Privacy and cookies

1. Who the controller is

Matteo Brucato, Italy, who develops Holy Gluten as a personal project. For any question about privacy or to exercise your rights, write to ciao@holygluten.app. No data protection officer (DPO) has been appointed, as one is not required for this processing.

2. Visiting the website

The website uses no cookies, analytics, advertising or social buttons. Fonts, images and libraries are served from our own domain: when you open the pages, your browser does not contact Google, external CDNs or photo libraries.

As with any website, the server hosting it (IONOS, in Germany) technically receives your IP address, the browser you use, the page requested and the time. It records them in log files used only to run and protect the service, which delete themselves after a few weeks. Legal basis: legitimate interest in offering a secure, working website (art. 6.1.f GDPR).

External links (for example GitHub for the watch firmware) lead to other people’s websites, with their own privacy notices.

3. Your account and the app

To use the app (Android or web version) you need an account with an email address and a password. We process:

• Account data: email, password (kept only in encrypted form by the database provider), the name you want to be called by and your profile photo, if you add one.
• What you accept when signing up: the version of the Terms of Use (in Italian) and of this notice, the date and time, and your statement that you are at least 14 years old.
• The content you enter: recipes, test bakes, flours, tins and trays, oven, sourdough starter feeds, bakes, plans and photos.
• Technical data needed to keep you signed in and to protect your account.

They are used to provide the service you asked for (art. 6.1.b GDPR). We do not use them for advertising, profiling or sale, we make no automated decisions about you (art. 22 GDPR) and we do not show your content to other users. They are kept for as long as you keep your account.

Service emails. Sign-up confirmation, verification codes and password resets are sent from no-reply@holygluten.app through Brevo (section 8). We send no newsletters or advertising.

The “Holy Gluten” recipes, with the green badge, are published by the app’s editors and everyone can see them: you can remove them from your recipe book, but your own recipes stay yours alone.

4. Deleting your Holy Gluten account and downloading your data

You can delete your Holy Gluten account (Android app and web version, developer Matteo Brucato) in two ways. You will also find everything, with the direct link, on the Delete account page (in Italian).

From the app, Android or web:

• open Profile;
• tap “Delete account” and confirm;
• you are signed out straight away; after 7 days the account is deleted for good. Within those 7 days you can change your mind: sign in again and choose “Keep my account”.

Without the app: write to ciao@holygluten.app from your account’s email address, with the subject “Delete my account”. We delete it straight away and reply to confirm, within one month at the latest.

What is deleted: email, password, name and profile photo; recipes, test bakes, flours, tins and trays, oven, starter feeds, bakes, plans and all photos; the record of the Terms you accepted.

What remains, and for how long: the database backups, which overwrite themselves within a few days; the emails you sent us, deleted within 12 months of closing the request (section 9); the reports sent from “Report a problem”, in the private error archive, for as long as they are needed to fix the error (if you wish, we delete those too: just ask in your email). The editors’ “Holy Gluten” recipes are not your data and remain.

Deleting only some data, without deleting the account: recipes, test bakes, flours, tins and trays, photos and your profile photo can be deleted one by one in the app; for any other data, write to us at the address above.

Downloading your data: in the Profile of the Android app or of the web version, “Download your data” saves a JSON file with everything linked to your account (in the Android app you choose the folder on your phone to save it in); photos are included as personal links valid for 7 days. You can also ask for them by email.

5. Phone permissions (Android app)

The app asks for a permission only when you use the feature that needs it, and you can revoke it in your phone’s settings:

• Camera: for photos of recipes and test bakes, to read a flour’s barcode (read on the phone) and to measure a tin.
• Microphone: for the voice commands of “Hands-free”. Your voice is recognised on the phone; only if the language model is missing, and after asking you, does it go through Google’s online service (section 8). The app does not record or store the audio.
• Notifications: for fold, step and starter-feed alerts, scheduled on the phone.
• Bluetooth: for the DIY watch (section 7).

The app does not use your location, your contacts or the advertising ID, and contains no analytics or crash-reporting tools.

