Privacy Policy

1. Who we are

MadsMenu is operated by the MadsMenu project, an independent personal project (not a registered company). For any privacy question, request, or concern, contact privacy@madsmenu.app.

2. What we collect

We only collect what's needed to run the household meal-planning board:

• Household name and slug — the name you give your household and its URL identifier.
• Member/person names — whatever text you enter for the people on your board (real first names, nicknames, or roles like "Dad" or "Emma"). You choose what to enter; nothing is verified or required to match a real identity.
• Meal plan content — the meals, dates, favorites, and guest stay dates you type in.
• Session material — an opaque session cookie (mm_sess) and a CSRF cookie (mm_csrf). We store only an HMAC-SHA-256 hash of the session cookie value (with a server-side secret pepper), never the raw cookie value.
• Session metadata — your browser's User-Agent string, and an HMAC hash of your IP address (never the raw IP).
• Recovery credential — an HMAC hash of your household's recovery code. The raw code is never stored anywhere; if you lose it, we cannot recover it for you.
• Invite tokens — an HMAC hash of any invite link you generate. The raw token is never stored.
• Rate-limit counters — short-lived counters keyed by IP address or household id, used to prevent abuse.
• Server logs — standard web server logs on our hosting provider (Fly.io), with cookie, authorization, CSRF, token, code, and invite fields stripped before logging.

We do not collect email addresses (there are no user accounts), payment information (the service is free during beta), and we run no analytics, no third-party scripts, no ad trackers, and no CDN-hosted fonts. Nothing about your usage is sold or shared with advertisers.

3. Why we process this data (legal basis)

Under GDPR Article 6, we rely on two legal bases, depending on the category:

• Performance of a contract (Art. 6(1)(b)) — for the data needed to actually provide the service you asked for: household names, member names, meal plan content, and session cookies that keep you signed in.
• Legitimate interest (Art. 6(1)(f)) — for security-related data: User-Agent strings, IP hashes, and rate-limit counters. These exist to detect abuse and protect the service, and we've minimized them (hashing, no raw IP storage) so the impact on you is small.

We do not rely on consent as a legal basis, and we do not show a cookie consent banner — see the next section for why.

4. Cookies

MadsMenu uses only strictly necessary cookies — the kind that don't require consent under EU cookie rules, because the service simply won't function without them. We don't use any cookies for advertising, analytics, or cross-site tracking.

5. Where data lives

The app runs on Fly.io, currently hosted in a US-East region, with data stored in Fly Managed Postgres (also US-East). As a personal-project MVP, we don't currently offer EU-region data pinning. If this matters for your use case, contact us before creating a household with real personal data.

6. Who else sees it

We don't share your data with advertisers, analytics providers, or any other third party. The only party that processes data on our behalf is Fly.io, our hosting provider, acting strictly as an infrastructure processor. There are no other sub-processors.

7. How long we keep it

• Your household's data lives until the household owner deletes it via Settings → Delete household. Deletion is an immediate, hard delete — all related rows are removed via cascading delete, not soft-marked or archived.
• Fly Managed Postgres takes automated daily backups, retained for Fly's default window (approximately 7 days). Deleted data may persist in these backups until they naturally age out — we cannot force early purging of backup snapshots.
• Sessions expire automatically after 30 days of inactivity or 180 days absolute, whichever comes first. A revoked session is immediately marked as revoked and stops working, but its record is retained for audit purposes until the household is deleted.
• Invite links expire after their configured window (24 hours by default). Redeemed, revoked, or expired invite records (hash only, never the raw token) are retained until the household is deleted.
• Rate-limit counters are ephemeral and reset automatically when their time window expires.

8. Your rights

Under GDPR Articles 15–22, you have the right to:

• Access your data — use Settings → Export data to download a full JSON dump of everything stored about your household.
• Rectify your data — edit household, member, and meal plan details directly in the app at any time.
• Erase your data — the household owner can permanently delete everything via Settings → Delete household.
• Port your data — the export above is machine-readable JSON you can take elsewhere.
• Object to or restrict processing — email privacy@madsmenu.app and we'll work with you.

9. Contact and complaints

Questions, requests, or concerns about this policy: privacy@madsmenu.app.

You also have the right to lodge a complaint with your local data protection authority (in the EU/EEA) or the UK Information Commissioner's Office (ICO) if you're in the UK, at any time.

10. Changes to this policy

If this policy changes, we'll update the "Last updated" date at the top of this page. We recommend checking back occasionally, especially before adding sensitive information about anyone in your household.