Privacy notice
Last updated 5 September 2026 · Applies to app.rara.recipes and rara-recipes.no
Who is responsible
RaRa Recipes (“RaRa”) is operated by Backroad AS, org. no. 934 341 929, Bergen, Norway — the data controller for the processing described here. Privacy inquiries are handled directly by the responsible team: [email protected].
What RaRa is
RaRa is a private recipe archive. What you record — recipes, photographs, dictations, notes — belongs to your archive and is visible only to the people invited into it. Your content is never public, never sold, and never used to train AI models.
What we process, why, and on what legal basis
- Account and membership — your name, email address, role in an archive, and sign-in records. Needed to provide the service (GDPR Art 6(1)(b), contract); without a name and a working email address an account cannot be provided. When you start a collection yourself, the address you type is kept for two days only to limit repeated sign-up emails, then deleted.
- Your content — recipes, photographs of recipe cards, voice-dictation transcripts, and notes you add. Processed to provide the service (Art 6(1)(b)). Stored privately per archive.
- Voice dictation — when you dictate, speech is turned into text and the transcript is stored as your draft. The audio itself is not retained.
- The assistant — recipe photographs, transcripts and drafts are sent to Anthropic (see below) to read cards, shape drafts and answer your questions. Basis: performance of the service you asked for (Art 6(1)(b)). Anthropic does not train models on this data.
- Technical logs — IP addresses and request logs, kept briefly for security and reliability (Art 6(1)(f), legitimate interest).
- Invitations — when a member invites you, they give us your name and, only if they choose to email it through RaRa, your email address (Art 6(1)(f), the member's legitimate interest in sharing their own archive). The invitation link is sent from the inviter's own phone through the app they pick — Messages, WhatsApp, Snapchat, their mail app or the share sheet — so that app, not RaRa, carries the message; RaRa sends only invitations the inviter asks us to email. An invitation lasts 14 days. The details are deleted when it expires or is withdrawn; if you join, the email address becomes your account.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | EU (Stockholm) |
| UpCloud | Application hosting | Norway (Stavanger) |
| Anthropic PBC | The AI assistant (reading cards, shaping drafts) | USA — under the EU-US Data Privacy Framework and Standard Contractual Clauses; no training on your data |
| Cloudflare | Email delivery, network and DNS, and the bot check on the sign-up form (Turnstile) | EU/global edge |
The sign-up form is protected by Cloudflare Turnstile, which checks that a real person is filling it in rather than a machine. It runs invisibly and sets no cookie for advertising or tracking; Cloudflare describes what it collects in its Turnstile Privacy Attestation. Referencing it here is a condition Cloudflare sets for using the invisible mode.
Your data is stored in the EU (Stockholm and Stavanger), with encrypted backups kept in the EU. AI assistant requests are processed by Anthropic in the US under the safeguards above; a copy of the applicable safeguards is available on request via the contact address. This notice is updated if any of this changes.
No automated decisions
RaRa makes no automated decisions with legal or similarly significant effects about you. The assistant only drafts and suggests — a person always reviews and decides.
How we protect it
Traffic is encrypted in transit and data is encrypted at rest; access is separated per archive at the database level; backups are encrypted and stored in the EU; access to production systems is restricted and logged.
Wherever you live
We apply the protections described here to everyone who uses RaRa, in every country. If you live outside Norway or the EEA, local law may give you additional rights, and nothing here limits them.
How long we keep things
Your account and content stay until you delete them or your archive is closed. Technical logs are kept for roughly 30 days. Backups roll over on a fixed schedule and deleted content leaves them as they roll.
Your rights
You can ask for access to, correction of, deletion of, or a copy (portability) of your personal data, ask us to restrict processing, and object to processing based on legitimate interest. Write to [email protected] — we respond within one month. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority where you live.
Children
RaRa accounts are intended for adults. A collection may naturally mention other people, including children, in recipes and stories — archive administrators are responsible for what their archive records, and anyone can ask us to remove content about them via the address above.
Changes
When this notice changes, the date at the top changes with it, and material changes are announced in the app.