Privacy Policy

Information We Collect

We collect and process the following types of information:

• Account information (email address and optional display name)
• Pizza recipes, menus, and images you upload
• Party information and guest picks
• Guest names and comments as provided by your guests
• Profile preferences, including your country (used to localize ingredient quantity suggestions)
• AI feature usage counts per calendar month, used to enforce fair-use limits
• Subscription information for paid plans (Stripe customer and subscription identifiers, plan tier, status, and current billing period end). Card details are entered directly into Stripe and never touch our servers.
• IP addresses, temporarily collected for rate limiting and abuse prevention

How We Use Your Information

We use your information to:

• Provide and maintain our service
• Enable you to create and share pizza menus
• Facilitate party planning and guest picks
• Send transactional emails (account verification, password resets, email change confirmations)
• Generate AI-assisted suggestions, descriptions, and parsed menus when you use our AI features
• Process subscription payments and manage your paid plan
• Prevent abuse through rate limiting
• Communicate with you about your account

Data Retention

Rate limiting data (including IP addresses) is automatically deleted within 24 hours. Email change and verification tokens expire within 1 to 7 days and are cleaned up automatically. AI usage counters are kept per calendar month and reset on the 1st. All other account data, including subscription records, is retained until you delete your account. Payment and subscription records held by Stripe on our behalf may be retained longer where required by tax, accounting, or other legal obligations.

Data Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

• With guests when you share a party menu link
• With service providers who help us operate our service (Firebase/Google Cloud, Vercel, PostHog, Stripe for subscription payments, Google's Gemini API for AI features, and our email delivery provider)
• When required by law

Analytics

We use PostHog (hosted in the European Union, Frankfurt) as a product analytics processor to understand how the app is used and improve it. Anonymized behavioural events — such as page views, menu interactions, and feature usage — are sent from your browser. Once you sign in, these events are associated with your user ID (not your email) so we can build funnels across sessions.

PostHog is configured to store its identifiers in your browser's local storage rather than cookies, and session recordings are disabled. Your data stays within the European Union.

AI Features

Our AI features are powered by Google's Gemini API and are available on the paid tier. All AI features are user-initiated — we never call the AI service in the background.

When you use an AI feature, we send only the content needed for that task — such as your pizza and ingredient names, party details, or menu text you provide. We never send your email address, account identifiers, or guest data.

Per Google's Gemini API terms for paid services, Google does not use your prompts or responses to train or improve their products. Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of their usage policies.

Your Rights

You have the right to:

• Access your personal data
• Delete your account at any time from your profile settings, which permanently removes all associated data including recipes, parties, images, and account information
• Export your data using the built-in backup feature

Regional Privacy Rights

European Union (GDPR). If you are located in the EU or EEA, you have additional rights under the General Data Protection Regulation, including the right to object to processing, the right to data portability, and the right to lodge a complaint with your local data protection authority. To exercise any of these rights, please contact us.

California (CCPA). California residents have the right to know what personal information we collect and the right to request deletion. To exercise these rights, please contact us.

Children's Privacy

This service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently collected such data, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us.

Cookies and Local Storage

We use cookies solely for authentication and session management. We also use your browser's local storage to remember sign-in state, UI preferences (such as theme and filter settings), and a randomly generated analytics identifier (see the Analytics section above). We do not use cookies or local storage for advertising or cross-site tracking. You can instruct your browser to refuse all cookies or clear local storage at any time.

Contact

If you have any questions about this Privacy Policy, please contact us.