Privacy
What we keep, and why
Mona Spice is a recipe site and a companion app for iPhone. This page says exactly what is stored about you, who can see it, and how to get it back or have it removed. It is written to be read, not to be survived.
Browsing the site
You can read every recipe without an account and without being asked for anything. The only thing the site keeps without asking is your language choice, in your own browser, which never leaves it. Two things wait for your permission, asked the first time you visit: Mona’s Instagram posts shown on recipe pages, which set Instagram’s own cookies; and an anonymous count of how often each page is opened and roughly how long it is read. That count is a number in our own database — no cookie, no identifier, no IP address. Declined, the Instagram post is replaced by a link and nothing is counted. You can change your answer at any time with the “Cookie settings” button below.
If you make an account
An account exists so you can post in the app's feed. It holds your email address, a password you choose (stored only as a cryptographic hash by Google Firebase Authentication, never in readable form), the display name and handle you pick, an optional short bio, and an optional profile picture. Your name, handle and picture are visible to anyone using the app. Your email address is not shown to other people.
What you post
Posts, replies, reactions and dish ratings are public: anyone using the app can see them, along with the name and picture on your profile. Photos you attach are stored in Google Cloud Storage in Paris. Do not post anything you would not want read by strangers.
What stays on your phone
Saved dishes, your shopping list, recipe drafts, how far through a recipe you are, and your app settings are kept on the device. Saved dishes are also copied to your account, so they follow you to a new phone. Nothing else in that list is sent anywhere.
Location and weather
The app's home screen can show your local weather. If you allow it, your approximate location is sent once to Open-Meteo to fetch a forecast. It is not stored, not logged, and not linked to your account. Refusing the prompt hides the weather and changes nothing else.
No tracking, no advertising
Nothing here follows you between apps or websites, nothing is sold or shared with data brokers, and there is no advertising. No profiling and no automated decisions are made about you.
Where it is held
Accounts, profiles and posts are stored in Google Firebase. Photos are held in Paris (europe-west9). The database itself currently runs in the United States, under Google's standard contractual clauses for transfers out of the EU. Firebase is the only processor involved.
Your rights
Under the GDPR you can ask for a copy of your data, correct it, or have it erased. In the app, Account → your profile lets you change your name, handle, picture, email and password; “Download my data” gives you everything held about you as a file; and “Delete my account” removes your account, your posts and their photos immediately and permanently. You can also write to us. If you think your data has been mishandled, you may complain to the CNIL.
How long it is kept
For as long as your account exists. Deleting your account deletes it all. A report you file about someone else's post is kept while it is being dealt with, so that the same post is not reported endlessly.
Getting in touch
Write to hello@monaspice.com with any question about this page or about your data.
Last updated: 2026-08-14