Privacy Policy

Last updated: 4 September 2026.

About this Policy

This Privacy Policy explains how Receitório and its website handle personal data. It is intended to describe what data is processed, why it is processed, who receives it, how long it is kept, and the rights available to you.

One of Receitório's design principles is that the main operational data you create in the app (for example recipes, ingredients, costs, inventory, and sales) is stored on your device and, where you choose to enable it, in your private iCloud account rather than in a Receitório-operated cloud database. On Windows that data stays on the computer only.

You can also reach us through the contact form.

1. Scope

This Policy applies to personal data processed through:

• the Receitório app;
• receitorio.app and its account, subscription, support, and related pages;
• purchases and subscription entitlement management connected to Receitório; and
• communications with our support or privacy channels.

Third-party products and services have their own privacy practices. Where you interact directly with Apple, Google, Stripe, or another independent provider, its own privacy notice may also apply.

2. Data you create in the app

Receitório lets you create and manage information such as recipes, ingredients, packaging, categories, locations, base preparations, costs, production records, purchases, inventory, sales, deleted items, and bakery settings.

The main app database is designed to be stored locally on your device. On iPhone, iPad, and Mac, if iCloud sync is available and you enable it, that data can sync through your private iCloud account under Apple's infrastructure and policies. There is no iCloud on Android; Section 2.1 describes the Android equivalents.

On Windows, that database is a SQLite file (receitorio.sqlite), kept with a preferences file (preferences.json) in the app's data folder under your Windows user profile. The Windows app has no iCloud, no system backup, and no device-to-device sync: that copy on your computer is the only one. To move your data to another computer or device, you export a file in "Ajustes", "Dados" and import it at the other end. Rafacst keeps no copy of that file. The Windows app's interface is Brazilian Portuguese for now, so its menu names are quoted in Portuguese throughout this Policy.

Rafacst does not operate its own server to store the app's main recipe, inventory, and sales database.

Purpose: provide the app's core functions.

Legal basis where GDPR applies: performance of the contract or steps you request before entering into a contract. To the extent the information remains solely on your device or private iCloud and is not accessible to Rafacst, Rafacst does not itself process that copy.

Retention: you control the copy stored in the app. It remains until you delete it, delete the app's data, or otherwise remove it. iCloud copies and backups are also subject to your Apple settings and Apple's retention practices.

2.1 Device backups and optional Google Drive sync

This section describes Android only. The Windows app has neither mechanism: nothing is backed up by the operating system and nothing is synced to a cloud account.

On Android, the operating system's own Android Auto Backup can copy the app's local database and preferences into your Google backup, encrypted, under the Google account on the device. That backup is run by the system, is not triggered by you inside the app, and cannot be read by Receitório. You control it in your Android settings and in your Google account's backup page. It is a separate mechanism from the Google Drive sync described next.

Android also offers an optional Google Drive sync. It is off by default. You turn it on in Settings, Data, "Sync with Google Drive". Turning it on opens a Google consent screen, and nothing is uploaded before you grant access. Every sync after that is manual: you press "Sync now". There is no background sync, no periodic sync, and no sync on launch.

Purpose: back up and restore your own data across your own devices, including restoring onto an iPhone, because the file format is shared with the iOS app.

What is sent: one file, named receitorio.receitorio-transfer, holding the same whole-data-set archive the Export button already writes to a file you choose: settings, ingredients, packaging, recipes, expenses, inventory, shopping lists, sales, losses, incidents, categories, and locations. The file is capped at 10 MB. It contains no account credentials, no analytics data, and no data about anyone but you.

Where it goes: appDataFolder, a hidden per-app folder inside your own Google Drive, under whichever Google account you pick in the consent screen, which is not necessarily the account you signed into the app with. The folder does not appear in the Drive interface, is not searchable, and cannot be shared; only Receitório can read the file. It counts against your own Google storage quota. Rafacst operates no server and keeps no copy: this data never reaches us or any third party.

The only scope requested is https://www.googleapis.com/auth/drive.appdata, which Google classifies as non-sensitive. It grants access to the app's own hidden folder and nothing else. It grants no access to your other Google Drive files, and none to Gmail, Contacts, or Google Photos.

