E-mails

Sign-in codes, password reset links, family invitations, the notice that an account was approved and payment requests are sent through Mailgun, a service of Mailgun Technologies, Inc., USA (Sinch group), on servers in the USA. Mailgun receives the recipient and content of the mail and keeps mails and delivery data such as recipient, subject and delivery status for a limited time. Mailgun processes the data on our behalf (Art. 28 GDPR); the transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

8. Recipes, plans and shopping lists

What you create in Greezy, that is recipes, pictures, weekly plans, shopping lists and settings, we store to show it to you and your family (Art. 6(1)(b) GDPR). The server scales uploaded pictures down and removes embedded metadata such as camera details or the location they were taken. Pictures no recipe takes are deleted after a day, lists for shopping right away a week after their last change. When you import a recipe from a link, Greezy's server fetches the page; the website sees the server, not you.

9. Families

When you invite someone to your family, we store their e-mail address and send them a link that works for seven days. Members of a family see and edit each other's recipes, plans and lists and see each other's names and e-mail addresses. When a member turns on sharing their shop logins, the others use their connections to the shops, the postcode and market they saved for flaschenpost and REWE and the dm market they picked. The legal basis is Art. 6(1)(b) GDPR, for the addresses of invited people the legitimate interest of whoever invites them (Art. 6(1)(f) GDPR).

10. Sharing by link

When you share a recipe or plan, anyone with the link sees it, together with your name; signed-in visitors can save a copy. When you share a shopping list, anyone with the link can add items: guests under a name they give, signed-in users with their account, under which they keep the list in "Shared with you". For every item we store who added it, so it is clear whom the shopping is for. When your family lets visitors search shops through the link, they search with the logins of the member who turned it on; they only see products, no cart, orders or account. Once you delete the link, it stops working.

11. Payment requests

For payment requests to those who added to your shared lists, you can save your PayPal.Me name, IBAN and account holder and your Wero link or contact in your account. Only the people you send or show a request to get these details, as text, QR code or e-mail. A request by e-mail goes through Mailgun (section 7) to the address you enter, otherwise to the address of the person's account; replies go to your e-mail address. The legal basis is Art. 6(1)(b) GDPR, for the recipients' data your legitimate interest in getting your money back (Art. 6(1)(f) GDPR).

12. Connected shops and apps

These services only get data when you connect them on the integrations page and let Greezy work with them (Art. 6(1)(b) GDPR). They process the data as controllers in their own right under their privacy policies.

  • Picnic: Your login goes to Picnic to sign in, which sends you a code by text message; we only store the key Picnic answers with. Greezy uses it to search products, read and fill your cart and read your deliveries and recipes. When others added items through a shared link, we note whom products in the cart are for.
  • Knuspr: You sign in at Knuspr itself; Greezy only gets an access (OAuth) for it, which we store encrypted, never your password. Greezy uses it to search products, read and fill your cart, pick the delivery window for checkout, read your upcoming orders and what you spent there. When you disconnect, we also revoke the access at Knuspr.
  • Flotte Karotte and Ökullus (Ökobox Online): We store your customer number or e-mail address and your password encrypted, as the shops have no lasting sign-in keys. Greezy reads your deliveries, orders and subscriptions and changes your next order and your subscriptions when you ask it to.
  • Bring! (Bring! Labs AG, Zurich, Switzerland): Your login goes to Bring once; we only store the keys Bring answers with, encrypted, and read your lists with them. When you send a list to Bring, Bring fetches it as a page through a link that works for a week. There is an adequacy decision of the European Commission for Switzerland.
  • flaschenpost: Your postcode goes to flaschenpost to find the warehouse that delivers to you; flaschenpost creates an empty, anonymous cart for it. We store the postcode with the warehouse.
  • REWE: Your postcode goes to REWE to find the market that delivers to you and the pickup markets near you, after that only search terms with the market you choose. We store the postcode with that market.
  • dm: Greezy sends search terms and product numbers to dm and, when you look for a dm market, the postcode or place you enter for it; nothing else about you. If you pick a market, we store it with its address and ask dm which of the products found it has in stock.

At dm, flaschenpost and REWE you open your picks on their websites, where their privacy policies apply. When you disconnect a service, we delete the stored login.

13. Recipe and picture sources

Greezy's server fetches recipes from Chefkoch, HelloFresh, Knuspr, Lidl and Pinterest, the shops' product pictures and ingredient pictures from Open Food Facts itself. It only sends search terms, recipe and product numbers or the Pinterest profile you enter. These providers don't get your IP address or your account data; Greezy passes pictures on through its own server. Your browser also loads the app's font and icons from Greezy only.

