Privacy Policy — United Kingdom

1. Data Controller

The controller responsible for data processing in connection with the Penuvia macOS application and penuvia.app is:

Specific Provisions for the United Kingdom (UK GDPR & Data Protection Act 2018)

• Applicable Framework: The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and PECR (no tracking cookies are set, so no PECR cookie consent banner is required).
• International Transfers: Optional Penuvia Cloud servers are located in Frankfurt am Main, Germany (EEA), covered by UK adequacy regulations recognizing the EEA as providing adequate protection.
• Art. 27 UK GDPR & UK Age Appropriate Design: Under Art. 27(2)(a) UK GDPR, no separate UK representative is required because Penuvia is Local-First, end-to-end encrypted, and conducts no large-scale high-risk profiling. Independent signups under age 13 are blocked; ages 13–17 default to high privacy with verified parent co-authorization.
• Your Rights & UK Regulator (ICO): Access, rectification, erasure, restriction, data portability, and objection, plus the right to lodge a complaint with the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (ico.org.uk).

2. Standard Local Mode (100% Offline on Your Mac)

By default, Penuvia stores all data of your local household (pantry inventory, storage locations, recipes, calendar series, daily plans, household members, and finances) exclusively on your Mac inside ~/Library/Application Support/Penuvia/. Penuvia contains zero analytics SDKs, zero crash/telemetry trackers, and zero advertising frameworks.

3. Optional Penuvia Cloud Account & Zero-Knowledge Encryption

• EU Server Location (Frankfurt, Germany): If you choose to register a Penuvia Cloud account or sync a shared household, backend infrastructure is operated via our processor Supabase in the European Union (AWS eu-central-1, Frankfurt am Main, Germany).
• Account Metadata: To provide authentication, role management, and youth protection, we process your email address, display name, date of birth (13+ / 18+ eligibility & guardian linkage), preferred language, optional TOTP multi-factor setup, and sync timestamps.
• Zero-Knowledge End-to-End Encryption (AES-256-GCM): All synced household contents are encrypted locally on your Mac using AES-256-GCM with HKDF-SHA256 key derivation before upload; financial records are isolated in a separate encrypted compartment. Neither Lucas Witthöft nor Supabase ever holds your plaintext vault key.
• Transactional Verification Emails: One-time 6-digit confirmation and recovery codes are delivered strictly on request via Resend (send.penuvia.app, EU region).

4. macOS System Permissions & Barcode Lookup (Open Food Facts)

• Camera & Apple Vision (100% On-Device): Receipt OCR, expiry-date recognition, and barcode scanning run entirely on your Mac via Apple’s native Vision framework. Camera images are never uploaded.
• Contacts (Optional, Local Only): Only after your explicit macOS permission does Penuvia read contact names/birthdays locally for autocomplete when adding household members; your address book is never uploaded.
• Barcode Product Lookup: Scanning an unknown EAN/GTIN barcode queries the open database Open Food Facts (world.openfoodfacts.org). Only the barcode digits (plus standard HTTPS request headers/IP) are transmitted — never user or account identifiers.
• Optional App Store Purchases (StoreKit 2): If paid Cloud features are offered via the Apple Mac App Store, payment processing is handled solely by Apple. Penuvia never receives credit card or banking details, only anonymous entitlement status.

5. Website penuvia.app, Edge Region Routing & Contact

• Zero Cookies & Zero Trackers: This website sets no tracking cookies, loads no external web fonts, and runs no analytics scripts.
• Cloudflare Edge Delivery: Technical connection metadata is processed transiently by Cloudflare for TLS delivery and DDoS protection. Your network country code (CF-IPCountry) is evaluated solely in memory to display the matching legal edition (EU, CH, UK, or US) without storing visitor profiles.
• Email & Contact Form: Emails to support@penuvia.app and privacy@penuvia.app are received via Apple iCloud+ Mail. Contact form submissions are stored strictly to handle your inquiry on our Frankfurt EU database (using a salted rate-limit hash rather than raw IP) and deleted once resolved.

6. Account & Data Deletion (In-App & Web Request)

You can delete your Penuvia Cloud account and associated server data at any time directly inside the app under Settings → Account & Cloud → Delete Account (with a 30-day safety recovery window before permanent purge). You may also request immediate deletion at any time via our Support & Contact Form or by emailing privacy@penuvia.app. Local household files on your Mac remain fully under your control.