How to stop and delete it: turn the switch off in Settings, Data. That ends all syncing and clears the local sync state. To erase the file, use Google's own interface: Drive, Settings, Manage apps, Receitório, "Delete hidden app data". Uninstalling the Android app does not delete the file, which is what makes restoring onto a new device work.

This sync is not continuous, not real-time, and not automatic. It does not sync record by record: it replaces the whole data set. It is not multi-user and not shared, so two people cannot collaborate through it. It is not a Rafacst-hosted backup.

Receitório's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements.

Legal basis where GDPR applies: your consent, given in the Google consent screen and withdrawable at any time by turning the switch off; performance of the backup function you request.

Retention: the file stays in your Google Drive until you delete it by the route above. Rafacst keeps no copy and cannot delete it for you.

3. Account and authentication data

Signing in can be optional for local app features. If you use an account, we may process:

You can erase this data yourself. The account page at https://receitorio.app/en/account/ deletes both your sign-in record and your purchase record, with no request to file. Deletion is refused while a paid entitlement is still active, because erasing the purchase record does not cancel a subscription at Apple or Stripe: cancel first, then delete. Data held on your device or in your private iCloud account is not affected by that deletion and is erased in the app.

• your account identifier;
• your name, when supplied by the sign-in provider;
• your email address, when supplied or entered;
• the authentication provider you use; and
• technical authentication information needed to verify a session.

In the Android app, sign-in uses Firebase Authentication with Google Sign-In or a passwordless email link. There is no Apple sign-in on Android. In the Windows app, signing in does not happen inside the app at all: the app opens your system browser at https://receitorio.app/desktop-unlock, where Firebase Authentication handles Google or email-and-password sign-in. The Windows app never shows a password field and never receives your password. There is no Apple sign-in on Windows. On the website, account and subscription pages use Firebase Authentication and may allow sign-in with Apple, Google, or email and password. Firebase verifies your credentials and issues authentication tokens. Our server uses the token to confirm that the session is genuine and to identify the account associated with your access. We do not receive or store your Apple or Google password, and the website does not store your Firebase password in plain text.

Purposes: authenticate you, maintain account security, associate purchases with the correct account, restore entitlements, and provide account-based features.

Legal basis where GDPR applies: performance of the contract; our legitimate interests in protecting accounts and preventing fraud where the processing is not strictly necessary to perform the contract.

Legitimate interests: account security, fraud prevention, abuse prevention, and reliable entitlement management.

Retention: account information is kept while the account remains active and afterward only for the period reasonably necessary for deletion processing, fraud/security records, dispute handling, and legal obligations. After account deletion, Firebase removes the associated authentication information from its live and backup systems within 180 days.

4. Purchase, subscription, and entitlement data

Receitório can be purchased through Apple's App Store, through Google Play, or through receitorio.app.

For App Store purchases, Apple processes the payment and provides purchase or subscription information needed to validate access.

For Google Play purchases on Android, Google processes the payment under Google Play's terms and provides the purchase or subscription information needed to validate access. RevenueCat validates that purchase and manages the entitlement. Rafacst does not receive your full card number. Android subscriptions are managed at https://play.google.com/store/account/subscriptions.

For purchases on this website, RevenueCat Web Billing and Stripe process the checkout and payment. Rafacst does not receive your full card number.

We and our providers may process:

• the product or plan purchased;
• purchase, renewal, expiration, cancellation, and refund status;
• transaction or order identifiers;
• country/store or payment-channel information;
• the account identifier used to connect the purchase to Receitório; and
• limited billing or tax information where required for receipts, accounting, fraud prevention, or legal compliance.

Purposes: process and validate purchases, unlock or restrict paid features, restore purchases, manage subscriptions, prevent fraud, handle refunds and disputes, keep accounting records, and comply with tax and legal obligations.

Legal bases where GDPR applies: performance of the contract; compliance with legal obligations; and legitimate interests in fraud prevention, payment security, and resolving transaction disputes.

