Privacy policy

This policy explains which personal data Pantrio processes, why, and what rights you have. We collect as little as we can: no advertising, no analytics, no tracking cookies.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Yunes Tebi
Giessener Strasse 27
57074 Siegen
Deutschland / Germany
Email: yunestibi.20.yt@gmail.com
Phone: +49 178 4781069

2. What we process and why

Visiting the website

When you open Pantrio, our hosting provider processes technical data such as your IP address, the date and time, the page requested and your browser's user agent. This is needed to deliver the site and keep it secure (Art. 6(1)(f) GDPR, our legitimate interest in a working, secure service). These logs are kept only briefly by the hosting provider.

Protection against abuse

To stop automated abuse (for example, someone requesting thousands of sign-in emails or recipe lookups), we count requests per IP address and, for sign-in emails, per one-way hash of the email address. These counters expire automatically after at most 15 minutes (Art. 6(1)(f) GDPR).

Before a sign-in email is sent, Cloudflare Turnstile checks that the request comes from a person and not a bot. For this, Cloudflare processes technical data from your browser, such as your IP address and browser characteristics. Turnstile sets no tracking cookies and the check is not used for advertising (Art. 6(1)(f) GDPR, our legitimate interest in protecting the sign-in from abuse).

Your account

If you create an account, we store your email address and, if you sign in with Google, the name and profile picture Google shares with us. We also store what you add in the app: your pantry, plans, saved recipes, shopping lists, which recipes you cooked, and settings such as language and units. We need this to provide the service you signed up for (Art. 6(1)(b) GDPR). We keep it until you delete your account or ask us to delete it.

Sign-in emails

Sign-in links are sent by email through our email provider. It processes your email address and the message for delivery (Art. 6(1)(b) GDPR).

Sign in with Google

If you choose "Continue with Google", Google learns that you are signing in to Pantrio and shares your name, email address and profile picture with us. Google's own privacy policy applies to Google's processing.

AI features

Some features (recognising ingredients from typed text or a fridge photo, checking recipe matches, translating recipes) send the text, photo or ingredient list you provide to our AI provider, Anthropic, for processing. We do not store fridge photos: they are only held in memory while the request runs. Under its commercial terms Anthropic does not use this data to train its models. Legal basis: Art. 6(1)(b) GDPR, because you use the feature.

Recipes

Recipe searches are sent from our server to Spoonacular without your name, email or IP address. Recipe and profile images are delivered through our own server, so your browser does not connect to those image hosts.

3. Cookies and storage in your browser

We only use what is strictly necessary for the site to work (§ 25(2) TDDDG): a session cookie that keeps you signed in, a cookie that remembers your language, and storage in your browser for small preferences (for example metric or imperial units, and which shopping-list items you ticked). That is why there is no cookie banner. We use no analytics or advertising cookies.

4. Service providers

We use these providers, each bound by a data processing agreement or acting under its own terms where stated:

• Vercel Inc. (USA): hosting; our server code runs in Frankfurt, Germany.
• Supabase: database and sign-in; the database is located in Frankfurt, Germany.
• Upstash: short-lived counters for abuse protection and a cache of recipe data.
• Resend: delivery of sign-in emails.
• Cloudflare, Inc. (USA): Turnstile bot check on the sign-in form.
• Anthropic PBC (USA): AI features described above.
• Google (Ireland/USA): optional sign-in with Google, under Google's terms.
• Spoonacular (USA): recipe data; receives no personal data from you.

Where data is transferred outside the European Union, the transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, or on the EU Standard Contractual Clauses.

5. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests (Art. 15–21 GDPR). To use these rights or to delete your account, email us at the address above. You also have the right to complain to a data protection supervisory authority, for example the one where you live.

6. Changes

We update this policy when Pantrio changes. Last updated: 2026-10-12.