Privacy policy

This policy explains how personal data is handled when you use At Our Table on the web, iOS or Android, contact support, or join a household created by somebody else. It should be read together with our Terms of Use.

At Our Table is operated by PinkPantherLabs, an independent software business based in Berlin, Germany. PinkPantherLabs is the controller for the personal data described in this policy. Operator information is published in our Imprint.

For privacy questions or to exercise a data-protection right, email support@atourtable.de.

• Account data: name, email address, account and household identifiers, password hash, verification status, sessions and security records. We do not store your plain-text password.
• Household profiles: household name, family-member names, dates of birth or age bands, gender selection, portions, invitations and household roles.
• Food preferences: cuisines, likes, dislikes, dietary choices, allergies, intolerances and meal feedback. Some voluntary entries can reveal health or religious information.
• Planning and shopping: generated recipes, weekly plans, meal attendance, shopping lists, selected supermarkets, country, currency, measurement system, postcode and locality.
• Photos and documents: optional profile photos and their illustrated versions, receipt images or PDFs, and receipt fields you review or correct, including merchant, date, currency, totals and line items.
• Subscription data: plan, trial, entitlement, renewal and purchase status, and billing provider identifiers. We do not receive full payment-card details for App Store, Google Play or Stripe purchases.
• Communications and technical data: support messages, transactional-email delivery information, IP address, device/browser information and security or diagnostic records generated when the service is used.

Nearby-supermarket discovery is optional. The app asks for foreground approximate location only after you choose “Find supermarkets near me.” Your device converts the location into a country and postcode. At Our Table sends the postcode—not GPS coordinates—to its backend and OpenStreetMap services to return nearby grocery stores.

We retain the postcode, locality and supermarkets selected for the household. We do not use continuous or background location. You can deny access and enter a postcode or supermarket manually. Device-level permission can be withdrawn in iOS or Android settings.

Required account fields are needed to provide the service. Profile photos, receipts, location access, feedback and most personalization fields are optional. Not providing optional data only disables the related feature.

At Our Table uses OpenAI services to propose meals and recipes, extract receipt fields, and turn an optional profile photo into an illustrated portrait. Relevant prompts, household preferences, receipt contents or images are sent only when needed for the feature you request. Requests are configured not to store generated API responses for later retrieval by the API.

AI output can be wrong. You should review recipes, allergens, food safety information, receipt totals and generated portraits before relying on or sharing them. At Our Table does not make decisions that produce legal or similarly significant effects solely by automated processing.

At Our Table is offered to household owners and is not directed to young children. An adult household owner may create a managed profile for a child and may invite an older child to use a restricted login. The owner must have authority to provide that family member’s data and is responsible for the profile, including any photo, allergy or dietary information entered for them.

Child logins cannot access household administration, billing, budgets or receipts. A household owner can edit or remove a managed profile.

We disclose only the data reasonably needed for these services:

• Convex: application database, authentication infrastructure and private file storage.
• Vercel: website delivery and associated technical request handling.
• OpenAI: requested recipe, receipt and portrait processing.
• Brevo: verification, password-reset and other transactional email.
• Expo: mobile build and over-the-air app update delivery.
• RevenueCat: subscription entitlement and purchase-status management.
• Stripe: web checkout, billing portal and payment administration.
• Apple and Google: native app distribution, purchases and subscription management.
• OpenStreetMap services: postcode lookup and nearby-supermarket discovery.

We may also disclose information when legally required, to protect users or the service, or as part of a corporate transaction subject to appropriate confidentiality and legal safeguards. We do not sell personal data or use it for third-party advertising or cross-app tracking.

Some providers may process data outside Germany or the European Economic Area. Where GDPR transfer restrictions apply, transfers must rely on an applicable adequacy decision, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism. You may contact us for information about the safeguards relevant to your data.

Account and household data is generally retained while the account is active. Photos and receipt originals remain until an authorized adult removes them or the relevant household is deleted. Short-lived verification codes expire automatically. Security, support, transaction and accounting records are retained only for the period reasonably needed for security, dispute handling or applicable legal duties.

Account deletion is available inside the app and through the process described at Delete your account. A household-owner deletion removes the household’s profiles, plans, shopping data, uploaded files and associated application records, except limited records that must be retained by law or are needed to establish or defend legal claims. Deleting the app does not delete an account, and deleting an account does not automatically cancel an Apple or Google subscription.

The website uses storage necessary for authentication, security and preserving your intended destination. The mobile app uses secure device storage for account sessions and local storage for preferences. The app also contacts Expo to check for compatible updates. This release does not include advertising cookies, advertising identifiers or cross-app tracking.

We use measures intended to protect personal data, including encrypted transport, private file storage, role-based authorization, household isolation, hashed passwords and one-time codes, and restricted access to operational systems. No online service can guarantee absolute security. Contact us promptly if you believe your account has been compromised.

Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data; object to processing based on legitimate interests; and withdraw consent at any time without affecting earlier lawful processing. You may also lodge a complaint with the data-protection authority for your habitual residence, workplace or the place of the alleged infringement.

Email support@atourtable.de. We may need to verify your identity before acting on a request.

We may update this policy when the product, providers or law changes. The latest version will remain available at this URL with its updated date. If a change materially affects how we use personal data, we will provide additional notice where required.