14. The assistant, AI assistants and API tokens

With a PRO account you can ask Greezy's assistant questions in the app. For each question, Greezy's server sends your message, the end of the conversation (your last ten messages and the answers, with what the assistant read for the last answer), the address of the page you have open and the app's language, together with the help texts and the recipes, plans and lists of yours and your family's that the assistant reads for the answer, to Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA, whose AI model Claude writes the answer. When Claude can't answer (during an outage, for instance), the same data goes to Workers AI, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, instead, which writes the answer with another AI model. The requests go through Cloudflare's AI Gateway, which receives your account's number to count costs per account and, as we set it up, doesn't log the content. Anthropic and Cloudflare process the data on our behalf (Art. 28 GDPR) and don't use it to train AI models; Cloudflare keeps inputs and answers only as long as it needs them for the answer. Your browser talks to Greezy only. Greezy doesn't store the conversation: it stays in your browser tab until you reload the page or start a new chat. We only count how many messages you send a day, as there are 50 at most. The legal basis is the performance of the contract, as you use the assistant yourself (Art. 6(1)(b) GDPR). The transfer to Anthropic in the USA rests on the EU Standard Contractual Clauses in Anthropic's data processing addendum (Art. 46(2)(c) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR); in addition, Cloudflare's data processing agreement with the EU Standard Contractual Clauses applies.

With a PRO account you can let an AI sort a shopping list into the sections of a store. Greezy's server then sends the names of the list's items that nobody in your family has put into a section yet, and of up to 50 items your family has sorted with their sections, nothing else, to Anthropic, whose AI model Claude answers with the sections, or, when Claude can't answer, to Workers AI. Both go through Cloudflare's AI Gateway and process the data as described above for the assistant. Greezy stores the sections for your family like those you pick yourself. The legal basis is the performance of the contract, as you start the sorting yourself (Art. 6(1)(b) GDPR).

You can give AI assistants access to your recipes, plans and lists through the MCP interface, with an API token or by signing in with OAuth. We store the name of the token or app, whether it only reads or may also make changes, when it was created, last used and expires, and the tokens themselves only as hashes. What an assistant reads is processed by its provider under their terms. You decide which assistants you connect and can revoke their access at any time (Art. 6(1)(b) GDPR).

Admins can connect assistants to a separate admin interface with admin tokens or by signing them in with OAuth. Their access expires after 90 days at the latest and stops working when the account is no admin anymore. We store the same details about it as about API tokens.

15. Cookies and local storage

Greezy only stores on your device what the app strictly needs (Section 25(2) No. 2 TDDDG). That is why we don't ask for your consent. Cookies:

  • session: keeps you signed in, encrypted, until you sign out, for 30 days at most.
  • __Host-csrf: protects forms against attacks through other websites (cross-site request forgery), until you close the browser.
  • i18n_redirected: the language last shown, for a year.
  • nuxt-color-mode: light, dark or system appearance, for a year.

In your browser's local storage, until you clear it:

  • greezy-locale: the language you picked while not signed in.
  • greezy-picks, greezy-order-hidden-shops, greezy-order-sort: the products picked last, hidden shops and the sort order when ordering.
  • greezy-pinterest-profile: the Pinterest profile opened last.
  • greezy-unsent-ticks: items you ticked off in the store that haven't reached Greezy yet, until they have or you sign out.

In your browser's session storage, until you close the tab:

  • greezy-cooking: the ingredients ticked while cooking a recipe.

So that shopping lists open without reception, a service worker keeps in your browser's cache: the app's files, the overview of your lists, the lists you opened with their items, who added them and their store sections, the shops you connected, and the account details the app starts with. It replaces them with what Greezy answers the next time, and deletes all but the app's files when you sign in or out. Clearing the site's data in your browser deletes all of it.

16. Security

All connections are encrypted with HTTPS. We store passwords, sign-in codes and tokens only as hashes, and passwords for Ökobox shops and the keys of Bring and Knuspr encrypted.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21). Much of it you change directly in Greezy, in your account, the integrations and the API tokens. You can also lodge a complaint with a data protection supervisory authority, for example the one where you live (Art. 77 GDPR).

You are under no legal or contractual obligation to give us data, but you can't create an account without an e-mail address. There is no automated decision-making, including profiling (Art. 22 GDPR).

18. Changes

We update this policy when Greezy gets new features or data goes somewhere new. The version published here applies.