Privacy Policy

1. Data controller

Piano Piatto, Switzerland, contact@pianopiatto.com.
Version of 1 November 2026. Policy compliant with the Swiss FADP and the EU GDPR.

2. Data we collect

Magic wand (Premium): what you choose (meal, time, portions, meal prep), the wish you write, the fridge and cupboard items you leave ticked with “With what I have”, and, so that the recipe respects them, your allergens, disliked foods and diet. We keep the number of creations, the names of the dishes suggested and their cost, to apply the monthly quota. For a photo: the name and ingredients of the saved recipe; we keep the number of photos, the recipe concerned and their cost. With “My version”: what you want to change; we keep on your version the link to the recipe it starts from.
Account: email, password (hashed), language, country. If you sign in with Google: your Google account ID, its name and its photo. If its address is that of an existing account, the two are linked; if that address had never been confirmed, the old password, passkeys and open sessions are removed, for your safety.
Public profile (optional): username, bio, profile photo.
Personalisation: dietary preferences, allergens (health data, with your explicit consent), disliked foods, household size and each person's appetite (age range, no names), budget, calorie target and your own appetite (to count your calories for your share).
Adapted recipes: the ingredients you left out or swapped, to show your dishes and build your shopping list.
Content: personal recipes and photos, published recipes, reviews (rating, tags, text, photo of the dish, author's reply), “Helpful” marks given to other people's reviews, likes given before 27 September 2026, meals marked "cooked", pantry (and when you confirmed having each item, so that dishes using them are suggested first), meal plans and shopping list. Food recognised in photos of your kitchen (Premium) only goes in if you put it away; the photo isn't kept.
Automatically: session tokens (hashed server-side), subscription status, usage events (e.g. "week generated", platform, app version) and crash reports, to improve the app.
Payments made in the App Store or Google Play: date, plan, amount and currency, any refund, and the transaction identifier, sent to us by RevenueCat with each purchase, renewal or refund. To show you what you have paid in “Subscription and payments”, answer your questions about a charge, and keep our accounts.
Last-visit date, to measure account activity and decide who to offer a deal to.
Log of sign-ins, visits and actions (date, time and duration, sign-in method, device type and app version; what you do in the app, such as a screen opened, a dish cooked, an item ticked or a recipe added to favourites, identified by IDs and never by text you typed; the emails we send you, by type and date, never their content; never your IP address), to help you if you can no longer sign in or something does not work, and to measure account activity. Kept for 12 months.
The link you arrived through, if it carries one (for example “Instagram, bio, campaign frigo”), recorded once at sign-up, so we know which posts bring us new users. No cookie or tracker: only these codes, read from the link's address.
Server technical log (error and operation messages, which may mention your account identifier; email addresses masked, never your IP address), to diagnose and fix outages. Kept for 30 days.
Baby at the table: only their month and year of birth, with no first name, exact date or photo, to work out their age in months and show you the guidance and recipes for that age. Your baby food sessions (day, chosen recipes, pots taken out of the freezer), for reminders and the shopping list.
The day before shopping: your shopping day (chosen in your Profile, or worked out from the days you tick your list) and your device's time zone, to prepare your next week the day before, at your local time. For each prepared week, we keep its days, its date, whether you were notified and whether you confirmed or changed it.

3. Data we do NOT collect

No geolocation, no phone contacts, no biometric data.
No advertising identifiers, no ad tracking, no cookies.
No card data: it is entered at the payment provider (Stripe, Apple or Google) and never reaches us.