Retention: purchase and entitlement records are retained for as long as needed to maintain your entitlement and afterward for the applicable accounting, tax, chargeback, fraud, and legal limitation periods. RevenueCat customer records are kept while needed to maintain the account and entitlement, then deleted when an eligible account deletion is completed. Stripe generally keeps transaction-related personal data for five years or more after the business relationship ends or the last transaction, whichever is later. Rafacst keeps its accounting and tax records for five years.

4.1 Unlocking and licence checks on Windows

The Windows app carries no billing SDK, so paid access is unlocked through the browser instead. The app opens a temporary listener on 127.0.0.1, the loopback address of your own computer, and sends you to the system browser to sign in. After sign-in, the website returns a signed, time-limited licence token to that local address, bound to your Firebase account identifier, and the app closes the listener immediately afterwards.

The token, the account identifier, your name, and your email address are stored on the computer in a file encrypted with the Windows Data Protection API (DPAPI), next to the app's database.

About every seven days, the app sends that token and the account identifier over HTTPS to https://receitorio.app/desktop-license/verify to confirm the paid entitlement is still valid. Nothing from your recipes, costs, inventory, sales, or customers is sent with it. If the computer has no connection, paid access keeps working for up to 30 days before the paid sections lock; the free sections keep working either way.

Apart from that check and the optional analytics described in Section 7, the Windows app contacts no other server. Website pages, the checkout, and Instagram open in your system browser, outside the app.

Purposes: unlock paid features for the right account, confirm the entitlement is still valid, and prevent unauthorized use of paid features.

Legal basis where GDPR applies: performance of the contract; our legitimate interests in preventing unauthorized use of paid features.

Retention: the encrypted licence file stays on your computer until you sign out in the app, under "Ajustes", "Conta", "Sair da conta", or uninstall the app.

5. Device permissions: camera, files, and local network

Receitório may ask for:

• camera access to scan receipts, QR codes, or barcodes;
• file access when you import or export data; and
• local-network access, on iPhone, iPad, and Mac only, when you choose to transfer data directly between nearby devices. Neither the Android app nor the Windows app has local-network transfer.

These permissions are controlled by your device settings. We use them only when needed for the function you choose to use.

On Android, camera recognition runs on the device itself, through bundled ML Kit models. Scanned images are never uploaded.

The Windows app uses no camera and asks for no camera permission. Receipts are imported from PDF, XLSX, or CSV files you pick yourself, and transfers between devices go through a file you export and import.

Purpose and GDPR legal basis: provide the function you request; performance of the contract or steps taken at your request.

6. Receipt, barcode, and product lookups

When you choose to scan or look up a receipt, QR code, barcode, or product, Receitório may send the minimum information needed for the lookup, such as:

• a receipt key;
• a receipt URL;
• a barcode or GTIN;
• a product name or related search term; or
• other information necessary to complete the lookup you requested.

Services can include ConsultaDANFE, official Brazilian state NF-e/NFC-e services, Open Food Facts, GTINHub, Google Shopping, or other services shown in the app or this Policy. For barcodes those last three are queried in that order, stopping at the first answer. On iPhone, iPad, and Mac the list also includes Brave Search, which the Android app does not query. The Windows app makes none of these lookups: a receipt PDF is read on the computer itself and nothing from it is sent over the internet.

These lookups occur only when you initiate them. You can review, edit, or enter the resulting information manually.

Brazilian NFC-e receipt scanning is intended for Brazil.

Purpose: return information you asked Receitório to look up and prefill fields for your review.

Legal basis where GDPR applies: performance of the service you request.

Recipients: the selected lookup provider. Depending on the provider and context, it may act as our service provider or as an independent controller under its own privacy policy.

Retention: Rafacst does not intentionally create a permanent central record of lookup content unless needed for security, diagnostics, or support. The third-party provider's own retention rules may apply to information it receives.

7. App analytics

Receitório uses Aptabase to understand which parts of the app are used and to decide what to improve. Aptabase processes app analytics in the European Union.

Ordinary analytics events are designed not to contain the contents of your recipes, ingredient prices, inventory, or sales. They can include information such as which screen or feature was used and basic technical information needed for aggregate product analytics.

