Privacy Policy — EU & Germany

1. Data Controller

The controller responsible for data processing in connection with the Penuvia macOS application and penuvia.app is:

Legal Bases & Your Rights in the European Economic Area (EU GDPR)

• Governing Framework: Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), supplemented by the German Federal Data Protection Act (BDSG) and TDDDG.
• Legal Bases (Art. 6(1) GDPR): Performance of a contract (Art. 6(1)(b) GDPR) for optional Penuvia Cloud accounts, encrypted household sync, and support inquiries; legitimate interests (Art. 6(1)(f) GDPR) for network security, abuse prevention, and website delivery; consent (Art. 6(1)(a) GDPR) for optional macOS system permissions (Camera, Contacts). Because we set zero tracking cookies, no cookie banner is required.
• Child & Teen Safeguards (Art. 8 GDPR): Independent accounts under age 13 are technically blocked. Users aged 13–17 require live co-authorization by a verified adult parent account.
• Your GDPR Rights (Art. 15–21 & Art. 77 GDPR): Access, rectification, erasure, restriction, data portability, objection, withdrawal of consent, and the right to lodge a complaint with your national EU data protection authority or the lead authority at our seat (ULD Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany).

2. Standard Local Mode (100% Offline on Your Mac)

By default, Penuvia stores all data of your local household (pantry inventory, storage locations, recipes, calendar series, daily plans, household members, and finances) exclusively on your Mac inside ~/Library/Application Support/Penuvia/. Penuvia contains zero analytics SDKs, zero crash/telemetry trackers, and zero advertising frameworks.

3. Optional Penuvia Cloud Account & Zero-Knowledge Encryption

• EU Server Location (Frankfurt, Germany): If you choose to register a Penuvia Cloud account or sync a shared household, backend infrastructure is operated via our processor Supabase in the European Union (AWS eu-central-1, Frankfurt am Main, Germany).
• Account Metadata: To provide authentication, role management, and youth protection, we process your email address, display name, date of birth (13+ / 18+ eligibility & guardian linkage), preferred language, optional TOTP multi-factor setup, and sync timestamps.
• Zero-Knowledge End-to-End Encryption (AES-256-GCM): All synced household contents are encrypted locally on your Mac using AES-256-GCM with HKDF-SHA256 key derivation before upload; financial records are isolated in a separate encrypted compartment. Neither Lucas Witthöft nor Supabase ever holds your plaintext vault key.
• Transactional Verification Emails: One-time 6-digit confirmation and recovery codes are delivered strictly on request via Resend (send.penuvia.app, EU region).

4. macOS System Permissions & Barcode Lookup (Open Food Facts)

• Camera & Apple Vision (100% On-Device): Receipt OCR, expiry-date recognition, and barcode scanning run entirely on your Mac via Apple’s native Vision framework. Camera images are never uploaded.
• Contacts (Optional, Local Only): Only after your explicit macOS permission does Penuvia read contact names/birthdays locally for autocomplete when adding household members; your address book is never uploaded.
• Barcode Product Lookup: Scanning an unknown EAN/GTIN barcode queries the open database Open Food Facts (world.openfoodfacts.org). Only the barcode digits (plus standard HTTPS request headers/IP) are transmitted — never user or account identifiers.
• Optional App Store Purchases (StoreKit 2): If paid Cloud features are offered via the Apple Mac App Store, payment processing is handled solely by Apple. Penuvia never receives credit card or banking details, only anonymous entitlement status.

5. Website penuvia.app, Edge Region Routing & Contact

• Zero Cookies & Zero Trackers: This website sets no tracking cookies, loads no external web fonts, and runs no analytics scripts.
• Cloudflare Edge Delivery: Technical connection metadata is processed transiently by Cloudflare for TLS delivery and DDoS protection. Your network country code (CF-IPCountry) is evaluated solely in memory to display the matching legal edition (EU, CH, UK, or US) without storing visitor profiles.
• Email & Contact Form: Emails to support@penuvia.app and privacy@penuvia.app are received via Apple iCloud+ Mail. Contact form submissions are stored strictly to handle your inquiry on our Frankfurt EU database (using a salted rate-limit hash rather than raw IP) and deleted once resolved.

6. Account & Data Deletion (In-App & Web Request)

You can delete your Penuvia Cloud account and associated server data at any time directly inside the app under Settings → Account & Cloud → Delete Account (with a 30-day safety recovery window before permanent purge). You may also request immediate deletion at any time via our Support & Contact Form or by emailing privacy@penuvia.app. Local household files on your Mac remain fully under your control.