4. What others can see

If you use the community: your username, photo, bio, published recipes and public counters.
Your reviews (rating, tags, text, and the label “Tasted it” when you did not cook it), with your username, to anyone who can see the recipe. Your friends (people you follow who follow you back) can see that you cooked a published recipe; others only see the count. When you find a review helpful, nobody sees it was you: its author and everyone else only see how many people did. A photo of your dish follows the same rule, and your friends also see it in their “Activity” feed when you post it.
When you publish a recipe, or make it visible to your friends, the people who follow you are told in their “Activity” feed (for a friends-only recipe, only your friends).
Your meal week, depending on your "Who sees my week" setting: no one, your friends (people you follow who follow you back) or everyone. Accounts created since 26 September 2026 start on "My friends"; you can change it anytime in your Profile. It shows the dishes day by day, never the quantities, how many people eat, or the names of your private recipes.
Your email address is never public. In a household, it is visible only to household members.
In a household, members see the household's adapted recipes, and that an ingredient was left out of a shared dish because a member dislikes it, without knowing who.
Inviting someone by email means processing their address solely to send the invitation (single-use codes, expiring after 7 days).
A recipe you send by link (from the catalogue, published, or one of your own) opens for anyone who has the link, even without an account, with your username. An unpublished personal recipe thus becomes readable by whoever receives the link, without appearing anywhere else. We keep the link, the number of times it was opened and, for an account created from it within two days, the fact that it came through it. Nothing is kept about a person who opens it without an account.
The “Activity” feed tells you what others did that concerns you: a household member joining, changing a meal, planning the days or finishing the shopping; a friend planning their week or cooking your recipe; someone following you, reviewing your recipe or replying to your review; your recipe link being opened, without ever saying by whom. It only shows what you could already see elsewhere in the app, and nothing more about you appears for others beyond those same actions. Each update is kept for 90 days. When someone finds your review helpful, the feed tells you, without ever saying who. A friend who posts a photo of a dish they cooked shows up there too, with the photo. Someone you follow who publishes a recipe shows up there too (a friends-only recipe, only if you are one of their friends).
Babies at the table and baby food sessions are visible only to the members of your household. They are never published.

5. Processors and transfers

Apple / Google: subscription payment processing (USA).
RevenueCat: subscription management: user identifier, subscription status and details of payments made in the store (USA).
Resend: sending our emails (Ireland, EU).
Stripe: card payment on the web (EU / USA).
Cloudflare: routing emails received at contact@pianopiatto.com (EU / USA).
Hetzner: hosting of the servers and the database (Germany, EU).
OpenAI: writing and translating magic wand recipes, only when you use it. Receives your request (including the ticked items from your pantry), your allergens, disliked foods and diet, and the recipe text to translate, and, for “My version”, the text of the recipe you start from (title, ingredients, steps; another member's recipe is sent without their username); never your name, email or account identifier. OpenAI does not train its models on this data (USA). For a photo, it only receives the name and ingredients of your saved recipe. May also receive the photo of a dish you post with a review, on its own (without your username), to check that it shows a dish, with no face and nothing offensive; a rejected photo is not kept. Also receives the photos of your fridge, freezer or cupboards that you take to fill your pantry (Premium), on their own, to recognise the food in them; they aren't kept. Photograph the shelves, with no people or documents in the frame.
Anthropic: checks that a photo created by the magic wand really shows the dish. Receives the created photo and the recipe's name and ingredients; never your name, email or account identifier. Anthropic does not train its models on this data (USA). May also receive the photo of a dish you post with a review, on its own (without your username), to check that it shows a dish, with no face and nothing offensive; a rejected photo is not kept.
Google: sign-in with Google, only if you choose it. The button takes you to Google's sign-in page, which then sends you back to Piano Piatto; nothing from Google is loaded in the app. Google sends us your Google account's ID, email, name and photo (USA).
Browser notification services (Apple, Google or Mozilla, depending on your browser): deliver web notifications to your device, only if you turned them on. They receive your device's address with them and a notification encrypted for it, whose content they cannot read (USA / EU).
Sentry (if enabled): technical crash reports (USA/EU). Hosting: Switzerland/EU.
Transfers outside the EU/Switzerland are covered by Standard Contractual Clauses and the Data Privacy Framework. Your data is never sold.

