Inverlin Privacy Policy

Last updated: 2026-10-14

Version: 2026-10-07

Inverlin is a household organisation app: recipes, meal plans, shopping lists, a pantry, and a shared calendar for the people running a home together. This policy explains what personal data the app processes, why, where it is stored, and what your rights are. It is written to be read, not skimmed. If anything is unclear, email us and we will answer plainly.

In short: personal data deleted after 30 days; content added to a shared household stays with that household. The rest of this document is the detail behind that sentence.

1. Who is responsible for your data

The data controller is Guillaume Meliot, a sole trader established in Sweden, operating the Inverlin app.

• Contact: support@inverlin.app

All privacy questions and requests go to the support email above and are answered by Guillaume Meliot.

2. The data we process

Your account

When you sign up we store, in our authentication system:

• your email address
• your display name (whatever you choose to be called in the app)
• your password, which is stored only as a cryptographic hash by the authentication provider. We never see or store your actual password.

Your preferences

Each account has a single preferences record that travels with you, whichever household you belong to. It can contain:

• dietary flags you choose to add (for example “vegetarian”)
• allergy information you optionally choose to add through the consent process below; we do not ask for it by default
• your appearance setting (light, dark, or system) and locale
• your notification preferences
• a Telegram chat identifier field. The current version of the app has no Telegram integration, so this field is empty for every user. If a Telegram feature ships later, it would only be filled if you deliberately link a Telegram account, and this policy will be updated first.
• a deletion schedule timestamp, set only if you have asked us to delete your account (see section 6).

A note on dietary and allergy information: this can reveal information about your health or your beliefs, which the law treats as special category data. You are never required to add it. We use it only to show it back to you and to flag conflicts on recipes.

Allergy entry is behind Add dietary information (optional). When you first open it to add allergy information, we ask for your explicit consent: “I want Inverlin to store this health information to tailor meals.” We show a link to this policy alongside that choice. Accepting records your consent before opening the input; declining records nothing. One consent covers the allergy information you enter about yourself and your household’s dependants. You can add or edit allergy information only while your consent is active; we do not ask again while it remains active. Previously stored dependant allergy notes can remain without active consent until you choose to remove them using the control described in section 7.

We keep a record linked to your account of your acceptance, when you accepted, the health category and the version of this policy you were shown. If you withdraw, we record when you withdrew and retain the consent history so we can demonstrate consent, as the law requires. These records are deleted with your account (section 6). You can withdraw at any time in Settings, under Dietary flags, using Remove allergy information and withdraw consent. Section 7 explains the choice about shared dependant notes.

Dietary flags are separate from this allergy consent process. We continue to rely on your explicit consent for dietary flags, which you give by adding them and withdraw by removing them in Settings. They are not behind the allergy consent prompt.

Your household membership

We record which household(s) you belong to, your role in each (owner or member), and when you joined. This is what connects your account to your household’s shared content.

Household content

Recipes, meal plans, shopping lists and items, pantry items, calendar events, and dependant records belong to the household, not to any individual member. They are household data, not part of your personal profile. Every member of a household can see its content, with one exception: a calendar event can be narrowed to specific attendees, in which case only the listed members can see it. These visibility rules are enforced at the database layer (row level security), not by the app on your phone deciding what to show.

Household rows carry a “created by” reference for audit purposes. It records who added something; it does not make that thing theirs. See section 6 for what happens to household content when you leave or delete your account.

Dependants

Household members can create records for people (or pets) the household plans for. Only a name is required for a dependant record. A date of birth, dietary notes and free-form notes are optional extra information the account holder chooses to add. Dependants are records created and controlled by adult account holders; today, dependants do not have accounts or logins of their own, and no access to the app. The adults in a household are responsible for the dependant information they choose to add, and can edit or delete it at any time.

What we deliberately do not collect

No location data. No contacts. No advertising identifiers, ad networks, or cross-app tracking. No data is sold or shared for marketing, ever. Analytics events never contain your content (see section 3).

3. Where your data lives, and who processes it for us

We use a small number of service providers (processors). Each one processes data only on our instructions, and each one is named here.

