Privacy Policy

Last updated: 2026-10-17

TL;DR: We collect the minimum data needed to run Grelife (email, name, password). If your family adds a child, we store the child's name and, only if you enter it, their birthdate (see section 11). We don't show ads and we don't sell your data. Optional analytics cookies (off by default) help us improve the app only if you allow them. AI suggestions are optional and require your consent. Your data is hosted in the European Union (Germany), and encrypted backups are kept there too. You can download a copy of your main data from the app, ask us by email for the rest, and have everything deleted on request.

1. Who is responsible

Loïc Gremaud Email: contact@grelife.ch

2. What we collect and why

We also store what you create: recipes, meal plans, shopping lists, ingredients, tags, family invitations, and the members of your family. This data belongs to your family and is isolated from other families: every query is scoped to your family, and the database additionally carries row-level security policies (see section 12).

Family members. A family can add the people it plans around, including children who have no account. For each one we store a name, a colour, whether they are an adult or a child, and a birthdate only if someone enters it. Section 11 explains what this means for children.

Family feed. We keep a timeline of what happens in your family so everyone can see what is new: who planned a meal, added a recipe, checked off shopping, or joined the family, and when. An entry can name the meal or recipe it is about. Only members of your family see it.

Emails waiting to be sent. Before we send you an email (account verification, password reset, invitation, security notice), we store your email address, your language, and what the email needs (such as your name or a link) until it goes out. This copy is deleted as soon as the email is handed to our email provider. If an email still fails after several attempts, we keep it so we can find out why.

Administrator lookups and actions. When our administrator looks up your account or your family (for example searching for an account by its email address), or acts on it (for example resetting a password or two-factor authentication, or signing out sessions), we record what was done, which account or family it concerned, when, and the IP address the administrator acted from. For a search, we also record what was searched, such as your email address, and the reason given. This record lets us show that every support action was legitimate (legitimate interest).

We may analyze aggregated or anonymized usage patterns to improve the service (for example, better meal suggestions or faster performance). This never exposes one family's data to another.

3. How we treat your data today

• No data selling. Your data is not a product.
• No third-party tracking. No tracking pixels, no fingerprinting, no advertising profiles.
• Optional analytics only. Any analytics are self-hosted and stay off until you choose to allow them (see section 5).
• No ads. Grelife is ad-free.
• No sharing except with OpenAI for AI suggestions (and only with your consent).

If this changes, we will update this policy, notify you, and give you a choice (see Terms of Service, section 6).

4. AI meal suggestions (optional)

This feature requires your family's explicit consent. When enabled, we send the following to OpenAI (based in the United States):

• Recipe names, ingredient names, and tag names
• Meal history (last 8 weeks: dates and meal names)
• Your language preference
• Custom meal instructions (if provided)

We never send your email, password, or personal identifiers to OpenAI.

You can withdraw consent and disable this feature at any time. The data transfer to the US is covered by Standard Contractual Clauses (SCCs) in our Data Processing Agreement with OpenAI.

5. Cookies and analytics

Strictly necessary (always on, no consent needed):

Optional analytics (off by default, only if you allow them):

We ask for your choice with a cookie banner. Analytics stay off unless you select Allow analytics, and you can change your mind anytime via Cookie settings in the footer.

If you allow analytics, we collect data about how the app performs in your browser: the addresses of the pages you open and of the data those pages load, page-load and Web Vitals timings, resource timing, JavaScript errors, which elements you click or tap (the text you see and type is masked, never recorded), and a session identifier. This helps us find and fix slow or broken pages. It is:

• Off by default. We collect nothing until you click Allow analytics.
• Self-hosted. The data goes to our own monitoring system on our EU servers, never to a third-party analytics provider.
• Minimal. We do not build advertising profiles, we do not sell or share it, and we keep your IP address minimal (not used for location profiling).
• Withdrawable. Reject or change your choice anytime. Your choice is remembered for 6 months, then we ask again. We also ask again sooner if we ever widen this: collect something new, use it for something new, or send it to someone new. We do not re-ask when we narrow what we collect or correct a mistake in this section, because interrupting you to re-approve less is how consent banners become noise.
• Not stored against your account. Analytics events carry no account identifier: only a session identifier that expires with your browsing session. Because there is no account key to look them up by, they are not part of your data export or account deletion, which cover your personal data (profile, recipes, meal plans, shopping lists).
• Not anonymous, and we will not call it that. Two things could still connect a browsing session back to you if we went looking: the page addresses above can contain the identifier of something you created (a specific recipe, for example), and when we investigate an error we can match a browser session to the matching server-side request records, which do identify your account. What we do not do is store analytics events under your account, or use any of this to build a profile of you.

