Privacy policy

This page explains the data Au Menu processes, its purposes, retention and your rights. No account is needed to read it.

Website audience

Umami runs on our VPS and measures page views and traffic sources without tracking cookies or account identifiers. A technical fingerprint based on your network and browser estimates first visits and returns within the same month. It resets at the start of each month; changing network or browser can count as a new visitor. It is never linked to your account. Private links, tokens and search terms are excluded. Do Not Track is respected.

Personal data contact

For questions or requests about your data, write to confidentialite@aume.nu. This address is forwarded to Roch, the initial data contact.

confidentialite@aume.nu

Hosting and providers

The application and its data are hosted on a Contabo VPS in Europe. Contabo provides hosting and Better Auth authenticates adult accounts. Production email uses the Brevo transactional API; development uses Mailpit. A submitted message has been accepted by the provider but is not necessarily delivered. No advertising tracker is activated and no third-party tracking SDK is loaded by default.

Data collected and purposes

Only adults have accounts. Diners can use an optional nickname; portion counts are sufficient without names. Account credentials (email and password) serve authentication and security and concern the account holder. Household names, portions, dietary preferences, recipe plans and cooking tasks serve meal planning and shopping and are visible to household members. Free-text notes and meal feedback support suggestions and remembered habits; personal “Me” notes concern only that person.

Meal photos and avatars are a planned feature; their audience will depend on meal and family-profile visibility. Notification preferences concern the recipient and serve reminders and service information. Technical logs serve security, diagnosis and abuse prevention and are reserved for operations staff. Declared allergies may be health data. Processing requires explicit consent from the person or a child’s legal guardian. Consent can be withdrawn at any time; withdrawal disables related personalisation without silently deleting the restriction. The application does not receive or store audio; device dictation arrives as ordinary text.

Retention periods

Account data is kept while the account exists, then operationally purged within 30 days of deletion, except for a specific documented legal obligation or dispute. Data exports are downloadable for 7 days, then deleted. Ordinary support exchanges: 6 months. Security and moderation incident files: 12 months. Technical logs: 30 days. Suppression lists retain only what is necessary to respect unsubscribes, bounces and complaints. Any extension requires a specific documented legal obligation or dispute; no general purposeless retention is practised.

Version 1 has no backup copy outside the VPS. No maximum data-loss or recovery-time guarantee (RPO/RTO) is announced. Losing the server may mean losing data; this risk is explicitly accepted for initial use.

The completed-meal feed and family profiles are not activated yet. Once activated, profiles will be private or public and each completion explicitly visible or hidden. Hidden completions will not be socially readable. Member avatars will be optional, replaceable and deletable, with initials as fallback. This page will be updated before activation.

Text and AI-derived data

AI assistance is not activated yet. When it is, prompts will send minimum constraints without names or direct identifiers. Raw text, interpreted proposals and confirmed facts will have separate purposes and retention periods. Creating an account does not imply marketing consent.

Usage measurement

When server collection is configured, successful recipe, week and shopping views and effective meal or portion changes feed global counters reserved for authorised superadmins. Account and household references are pseudonymised using a server salt. Events contain no name, family text, allergy, search, free URL, cookie, IP address or user agent. There are no named details or session recordings.

Pseudonymous events are retained for 90 days, global daily aggregates without identifiers for 12 months. Relevant pseudonyms are erased during deletion. Views are browser reports, not proof of cooked meals or satisfaction. Technical preparation does not establish production activation or verified legal compliance.

Recipe choices during a visit

When this server log is activated, proposed public recipes and decisions to choose, skip or keep a menu are retained for future suggestion improvements, including guest visits. A random identifier links steps in one tab, survives reloads and disappears when the tab closes, subject to browser restoration.

The log contains no account or household reference, cookie, IP address, meal-plan date, dietary restriction or personal text. Catalogue choices are recorded without inventing rejected alternatives. Events are kept for 90 days and purged daily; they are not yet used for collective learning. Personalisation preferences follow their usual storage, locally in the browser for guests.

Language choice

Your chosen language is stored for one year in the au-menu-language cookie and, when signed in, in your own account preferences with an update date. It serves interface and catalogue language selection; it is not shared with your household.

Your rights

The account screens for directly exercising these rights are not published yet. Use the email contact below. Access/export: an adult account is required; in-app generation requires an authenticated session and a full export requires password reauthentication within ten minutes. Files are downloadable for 7 days. Email your account address and requested scope. Correction: describe the current information, exact replacement and account address. Deletion: operational purge within 30 days; an adult account and password reauthentication within ten minutes are required for the account workflow. Send an email from your account address.

Unsubscribe from some or all optional emails without mandatory sign-in using each message’s direct unsubscribe link; notification preference screens are not published yet. You may also request assisted unsubscription by email. Objection/report: email to object to processing or report abusive content. Withdraw allergy consent: email to disable related personalisation; the restriction is not silently deleted. Leaving a household revokes access and allows rights to be exercised; other members’ collective shopping and completed meals are not automatically deleted.

We reply to the request address and may ask for proof of account control. Roch will document processing deadlines and exceptions before opening to the first external users.