Privacy Policy

Your Data, Your Control

Protecting your personal data is very important to us. In this privacy policy, we inform you transparently about what data we collect, how we use it, and how you retain full control.

1. Controller

Responsible for data processing on this website:

Vanessa Schumacher

Sole Proprietor

Contact: Via our Contact Form

2. Data Collection & Usage

a) Registration

To create your personal nutrition plan, we need:

Email Address
Name
Health Goals
Dietary Preferences

b) App Usage

Your interactions (e.g., recipes marked as "eaten") for statistics
Favorite recipes for quick access
Device information to optimize display

c) If you try the weekly plan without an account

You can have a weekly plan created without signing in. To do so you answer four questions about your date of birth, sex, height, weight, activity level, sleep quality and your health priorities.

These answers never leave your browser.

They are stored locally in your browser only (local storage, key upfood_guest_profile_v1) — not on our servers.
The recipe selection is calculated by your browser. We receive neither your answers nor the result. The only request that reaches our server is the one for the public recipe catalogue — the same request as simply browsing it.
No user account and no database record is created.

Legal basis, retention and deletion

Storage on your device: Storing these answers in your browser is strictly necessary to provide the service you expressly requested — your weekly plan. It is therefore permitted without consent under § 25(2)(2) TDDDG. No cookie is set.
Health data: Height, weight, sleep quality and health priorities are special categories of personal data under Art. 9 GDPR. That is precisely why we do not process them at all at this stage — they stay with you until you decide to create an account.
Retention: The answers remain in your browser until you create an account, until you clear this site's browser storage, or until you close a private window.
If you then sign in: We transfer the answers into your account so you do not have to enter them again. From that point section a) applies and processing is based on your consent under Art. 9(2)(a) GDPR. The local copy in your browser is deleted.
Delete them yourself: You can remove the answers at any time by clearing the site data for up-food.de or up-food.com in your browser. You need no account for this, and you do not have to ask us.

3. Third Parties

Payment Processing

Payment data is securely transmitted directly to Stripe Payments Europe, Ltd. We do not store credit card details.

Hosting & Tech

Our servers and databases are operated by certified providers in secure data centers.

4. Analytics & Advertising

These tools are loaded only after your explicit consent. If you allow necessary cookies only, none of them becomes active: no cookies are set and no data is transmitted.

Google Analytics 4 — audience measurement

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Analytics to understand which pages are opened and how visitors move through the site. It processes a shortened IP address, device and browser details, the pages viewed and the referring source.

Google Analytics runs in consent mode: the script is embedded but starts with storage denied. Cookies are set and usage data is collected only once you accept the “Analytics cookies” category.

Meta Pixel (Facebook & Instagram) — advertising

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The Meta Pixel measures whether our ads on Facebook and Instagram lead to a visit, and allows us to show relevant ads to visitors later. It sets the _fbpcookie and transmits the page viewed, device and browser details and your IP address to Meta. It also reports when you start or complete a checkout — withoutyour name, email address or payment details.

Unlike Google, there is no mode in which the script already runs but stores nothing. The Meta Pixel is therefore loaded only after you accept the “Marketing cookies” category. Without consent it is not present on the page at all. No advertising is displayed on this website itself.

Legal basis, US transfers and withdrawal

Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG (formerly TTDSG).
Transfers to the USA: both services may transfer data to their US parent companies. Google LLC and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework, supplemented by the EU Commission’s Standard Contractual Clauses. Access by US authorities can nevertheless not be fully ruled out.
Joint controllership: for the collection and transmission of data by the Meta Pixel we and Meta are joint controllers (Art. 26 GDPR). What Meta does with the data afterwards is Meta’s sole responsibility.
Withdrawal: you can change your consent at any time with future effect — via the cookie settings at the bottom of the page or in the cookie policy. Data already transmitted is not affected.

5. Your Rights & Deletion

Important: Deletion is permanent

If you delete your account, all your personal data (including history, plans) will be irrevocably and immediately deleted.

Data Export: Download your data directly in the app.
Access & Correction: See what we store and fix errors.

6. International Users

USA (CCPA/CPRA)

If you are a resident of California or other US states with similar privacy laws:

Right to Know: You can request details about the categories of personal data we collect.
Right to Delete: You can request deletion of your data directly in the app settings.
Do Not Sell My Info: We do NOT sell your personal data to third parties.

UK & EU

We adhere to the high standards of the GDPR (General Data Protection Regulation). UK users have equivalent rights under the UK GDPR.

Any Questions?

Our privacy team is happy to help.

Status: January 2026