6. Retention and deletion

Recipe links you sent (who shared, number of opens, accounts that came through the link): as long as your account and the recipe exist.
Magic wand creations (number, dishes suggested, cost): 13 months. Saved recipes follow the rule for your personal recipes. Magic wand photos (number, recipe, cost): 13 months as well. Kitchen photos read by AI (number of items, cost): 13 months; the photo itself is never kept.
“Activity” feed: 90 days, then deleted automatically.
Replaced meal week (regenerated, redone or deleted), kept so you can go back to it: 7 days, then deleted automatically.
Web notifications: the device receiving them is forgotten as soon as you turn them off, sign out or withdraw permission, and at the latest after 60 days without opening the app; a sent notification is deleted 7 days later.
Your data is kept as long as your account exists; inactive accounts are deleted after 24 months (with 30 days notice).
Your reviews stay published until you remove them, or until your account or the recipe is deleted. A “Helpful” mark disappears when you remove it, or with the review. A photo of your dish stays posted until you remove it, or goes with the review; its location and device data are removed as soon as it is sent.
Account deletion from the settings: immediate erasure, full technical purge within 30 days at most.
Usage events are anonymised (detached from the account) after deletion.
Payments made in the App Store or Google Play: as long as your account exists. When it is deleted, the link to your account is erased: only the amount, currency and date remain, anonymously, for our accounts.
Session tokens: 30 days maximum, revoked on logout. Security logs, log of sign-ins, visits and actions: 12 months. Server technical log: 30 days.
Deleted data may briefly remain in backups, purged through a short rotation (within the 30-day limit).
Babies at the table and baby food sessions: as long as your account exists; erased as soon as you remove them, and sessions together with the week they belong to.
Record of weeks prepared the day before shopping: 13 months, then deleted automatically; the meals themselves follow the rule of your plan.

7. Security

Passwords hashed (bcrypt, factor 12), never readable.
Short-lived access tokens; rotating refresh tokens, stored hashed and revoked upon suspicious reuse.
On mobile, tokens live in the system secure keychain (Keychain / Keystore); in a browser, where no such keychain exists, they are kept in the site's local storage. The local cache is isolated per account.
HTTPS/TLS in production, photos validated and re-encoded server-side, database not publicly exposed, brute-force protection.

8. Your rights

Access, rectification, deletion, portability (JSON), objection, restriction and consent withdrawal (e.g. allergens). Answer within 30 days.
Offer emails: we occasionally write to you about our own offers (extended trial, reduced price). Every message carries a one-click unsubscribe link, and the "Offers and news" switch in your profile does the same. Unsubscribing never stops service emails (password, security, support). No address is ever sold or shared with a third party for advertising.
Exercise them from the app settings or by email: contact@pianopiatto.com.
You may lodge a complaint with the FDPIC (Switzerland), the CNIL (France) or your local authority (EU).
On top of that comes a single email in the whole life of the account: on the first evening before shopping after you sign up, showing your prepared week, only if you haven't come back to the app and haven't turned on any notifications. It carries the same unsubscribe link.

9. Notifications and minors

Notifications: in the mobile apps, they are local, scheduled on your device, and nothing is sent to our servers. On the web, a browser cannot schedule them: if you turn them on (never without your consent), we keep the address your browser gives us for this device and the upcoming reminders, already written (for example “Take it out of the freezer: Chicken, Roast chicken, Saturday”), which our server sends at the planned time, as well as updates from the “Activity” feed (household and recipes by default, friends only if you switch them on). Each type can be turned off in Profile, Notifications; “Stop receiving them here”, signing out or your browser settings stop everything on this device. New recipes from people you follow are sent by default, at most one per person and two a day in total; a switch turns them off.
App open from age 13 (parental consent required under 16). Accounts of children under 13 are deleted.
Significant changes to this policy are notified in the app at least 15 days in advance.
A baby added in "Who's eating?" has no account: only their month of birth is kept, which does not make it possible to identify them. It is never published or passed on to a third party, and can be removed at any time.
The day before shopping, around 6 pm your time, our server prepares your next week if it is empty and tells you with a notification, on your phone as in the browser where you turned them on. You can turn it off in Profile, "Prepare my week the day before".