6. Third parties

No third-party analytics providers, no ad networks. Optional analytics and error monitoring are self-hosted on our own EU servers (see section 5).

Checking for leaked passwords. When you create an account, change your password, or reset it, we check that the new password is not on the public list of passwords exposed in past data breaches. Your password never leaves our server. Here is how:

1. Our server turns your password into a hash: a fixed scramble of letters and numbers that cannot be turned back into the password.
2. We send only the first 5 characters of that hash to Have I Been Pwned.
3. The service answers with every leaked hash that starts with those 5 characters, usually hundreds of them, and our server looks for yours in that list itself.

So the service never learns your password, and cannot even tell which of those hundreds of hashes we were checking. This technique is called k-anonymity. We also ask for a padded answer, so someone watching the network cannot guess anything from its size. We send no email address and nothing else that identifies you. If the service cannot be reached, we skip the check rather than block you.

7. Where your data lives

Your data is hosted in the European Union (Germany) on servers we manage at Hetzner Cloud. We run the application stack ourselves (the PostgreSQL database and Valkey cache); Hetzner provides the underlying infrastructure and does not access your data. Encrypted backups are kept in Germany, alongside the servers. We are adding a second encrypted copy in Switzerland; this section will say so once that is running, and not before.

If this changes, we will update this policy.

8. How long we keep your data

We don't keep data longer than necessary. When you delete something, it is removed from the live database immediately. Automated backups kept for disaster recovery may still contain deleted data for up to 30 days, after which they are permanently deleted. We never restore individual data from backups to reverse a deletion you requested. If we ever perform a full database restore, we make reasonable efforts to re-apply deletion requests that occurred after the backup date.

9. Your rights

You can always:

• See your data: request a copy of everything we have about you.
• Fix your data: correct anything that's wrong.
• Delete your data: request full deletion of your account and data.
• Export your data: download a machine-readable file from your privacy settings. Today it contains your profile, your family's name and language, your recipes, meal plans, meal calendar, and shopping list. It does not yet include family members, the family feed, or your two-factor and passkey details: ask us at contact@grelife.ch and we will send you those too.
• Restrict processing: ask us to limit how we use your data.
• Object: object to processing based on legitimate interest.
• Withdraw consent: turn off AI suggestions or analytics at any time.

Contact us at contact@grelife.ch. We respond within 30 days.

10. Access to your data

We only look at your data when:

• You ask us for help (support request)
• We need to fix a technical issue affecting your account
• We are legally required to (court order, legal obligation)

We never browse your data out of curiosity.

11. Children

Children can use Grelife only through a parent or guardian's invitation. We don't allow direct registration for minors. The inviting parent is responsible for their children's access.

A family can also add a child who has no account, so it can plan around them. For that child we store:

• a name (a first name or a nickname is enough)
• a colour, to tell family members apart in the app
• that they are a child
• a birthdate, only if someone enters it. It is optional.

This is entered by a member of your family who has an account, normally a parent. The child does not log in and enters nothing. We use this only to organise your family's plans in Grelife, for example to show who something is for or when a birthday falls. Only members of your family can see it. We never send this stored record to OpenAI or to anyone else, and we never use it for advertising or profiling. One exception is up to you: if your family uses AI suggestions, the meal instructions you type yourself are sent to OpenAI as written (see section 4), so anything you write there, a child's name included, is sent too.

Removing a child's data. Any member of your family who has an account can change the child's name, remove the birthdate, or delete the child. A child who already appears in your family's plans cannot be deleted, only archived: they are hidden everywhere, but their name stays on past entries so your history still makes sense. To erase a child completely, write to contact@grelife.ch and we will do it, or delete your family: when the last family member with an account deletes their account, all of the family's data is deleted.

12. How we protect your data

• Passwords are hashed with Argon2id (industry best practice)
• Sessions use cryptographically random identifiers
• Authentication cookies are HttpOnly and Secure
• CSRF protection via custom headers and SameSite cookies
• Rate limiting on login and registration
• Every query is scoped to your family, so one family's data is never returned to another. Row-level security policies are defined in the database as a second layer; enforcing them at the database role level is in progress

13. If something goes wrong

If we discover a data breach that puts your rights at risk:

• We notify the Swiss data protection authority (FDPIC) as quickly as possible
• We notify the relevant EU authority within 72 hours (if GDPR applies)
• We inform you directly if the breach poses a high risk to you

14. Where to complain

You can lodge a complaint with:

• Switzerland: FDPIC, https://www.edoeb.admin.ch
• EU: The data protection authority in your country

15. Changes to this policy

When we update this policy, we change the date at the top. For significant changes, we notify you by email or in the app.