The operator of TofuLove and contact details for privacy questions are listed in the legal notice. View legal notice
When you visit the site, technical connection data such as your IP address, time and requested page are processed. Clerk handles your email address and sign-in data for authentication and account management. TofuLove stores your account, household membership, invitations and settings in Convex.
Content you add to TofuLove, such as recipes, images, meal plans, shopping lists and chat messages, is processed to provide those features. Household content is visible to authorized members of your household. Conversations with Tofi and their attachments belong to your account and are not visible to other household members. Platform administrators see account details and usage figures to run the service. They open household content or Tofi conversations with their attachments only for a specific reason, such as a support request, and only for a limited time. Each such access and every change is logged with the administrator and the reason.
We process account and household data to provide the service (GDPR Art. 6(1)(b)). We process technical connection data to keep the website secure and reliable (GDPR Art. 6(1)(f)). Optional browser notifications are enabled only after you grant permission, and you can disable them in your device settings.
Clerk provides sign-in, while Convex stores app data and images. The production database is currently configured in a US region. The website is delivered through a server and Cloudflare. When you use Tofi, the messages and context needed for your request are sent to Anthropic, the provider of the Claude AI models Tofi uses. Do not enter information there that you do not want to share with that provider.
The food preferences and intolerances you set for your household, and Tofi’s memory of your household, are stored and sent with each Tofi request to Anthropic, the provider of the Claude models, so that Tofi’s suggestions fit your household. Tofi writes short notes into this memory about what you enjoy, what goes down well and how you cook when you mention it in a chat. Once a night Tofi sorts these notes through Anthropic, reading the names of your favourites, of the dishes you plan and of the suggestions you save or don’t, but no chat histories. Every member of the household sees a summary of the memory in the food preferences and can ask Tofi to remember something differently or forget it. The memory is deleted with the household.
The ChatGPT connection is optional. If you enable it, ChatGPT can read and change shared household data after you grant access. See the ChatGPT connection privacy notice.
Notebook pages belong to a household and are visible to its members. Whoever created a page or manages the household can share it with people from other households who already have a TofuLove account, to read or to edit. For this we store the invited email address, the role and who sent the invitation. Invitations expire after seven days and are not sent by email.
Invited people see the page’s content, the household’s name and the names of the people who write on the page or currently have it open. Only members of the household that owns the page see invited people’s email addresses. Access ends when the person is removed, leaves the page or deletes their account. Pages are deleted with their household.
When someone calls Tofi on a page, the request and the page’s content are sent to Anthropic. On pages shared with other households, or when an invited person asks, Tofi uses only the food preferences of the household that owns the page and never Tofi’s memory of any household. Everyone who may see the page sees what Tofi writes on it, including text Tofi wrote before the page was shared.
Images someone puts on a page are stored with the page. They count towards the storage of the household that owns the page, also when an invited person uploads them. Everyone who may see the page, including invited people, sees its images; they have no public address. When someone calls Tofi on the page, up to six of its images are sent to Anthropic with the request. The apps and the website make images smaller before uploading and remove location and camera data in the process. Images that are on no page are deleted after an hour; the others are deleted with their page or their household.
Discover additionally processes: your public profile (username, optionally display name, bio and profile picture), for creators your published posts with photos, videos, captions and recipes, your age group (provided by Apple as an age range, not a date of birth) and your agreement to the community guidelines with its timestamp. The default username reveals neither email address nor household. Creator profiles and posts are public, including through web links without signing in.
We also store what you do in Discover: likes, saved posts, follows, hides (Not interested), blocks, chosen interests and reports. For recommendations in “For you” we record engagement signals such as qualified views, share of a video watched, recipes opened and planning or cooking. These signals are linked to your account and are not public. Likes and saves appear only as counts on the post.
Notice form: when you report content, we process the reported address, your explanation, your email address and optionally your name to assess the report, tell you about receipt and decision and meet our obligations under the Digital Services Act (GDPR Art. 6(1)(c) and (f)). To prevent abuse we limit the number of reports per source using a salted hash of the IP address; we do not store the IP address itself for this. We delete your contact details 180 days after the decision.
