Privacy Policy — United States

1. Data Controller

The controller responsible for data processing in connection with the Penuvia macOS application and penuvia.app is:

United States Privacy Disclosures (Federal COPPA & State Privacy Laws incl. CCPA/CPRA)

• Children’s Privacy — COPPA Compliance (15 U.S.C. § 6501 et seq.): Penuvia does not knowingly collect, use, or disclose personal information from children under the age of 13. Independent account creation for anyone under 13 is technically blocked in the app. Teens aged 13–17 may only join with live authorization from a verified adult parent account. If you believe data from a child under 13 was submitted inadvertently, contact privacy@penuvia.app for immediate deletion.
• We Do Not Sell or Share Personal Information (CCPA/CPRA, VCDPA, CPA, CTDPA, TDPSA): We never sell your personal information, never share it for cross-context behavioral or targeted advertising, never use sensitive personal information to infer characteristics, and embed zero third-party ad SDKs or data brokers.
• California Notice at Collection: Only if you voluntarily create a Penuvia Cloud account or submit a support inquiry do we collect: (a) Account Identifiers (email address, display name, account UUID); (b) Age-Gate Verification (birth date & adult/youth tier); (c) Zero-Knowledge Ciphertext (household records encrypted client-side on your Mac with AES-256-GCM prior to upload — unreadable to us); and (d) StoreKit Entitlement Status (if optional App Store subscriptions are used — Apple processes payments; we never see payment card numbers). Data is retained only while your account is active (plus a 30-day recovery window upon scheduled deletion).
• Your U.S. State Privacy Rights & Non-Discrimination: Residents of California and other applicable U.S. states have the right to know/access, correct, port, and delete personal information, and the right not to receive discriminatory treatment for exercising privacy rights. Exercise these rights anytime in-app (Settings → Delete Account) or via privacy@penuvia.app (California Civil Code § 1798.83 “Shine the Light”: we disclose zero personal data to third parties for direct marketing).

2. Standard Local Mode (100% Offline on Your Mac)

By default, Penuvia stores all data of your local household (pantry inventory, storage locations, recipes, calendar series, daily plans, household members, and finances) exclusively on your Mac inside ~/Library/Application Support/Penuvia/. Penuvia contains zero analytics SDKs, zero crash/telemetry trackers, and zero advertising frameworks.

3. Optional Penuvia Cloud Account & Zero-Knowledge Encryption

• EU Server Location (Frankfurt, Germany): If you choose to register a Penuvia Cloud account or sync a shared household, backend infrastructure is operated via our processor Supabase in the European Union (AWS eu-central-1, Frankfurt am Main, Germany).
• Account Metadata: To provide authentication, role management, and youth protection, we process your email address, display name, date of birth (13+ / 18+ eligibility & guardian linkage), preferred language, optional TOTP multi-factor setup, and sync timestamps.
• Zero-Knowledge End-to-End Encryption (AES-256-GCM): All synced household contents are encrypted locally on your Mac using AES-256-GCM with HKDF-SHA256 key derivation before upload; financial records are isolated in a separate encrypted compartment. Neither Lucas Witthöft nor Supabase ever holds your plaintext vault key.
• Transactional Verification Emails: One-time 6-digit confirmation and recovery codes are delivered strictly on request via Resend (send.penuvia.app, EU region).

4. macOS System Permissions & Barcode Lookup (Open Food Facts)

• Camera & Apple Vision (100% On-Device): Receipt OCR, expiry-date recognition, and barcode scanning run entirely on your Mac via Apple’s native Vision framework. Camera images are never uploaded.
• Contacts (Optional, Local Only): Only after your explicit macOS permission does Penuvia read contact names/birthdays locally for autocomplete when adding household members; your address book is never uploaded.
• Barcode Product Lookup: Scanning an unknown EAN/GTIN barcode queries the open database Open Food Facts (world.openfoodfacts.org). Only the barcode digits (plus standard HTTPS request headers/IP) are transmitted — never user or account identifiers.
• Optional App Store Purchases (StoreKit 2): If paid Cloud features are offered via the Apple Mac App Store, payment processing is handled solely by Apple. Penuvia never receives credit card or banking details, only anonymous entitlement status.

5. Website penuvia.app, Edge Region Routing & Contact

• Zero Cookies & Zero Trackers: This website sets no tracking cookies, loads no external web fonts, and runs no analytics scripts.
• Cloudflare Edge Delivery: Technical connection metadata is processed transiently by Cloudflare for TLS delivery and DDoS protection. Your network country code (CF-IPCountry) is evaluated solely in memory to display the matching legal edition (EU, CH, UK, or US) without storing visitor profiles.
• Email & Contact Form: Emails to support@penuvia.app and privacy@penuvia.app are received via Apple iCloud+ Mail. Contact form submissions are stored strictly to handle your inquiry on our Frankfurt EU database (using a salted rate-limit hash rather than raw IP) and deleted once resolved.

6. Account & Data Deletion (In-App & Web Request)

You can delete your Penuvia Cloud account and associated server data at any time directly inside the app under Settings → Account & Cloud → Delete Account (with a 30-day safety recovery window before permanent purge). You may also request immediate deletion at any time via our Support & Contact Form or by emailing privacy@penuvia.app. Local household files on your Mac remain fully under your control.