Legal HomePrivacy Policy (English)Privacy Policy (German)Terms of Service (English)Terms of Service (German)Cookie Policy (English)Cookie Policy (German)Imprint (English)Impressum (German)User Rights (English)User Rights (German)

Privacy Policy - Pantryverse App

Version: 1.0.0
Effective Date: December 23, 2025
Last Updated: July 22, 2026

1. Data Controller and Contact Information

Data Controller under GDPR

Torsten Hubertus Kunz
Sole proprietor (natural person)
Pistoriusstraße 9a
13086 Berlin
Germany

Commercial Register: n/a (natural person, beta phase)
Tax Number: n/a (natural person, beta phase)

Contact:
Email: statue-speer-4p@icloud.com
Website: https://pantryverse.com

Data Protection Officer

Not appointed (not required for a single-operator beta with limited processing).

2. Scope of This Privacy Policy

This privacy policy applies to the processing of personal data by the Pantryverse App on the following platforms:

iOS App

Web Application

Geographic Scope: Germany and European Union
Languages: German (primary), English (secondary)
Beta diagnostics: Firebase Crashlytics is used for crash reporting and
coarse non-fatal product-health diagnostics. Firebase Analytics is used only
for coarse web shared-list acquisition events when configured, without recipe
content, grocery content, list IDs, creator IDs, or cross-app tracking.

3. Types of Data Processed

3.1 Required Data for App Usage

This data is necessary for the core functions of the app:

Registration Data:

Account Data:

3.2 Application Data

Recipe Data:

Grocery Lists:

Synchronization Data:

3.3 Special Categories of Personal Data

Pantryverse does not collect biometric templates or server-side biometric
settings during Trusted Beta. Apple may process Face ID or Touch ID locally on
your device for OS-level authentication, such as Sign in with Apple. Pantryverse
receives only the sign-in result and provider metadata needed for account
functionality.

3.4 Technical and Device Data

Device Information:

Access Data:

3.5 Analytics and Performance Data

Pantryverse does not use collected data for advertising tracking or cross-app
tracking. During Trusted Beta, analytics are limited to coarse operational and
shared-list acquisition events when Firebase Analytics is configured for the
web shared-list surface.

4.1 Contract Performance (Art. 6(1)(b) GDPR)

Purpose: Providing the main functions of the app

Data Processed:

Duration: During the contract term

4.2 Legitimate Interests (Art. 6(1)(f) GDPR)

Purpose: Security, fraud prevention, and system stability

Data Processed:

Balancing of Interests: Our legitimate interest in the security and functionality of the app outweighs your interests because:

Right to Object: You can object to the processing (see Section 8).

Purpose: Additional features and improvements

Data Processed (only with explicit consent):

Withdrawal: You can withdraw your consent at any time (see Section 8).

Purpose: Compliance with legal retention requirements

Applicable Laws:

5. AI-Powered Data Processing and EU AI Act

5.1 AI Systems in the App

Recipe Analysis and Categorization:

Data Minimization:

5.2 Transparency and Explainability

Information about AI Decisions:

Quality Assurance:

6. Retention Periods

6.1 Account Data

Duration: Until account deletion for active Firebase account data; limited
provider, backup, security, and legal evidence records may remain only where
required or permitted.
Reason: Account operation, security, legal evidence, and recovery limits.

6.2 Application Data (Recipes, Lists)

Duration: Until account deletion for active Firestore and Storage user
data; backup copies may remain for the backup retention period.
Reason: App functionality and recoverability.

6.3 Device Biometric Processing

Pantryverse does not store biometric templates or biometric settings on its
servers. OS-level Face ID or Touch ID processing remains on your Apple device.

6.4 Analytics and Performance Data

Crash and non-fatal diagnostics: Kept in Firebase Crashlytics according to
Firebase retention controls.
Web shared-list analytics: Optional, coarse event data only when configured.
Reason: Product health, security, and Trusted Beta operations.

6.5 AI Processing Data

Local processing: 90 days
Third-party AI provider logs: Minimization and time-limited retention per provider policies

6.6 Support Communications

Duration: 3 years after problem resolution
Reason: Quality assurance and legal protection

Consent records: 7 years after withdrawal
Compliance documentation: 3 years

Deletion implementation: In-app Account Deletion removes active
user-scoped Firestore data, user-scoped Storage files, and the Firebase Auth
user. Provider logs, backups, and legal evidence are handled through the
applicable provider and retention processes.

7. Recipients and Categories of Recipients

7.1 Data Processors

Google LLC / Google Ireland Limited (Firebase)

Third-party AI service providers

7.2 Platform Providers

Apple Inc.

7.3 Infrastructure and Development

No additional recipients beyond those listed above.

