Privacy policy

Version for the closed test · Last updated: 9 November 2026

This page sets out what personal data the Ondello app and this website process, why, who helps us process it and what rights you have. It is the version for the closed test. A lawyer will review it before the app is released to the public.

1. Who is responsible for your data

The controller of your personal data is Patryk Baran, who develops Ondello, a natural person in Poland.

• For data protection, your rights and account deletion, write to privacy@ondello.app.
• For anything else, write to support@ondello.app.

2. In short

• We process what the app needs to plan meals for your household: your e-mail address, your household’s data and the recipes you add. With your explicit consent, we also process calorie targets and what your household plans and eats.
• Only your household’s members see your household’s data.
• We show no ads, use no analytics or tracking, and never sell data.
• This website sets no cookies and runs no scripts.

3. What we process and why

Your account

We keep your e-mail address, which you sign in with by a one-time code, and your account’s language, so that our e-mails reach you in the app’s language. Our server also records the time and IP address of each sign-in and request in its logs.

We need this to create and run your account, sign you in and keep the service secure. Legal basis: the agreement between us (Art. 6(1)(b) GDPR). For the logs: our legitimate interest in keeping the service secure and preventing abuse (Art. 6(1)(f) GDPR).

Your household

The household’s name and currency, its members’ names and roles (including members without an account, such as a child), invitation codes, meal plans, shopping lists and the prices you enter.

This is what the app is for. Legal basis: Art. 6(1)(b) GDPR.

Diet data

Calorie and macronutrient targets, each person’s portion in the plan, and the meals and snacks marked as eaten, with their calories and macronutrients. This data may count as health data. So we process it only with your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), described in section 4.

Recipes and imports

The recipes you type in or import. To import a recipe, you give us a link to a web page, a link to a post or video, an export file from another recipe app, or photos of cookbook pages. Our server fetches a linked page itself, and an AI model reads the recipe from it (section 5). We keep each import’s status, outcome and cost with your household’s data.

We need this to keep your household’s recipes and plan meals from them. Legal basis: Art. 6(1)(b) GDPR.

Photos

Recipe photos you take or choose, and photos kept from a recipe’s source. Before a photo is uploaded, the app re-encodes it on your phone. This removes its metadata, such as where it was taken. We delete photos of pages taken for an import from our server once the import is saved or discarded. If no import uses them, they are deleted after an hour. When you scan a barcode, your phone reads the camera image and never sends it to us.

Legal basis: Art. 6(1)(b) GDPR.

Feedback you send

“Send feedback” in the app opens an e-mail to support@ondello.app in your own mail app. We receive your e-mail address, what you write, and technical details that you see before sending: the app’s version, build and platform, the types of the app’s last errors with the places in its code where they happened, and the tables of any rows that synchronisation skipped. The technical details contain no error messages and none of your data.

The app has no crash reporter. It keeps those last errors on your phone and sends them only inside a feedback e-mail you send. Feedback you send through Google Play reaches us from Google.

We need this to answer you and improve the app. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Requests about your data

Your e-mails about your rights or about deleting your account, and our replies. Legal basis: our legal obligations under the GDPR (Art. 6(1)(c) GDPR), and our legitimate interest in being able to show that a request was handled (Art. 6(1)(f) GDPR).

This website

This website sets no cookies, runs no scripts and uses no analytics. As with any website, its host receives your IP address, your browser’s details and the page you ask for (section 5). Legal basis: our legitimate interest in showing you the site (Art. 6(1)(f) GDPR).

What is required, and automated decisions

You need an e-mail address to have an account. Diet data is voluntary, but without it the app cannot size each person’s portion. The app makes no automated decisions with legal or similarly significant effects on you. You can change the portions it suggests.

4. Diet data and your consent

Before a household holds diet data, the app asks each person with an account for consent. You give it by ticking a box that is never ticked in advance. The box is on the form that creates or joins a household. For an account created earlier, the app asks once, when it starts. The wording, version 1:

I agree that Ondello keeps calorie targets and what we plan and eat, to size our portions. Only our household sees it. I can withdraw this from the Home tab’s menu.