Where an event has been irreversibly anonymized so that no person can reasonably be identified, it is no longer personal data under the GDPR.

Purpose: measure product usage, diagnose broad product issues, and improve the app.

Legal basis where personal data is involved and GDPR applies: our legitimate interests in understanding and improving Receitório, unless consent is legally required for a particular technology or jurisdiction.

Legitimate interests: product reliability, feature prioritization, and understanding aggregate use without advertising profiling.

Retention: the self-hosted Aptabase instance keeps ordinary app analytics events for five years and debug-build events for 182 days.

In the Windows app, no user identity is sent with these events: identifiers are hashed with SHA-256 on the device before they leave it, and you can turn these events off inside the app, under Settings, About.

We do not use app analytics to track you across unrelated apps or websites or to serve third-party advertising.

8. Diagnostics and pseudonymous identifiers

In limited diagnostic situations, a purchase transaction identifier may be transformed using a one-way hash before it is sent with diagnostic information.

A hashed identifier is not necessarily anonymous. If it can still be linked or matched to an account or transaction, we treat it as pseudonymous personal data rather than claiming that it is anonymous.

Purpose: investigate purchase-entitlement failures, duplicate transactions, restoration issues, or similar technical problems.

Legal basis where GDPR applies: our legitimate interests in troubleshooting, service security, preventing fraud, and providing reliable paid access; where the diagnostic is necessary to provide support you requested, performance of the contract may also apply.

Retention: Receitório keeps no diagnostic log store of its own. Diagnostic lines written by the website's server functions exist only in Cloudflare's short-lived runtime logs and are not exported or archived.

9. Website hosting, security, and technical logs

The website uses infrastructure and security services that may process technical data such as:

• IP address;
• browser and device information;
• timestamps and request metadata;
• security signals; and
• logs needed to detect abuse, attacks, or technical failures.

Cloudflare provides website infrastructure and security services and is also used for Turnstile on forms to distinguish legitimate visitors from automated abuse.

Purposes: deliver the website, protect it from abuse and attacks, maintain security, prevent spam, and diagnose technical failures.

Legal basis where GDPR applies: our legitimate interests in operating a secure and reliable website; compliance with legal obligations where applicable.

Legitimate interests: network security, fraud and abuse prevention, service reliability, and protection of our users and infrastructure.

Retention: we do not keep our own copy of website request logs. Cloudflare processes and retains request and security metadata under its own retention practices for the plan in use.

10. Website cookies and analytics

The website can use Google Tag Manager, Google Analytics, and similar measurement tools. Website analytics runs on our legitimate interest and is active by default. You can turn it off at any time.

Our privacy-preferences notice lets you turn website analytics off or back on, and you can reopen it later from the cookie-preferences control.

10.1 Strictly necessary storage

We may use storage necessary to operate requested website functions, remember security or authentication state, maintain a shopping or account session, record privacy choices, or prevent fraud. Where the law permits, this storage does not depend on your analytics choice.

10.2 Analytics storage

Analytics tools are used to understand visits, page usage, and the effectiveness of product information. They are active by default, and they stop when you turn website analytics off.

Legal basis where GDPR applies: our legitimate interests in measuring website use and improving how we describe the product; legitimate interests or contractual necessity for storage that is strictly necessary. You can object at any time with the cookie-preferences control, which turns website analytics off.

Google Analytics retention: event data is kept for two months, and user data is kept for 14 months.

Privacy-choice retention: your choice is stored in your browser's local storage under the key receitorio-consent-v1, with no expiry date. It stays until you change your choice or clear the site's data in your browser, and it is not stored on our servers.

You can object at any time by reopening the cookie-preferences control and turning website analytics off. The objection does not make earlier lawful processing unlawful.

11. Contact, support, and privacy requests

When you contact us, we may collect:

• your name;
• your email address;
• the content of your message;
• attachments or information you choose to include; and
• technical or account information needed to investigate your request.

The contact form uses Cloudflare Turnstile to reduce spam and abuse.

