Privacy policy

This policy explains what data Hey Potsy collects, why, who else sees it, how long we keep it, and what you can do about it. It covers this website, the waitlist and the Hey Potsy app. We keep it short and plain. If anything is unclear, write to us.

Who we are

Hey Potsy is run by [Company name], [Address], Austria, [Company register number / UID]. We are the controller of your data under the GDPR. Questions about your data: hello@heypotsy.com.

We have not appointed a data protection officer, because the law does not require one for a business of our kind. Write to the address above about anything to do with your data.

In short

• Your recipes, plans and shopping lists are visible only to the members of your household.
• We don’t sell data, show no ads and use no tracking or analytics.
• To answer you, Potsy sends what you ask to an AI provider. They answer and don’t keep it for us.
• You can download all your data and delete your account yourself, on the account page.

The waitlist

When you join the waitlist we store your email address, the language of the page you used, the time you joined and, if you answer it, what you cook most. We use them only to invite you to Hey Potsy, with one email when your invite is ready, and to see which languages to prepare first.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to us; we then delete your entry. Waitlist entries are deleted at the latest 12 months after the public launch if you haven't joined.

Your account

You sign in with Google or with a code we send to your email. We store:

• your email address, your name and your profile picture (from Google, if you sign in with it);
• the household you belong to, and when you joined;
• your own settings, such as your app language, Potsy’s voice and whether “Hey Potsy” is on.

We use this to let you in, to show who is in a household, and to keep your settings across your devices. The legal basis is the contract with you (Art. 6(1)(b) GDPR): without it we can’t give you the app.

Your household’s data

A household is the family that shares one cookbook. Everything in it is shared by all its members, who can all see and change it:

• recipes, with their photos, notes and source links;
• the meal plan, the shopping list and the ingredient list;
• household settings: country, languages, the meals you plan, diet and foods you don’t like;
• allergies and food intolerances, if you enter them;
• pending invites, with the email address of the person invited.

We use this data only to run the app for your household. The legal basis is the contract (Art. 6(1)(b) GDPR).

Allergies are health data. Entering them is optional. If you do, you agree that we use them to warn about recipes, leave them out of meal plans and tell Potsy about them (Art. 9(2)(a) GDPR). Only enter allergies of people who have agreed, or whose parent you are. You can remove them at any time in Settings; they are then gone.

Recipe photos

Recipe photos are kept in our storage under a long random address. They are not listed anywhere and can’t be guessed, but anyone who has the link to a photo can open it, without signing in. Don’t use recipe photos for anything private, such as pictures of people.

When you look for a photo for a recipe, we send the recipe’s name to image search services (Bing, Pexels and Openverse). Your device then loads the preview pictures directly from those services and the websites they come from, which see your IP address. The photo you choose is copied into our storage.

Potsy and the AI

Potsy is the app’s helper. When you ask him something, import a recipe, plan meals or translate a recipe, our server sends the request to OpenRouter, which passes it to the AI model that answers. The request contains what is needed to answer: your message or the recipe you import, and the household details that matter for cooking (country, languages, allergies, diet, dislikes, and for planning your recipes and plan). It does not contain your name or email address.

The models we use today come from OpenAI (text answers and imports), Google (YouTube videos and Potsy’s voice) and Microsoft or OpenAI (turning speech into text). When Potsy looks up new recipe ideas on the web, the search goes through Exa, a search service. We may change models; this list is kept up to date.

OpenRouter does not keep the content of requests for us. The model providers may keep a request for a short time, for example to detect abuse, under their own terms. We don’t keep your questions or Potsy’s answers on our servers, except what you save yourself, such as a recipe.

For each AI request we log, per household: the time, the kind of request, the model, the tokens used and what it cost. Not what was asked. We use this log to count Potsy’s energy for your plan, to find errors and to see what the AI costs us. The legal basis is the contract (Art. 6(1)(b) GDPR) and our legitimate interest in running the service at a fair cost (Art. 6(1)(f) GDPR).

Photos you show Potsy

When you show Potsy a photo in the app and ask about it, the photo is sent to our AI provider (through OpenRouter) to answer you, and then it is not kept: not on our servers and not in our logs. Only if you ask Potsy to make a recipe from it does it become that recipe's photo in your cookbook, like any recipe you save.

