English translation for information: the French version is the one in force.

Privacy policy

Version of 10 October 2026 — Faitout app, published by Aplomb.

This is an English translation provided for information. The French version is the one in force; if the two differ, the French version prevails. [TO BE COMPLETED: review of this translation by a lawyer before the app is offered in English.]

This policy describes what the app records, where, why, for how long, and what you can do about it. It is written alongside the features it covers: every sentence matches a behaviour of the version you are using.

1. Who is responsible

The data controller is Aplomb, [TO BE COMPLETED: legal form, SIREN number, registered office address], reachable at contact@aplomb-apps.fr. [TO BE COMPLETED: name of the person responsible for data, if different.]

2. What the app records

Everything below is recorded on your device, and nowhere else in this version:

• The household: its name, the day the week starts, the active meals, the energy profiles and time levels for each meal, the number of people eating.
• The members: a first name or nickname, a type (adult, teenager, child), dislikes, absences and, only if you have consented, allergens and diets.
• The generated weekly menus (52 at most), with locks, replacements and portions.
• Your feedback: favourites, ratings, dismissed recipes, replacements. It feeds the on-device learning, which you can view, switch off and reset.
• The recipes you create or import, and the notes you write on them.
• Shopping lists, items added by hand, the pantry (quantities, use-by dates, the origin of each line: typed, barcode, receipt), your shops and the order of their aisles.
• Preferences: theme, language, default sharing channel, rounding to pack sizes, the last email address and phone number entered to send a list.
• The cooking session in progress (step and timers), the recipe time.
• A random device identifier, generated once by the app, derived neither from you nor from the hardware.
• The subscription: its status (none, trial, active, cancelled, expired), the dates of the trial and of the current period, the chosen offer (section 13).

The app asks for no surname, address, date of birth or location. An account exists only if you turn on the shared household (section 6); it is anonymous.

3. Allergens and diets: health data

Allergens and diets are health data within the meaning of Article 9 of the GDPR. The app records them only after your explicit consent, given at welcome and withdrawable at any time in the member's card or in the settings. Without this consent, members are recorded with no allergy or diet, and the engine cannot exclude recipes on those grounds.

This data never leaves the device. When a request goes to the steering assistant (section 5), constraints are sent as anonymous rules ("no peanuts", "no pork") attached to no person.

4. What stays on the device

In this version, the app works without a server: generating weeks, recipes, lists, lunchboxes, shop mode, cooking mode, export and import all work offline. Data is stored in the app's private space on your device. [TO BE COMPLETED: on phones, encryption at rest by the system and by the local database; to be confirmed with the first mobile version.]

Sending a list by email or text message goes through your device's own apps (mail, messages): the app prepares the message, you send it. No sending gateway is used.

In cooking mode, the app can read the steps aloud (your device's speech synthesis) and listen for a command ("next", "timer 10 minutes") when you tap the microphone. The microphone only opens after that tap, for one phrase, and closes by itself; the microphone permission is asked the first time. Recognition happens on the device, offline: the sound is neither recorded nor sent to our servers, nor to Apple's or Google's. A device that cannot recognise speech offline does not open the microphone: the command is typed instead. Voice commands are not offered in the web version.

5. What goes through our servers: the AI assistant

Three functions, and only three, send data off the device, at your explicit request:

• Steering a week in one sentence ("soups in the evening", "no red meat").
• Importing a recipe from a text, a web address or a photo.
• Reading a photographed till receipt to fill the pantry (the photo is sent, the product lines come back; do not photograph a receipt that shows your name or bank details).

What is sent: the sentence or text you entered, the web address or image of the recipe, the list of ingredients known to the app (a fixed vocabulary, with nothing personal), and the random device identifier. What is never sent: first names, the make-up of the household, allergens and diets as such, your weeks, your lists.

The route: the app calls a function hosted by Supabase in the European Union (Frankfurt region), which passes the request to Anthropic's application programming interface (Claude model) and returns the structured answer to you. Anthropic is established in the United States; the transfer is covered by [TO BE COMPLETED: transfer mechanism chosen — standard contractual clauses in Anthropic's data processing agreement, or certification under the EU-US framework; to be checked by a lawyer]. Under Anthropic's terms for its application programming interface, the data sent is not used to train its models. [TO BE COMPLETED: retention period at Anthropic under the agreement in force.]

What our servers keep:

• A daily counter per device identifier (number of requests that day, limit of 20), deleted [TO BE COMPLETED: purge period for quota rows, recommended 7 days].
• A cache of answers, indexed by a fingerprint of the normalised text: the same request does not go to Anthropic again. The cache contains no device identifier and no member data; [TO BE COMPLETED: cache retention period, recommended 90 days].

These tables cannot be reached from the app or from outside: only the function reads and writes them.

You can choose never to use the assistant: steering with presets and the local analysis of a pasted recipe work without it, and the "simulated AI" mode in the Developer panel stops anything being sent.

