Privacy

Your data stays at your table.

This policy explains the data used by Savoureux.fr. The controller is the individual who publishes Savoureux.fr on a non-professional basis, reachable at bonjour@savoureux.fr. Last updated 4 September 2026.

Data and purposes

  • Account and profile: email address, identifier, chosen display name, username, biography, city and avatar, to create and secure the account.
  • Community and personal features: favourites, votes, recipes, saved ingredient menus, photographs, moderation history and the exchanges required to manage them.
  • Recipe generation: language, ingredients selected from the catalogue and a pseudonymous technical identifier used for safety and quotas. No free-text field, name, email or profile content is sent to the model.
  • Newsletter: email address, language and signup date, only if you subscribe to the newsletter. Every message carries a one-click unsubscribe link that takes effect immediately.
  • Security: IP address, browser, technical logs, anti-bot result and a hashed fingerprint to prevent spam, fraud and attacks. To limit each recipe to one vote per connection, the IP address is converted server-side into a non-reversible HMAC fingerprint; the raw address is not stored with the vote. When a recipe is generated without an account, the IP address and, when supplied by the hosting provider, the approximate city and country are linked to that generation in a private abuse-monitoring log.

Legal bases

The account and requested features are processed to provide the service. Moderation, security, abuse prevention and the defence of Savoureux.fr's rights rely on the legitimate interest in protecting the site and community. Statutory requirements rely on legal obligation. The newsletter relies on your consent, given by entering your address in the signup form; that consent can be withdrawn at any time through the unsubscribe link in every message, without justification.

Source and required information

Account, profile and contribution information comes directly from the user. Security data is produced automatically when the service is used. An email address, password and display name are required to create an account; without them, member-only features are unavailable. The ingredient list is required to generate a recipe. Fields marked as required in the form are necessary to submit a recipe; biography, city and avatar remain optional.

Public visibility and search indexing

The username, display name, avatar, biography, city, join date, published recipes, favourites, positively upvoted recipes and saved menus appear on the public profile. Photographs, author name and the content of accepted recipes are also public. These pages may be viewed without an account, indexed by search engines and held temporarily in their caches. Before publication, a submitted photograph is available only to its author and the moderation team. The email address, negative votes and pending or rejected recipes are not public. Users should therefore avoid saving information in a menu or publishing anything they do not want to make public.

Recipients and technical services

Only authorised members of the Savoureux.fr team and the providers strictly necessary to operate the service receive relevant data:

  • Vercel for hosting, delivering the site and retaining essential technical logs;
  • Supabase for authentication, account-related messages, database services and private photograph storage before publication;
  • Google reCAPTCHA and Cloudflare Turnstile to assess sensitive actions and limit automated spam;
  • NordRouter, OpenAI and Anthropic to create a recipe from the selected language and closed list of ingredients; depending on the provider actually called, a pseudonymous safety identifier may also be sent;
  • Resend for operational email notifications required to monitor new registrations and moderate submitted recipes.

These providers are used for their respective functions and under their contractual confidentiality and security commitments. Some technical processing may take place outside the European Economic Area, including in the United States, under the transfer mechanism applicable to the relevant provider. You may request details about recipients and safeguards at bonjour@savoureux.fr.

Savoureux.fr does not sell or rent its users' personal data.

Retention

  • Account data remains active for the life of the account. When it is deleted, data that is no longer needed is erased; material required for a statutory duty, an open report or the establishment or defence of a right is placed in restricted intermediate storage until the applicable period expires.
  • Saved ingredient menus are retained until the user deletes them or their account is deleted.
  • A newsletter address is retained until you unsubscribe, then marked as unsubscribed so that it is no longer contacted.
  • Published contributions remain visible until withdrawal, deletion or closure of the service. Moderation versions and correspondence are deleted no later than twelve months after the last review or report is closed, unless litigation or a statutory duty remains open.
  • Pseudonymous AI quota fingerprints are designed for a maximum retention of 48 hours. The raw IP address is not stored in that table.
  • The HMAC fingerprint associated with a vote is retained while that vote and the relevant recipe remain active, so it cannot be counted again from the same connection. It is deleted with the vote or recipe and is never made public.
  • The private anonymous-generation log (recipe concerned, IP address and available approximate location) is retained for no more than 30 days. An automatic hourly purge removes entries as they expire; they remain inaccessible to the public and ordinary accounts.
  • A generated recipe is held in browser session storage and may disappear when that session ends unless the user creates and confirms an account from that session or chooses to submit the recipe.
  • Security logs and notifications are retained while an incident is investigated, then deleted or anonymised no later than twelve months after closure, unless a statutory duty or litigation requires longer retention.

Cookies and local storage

Strictly necessary cookies or storage maintain the Supabase session, language preference or a recipe in progress. Google reCAPTCHA is used when generating or submitting a recipe; Cloudflare Turnstile may be used for registration or sign-in. These safeguards process technical data when a protected action is requested.

Your rights

You may request access, correction, erasure, restriction, applicable portability, or object to processing based on legitimate interest. Email bonjour@savoureux.fr and describe the request; proportionate identity verification may be needed. Savoureux.fr responds within the period set by the GDPR, normally one month. You may also complain to the French data-protection authority, the CNIL.

Automated generation and moderation

Generation automatically assembles a recipe suggestion from the selected ingredients. It does not make a legal, financial or other decision that significantly affects the user. A generated recipe is never presented as tested. Every contribution intended for the community is moderated before publication.

Security and updates

Privileged credentials stay on the server, database rules control writes, inputs are validated and expensive operations are rate-limited. Data sent to the generation service is not used to train its models by default. This policy will be updated when features, processors or applicable rules change. If translations differ, the French policy is the reference version.