Purposes: answer questions, provide support, investigate problems, handle complaints, and respond to privacy or legal requests.

Legal bases where GDPR applies: performance of the contract where the request concerns the service; compliance with legal obligations where the request exercises a statutory right; and legitimate interests in customer support and dispute management in other cases.

Retention: support correspondence is kept for one year after we receive it, or longer where reasonably necessary for an active dispute, fraud investigation, or legal obligation.

12. Data we receive from other sources

Not all personal data is entered directly into Receitório by you. Depending on the function you use, we can receive information from:

• Apple, Google, or Firebase about authentication;
• Apple, RevenueCat, or Stripe about purchases and subscription status;
• security and hosting providers about abuse or technical events; and
• lookup providers when returning the result of a query you initiated.

We use that information only for the purposes described in this Policy.

13. Who receives personal data

We do not sell personal data.

We may disclose or make personal data available to service providers and other recipients where necessary for the purposes described above. Current categories and examples include:

• authentication and account services: Firebase/Google and Apple;
• app distribution, sign-in, and private cloud storage: Apple;
• app distribution, sign-in, purchases, system backup, and the optional Drive sync into your own Google Drive: Google;
• app distribution and updates on Windows: Microsoft, through the Microsoft Store, which processes no purchase for Receitório and receives no data from the app;
• web and Google Play purchases and entitlement management: RevenueCat;
• payment processing: Stripe;
• website hosting, security, and anti-abuse: Cloudflare;
• website analytics: Google, until you turn website analytics off;
• app analytics: Aptabase;
• receipt and product lookup providers: the services identified in Section 6; and
• professional advisers, authorities, courts, or counterparties: where reasonably necessary to comply with law, establish or defend legal claims, obtain professional advice, or complete a lawful corporate transaction.

A provider may act as our processor/service provider for some activities and as an independent controller for others. Its role depends on the service and applicable contract. Where a provider is our processor, we require the protections required by applicable data-protection law.

We do not share personal data with third parties for their own behavioral advertising based on your activity across unrelated apps or websites.

14. International data transfers

Rafacst is established in Brazil, while some providers operate in the United States, the European Union, and other countries. Personal data may therefore be processed outside the country where you live.

For transfers of personal data from the EEA to Brazil that fall within the scope of the European Commission's adequacy decision for Brazil adopted on 26 January 2026, the transfer can rely on that adequacy decision.

For transfers from the EEA to a country or recipient not covered by an applicable adequacy decision, we or our providers use a lawful transfer mechanism where required, such as the European Commission's Standard Contractual Clauses (SCCs) and appropriate supplementary measures, or another mechanism recognized by applicable law. A provider may rely on an applicable adequacy framework where legally available and where the recipient is validly covered by it.

You can contact us to request information about the applicable transfer safeguards and, where the law requires, a copy or summary of the relevant safeguards, subject to lawful redactions for confidential information.

15. How long we keep data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and for any applicable legal, accounting, tax, security, fraud-prevention, dispute, or limitation period.

The relevant retention rules are described in the sections above. Before publishing this Policy, Rafacst must replace each retention placeholder with the actual configured period or a sufficiently specific retention criterion.

When data is no longer needed, we delete or anonymize it unless continued retention is required or permitted by law.

Copies in backups may persist for a limited period until backup rotation completes. Data stored solely in your private iCloud account is controlled through your Apple account and is subject to Apple's systems and retention practices. Data stored solely in your Google backup or in the hidden Google Drive folder described in Section 2.1 is controlled through your Google account; uninstalling the Android app does not erase the Drive file. On Windows there is no such copy: your data is erased in the app, under "Ajustes", "Dados", "Apagar todos os dados", behind a double confirmation, or by uninstalling the app. Items you delete inside the app can be restored for up to 7 days before they are discarded.

You do not have to wait for a retention period to end. The account page described in Section 3 erases your sign-in and purchase records immediately, subject to the records we must keep for accounting, tax, fraud, and legal purposes.

