Privacy Notice

Controller

Fraîche (contact: legal@fraiche.app) is the controller for the personal data described in this notice.

What analytics collects

Our product analytics captures only ids, counts, durations, enums, booleans, and a pseudonymous user UUID. We do not send recipe text, ingredient names, prices, supplier names, email addresses, or free-text notes to analytics.

Purpose

Analytics is used for product improvement only: understanding feature usage, performance, and reliability.

Lawful basis

Processing is based on GDPR Article 6(1)(f) — legitimate interest. The balancing test supports this because the data is minimal, processing is EU-only, and there is no advertising or cross-site tracking.

Our cookie-less configuration still uses a server-generated privacy-preserving hash (pseudonymous id), and the ingestion endpoint sees connection IP addresses. Both remain personal data under GDPR, so legitimate interest does not remove GDPR duties; it removes the consent requirement for this minimal configuration.

Processor

Analytics processing is carried out by PostHog Cloud EU. Data is not transferred outside the EU for analytics purposes.

Retention

Event data is retained for up to 180 days. Session replay data, where enabled, is retained for the PostHog Cloud default of 30 days.

Right to object (Article 21)

You can object to analytics processing in three ways:

• Organization admins can toggle the analytics objection switch in Settings → Security → Privacy.
• Any user can enable browser Do Not Track; we honour that signal.
• You can object by emailing legal@fraiche.app.

Erasure requests

To request erasure of your personal data, contact legal@fraiche.app.

Terms

Use of the service is also governed by our Terms of Service.