Privacy Policy
Last updated 19 September 2026
Ambre is a recipe and meal-planning app made by Ambi Studio AB, a company based in Oxelösund, Sweden. This policy explains what personal data we handle when you use the Ambre apps (iPhone, iPad, Mac, Apple Watch, Apple TV and Apple Vision Pro), the Ambre web app and this website, and what you can do about it.
Ambi Studio AB (company registration number 559148-7458) is the data controller. If anything here is unclear, write to us at [email protected]; our postal address is under Contact.
The short version
- Your recipes, meal plans and collections are stored on our servers so they can sync between your devices and be shared with the people you choose.
- If you create an account we store your email address. You can also use Ambre without an account.
- Some features use AI services run by other companies. When you use them, the content needed for that feature — for example the text of a web page you import — is sent to those companies for processing.
- We use analytics and crash reporting to understand how Ambre is used and to fix problems. These are linked to your account.
- We don’t show ads, we don’t sell your data, and we don’t track you across other companies’ apps and websites.
- You can delete your account in the app at any time.
What we collect
Account and profile
- Email address, if you sign in. We use it to send you a sign-in code and to recognise your account. Ambre has no passwords.
- Display name and profile photo, if you add them. Your display name starts out as the first part of your email address and you can change it.
- Account identifiers: an ID we generate for your account, and — if you used Ambre before version 5 — an anonymous identifier from your iCloud account that lets us connect your earlier library to your account. We never see your Apple ID or iCloud email address.
If you choose “Continue without an account” we create an anonymous account with no email address. Everything else in this policy still applies to the content you save.
What you save in Ambre
- Recipes: names, descriptions, ingredients, instructions, notes, photos, source links, favourites, tags, cooking progress and timers.
- Voice recordings you make to create a recipe, and the text transcribed from them.
- Meal plans, scheduled recipes, grocery lists and collections.
- Your taste palette: likes, dislikes, and any diets and allergies you choose to enter. This is optional. Because allergies and diets can say something about your health, we only use them to tailor recommendations and to show them to people in your circle (see Sharing), and you can remove them at any time.
Sharing and connections
- Who you share meal plans with, who is in your circle, and the invite and share links you create.
Subscriptions
- Whether you subscribe to Ambre+, which plan, and its renewal status. Purchases are made through Apple; we never receive your payment card details.
Device and usage information
- Usage data: which features you use and how (for example that a recipe import started, succeeded or failed, or that the paywall was shown), your app version, device type, operating system version and language. When you import a recipe from a link, the link is included. When you search the web for recipes in Ambre, your search text is included.
- Diagnostics: crash reports, hangs, and errors such as a failed sync or a failed import, together with the names of the screens you visited leading up to the problem and technical details of the request that failed.
- Push notification token, so we can notify you about activity in shared meal plans and fire timers across your devices, and so the app can be told when its feature configuration changes.
- IP address: like any internet service, our servers and providers see your IP address when the app connects. We don’t store it in our database.
We do not collect your precise location, contacts, calendar, Apple Health data or advertising identifier. The only health-related information Ambre handles is any diet or allergy you choose to enter in your taste palette, described above. Older versions of the app let our analytics provider, Mixpanel, estimate your city and country from your IP address; current versions switch that off.
Device permissions
Ambre asks for access only when a feature needs it: the camera (to photograph a recipe or a dish), the microphone (to record a recipe by voice), Reminders (to send a grocery list to Apple Reminders), notifications and alarms (for timers and shared meal plans), and hand tracking on Apple Vision Pro. Photos you pick from your library are chosen through Apple’s photo picker, so Ambre only sees the photos you select. You can change these permissions in your device settings.
AI features
Several features send content to AI providers through our own server, which adds our credentials and forwards the request. We don’t store that content on the way through.
| When you… | What is sent | To |
|---|---|---|
| Import a recipe from a link, the share sheet or a social post | The text of the page or caption, and its link | Anthropic or OpenAI |
| Scan a recipe with the camera or from a photo | Only the text recognised in the photo. Text recognition happens on your device; the photo itself stays there. | Anthropic or OpenAI |
| Record a recipe by voice, or import a recipe from a video you share | The audio recording, for transcription, then the transcript | OpenAI, then Anthropic or OpenAI |
| Point the camera at a dish to find recipes for it (Visual Intelligence) | A small, compressed still image from the camera | Anthropic |
| Translate a recipe | The recipe’s text | Anthropic or OpenAI |
| Ask for recipe recommendations | Your taste palette (including any diets and allergies), the time of day and season, and dishes already suggested | Anthropic or OpenAI |
| Ask for collection suggestions | The names of your recipes and collections | Anthropic or OpenAI |
| Generate an image for a recipe | The recipe’s name | Stability AI |
| Have a recipe read aloud | The text to be spoken | OpenAI |
| Search the web for recipes | Your search text and language. No account identifier is sent. | Brave Search |
These providers process the content to return a result to you. Under their terms for business customers they do not use it to train their models; they may keep it for a limited time to detect abuse. We ask OpenAI not to store requests where that option exists.
AI results can be wrong. Please read the Terms of Use on checking ingredients and allergens.
Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing Ambre: your account, syncing, sharing, AI features you invoke, subscriptions and customer support | Performance of our contract with you |
| Using the diets and allergies in your taste palette for recommendations and showing them to your circle | Your consent, which you give by entering them and can withdraw by removing them |
| Understanding how Ambre is used, measuring and testing new features, and fixing crashes and errors | Our legitimate interest in running and improving the product |
| Preventing abuse and keeping the service secure, including usage limits on AI features | Our legitimate interest in protecting the service and its users |
| Meeting legal obligations, such as bookkeeping and responding to lawful requests | Legal obligation |
You can object to processing based on legitimate interest — see Your rights.
