Privacy policy

1. Data controller

TEZDEV SAS, 100 rue des Marquisats, 74000 Annecy, France.
Contact: info@tezdev.com
Last updated: 2026-11

2. Data we collect

Account: email address (if you provide one), name, age, photo (optional), phone number (optional, verified by SMS), language.

Health data (GDPR art. 9): allergies, intolerances, diets (including religious ones), liked and disliked foods.

Child profiles: first name, age and food profile of the children you add.

Usage: contacts, contact requests, events, replies, votes, saved recipes, notifications, device identifier for push notifications.

3. Purposes and legal bases

• Providing the service (account, contacts, events, votes) — performance of contract.
• Adapting recipes and menus to your dietary constraints — explicit consent (art. 9.2.a), collected at sign-up and withdrawable at any time.
• Notifying you (invitations, votes, menus) — performance of contract; you can turn notifications off in your phone settings.
• Security and abuse prevention (rate limiting) — legitimate interest.

4. Who sees your data

• Your people: your name and photo. The details of your food profile only if you turn on "Share my food profile with my people" (off by default).
• The host and guests of a table you attend (or maybe attend): the table's allergies, intolerances and diets, grouped together (e.g. "2 vegetarians", "peanuts"), without your name if you don't share your profile. This is needed to cook safely. At a small table (2 or 3 people), the grouping may let others guess yours. Your likes and dislikes are never shown if you don't share your profile.
• People who only opened a table's link without attending see none of this.
• Someone joins your people when they open your personal link (or QR code), when you join a table they host through its link (and vice versa), or when you accept their request. You can remove or block anyone at any time; a blocked person can no longer use your link.
• Your email and phone number are never shown to other users.

5. Processors

• OVH SAS (OVHcloud): server and database hosting.
• Google (Firebase): authentication, photo storage, push notifications.
• Groq, Inc. (United States): recipe and menu generation. Only anonymised dietary constraints and your choices (style, servings, ingredients) are sent — no name, email or identifier.
• Ingredient search: our own service, hosted on the same server; it only receives the searched text.
• Cloudflare, Inc.: hosting of ingredient images. When an image is displayed, Cloudflare receives your IP address and the name of the ingredient shown (nothing else: no name, email or profile).
• Error tracking: a tool (GlitchTip) hosted on our own server, which records server errors without the content of your requests.

6. Transfers outside the EU

Google (Firebase), Groq, Inc. (recipe and menu generation) and Cloudflare, Inc. (ingredient images) may process some data in the United States. Only anonymised dietary constraints are sent to Groq (no name or email). These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

7. Retention

• Account and profile: as long as the account exists. When you delete your account, all data (child profiles, contacts, organized events, recipes, notifications, photos) is erased immediately.
• Notifications: erased automatically after 6 months (or earlier if you delete them or your account).
• Server technical logs and error reports: 30 days maximum.
• Content reports (recipe, menu, table, person): kept for 1 year maximum. The reported content (for example the recipe text) is kept with the report so it can be reviewed and any abuse handled.
• Database backups: 14 days maximum.

8. Your rights

From Circle › Settings › Account & privacy you can directly:

• export all your data (JSON file) — right of access and portability;
• edit your information — right to rectification;
• withdraw your health-data consent (your food profile is then erased);
• delete your account — right to erasure.

For any other request (objection, restriction): info@tezdev.com. You may also contact the CNIL (www.cnil.fr).

9. Minors and child profiles

You must be at least 15 to create an account. Children can only be added as a "child profile" by a parent. By creating a child profile you confirm that you hold parental authority and consent to the processing of their data (GDPR art. 8). A child's profile details follow their parent's sharing setting.

10. Security

• Authentication via Firebase Auth, short-lived tokens
• Encrypted communications (HTTPS/TLS)
• Third-party service keys kept on our server only
• Rate limiting to prevent abuse

11. Cookies and trackers

The app uses no advertising cookies or analytics trackers.

12. Changes to this policy

If this policy changes significantly, you will be informed in the app. The date of the last update is shown at the top of the document.