Privacy Policy
App: Ollou — recettes, réserve, planning et courses
Data controller: Sole proprietorship (auto-entreprise) [name, SIRET and address — to be completed upon registration]
Privacy contact: [email address — to be completed]
Last updated: [date — to be completed before publication]
French version: ../politique-confidentialite.md
1. Introduction
This policy explains what data we process, why, how long, with whom we share it, and your rights under Regulation (EU) 2016/679 (GDPR) and applicable law.
The App is a personal augmented recipe notebook. It is not a social network: your recipes are not published on a public profile and there is no news feed or follow feature.
2. Data processed — overview
| Category | Examples | Main purpose |
|---|---|---|
| Account | Email, user ID, creation dates | Authentication, support, store-linked billing |
| Recipes | Titles, ingredients, steps, tags, URLs, favorites, “to try / to cook” flags | Notebook, planning, shopping, cooking mode |
| Recipe overlays | Customizations on catalogue recipes (user_recipes) | Personalized display without changing the shared catalogue |
| Pantry | Adopted products, “have / don’t have” stock, renames (user_products) | Inventory, “Makeable” filter, shopping |
| Planning | Meals by date and slot (recipe, product, or note) | Meal organization |
| Shopping | Checked / unchecked lines, free text | Dynamic shopping list |
| Preferences | Aisle order, chrome tints, filter skins | UI personalization |
| Import | Queued URLs (import_inbox_urls), drafts in progress | Multi-device import resume |
| Technical data | Limited server logs, session identifiers | Security, diagnostics, sync |
We do not collect a public profile, friend lists, or continuous GPS location.
3. Detail by feature
3.1 Account and authentication
- Data: email, password (hashed by Supabase Auth), UUID, timestamps.
- Legal basis: contract performance (Terms of Use) and, where applicable, legitimate interest (security).
- Hosting: Supabase (PostgreSQL + Auth), see § 6.
3.2 Recipes and notebook
- Data: content of recipes you create, import, or customize; metadata (times, servings, categories); optional source URL or external image URL.
- Recipe images: the App stores a URL pointing to an external resource in the database. In the current version, it does not host the image file on its servers: the device loads the image from the third-party site. You are responsible for the URL choice and associated rights.
- Shared catalogue: some recipes and products are marked public (
is_public) and form the editorial catalogue. These entries are readable via the Supabase API without a user account (public key embedded in the app): any client with that key can read the public catalogue. Private data (personal recipes, pantry, planning, etc.) remains protected by authentication and RLS.
3.3 Pantry and barcode scan
- Data: product IDs, stock state, customizations (name, category, icon).
- Scan: the camera is used locally to read a barcode. We query Open Food Facts for public product information. No scan photo is sent to Open Food Facts — only a query by code.
- Unknown scanned products: depending on your plan, an unknown code may create an entry in the shared catalogue (no direct personal data, but a catalogue contribution).
3.4 Planning and shopping
- Data: dates, meal types, linked recipes or products, free notes; shopping lines and checked state.
- Purpose: automatic shopping list generation from planning and pantry.
3.5 URL import
- Data sent: the URL you submit is processed by a Supabase Edge Function, which fetches the page (within size and time limits) and sends an text extract to an AI model (Google Gemini Flash and/or Groq) to produce a structured draft.
- Validation: the draft is saved only after your validation in the App.
- Retention: queued URLs synced in your profile if you use the multi-device inbox.
3.6 Photo import and OCR
Two distinct steps, important for transparency:
1. Local OCR (on device): the photo is processed by Google ML Kit on Android/iOS only. Recognized text is extracted locally. The photo itself is not uploaded to our servers at this step.
- ML Kit telemetry: native Google ML Kit SDKs (Android/iOS) may collect technical usage data under Google's ML Kit Terms of Service. No photo is sent to Google for OCR; telemetry covers SDK usage, not your recipe content.
2. AI structuring (server): OCR text (not the image) is sent to the same Supabase Edge Function, then to Gemini and/or Groq, to obtain a recipe draft. You validate before saving.
On Web, photo import / OCR is not available.
