Privacy Policy — Switzerland

1. Data Controller

The controller responsible for data processing in connection with the Penuvia macOS application and penuvia.app is:

Specific Provisions for Switzerland & Liechtenstein (Swiss FADP / revDSG)

• Applicable Law: Swiss Federal Act on Data Protection (FADP / revDSG, SR 235.1) and the Data Protection Ordinance (DPO).
• Cross-Border Disclosure (Art. 16(1) FADP): Optional Penuvia Cloud data is hosted in Frankfurt am Main, Germany (EEA) — a jurisdiction formally recognized by the Swiss Federal Council as providing an adequate level of data protection (Annex 1 DPO).
• Art. 14 FADP Representative Exemption: Because Penuvia operates Local-First with zero-knowledge end-to-end encryption and does not conduct large-scale high-risk profiling of Swiss residents, the statutory exemption under Art. 14(1) FADP applies.
• Your Rights & Supervisory Authority (Art. 25–29 FADP): Right to access, data portability, correction, and deletion. Competent Swiss supervisory authority: Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, CH-3003 Bern.

2. Standard Local Mode (100% Offline on Your Mac)

By default, Penuvia stores all data of your local household (pantry inventory, storage locations, recipes, calendar series, daily plans, household members, and finances) exclusively on your Mac inside ~/Library/Application Support/Penuvia/. Penuvia contains zero analytics SDKs, zero crash/telemetry trackers, and zero advertising frameworks.

3. Optional Penuvia Cloud Account & Zero-Knowledge Encryption

• EU Server Location (Frankfurt, Germany): If you choose to register a Penuvia Cloud account or sync a shared household, backend infrastructure is operated via our processor Supabase in the European Union (AWS eu-central-1, Frankfurt am Main, Germany).
• Account Metadata: To provide authentication, role management, and youth protection, we process your email address, display name, date of birth (13+ / 18+ eligibility & guardian linkage), preferred language, optional TOTP multi-factor setup, and sync timestamps.
• Zero-Knowledge End-to-End Encryption (AES-256-GCM): All synced household contents are encrypted locally on your Mac using AES-256-GCM with HKDF-SHA256 key derivation before upload; financial records are isolated in a separate encrypted compartment. Neither Lucas Witthöft nor Supabase ever holds your plaintext vault key.
• Transactional Verification Emails: One-time 6-digit confirmation and recovery codes are delivered strictly on request via Resend (send.penuvia.app, EU region).

4. macOS System Permissions & Barcode Lookup (Open Food Facts)

• Camera & Apple Vision (100% On-Device): Receipt OCR, expiry-date recognition, and barcode scanning run entirely on your Mac via Apple’s native Vision framework. Camera images are never uploaded.
• Contacts (Optional, Local Only): Only after your explicit macOS permission does Penuvia read contact names/birthdays locally for autocomplete when adding household members; your address book is never uploaded.
• Barcode Product Lookup: Scanning an unknown EAN/GTIN barcode queries the open database Open Food Facts (world.openfoodfacts.org). Only the barcode digits (plus standard HTTPS request headers/IP) are transmitted — never user or account identifiers.
• Optional App Store Purchases (StoreKit 2): If paid Cloud features are offered via the Apple Mac App Store, payment processing is handled solely by Apple. Penuvia never receives credit card or banking details, only anonymous entitlement status.

5. Website penuvia.app, Edge Region Routing & Contact

• Zero Cookies & Zero Trackers: This website sets no tracking cookies, loads no external web fonts, and runs no analytics scripts.
• Cloudflare Edge Delivery: Technical connection metadata is processed transiently by Cloudflare for TLS delivery and DDoS protection. Your network country code (CF-IPCountry) is evaluated solely in memory to display the matching legal edition (EU, CH, UK, or US) without storing visitor profiles.
• Email & Contact Form: Emails to support@penuvia.app and privacy@penuvia.app are received via Apple iCloud+ Mail. Contact form submissions are stored strictly to handle your inquiry on our Frankfurt EU database (using a salted rate-limit hash rather than raw IP) and deleted once resolved.

6. Account & Data Deletion (In-App & Web Request)

You can delete your Penuvia Cloud account and associated server data at any time directly inside the app under Settings → Account & Cloud → Delete Account (with a 30-day safety recovery window before permanent purge). You may also request immediate deletion at any time via our Support & Contact Form or by emailing privacy@penuvia.app. Local household files on your Mac remain fully under your control.