Privacy Policy

The controller responsible for processing personal data under Swiss data protection legislation is:

e77code GmbH Sunnedörflistr. 42 3512 Walkringen, Switzerland

Email: [email protected] Website: https://yadlo.app

The Yadlo application only processes data strictly necessary for weekly family meal planning and synchronization between devices:

• Account data: For household admins, the email address or Sign in with Apple identifier, or the Google account identifier and email address if you sign in with Google. Family members who join with an invite code receive an anonymous account without an email address. If you use Sign in with Apple, the name Apple shares on your first sign in.
• Household profile: Member display names, assigned avatar colors and household role (Admin or Member).
• Culinary records: Recipe titles, ingredient lists, tags, ratings, weekly planned meals including who cooks them, and the shared grocery list.
• Photos: Meal and recipe photos you upload.
• Security records: Invite code attempts (account identifier and time), used only to block code guessing.
• Lock Screen meal check in: the Live Activity token of your phone, its time zone and the time of your morning notification, so the question whether you cooked your meals can appear on your Lock Screen at that time.
• Data stored only on your device: Sign in tokens (in the iOS Keychain) and cached household data. Daily meal notifications are scheduled on your device.

Your personal data is processed solely for:

• Providing meal planning, rating and recipe management.
• Synchronizing household plans between family members.
• Delivering reminders for planned meals on your device.
• Protecting accounts and households against misuse, for example by limiting invite code attempts.

We do not use your data for advertising or tracking, and we do not sell it.

Synchronization and storage between devices run on our own servers in Switzerland, operated by e77code GmbH (api.yadlo.app). No hosting provider has access to the data.

Account data, households, recipes, ratings, meal plans and uploaded photos are stored on these servers. All connections are encrypted (TLS/HTTPS). Database access rules (Row Level Security) ensure that household data can only be read and changed by members of that household. Uploaded photos are stored without their metadata, such as the location where they were taken.

To provide dependable infrastructure and secure communication, we use the following technical subprocessors:

• Transactional Email: Resend Inc. (USA; used only for the confirmation email when you sign up, with a confirmation link and a 6 digit code).
• Network & DDoS Protection: Cloudflare Inc. (USA / global network).
• Authentication: Sign in with Apple (Apple Inc., USA/Ireland). When you delete an account created with Sign in with Apple, we also revoke Yadlo's authorization with Apple.
• Authentication: Sign in with Google (Google LLC, USA / Google Ireland Ltd.). Google confirms your account to us when you choose to sign in with it.
• Push notifications: Apple Push Notification service (Apple Inc., USA/Ireland), only to tell a family's admin that someone asked to join, and to show the meal check in on the Lock Screen of the person who cooks.

Where data is transferred to countries without an adequate level of data protection, appropriate safeguards such as Standard Contractual Clauses (SCCs) according to Art. 16 revDSG apply.

Your data is stored only as long as your account and household remain active.

• Delete Account (Settings): Permanently deletes your account, your member profile and your ratings. If you are the only admin, the entire household is deleted as well, including all recipes, plans and member profiles.
• Disband Family (admins): Permanently deletes the household with all recipes, plans and member profiles.
• Leave Family (members): Removes your member profile and your ratings from the household.
• Households in which no member profile belongs to an account anymore are deleted automatically within about a day, with all their data.
• Anonymous accounts of family members that no longer belong to a family, and have no open request to join one, are deleted after one day.
• Photos are deleted together with their household. Photos that are no longer used by any recipe are removed after about one hour.
• Invite code attempts are deleted after 24 hours.
• Requests to join a family are deleted once the admin answers them, or after 7 days.
• The notification token of an admin's phone is deleted when they sign out or delete their account.
• The Lock Screen check in data of a phone (token, time zone, morning time) is deleted when its user signs out, leaves the family or deletes their account.
• Grocery lists are deleted about three weeks after the end of their week.
• Sign in sessions end 60 days after they were last used. Verification codes expire after one hour.
• Backups of the database are kept for about two weeks, so deleted data also disappears from them after about two weeks.
• Data stored on your device is removed when you delete your account, sign out or uninstall the app.

Under the revised Swiss Data Protection Act, you are entitled to:

• Request access to personal data processed concerning you (Art. 25 revDSG).
• Request rectification of inaccurate records (Art. 32 revDSG).
• Request data portability and transfer (Art. 28 revDSG).
• Request complete erasure of your personal records («Right to be forgotten»). You can do this yourself at any time with Delete Account.

To exercise any of these rights, contact us directly at [email protected]. The competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB, Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch).

When you visit yadlo.app, our web servers in Switzerland and our network protection provider Cloudflare Inc. (USA / global network) process your IP address and technical request data (time, page, browser) to deliver the pages and protect them from abuse. These server logs are kept only briefly. The website uses no cookies for tracking and no analytics tools, and its fonts are served from our own website.

• Feedback form: when you send feedback, we store your name, your rating, your message and the language of the page in our database (our own servers in Switzerland), to read it and improve Yadlo. New feedback is also forwarded to our internal team chat (Discord Inc., USA). You can ask us to delete your feedback at any time.
• Bot check: before the form is sent, Cloudflare Turnstile (Cloudflare Inc., USA) checks that a person is using it. For this, Cloudflare receives your IP address and technical browser data.

Where these providers process data outside Switzerland, the safeguards described in section 5 apply.