6. Cookie policy: cookies and device storage

The website, the web version and the app use no cookies. The web version keeps in the browser storage (localStorage and cache), and the Android app on the phone, only the technical data they need, which stays on your device:

• sb-…-auth-token: the session, to keep you signed in. Deleted when you sign out.
• madre-drafts: drafts of forms not yet saved. Deleted when you sign out.
• madre-device: the paired watch, if any (Android app only).
• madre.install.dismissedAt: whether you closed the invitation to add the app to the Home screen.
• hg.pwaBar.dismissedAt: whether you closed, on the website, the invitation to add the web version to the Home screen (iPhone and iPad only). To show it, the website works out the type of device from the browser, on the device itself: it sends and stores nothing else.
• madre.voice.noticeAccepted: whether you have already read the notice about voice commands in the browser.
• hg.cookies.noticeSeen: whether you have already closed, on the website or in the web version, the notice about these cookies.
• Application cache (service worker): the site’s files, so it opens faster; no personal data.

As these are strictly necessary tools, no consent is needed (art. 122 of the Italian Privacy Code and the Italian Data Protection Authority’s Guidelines of 10 June 2021): on your first visit a notice reminds you of this, without asking you to accept anything. You can delete them at any time from your browser’s or phone’s settings.

If one day we added cookies or tools that are not strictly necessary (for example statistics), we would say so here first and turn them on only after asking for your consent, which you could withdraw at any time.

7. The DIY watch

The watch has no Wi-Fi or internet access and does not know your account: it talks only over Bluetooth with the app on your phone, which sends it the starter feeds and your sourdough starter’s name. This data stays on the watch and is deleted when you unpair or reflash it.

The firmware and the case files are downloaded from GitHub (section 8); we receive no data when you download them.

8. Providers and where the data goes

We use these services. Those that process data on our behalf are processors under a contract pursuant to art. 28 GDPR; for those based in the United States, the transfer relies on the EU-U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

• Supabase (the app’s database, sign-in and photos): data is stored in the European Union, in Frankfurt (Germany). Any technical access from outside the EU is covered by the Standard Contractual Clauses.
• IONOS SE (Montabaur, Germany): hosts the website and the web version on a server in a data centre in the European Union and receives technical browsing data (section 2). No transfer outside the EU.
• Brevo (Sendinblue SAS, Paris, France): sends the account’s service emails (section 3) and receives your email address and the text of the message for that purpose. Data stored in the European Union.
• Cloudflare, Inc. (USA): manages the domain’s DNS, that is, it translates holygluten.app into the server’s address, without receiving the site’s traffic. It also forwards emails sent to @holygluten.app addresses to our mailbox.
• Google (Google Ireland Ltd and Google LLC, USA): the Gmail mailbox where the emails you write to us arrive; measuring tins with the camera uses Google Play Services for AR (ARCore), only when you start it, and is governed by Google’s privacy policy; online speech recognition in the Android app only if you accept it (section 5).
• The browser’s speech recognition (“Hands-free” in the web version): if you turn it on, the browser transcribes your voice; in Chrome and Edge the audio is sent to Google’s or Microsoft’s servers, in Safari to Apple’s. We do not receive it. The app reminds you before turning on the microphone for the first time.
• Open Food Facts (French association, EU): only when you scan or search for a flour, the app sends the barcode to their public database. Product data belongs to Open Food Facts, under the Open Database License.
• GitHub, Inc. (USA): hosts the watch’s firmware and print files; if you download them, GitHub processes your browsing data as an independent controller. In the Android app, if you send a report from “Report a problem”, it receives the text you write, the app and phone versions, the watch status and the last lines of the internal log, in a private archive used only to fix the error.
• GoDaddy: registrar of the holygluten.app domain. It receives no user data.

9. If you write to us

The emails you send to ciao@holygluten.app, or to the other @holygluten.app addresses, are used only to reply to you and handle your request (art. 6.1.b and 6.1.f GDPR), and we delete them when they are no longer needed, normally within 12 months of closing the request.

10. Security

The website, the web version and the app communicate only over HTTPS. In the database each user sees and changes only their own data, photos are kept in a private store reachable only with your sign-in, and the password is never stored in plain text. If a data breach affecting you occurred, we would notify you as the GDPR requires (arts. 33-34).

11. Your rights

At any time you can ask to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) or object to processing based on legitimate interest (arts. 15-22 GDPR), by writing to ciao@holygluten.app, if possible from your account’s email address. You can also delete your account and download a copy of your data directly from the Profile (section 4). We reply within one month. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of the EU country where you live.

12. Minors

The app is for people aged at least 14, the minimum age to consent to digital services in Italy (art. 2-quinquies of the Italian Privacy Code). If we find an account belonging to someone younger, we delete it.

13. Changes

If anything changes (for example a new provider), we update this page and the date at the top; for important changes we notify registered users.