7.4 New Data Processors

Notification Obligation: 30 days in advance
Right to Object: You can object within 30 days

8. International Data Transfers

8.1 Adequacy Decisions

EU-US Data Privacy Framework

8.2 Standard Contractual Clauses (Art. 46 GDPR)

Version: Implementing Decision (EU) 2021/914
Applicable to: US-based processors as required

Additional Safeguards:

8.3 Countries with Data Transfer

USA:

Ireland (EU):

9. Cookies and Tracking (TDDDG § 25)

Technically Required Cookies (no consent required):

Analytics Cookies (consent required under TDDDG § 25):
No analytics cookies are used during beta.

Cookie Banner: Not shown during beta because only essential cookies are used
Withdrawal: You can remove cookies via your browser settings

9.3 Local Storage and App Data (iOS)

Local Data Storage:

Purpose: Offline functionality and user experience
Access: Only by the Pantryverse App

10. Your Rights as a Data Subject

10.1 Right of Access (Art. 15 GDPR)

Content: Complete overview of your processed data
Format: Structured, machine-readable (JSON/CSV)
Timeframe: Within 30 days
Contact: statue-speer-4p@icloud.com

10.2 Right to Rectification (Art. 16 GDPR)

Option: Directly in the app or via email request
Timeframe: Without delay, at the latest within 30 days

10.3 Right to Erasure (Art. 17 GDPR)

“Right to be Forgotten”:

Exceptions (no deletion):

10.4 Right to Restriction of Processing (Art. 18 GDPR)

Cases: Accuracy disputed, processing unlawful, objection lodged
Effect: Data is “frozen” but not deleted

10.5 Right to Data Portability (Art. 20 GDPR)

Format: JSON, CSV, or other structured formats
Scope: All data provided by you
Direct Transfer: Assessed on request for the specific destination. If direct
transfer is not practical, Pantryverse provides a structured export file.

10.6 Right to Object (Art. 21 GDPR)

Against processing based on legitimate interests:

Against direct marketing:

Withdrawal Options:

Effect: For the future, already completed processing remains lawful

Complaint to Supervisory Authority (Art. 77 GDPR):

Federal Commissioner for Data Protection and Freedom of Information (BfDI)
Graurheindorfer Str. 153
53117 Bonn
Germany

Contact:

Judicial Remedy (Art. 79 GDPR):

11. Security Measures

11.1 Technical Safeguards

Encryption and Transport Security:

Access Controls:

Abuse Prevention:

11.2 Organizational Safeguards

Privacy by Design and Default:

Training and Awareness:

Monitoring and Auditing:

11.3 Data Protection Review

Reviewed areas:

Result: High level of protection, appropriate risk mitigation

12. Automated Decision-Making and Profiling

Clarification: The Pantryverse App does not make automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

12.2 AI-Powered Recommendations

Recipe Categorization:

Grocery List Optimization:

12.3 Profiling (Limited)

Personalization of User Experience:

13. Data Protection for Minors

13.1 Age Limit

Minimum Age: 16 years (Art. 8 GDPR)
Under 16 years: Consent from legal guardians required

13.2 Verification

Age Query: During registration
Parental Consent: Email verification required
Deletion: Within 30 days if consent is missing

13.3 Special Protective Measures

14. Changes to This Privacy Policy

14.1 Amendment Procedure

Material Changes: 30 days advance notice via email
Minor Changes: Notification in the app
New Legal Bases: Renewed consent required

14.2 Version Control

Current Version: Always at https://legal.pantryverse.com/privacy/en
Previous Versions: Archived for 10 years
Changelog: Detailed change history available

14.3 Your Response Options

Objection: Within 30 days after notification
Termination: Account deletion for unacceptable changes
Consultation: Free support for questions

15. Contact and Data Protection Inquiries

15.1 Data Protection Contacts

General Data Protection Questions:
Email: statue-speer-4p@icloud.com
Response Time: Within 48 hours

Data Subject Rights:
Email: statue-speer-4p@icloud.com
Processing Time: Within 30 days (GDPR Art. 12)

Data Breaches:
Email: statue-speer-4p@icloud.com
Availability: 24/7

15.2 Required Information for Requests

Access Requests:

Deletion Requests:

Rectification Requests:

15.3 Processing Procedure

  1. Acknowledgment: Within 24 hours
  2. Identity Verification: Up to 7 days
  3. Processing: Up to 30 days (GDPR-compliant)
  4. Response: Structured and comprehensible
  5. Follow-up Questions: Free support

15.4 Languages

German: Complete processing
English: Complete processing
Other Languages: Upon request

Applicable Laws (as of June 2025)

Jurisdiction and Applicable Law

Jurisdiction: Germany (Local Court at the controller’s seat)
Applicable Law: German law
EU Law: GDPR and other EU regulations take precedence

Last Updated: July 22, 2026
Next Review: July 22, 2027

For questions about this privacy policy, please contact: statue-speer-4p@icloud.com

Pantryverse legal pages