3.7 Cooking mode and voice commands
- Text-to-speech (TTS) and speech recognition (STT): processing locally on the device via system APIs (
speech_to_text, TTS engine). Voice commands navigate steps (e.g. “next”, “repeat”). - Microphone: access requested only in cooking mode when you enable listening. No audio recording is stored on our servers; processing stays on the device via the OS engine.
- Free cap: step-by-step cooking mode may be limited to a number of recipes depending on your plan (see Terms of Sale).
3.8 Camera (other than scan)
- Used to take or pick a photo for OCR import, or for barcode scan in pantry.
- Permissions requested on demand; refusal disables the feature, rest of app remains usable.
4. Data we do not sell
We do not sell your personal data. We do not run third-party behavioral advertising in the App at this draft date.
5. Legal basis (GDPR)
| Processing | Legal basis |
|---|---|
| Account, sync, recipes, pantry, planning, shopping | Contract — service delivery |
| AI import (URL, OCR text) | Contract + consent implicit through import action (to be formalized in UI before prod — legal validation required) |
| Camera, microphone | Consent via OS permissions |
| Security, technical logs | Legitimate interest |
| Legal obligations | Legal obligation |
6. Processors and recipients
| Provider | Role | Location / transfer |
|---|---|---|
| Supabase Inc. | PostgreSQL, Auth, Edge Functions hosting | USA / EU per project — DPA and SCCs to be verified |
| Google (Gemini API) | AI structuring of imports | USA — transfer under Google contract |
| Groq | AI structuring (fallback) | USA — same |
| Google ML Kit | Local OCR on device | Local image processing; SDK usage telemetry possible (Google ML Kit ToS) |
| Open Food Facts | Product info by barcode | Open data project — HTTP query by code |
| Apple / Google | App distribution and future IAP | Per their respective policies |
No Stripe for mobile subscription at this draft date.
List not exhaustive — update before production if OAuth, analytics, crash reporting, etc. are added.
7. Retention periods
| Data | Indicative period |
|---|---|
| Account and user content | While account is active |
| After account deletion | Immediate for the Auth account and user-scoped data (CASCADE). Public catalogue products already created by scan are anonymized (created_by → NULL). Infrastructure logs: host retention, outside the app deadline. |
| Server logs | [period — to be completed, e.g. 90 days] |
| Unvalidated import drafts | Until abandoned or validated; inbox clearable by user |
8. Security
Measures include in particular:
- password authentication and secure sessions;
- PostgreSQL Row Level Security (RLS): each user accesses only their rows (
user_id); - encryption in transit (HTTPS/TLS);
- no plaintext password storage by the publisher.
No measure provides absolute security; report suspicion to [security email — to be completed].
9. Your rights
Subject to legal exceptions, you have rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where processing relies on it.
How to exercise your rights: [email address — to be completed], with ID copy if necessary.
Complaint: you may lodge a complaint with the CNIL (France) or your local supervisory authority.
10. Minors
The App is not intended for children under 13 without adult supervision. We do not knowingly collect children’s data without verifiable parental consent. Contact us for deletion requests.
11. Transfers outside the European Union
Some processors (Supabase, Google, Groq) may process data outside the EU. Transfers must be covered by standard contractual clauses or adequate protection — to be documented with legal counsel.
12. Artificial intelligence — specific information
- Purpose: assistance structuring recipes (not advertising profiling).
- Inputs: URL, extracted web text, or OCR text (not raw photo).
- Output: JSON draft shown for mandatory human validation.
- Errors: models may be wrong; verify allergens, quantities, and cooking times.
- Training: at this draft date, API contracts used must not train public models — verify Google/Groq DPAs before prod.
13. Changes to this policy
We may update this policy. The date at the top will be revised. For major changes, in-app or email notice may be sent.
14. Contact
Data controller: Sole proprietorship (auto-entreprise) [name, SIRET and address — to be completed upon registration]
Email: [email address — to be completed]
Postal address: [address — to be completed upon registration]
Launch draft — F6 card, T137 task. Covers: email, recipes, pantry, scan, camera, cooking voice/mic, Gemini/Groq AI import, Supabase, external image URLs only, OCR text sent to AI.