What other people can see
- Shared meal plans. Everyone in a shared meal plan can see and edit its recipes and see the other members’ display names. They cannot see your email address.
- Your circle. People you connect with can see your display name and profile photo, all of your collections and the recipes in them, and your taste palette including any diets and allergies you’ve entered. They can’t see your notes, cooking progress or email address. Removing someone from your circle ends their access immediately. People can only join through an invite link that you send them; nobody can look you up by email, phone number or username.
- Public recipe links. When you share a recipe as a link, we create a copy of the recipe — name, description, ingredients, instructions, photo and source link — that anyone with the link can view, without signing in. If you created the recipe by voice, the copy also includes that voice recording and its transcript, so the person you send it to can listen to it. The copy doesn’t show your name. It stays available until your account is deleted; email us if you want a link removed sooner. Search engines could index a link if it is posted publicly.
- Invite links to a meal plan or a circle work for 72 hours.
- Photos. Recipe photos and profile photos are stored at long, unguessable web addresses that do not require signing in, so that they load quickly and can appear on shared pages. Voice recordings are stored privately; only when you share a recipe as a link is a copy of its recording stored at such an address, for as long as the link exists.
- The Ambre gallery. If you published recipes to the public gallery in an earlier version of Ambre, those recipes and your public profile name and photo are stored in Apple’s iCloud public database and are visible to other Ambre users. Email us to have them removed.
Who processes data for us
We use the following companies to run Ambre. They process data on our behalf and under contract.
| Company | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and live sync | EU (Stockholm) |
| Amazon Web Services | Hosting for our server | EU (Frankfurt) |
| Anthropic | AI features listed above | United States |
| OpenAI | AI features listed above | United States |
| Stability AI | Recipe image generation | United States / United Kingdom |
| Brave Software | Web recipe search | United States |
| Mixpanel | Product analytics, linked to your account ID and email address | EU |
| Sentry | Crash and error reporting, linked to your account ID and email address | United States |
| RevenueCat | Subscription status, linked to your account ID and email address | United States |
| Apple | App Store purchases, push notifications, and iCloud for libraries created before version 5 | Worldwide |
| Cloudflare and GitHub | Hosting for this website and shared recipe pages | Worldwide |
We also run our own feature-configuration service that decides which features and experiments your app gets. It receives your account ID, app and system version, language and push token. Your email address is converted to an irreversible hash on your device before it is sent.
We don’t sell personal data or share it with advertisers or data brokers. We may disclose data if the law requires it, or to a successor if Ambre is ever transferred to another company, in which case this policy continues to apply.
Transfers outside the EU/EEA
Some of the companies above are in the United States. Where data is transferred outside the EU/EEA, we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses.
How long we keep it
- Your account and content are kept for as long as you have an account.
- Deleted items. When you delete a recipe, plan or collection we keep a marker that it was deleted so the deletion reaches all your devices. It is removed along with your account.
- Account deletion. When you ask to delete your account it is scheduled for deletion 90 days later. During that time you can change your mind by signing in. If you don’t want to wait, email us from the address on your account and we will delete it right away instead. After 90 days we permanently delete your account, profile, recipes, photos, voice recordings, meal plans, collections, taste palette, circle connections, share links and push tokens. Shared meal plans you own are deleted for everyone in them.
- Notification records (which shared-plan notification was sent, without its content) are kept for about 30 days.
- Analytics, diagnostics and subscription records. When your account is permanently deleted we also instruct Mixpanel to erase the analytics data linked to it (Mixpanel completes this within 30 days) and delete your customer record at RevenueCat. Crash and error reports at Sentry can’t be deleted per person; they expire on their own within 90 days. Apple keeps its own record of your purchases under its privacy policy.
- A small internal record used to resolve conflicts when two accounts claim the same earlier iCloud library may be kept after deletion; it contains account IDs only.
Your rights
Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent you have given. To use any of these rights, email [email protected] from the address on your account. We answer within one month.
In the app you can:
- Delete your account: Profile → Edit Profile → Delete Account (on iPhone, iPad, Mac and Apple Vision Pro). Deletion takes effect after 90 days; email us if you want it done immediately.
- Edit or remove your display name, photo, taste palette and any content.
- Export individual recipes as files.
- Object to analytics: email us and we will erase the analytics data linked to your account.
If you believe we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (imy.se) or to the data protection authority where you live.
Children
Ambre is not directed at children under 13, and we don’t knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.
This website
ambre.app uses no cookies, analytics or tracking scripts. Pages load fonts and styles from Google Fonts and jsDelivr, and the App Store badge from Apple, which means those companies see your IP address when you visit.
Security
Data is encrypted in transit and at rest with our hosting providers, access to our database is restricted per account by row-level security rules, and sign-in sessions are stored in your device’s keychain. No system is perfectly secure; if we become aware of a breach affecting your data we will tell you and the authorities as the law requires.
Changes to this policy
When we make material changes we will update the date at the top and tell you in the app or by email before they take effect.
Contact
Ambi Studio AB
Company registration number 559148-7458 · VAT number SE559148745801
Isakslundsvägen 69, 613 38 Oxelösund, Sweden
[email protected]