16. Is providing the data mandatory?

Some data is necessary if you choose to use a particular feature:

• you can use some local app features without creating an online account;
• account and authentication data is required for functions that depend on an account, including website purchase access and entitlement restoration where applicable;
• payment and transaction data is necessary to make and administer a purchase;
• information needed for a receipt, barcode, or product lookup is required only when you choose that lookup;
• support contact details are needed if you want a reply to a support or privacy request; and
• website analytics is not required to purchase or use Receitório, and you can turn it off at any time.

If you do not provide data that is necessary for a requested feature or contract, we may be unable to provide that feature or complete the transaction.

17. Your rights in the European Union and EEA

If the GDPR applies to our processing of your personal data, you can have the following rights, subject to the conditions and exceptions in the law:

• access: obtain confirmation and a copy of personal data we process about you;
• rectification: correct inaccurate or incomplete personal data;
• erasure: ask us to delete personal data where the legal conditions are met;
• restriction: ask us to restrict processing in certain circumstances;
• data portability: receive certain data in a structured, commonly used, machine-readable format and, where technically feasible, transmit it to another controller;
• objection: object to processing based on legitimate interests, including related profiling, on grounds relating to your particular situation;
• withdraw consent: withdraw consent at any time where consent is the legal basis, without affecting processing that was lawful before withdrawal; and
• complain to a supervisory authority: lodge a complaint with the competent data-protection authority, including where applicable the authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

Where we process data for direct marketing, you have the right to object at any time. Receitório does not currently use the app's operational data for third-party behavioral advertising.

To exercise a right, contact dpo@rafacst.me or use the contact page. We may need to verify your identity before acting on a request. We will respond within the period required by applicable law.

For the sign-in and purchase records, erasure is available without a request: the account page deletes them directly.

18. Rights in other jurisdictions

Depending on where you live, you may have additional privacy rights. We will honor rights required by applicable law.

For example, Brazilian users may have rights under the LGPD, and users in Mexico may have rights of access, rectification, cancellation, and objection (ARCO) under applicable law.

A request can be sent through the privacy contact described in Section 17.

19. Automated decision-making

Receitório does not currently make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of GDPR Article 22.

If this changes, we will provide the information and safeguards required by applicable law before using such processing where required.

20. Sensitive data

Receitório is not designed to collect special categories of personal data such as health data, religious beliefs, biometric data used for identification, or political opinions. Please do not include unnecessary sensitive personal information in support messages or free-text fields.

If a particular feature later requires sensitive data, we will update this Policy and establish an appropriate legal basis before introducing that processing.

21. Children and minors

Receitório is not directed at children and we do not knowingly seek to collect children's personal data.

If you believe a child has provided personal data to us in circumstances where consent or authorization was legally required, contact us so that we can investigate and take appropriate action.

22. Security

We use reasonable technical and organizational measures designed to protect personal data, including secure transport for network communications, access controls, provider security measures, and platform-protected storage where available.

No system is completely secure. You should protect your device, Apple Account, email account, and Receitório credentials and keep your operating system up to date.

Where applicable law requires notification of a personal-data breach to a supervisory authority or affected individuals, we will make the required notification.

23. Changes to this Policy

We may update this Policy when Receitório, our providers, legal requirements, or our data practices change.

For material changes, we will provide appropriate notice through the website, app, email, or another suitable channel where required by law. If a new processing activity requires consent, we will request new consent rather than treating publication of an updated Policy as consent.

The date at the top shows when this version was last updated.

24. Company and contact details

For privacy questions or to exercise privacy rights:

R Castro Silva Consultoria em Tecnologia LTDA — Rafacst Consultoria

CNPJ 66.424.919/0001-10

Business address: Rua Guaicurus 635, Apt. 202 Tower A, Água Branca, São Paulo, SP, 05033-001, Brazil

Privacy email: dpo@rafacst.me

Contact page: https://receitorio.app/en/contact/

Contact

Privacy questions can be sent through the contact form.

This Privacy Policy explains how Receitório handles personal data. The app is developed and supplied by R Castro Silva Consultoria em Tecnologia LTDA, trading as Rafacst Consultoria, registered in Brazil under CNPJ 66.424.919/0001-10.