We record which version you agreed to, the language it was shown in and the time.

You can withdraw your consent at any time: Home tab → ⋮ menu → “Request account deletion”. The app cannot plan portions without this data, so withdrawing is a request to delete your account (account deletion). Processing before you withdraw stays lawful.

If you enter details for someone without an account, such as a child, you do so as their parent or guardian, or with their agreement.

5. Who processes data for us

These companies process data on our behalf, each only for its own task. Section 6 covers transfers outside the European Economic Area.

Supabase: our server

Supabase Pte. Ltd., of Singapore, runs the app’s database, sign-in, file storage and server functions. It receives everything the app stores (sections 3 and 4), and its logs record the IP address and device details of each request. The database, sign-in data and files are kept in Stockholm, Sweden.

Anthropic: reading recipes for imports

The AI model of Anthropic Ireland, Limited, of Dublin, Ireland, reads the recipe from what you import. Anthropic receives the text of the imported page or file, a post’s caption or a video’s transcript, or the photos of the pages, and the app’s language. It never receives your e-mail address, your household’s data or anything else that identifies you, and it does not train its models on what it receives. The data goes to Anthropic’s servers in the United States, and the model may run in other countries too.

Zoho: e-mail

Zoho Corporation B.V., of the Netherlands, runs our e-mail. Zoho Mail holds our mailboxes, support@ondello.app and privacy@ondello.app among them, and receives the e-mails you send us and our replies. Zoho CPaaS sends the app’s sign-in e-mails from no-reply@mail.ondello.app. It receives your e-mail address, the sign-in code and the e-mail’s language, and does not track whether you open the e-mail. Our account is in Zoho’s EU data centre, in Amsterdam and Dublin.

Netlify: this website

Netlify, Inc., of the United States, hosts ondello.app. Its logs record your IP address, your browser’s details and the page you ask for.

Brevo: sign-in e-mails until 8 November 2026

Brevo (Sendinblue SAS, of Paris, France) sent the app’s sign-in e-mails until 8 November 2026, when Zoho CPaaS took over. Its account is being closed. Until then, Brevo holds the e-mail addresses it sent sign-in e-mails to and its log of those e-mails. It keeps data in the EU.

Others who receive data

The following are not our processors. Each receives only what is described here.

Google Play

Google installs and updates the app, runs the closed test and passes on to us feedback you send through Google Play. Google does this as a separate controller, under its own privacy policy. For users in the European Economic Area, that is Google Ireland Limited. From phones that share usage and diagnostics data with Google, Google Play gives us reports of the app’s crashes and freezes (Android vitals).

Google Play’s automatic protection

Google Play adds a check to the app which, when the app runs, confirms that it was installed from Google Play. Now and then the check needs an internet connection. Google does not say whether it runs this check on our behalf or as a separate controller.

Google ML Kit, the barcode scanner on Android

ML Kit reads the camera image on the phone, so images and barcodes are not sent to Google. It does send Google diagnostics: the phone’s manufacturer, model and system version, the app’s name and version, figures on the scanner’s performance and settings, and identifiers per installation that are not meant to identify a person or a device. Google uses them to measure and improve ML Kit and to detect misuse, and does not pass them on. On the iPhone, the scanner uses Apple’s Vision, which runs on the phone and sends nothing.

Open Food Facts

When you scan a product the app does not know, our server asks Open Food Facts, a French non-profit food database, about its barcode. It sends only the barcode and our contact address, and no information about you.

ScrapeCreators

Web Scraping Guy LLC, of Texas, United States, fetches the caption and, if needed, the transcript of a public post or video that you import by its link. Our server sends it only the post’s link, and no information about you.

Recipe sites

When the app shows a recipe’s photo straight from the site the recipe was imported from, your phone loads it from that site. The site then sees your phone’s IP address and the app’s details, as with any web page. A photo kept as the recipe’s photo comes from our server instead. Pages imported by link are fetched by our server, not by your phone.