Supabase hosts the database and the authentication system. All account data, preferences, and household content described above live in a Supabase project in the European Union region. Connections are encrypted in transit (TLS), and access is governed by row level security rules enforced by the database itself.

Resend delivers the emails the service has to send: a sign-up confirmation link, or a password reset link. Resend receives your email address and the contents of that message, and nothing else: no household content, no preferences, no analytics. The sending identity for Inverlin mail is in Resend’s Ireland (eu-west-1) infrastructure, and part of Resend’s delivery and bounce handling runs in the United States, so your email address is processed there as part of sending you these messages. That transfer is covered by the safeguards in Resend’s data processing agreement.

Sentry provides crash and error reporting. When the app crashes or hits an error, a report is sent containing technical details: the error and stack trace, device model, operating system version, and app version. We configure Sentry to not collect default personally identifying information (the SDK’s sendDefaultPii setting is off), so reports are not tied to your email or name. Sentry project data region: European Union.

PostHog is the analytics service the app is built to use, and no analytics are being collected today. Analytics only operate in a build where an analytics key is configured, and no PostHog project exists for Inverlin, so the current app sends nothing. By construction the app can only send events from a fixed, closed list defined in its code (for example “signup completed”, “recipe added”, “shop completed”), and event properties are restricted to app-defined values such as whether a recipe was added manually or from a URL. Recipe titles, ingredients, shopping items, names, and any other free text can never appear in an analytics event; the code’s type system does not allow it. If we enable analytics we will use PostHog’s EU Cloud, the app refuses to start against any other analytics host, and we will state the retention period on this page before a single event is collected.

Crash reporting and analytics only operate in builds where the respective service keys are configured. A build without keys sends nothing to either service.

Sentry deletes error reports after 30 days on our current plan; if we move to a plan with a different retention period we will update this page. No analytics retention period applies while no analytics project exists, and we will state it here before any event is collected.

We do not share your data with anyone else, except if we are legally required to (for example by a court order), in which case we would disclose only what is required.

4. Why we are allowed to process this data (lawful bases)

Under the EU General Data Protection Regulation (GDPR):

• Performance of a contract (Article 6(1)(b)): everything needed to actually provide the service – your account, preferences, household membership, and household content. Without this data the app simply does not work.
• Legitimate interests (Article 6(1)(f)): crash reporting and product analytics. Our interest is keeping the app working and understanding whether its core features are used, so we can fix and improve them. We have deliberately minimised what these tools receive (see section 3) so that this interest does not intrude on your privacy. You can object to this processing (see section 7).
• Explicit consent (Article 9(2)(a)): dietary and allergy information you choose to add. Allergy consent is recorded with its date and policy version; dietary flags retain the separate consent treatment described in section 2.

5. Applicable data protection law

Guillaume Meliot is established in Sweden. We process personal data under the EU GDPR and applicable supplementary Swedish data protection law. Privacy questions and requests can be made through the contact in section 1.

Our hosting is in the European Union. All account and household data is stored in a Supabase project in Supabase’s EU region, and crash reports are stored in Sentry’s European Union region. Analytics would be sent to PostHog’s EU endpoint; none are being collected today (see section 3).

Supabase, Sentry and Resend are our only processors today; no other service receives your data. PostHog becomes a fourth if we enable analytics, and we will not enable it without updating this page first (see section 3). Each provider is engaged under that provider’s standard data processing agreement. The data they hold for us is stored in the European Union, with one exception: part of Resend’s email delivery and bounce handling runs in the United States, so your email address is processed outside the European Economic Area when we send you a confirmation or password reset message. Nothing else leaves the EEA in the ordinary course. Staff at any of these providers can also access data from outside the European Economic Area while they operate their services and provide support. Where data is transferred or accessed outside the EEA, the transfer relies on the safeguards in that provider’s data processing agreement, including the standard contractual clauses where the provider uses them, together with the technical measures described in section 3.

6. How long we keep data, and how deletion works

While your account exists, we keep your data so the app works.