5a. Barcodes: Open Food Facts

When you scan or type a barcode in the pantry, the app queries Open Food Facts, an open, collaborative database (a French non-profit association, ODbL licence). The request contains the barcode and, like any request on the internet, your device's IP address; nothing else, no account, no identifier. Open Food Facts is not told what you do with it. You can choose never to scan: searching by name does the same without a network.

5b. Retailers' click-and-collect sites: your browser, not our servers

If you link a shop to its retailer's click-and-collect site, the app can open that retailer's website in your browser: on its search page with the item's name, or on its home page, with the list then copied to your clipboard. It is your browser that visits the site, with its own cookies and its own policy; the app sends nothing to the retailer and receives nothing from it. The item's name in the address is the only information that leaves, and you can see it.

6. The shared household: an anonymous account, synchronised documents

If you choose "Share this household" or "Join with a code", the app creates an anonymous account on our servers (Supabase, European Union): an identifier, with no email and no password. The household's documents are then copied to this server and synchronised between the member devices: household settings, members (with allergens and diets if you have consented: this is precisely what the other device needs to know to exclude the same recipes), weekly menus, shopping lists, pantry, shops, personal recipes, presets and permanent steering. What stays on each device: preferences, learning feedback, the cooking session.

Each document carries a version; a deletion is a marker replayed before any merge; when two devices change the same thing, the last write wins and the other value is kept in a history readable on the device. Each member has a role, editor or reader, and a device label chosen by the person. The eight-character invitation code gives access to the household: only share it with the people in the household.

You leave the household in one gesture: your device keeps its data and stops sharing; if nobody is left, the household and its documents are deleted from the server. "Delete my account" deletes on the server side, in one gesture, your membership, the household if it becomes empty, and the account itself. Data is encrypted in transit (TLS) and at rest by the host; row-level security rules mean an account can only read the documents of its own household.

7. What the app does not do

• Advertising, free version only, and only if you accept it: a single banner, in the Recipes tab. The app asks you once, in that spot; without an answer or after a refusal, it shows no advertising at all, and you can change your choice in the settings. Never in the week, the shopping list, the kitchen or the shop, never full-screen; none during the trial or with Premium, none during the first three launches. The planned ad network is Google AdMob; until it is connected, the ad slots are empty frames marked "simulated". Once it is: non-personalised advertising by default in the European Union, consent requested before any personalised advertising (Google's consent platform, revocable in the settings), and Google's policy will apply to that data. [TO BE COMPLETED: AdMob identifiers, link to Google's policy, go-live date.]
• No audience measurement, no tracker, no crash-reporting kit in this version. [TO BE COMPLETED: if a crash-reporting or measurement tool is added, name it here and make it subject to consent.]
• No sale or transfer of data to third parties.
• No geolocation, no access to contacts, no reading of your messages.
• No profiling for commercial purposes: the on-device learning is used to suggest meals, stays on the device, and can be viewed and reset.

8. Legal basis and purposes

9. Retention periods

• On the device: as long as you keep the app and the data; 52 weekly menus at most, the oldest being deleted automatically.
• On our servers: the assistant's daily counter and cache, for the periods in section 5; the shared household's documents as long as the household has at least one member; the anonymous account until it is deleted. Nothing else.

10. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. In this version, you exercise them directly in the app, without writing to us:

• Access and portability: Settings › My data › Export my data. A single JSON file, readable, complete, which can be imported again.
• Rectification: every card can be edited in place.
• Erasure: Settings › My data › Erase everything erases everything from the device, in one gesture; Household › Delete my account erases everything on the server side, in one gesture. The counter and cache rows on the server side contain nothing that could identify you; they are purged automatically.
• Withdrawal of consent: in a member's card or at welcome; allergens and diets are then erased.
• Restriction and objection: learning can be switched off in Settings › Learning; the AI assistant can be turned off in the Developer panel.

For any request, write to contact@aplomb-apps.fr. You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

11. Minors

The app is intended for the person who organises a household's meals. Child members are described by a first name, a type and food preferences, entered by the responsible adult. The app is not addressed directly to children and does not create accounts in their name.

12. Security

Exchanges with our servers are encrypted in transit (TLS). The server functions expose no table: access goes through a publishable key and row-level security rules closed by default. The device's data is in the app's private space. [TO BE COMPLETED: encryption-at-rest measures per platform, to be documented with the first mobile version.]

13. Subscription

The app offers a free fourteen-day trial and a Premium subscription, described in the terms of sale. In this version, the trial and the subscription are recorded on your device only (section 2): no app store is connected, no payment is possible, no payment data exists.

When the subscription goes through the app stores (Apple's App Store, Google Play), payment, invoicing and cancellation will be handled by them, under their own terms; Aplomb will neither receive nor keep any payment data. The subscription management provider, which receives an anonymous subscriber identifier and the transaction receipts, will be named here before it goes live. [TO BE COMPLETED: chosen provider (RevenueCat planned), location, data processing agreement.]

14. Changes

This policy carries a version date; the version in force is the one shown in the app. Any change of processing is described here before it goes live.