Extra Rice, PleasePrivacy policy
Last updated 5 November 2026
The short version. Without an account, your data stays on your phone. With an account, your email address and the data you choose to sync are stored in the EU. Your health profile and your own recipes stay on your phone. Questions and photos you send to the AI features go to OpenAI to get an answer. There are no ads or trackers, and we never sell your data.
Who we are
Extra Rice, Please is a Filipino food, meal-planning and food-tracking app. The data controller responsible for your personal data is:
Rhea Prokop
Business ID (IČO): 03681033
Na Formance 495/6, Újezd u Průhonic, 149 00 Prague 4, Czech Republic
Self-employed person entered in the Czech Trade Register.
Email: privacy@extrarice.app
Using the app without an account
You can use Extra Rice, Please without an account. What you enter is saved on your phone and we don’t receive it. To show recipes, photos and the food list, the app downloads them from our server. That request contains no personal data, although, like any internet request, our hosting provider sees your phone’s IP address.
What we collect when you have an account
| Data | Why |
|---|---|
| Email address and password (stored only as a secure hash) | To create your account, sign you in and send account emails. |
| Your profile: name, country, household size, foods you avoid, rice preference, budget, cooking time, appearance settings, and calorie and macro targets | To tailor recipes and plans, and to keep your settings the same on all your phones. |
| Favourites, food log, meal plan, pantry, extra grocery items, and your recipe ratings and notes | To sync them between your phones. This is the service itself. Your ratings and notes aren’t shown to other users. |
| A daily count of your AI requests, and whether you have Pro | To apply the free daily limit and give you what you’ve paid for. |
| Technical data: IP address, device and app version, time of requests | Recorded automatically by our hosting provider to keep the service secure and working. Kept for a short period. |
What stays on your phone
Your health profile (sex, year of birth, height, weight, activity level and goal) and your own recipes, foods, meals and their photos are stored only on your phone. They are not sent to our servers or synced, unless you include them in something you send to an AI feature.
We don’t collect your location, contacts, or anything from other apps on your phone. The app uses your camera only when you choose to take a photo or scan a barcode, and your photo library only when you choose a photo.
AI features
The cooking companion, substitutions, Remix My Leftovers, meal scanning and AI meal planning are optional and need an account. When you use one, what you send (your question, the relevant recipe or preferences, or your photo) goes through our server to OpenAI, which generates the answer. We don’t store your questions, photos or the answers on our servers; we only count how many requests you made that day. OpenAI processes them under its terms for business customers.
Please don’t include sensitive personal information in your questions or photos. AI answers can be wrong, so check them before relying on them.
Scanning barcodes
The barcode is read on your phone, and the camera picture is not stored or sent anywhere. To find the product, the app sends the barcode number, and nothing else about you, directly to Open Food Facts, a non-profit food database based in France. Like any internet request, they see your phone’s IP address, and their own privacy policy applies.
Who can see your data
Your synced data is private to your account, and other users can’t see it. Our database rules limit each account to its own data. Extra Rice, Please administrators may access account data only when needed to run the service, keep it secure, or answer a request from you.
Food preferences and health-related information
Your calorie and macro targets, food log and the foods you avoid may reveal information about your health or beliefs, which the GDPR treats as special categories of data. Entering them is optional, and if you don’t sign in they never leave your phone. If you sign in and sync them, we process them only to provide these features to you, on the basis of your explicit consent (Article 9(2)(a) GDPR). You can withdraw consent at any time by changing them, signing out or deleting your account.
Legal basis
- Providing the app you signed up for (Article 6(1)(b) GDPR): your account, syncing, AI features you use and any Pro subscription.
- Our legal obligations (Article 6(1)(c)): keeping purchase records for accounting and tax.
- Your consent (Article 6(1)(a) and 9(2)(a)): health-related information, as described above.
- Our legitimate interest in a secure, working service (Article 6(1)(f)): technical data and security logs.
Service providers
We use a few companies to run Extra Rice, Please. They process data on our instructions under data-processing agreements, or under their own policies where stated.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and recipe photo storage | EU (Frankfurt, Germany) |
| Resend | Sends account emails | United States |
| OpenAI | Generates answers for the AI features you use | United States |
| RevenueCat | Checks Pro purchases with the app stores. It receives your account ID and the purchase, never your name or email | United States |
| Apple and Google | Take payment for Pro through their app stores. Their own privacy policies apply | Worldwide |
| Cloudflare | Hosts this website and forwards email sent to our addresses | Worldwide network |
When data is processed outside the European Economic Area, it’s protected by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
What we don’t do
- We don’t show ads.
- We don’t use analytics or advertising trackers in the app or on this website, and this website doesn’t set cookies.
- We don’t sell or rent your data, or share it for anyone else’s marketing.
How long we keep it
We keep your data for as long as you have an account. When you delete your account, your account and synced data are deleted from our live systems straight away. Technical logs are deleted automatically within a few weeks, and any backup copies within 30 days. Purchase records are kept for as long as accounting and tax law requires. If you email us, we keep that conversation for as long as needed to deal with it.
Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time.
- Correct: edit your profile, plans and targets directly in the app.
- Delete: see how account deletion works.
- Get a copy, or anything else: email privacy@extrarice.app. We reply within one month.
You also have the right to complain to a data protection authority. In the Czech Republic that’s the Úřad pro ochranu osobních údajů (uoou.gov.cz).
Children
Extra Rice, Please is meant for adults: you must be 18 or older to create an account, and we don’t knowingly collect children’s data. If you believe a child has created an account, email us and we’ll delete it.
Security
Data is encrypted in transit, and access rules on our database let each account reach only its own data.
Changes to this policy
If we change this policy, we’ll update the date at the top. If a change affects how we use your data in a significant way, we’ll tell you in the app first.