Deleting your account. You can delete your account inside the app: Settings, then Account, then Delete account. There is no need to email anyone, although you can (section 7). Deletion works like this:

1. When you confirm, your account is scheduled for permanent deletion 30 days later, and you are signed out.
2. During those 30 days you can change your mind: sign back in and cancel the deletion, and everything is as it was.
3. After the 30 days, your account and personal data are permanently deleted: the authentication record (email, display name, password hash), your preferences record (dietary flags, allergies, and the rest of section 2), and your consent records, including the history of grants and withdrawals. This is done by an automated job; it is not reversible.

What happens to household content. Content added to a shared household stays with that household. Recipes, meal plans, shopping lists, pantry items, calendar events, and dependant records belong to the household as a whole, and deleting your account does not take them away from the people you shared a home with. The “added by” reference on such content is cleared when your account is deleted, so nothing in the household points to you any more. If you are the only member of a household when your account is deleted, that household and all its content are deleted with it, because there is no one left to own them.

Leaving a household (without deleting your account) follows the same principle: the household keeps its content. As part of leaving, you can choose to take a copy of the recipes you created into your new household; the originals stay behind. Nothing is moved or removed from the household you leave.

Crash and analytics data expires on the providers’ retention schedules (section 3) and cannot be traced back to a deleted account, since it was never tied to your identity in the first place.

7. Your rights

You have the right to:

• access the personal data we hold about you
• rectification – have inaccurate data corrected (most of it you can edit directly in the app)
• erasure – have your data deleted (the in-app deletion in section 6, or by request)
• portability – receive the data you gave us in a structured, commonly used, machine-readable format
• object to processing based on legitimate interests, including analytics
• restriction of processing while a dispute about the data is resolved
• withdraw consent at any time: for allergies, use Remove allergy information and withdraw consent. in Settings, under Dietary flags. This automatically clears your own allergy information. Before removing allergy notes from dependants, we ask whether you want to remove them too, because these records are shared with everyone in your household. You can keep those notes or remove them for everyone. When you withdraw active consent, choosing to remove dependant allergy notes removes them from every household you belong to. If you have no active consent, the same control removes dependant allergy notes only from your current household; notes in other households remain. For dietary flags, withdraw by removing them in Settings. You can also withdraw by emailing the support address below.

The app currently has no self-service export feature. Access and portability requests are fulfilled manually: email support@inverlin.app from the email address on your account, and we will send you a complete export of your personal data and the household content you created, in a machine-readable format (JSON), within one month of your request. The same address and timescale apply to every other right listed above. We will use your account email address to verify that a request really comes from you. There is no charge unless a request is manifestly unfounded or excessive, in which case the law allows a reasonable fee or a refusal, with reasons given.

Complaints. You can contact us with any concern about how we handle your data. You also have the right to complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se, or another competent supervisory authority, including in the EU country where you live or work. You do not need to contact us before lodging a complaint.

8. Security

In transit, all data is encrypted with TLS. At the database, row level security rules mean the database itself refuses to serve data to anyone outside your household (or outside the attendee list, for narrowed calendar events) – the app on your phone is never trusted to make that decision. On your device, session credentials are kept in the operating system’s secure storage. Passwords are hashed by the authentication provider and are never visible to us.

No system is perfectly secure. Where required by the GDPR, we notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. We inform affected people without undue delay when the breach is likely to result in a high risk to their rights and freedoms, subject to the GDPR’s exceptions.

9. Children

Inverlin is for adults. An account holder must be 18 or over, and we do not knowingly hold accounts for anyone under 18. Dependant records (section 2) are not accounts: a dependant in a household appears in the app only as a record created and controlled by an adult account holder, with no login and no access of their own. If you believe someone under 18 holds an account, contact support@inverlin.app and we will delete it.

10. Changes to this policy

If this policy changes in any way that matters – a new processor, a new category of data, a new purpose – we will update this page, change the date at the top, and tell you in the app before the change takes effect. Trivial edits (typos, clarifications) just update the page.

11. Contact

Guillaume Meliot, sole trader established in Sweden support@inverlin.app

Questions, requests, and complaints all go to the same place, and are read by the developer, not a ticketing system.