Cloudflare

If our server cannot look up a linked site’s address itself, it asks Cloudflare’s DNS service. Cloudflare sees only the site’s name.

Hostido

Hostido, a Polish company, registers the domain ondello.app and answers DNS queries about it. It receives none of your data.

6. Transfers outside the European Economic Area

Some of the companies in section 5 process data outside the European Economic Area (EEA), or let staff outside it reach data. The safeguards below are the ones their own terms name:

• Supabase is based in Singapore. The database, sign-in data and files stay in Sweden, and its logs are stored in EU data centres. But Supabase also processes logs and service data outside that region, and its support and operations staff include Supabase, Inc. in the United States. Files may be delivered through a worldwide network of servers, and most of Supabase’s subprocessors are in the United States. Safeguard: the European Commission’s standard contractual clauses, in Supabase’s data processing addendum.
• Anthropic processes data on its servers in the United States, and its model may run in other countries. Safeguard: the standard contractual clauses, in Anthropic’s data processing addendum.
• Netlify is in the United States. Safeguard: the EU-US Data Privacy Framework, under which Netlify is certified, and the standard contractual clauses if the Framework stops applying.
• Zoho keeps our data in its EU data centre. Its support staff in India may reach it for technical support. Safeguard: the standard contractual clauses.
• Brevo keeps data in the EU. Safeguard for its own subprocessors outside the EEA: the standard contractual clauses or the EU-US Data Privacy Framework.
• Google transfers data from the EEA to the United States under the EU-US Data Privacy Framework and the standard contractual clauses. ML Kit’s diagnostics go to Google LLC in the United States.

7. How long we keep data

• Your account, your household’s data, diet data, recipes and photos: as long as the account exists. After you ask us to delete your account, we delete them within 30 days (account deletion).
• When you delete something in the app, we mark it as deleted and keep it with your household’s data until the household is deleted. That way the household’s other phones learn about the deletion. A photo that no recipe uses any more is removed from the server.
• Photos of pages for an import: until the import is saved or discarded, or an hour if no import uses them.
• Sign-in codes: 15 minutes. Invitation codes: 48 hours.
• Our server’s logs: up to 7 days.
• Daily backups of the server’s database: 7 days. They start when the test server moves to a paid plan, before outside testers join. Until then there are none.
• What Anthropic receives for an import: Anthropic deletes it within 30 days. If its safety checks flag the request, it keeps it for up to 2 years.
• Zoho CPaaS’s log of each sign-in e-mail: 60 days.
• Netlify’s logs: as its own terms provide.
• Copies of the database: before each update of the server, the developer copies the database to their own computer, and deletes each copy after 90 days.
• Feedback e-mails: until the app’s public release, and at most 12 months.
• Requests to delete an account, and our replies: 12 months, to show that the request was handled.
• Data from the closed test: section 8.

The app’s copy of your data on your phone is deleted when you sign out.

8. The closed test

During the closed test, Ondello runs on a test server. Testers’ data stays there and does not move to the public version of the app. We delete testers’ accounts and data on the test server within 30 days of the app’s public release.

9. Security

Data travels encrypted (HTTPS). Access rules on the server keep households apart, so no household can read another’s data. You sign in with a one-time code sent by e-mail. There are no passwords.

10. Your rights

You have the right to:

• access your data and get a copy of it;
• have it corrected (most of it you can correct in the app);
• have it deleted (account deletion);
• have its processing restricted;
• receive it in a machine-readable format and pass it on (data portability);
• object to processing based on our legitimate interest;
• withdraw your consent at any time (section 4).

Write to privacy@ondello.app from the address you sign in with, so that we know the request is yours. We answer within one month.

You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or with the data protection authority of the EU country where you live or work.

11. Children

Accounts are for people aged 18 and over. A child’s data gets into Ondello only when a parent or guardian adds the child to the household as a member without an account.

12. Changes to this policy

The date of the latest change is at the top. If a change affects how we use your data, we tell you by e-mail before it takes effect. If we change what diet data is used for, we ask for your consent again.