Legal bases: we process profile, posts, interactions and age group to provide Discover (GDPR Art. 6(1)(b)). Moderation, reports, statements of reasons and protecting minors rest on our legal obligations and legitimate interest in a safe service (GDPR Art. 6(1)(c) and (f)). Recommendations in “For you” rest on GDPR Art. 6(1)(b) and (f); “Following” works without profiling.
Service providers for Discover: Mux (US) hosts and delivers videos using time-limited signed requests. Resend (EU region) sends our transactional emails, such as approvals, statements of reasons, receipts and invitations, without tracking. Convex (US) stores data and images; Clerk handles sign-in. PostHog (EU) measures usage only with your consent. For transfers to the US we rely on the available safeguards, such as standard contractual clauses or the EU-US Data Privacy Framework.
Retention: profile, posts and interactions stay until you delete them or your account; then we delete them with their media (videos at Mux through deletion jobs). Posts removed by moderators are kept for 30 days for possible restoration, then their media is deleted. Reports and statements of reasons are kept without a link to your account for as long as the law requires. We delete the contact details of reporters 180 days after the decision. The records of our emails to reporters, which contain their address, are deleted 180 days after they were created, regardless of when the decision is made.
The optional Gurkerl connection belongs only to your account. If you enable it, we check your Gurkerl email and password with Gurkerl and store them encrypted so Tofi can search products and manage shopping lists or the cart at your request. Your searches and selected products are sent to Gurkerl. Required search, list and cart results are processed in the Tofi chat and sent to Anthropic, the provider of the Claude models; your password is never sent to the model. You review and explicitly approve orders yourself on Gurkerl. Disconnecting deletes credentials from the active database; technical backups may retain encrypted data until their retention period ends.
Manage connectionsWe keep data while it is needed for your account and household. You can delete individual content and chats in the app. Deleting a household removes its data from the active database. Technical backups may retain deleted data for a limited period. Legal retention duties may still apply.
The app stores settings such as language, theme and technical preferences on your device. Clerk uses session data required for sign-in. If you enable push notifications, we store the device subscription and send notifications through your browser’s push service.
Clerk uses cookies and similar local storage needed for sign-in. You decide whether you would also like to help us with usage data. Only after you agree do we use PostHog, with data processing in the EU. We save your choice on the respective device. If you are signed in, we link events to your account. This includes technical error reports: which function failed, the kind of error and the app version, without error messages. We do not send names, email addresses, recipe content, shopping lists, messages or typed input for this purpose. We do not use these data for advertising.
On the website, we then see page views and selected actions. Page addresses are sent without query parameters. Automatic click capture and screen recordings are disabled on the website. You can change or withdraw your choice for the website here at any time.
In the iOS app, you can enable ‘Share usage’ to let us see which features and screens you use, where you tap and whether something goes wrong. This includes app and device details, usage duration, loading times and technical errors. This helps us improve TofuLove for you. Your personal content and typed input are not sent for this purpose.
In the Android app, ‘Share usage’ is off by default. You can enable it in Settings and turn it off again at any time. We then use PostHog in the EU to process screen views, feature use, usage duration and technical errors with app and device details. If you are signed in, we link events to your technical account ID. Names, email addresses, recipe content, messages, typed input and private images are not sent for this purpose. Screen recordings are disabled on Android.
You can also enable ‘Share screen activity’ in the iOS app. These recordings help us understand problems. Text, typed input and private images are masked before they are sent. Screen recordings are off by default and need your separate consent. You can turn off either option at any time in the iOS app’s settings. Your choice here on the website does not change the iOS app’s settings.
You may request access, correction, deletion, restriction of processing and data portability, and object to processing based on legitimate interests. Use the contact in the legal notice. You may also lodge a complaint with a data protection authority; in Austria, this is the Datenschutzbehörde.