Your voice

• “Hey Potsy” is heard on your device. When it is on, the app listens to the microphone for that name, on the device itself; no sound leaves your device for it. If you teach Potsy your voice, the recordings stay on your device; only the settings learned from them are saved with your account. The listening model is downloaded once from Hugging Face, which sees your IP address.
• When you talk to Potsy (after tapping him or saying his name), what you say is recorded until you pause and sent through OpenRouter to a speech-to-text model (Microsoft or OpenAI). The text goes on like a typed question. We don’t keep the recording.
• Potsy’s spoken answers are made from his text by Google’s voice model, through OpenRouter.

Importing recipes

When you import a recipe from a link, our server fetches that page, so the website sees our server, not you. A YouTube link is passed to Google’s model, which watches the video. Text and photos of cookbook pages you import go to the AI as described above.

Security and abuse

To protect the service we count how often each account uses each AI action, and refuse calls above a limit. These counts are kept for one day. Our providers keep technical logs (such as IP addresses and error messages) for a short time to keep the service secure. The legal basis is our legitimate interest in a safe, working service (Art. 6(1)(f) GDPR).

Paying for a plan

During the beta, plans are free. Once payments start, they will be handled by Paddle, which sells the plans as our reseller (merchant of record). You pay Paddle directly; we never see your card or bank details. Paddle tells us your plan, whether it is paid, and your country for tax. Paddle is itself responsible for the data it needs for payment, tax and fraud checks, under its own privacy policy.

Who processes the data for us

These companies process data on our behalf, under a data processing agreement, and only as we instruct:

• Supabase (database, sign-in, file storage and our server code). Our project runs in the EU. Supabase Inc. is based in the USA.
• OpenRouter (passes AI requests to the models), USA. Through it: OpenAI (USA), Google (USA), Microsoft (USA) and Exa (web search, USA).
• Cloudflare (hosting of the app and this website, our domain, and forwarding mail sent to our address), USA, with servers worldwide. It sees technical data such as your IP address to deliver the pages.
• GitHub (Microsoft; our code and the database backups), USA.
• Google as sign-in provider, if you choose “Sign in with Google”. Your profile picture is loaded from Google.
• Sign-in codes are sent by email through Supabase [or: email service name, country].

Some of these companies are in the USA. Where data leaves the EU, it is protected by the EU–US Data Privacy Framework, where the company is certified, or by the EU’s standard contractual clauses. You can ask us for a copy.

Image search (Bing, Pexels, Openverse) and Hugging Face are not our processors: they only receive a dish name or a download request, as described above.

How long we keep data

• Your account is kept until you delete it.
• Household data (recipes, plans, lists, photos, AI log) is kept while the household has members. When the last member deletes their account, the household and everything in it are deleted.
• When you leave a household, or are removed from it, its recipes and lists stay with that household. You keep your account and get a new, empty household.
• Rate-limit counts: one day.
• Backups of the database are kept for up to 90 days. Deleted data disappears from them when they expire.
• Waitlist entries: as described above.
• Payment and invoice records are kept by Paddle as long as tax law requires.

On your device

We use no cookies. The website and the app store a few things in your browser’s local storage, which is needed for them to work:

• your sign-in session, so you stay signed in;
• a copy of your household’s recipes, plan and lists, so the app works offline (removed when you sign out);
• settings for this device, such as light or dark mode, the language, whether Potsy reads aloud, and how far you got in setting up;
• the app’s files, kept by the browser so it opens fast and offline.

None of this is used for tracking. Fonts are served from our own server.

Children

Hey Potsy is for families, run by adults. The person who creates a household must be an adult. Every other member must be at least 16, or have the consent of a parent in the household. We don’t knowingly collect data from children under 16 without that consent. If you think we have, write to us and we will delete it.

Your rights

You have the right to access your data, to correct it, to delete it, to restrict or object to its processing, and to data portability. Where we rely on your consent, you can withdraw it at any time; this doesn’t affect what was done before.

• Download your data: on the account page, “Download my data” gives you everything of yours and your household’s as a JSON file.
• Delete your account: also on the account page, at any time. Your account is deleted at once. If you were the last member, your household and all its recipes and photos go with it.
• Remove a member: the first member of a household can remove others; they keep their own account.
• For anything else, write to hello@heypotsy.com. We answer within one month.

You can also complain to a data protection authority. In Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. You can also turn to the authority in the EU country where you live.

No automated decisions

We make no decisions about you by automated means that have legal or similarly significant effects. Potsy’s answers are suggestions; you decide what to cook.

Changes

When we change this policy, we update the date at the top. If a change matters for how we use your data, we tell you in the app or by email before it applies.