Privacy policy

1. Data controller

The data controller is Jérémy Pierre (Youmax), publisher of Popotam (see the legal notice). For any question about your data: contact@youmax.fr.

2. Your meal plan and your grocery list

When you save your meal plan online, it is stored in a private space (a PostgreSQL database hosted by Scaleway, in France / European Union), accessible only through a secret link that only you know. No account is created.

No email address is associated with this space, unless you save one yourself: this is optional, and it is the subject of section 4.

A working copy also stays in your browser (local storage), so the app works even offline. It does not leave your device.

So that it can put weeks together even when the AI is not available, Popotam keeps a catalog of dishes, rebuilt every night from saved meal plans. A dish only enters it if it appears in at least three different spaces: these are common dishes (a lentil curry, a zucchini gratin), never a dish that would concern only you. The catalog only keeps the dish itself (its name, its ingredients, its quantities, its preparation time) and the number of spaces where it appears. It never says which space a dish comes from. It is never sold. Its dishes are used to put together the weeks of the people who use Popotam, to feed the discovery feed and the Fridge raid, and may be reviewed by Mistral AI under the conditions described in section 3. The most common of them, those that appear in at least ten different spaces, may also be shown on the site's public pages, such as “What's for dinner tonight?” (French pages): they show the dish, its ingredients, its quantities, its preparation time and its estimated price, never the number of spaces where it appears, nor anything that would reveal who ate it. For these pages, Popotam has Mistral AI write the recipe for these common dishes a single time: only the name of the dish, its time and its ingredients with their quantities are sent, never anything that comes from your space. The recipe is then stored and read back as is, with no new call. Some of these dishes are also illustrated by an AI-generated image, created a single time, from a description of the dish written from its recipe: Mistral AI generates the image with the model from Black Forest Labs (a German company), which briefly places it on Microsoft Azure storage while Popotam retrieves it. Others are generated by hand by Popotam's publisher with Google Gemini, from the same description. In both cases, only the description of the dish is shared, never anything that comes from your space. Every image displayed carries the label “AI-generated image”. For the English version of Popotam, the names of the catalog dishes, the names of their ingredients and the public recipes were translated into English a single time with Claude, Anthropic's AI: only these common dishes and these public recipes were sent, never anything that comes from your space.

If you choose English, that choice (the language, and metric or US units) is kept in your browser, on this device only, and Popotam attaches it to its requests so it can answer you in your language. It is used for nothing else and is not saved on the server.

Every week, Popotam also publishes overall statistics about meal plans (target budget, estimated cost of a meal, preparation time, calories, share of vegetarian meals, most frequent dishes and ingredients, declared diets) on the Menu barometer page (French page). They are calculated on at least 50 households, only mention a dish or an ingredient if it concerns at least 10 different households, and never contain anything that would make it possible to recognize a household, a meal plan or any text you typed.

3. Your menu generated by AI

Popotam offers two ways to put a menu together, and you choose which one you use.

If you choose “My AI”, Popotam sends nothing at all: you copy the instructions into the AI of your choice yourself, from your own account.

If you choose instant generation, Popotam calls an AI on your behalf, through two providers. Putting your weeks together (generating a week, “Redo my week”, and the automatic weekly generation) is entrusted to OpenAI's GPT-6 Luna model. Everything else is entrusted to Mistral AI (a French company, infrastructure in the European Union). If OpenAI does not respond, Mistral AI puts your week together instead.

Why two? A Popotam week has to respect many constraints at once: your diet, your excluded foods, your cooking times day by day, your budget, your pantry, your appetite for variety. We compared several models on real weeks, with the same checks for each, and GPT-6 Luna is currently the one that follows them best. This is a choice based on quality, not on principle: as soon as Mistral AI offers a model capable enough to handle constraints as demanding as Popotam's, we will go back to Mistral.

These calls happen in these cases, and only these: when you generate a week, when you use “Redo my week”, when you ask for “Swap it” on a dish, when you open a dish's recipe, when you prepare a batch cooking session, when the Fridge raid finds nothing in the catalog and suggests ideas (only the ingredients you entered and your preferences are sent, never free text), and, if you turned it on, during the automatic weekly generation, including when you are not in the app. Add to these the two cases described below: pricing a recipe of your own, and reviewing a week put together from the catalog. And one last case, which does not involve you: writing, once and for all, the recipes and illustrations of the dishes shown on the public pages (see section 2), without any space data.

No personal data is sent, neither to OpenAI nor to Mistral AI: only your meal preferences and dish names. What is sent is limited to what is needed to put a menu together: the number of people, your target budget, your grocery cart optimization level, your dietary restrictions, the foods you excluded, the settings on your Preferences screen (favorite cuisines, time, equipment, items in your pantry, favorites...), the names of dishes not to repeat, and, if you write one, what you say you feel like eating in “Swap it” (free text, limited to 400 characters). Since this field is free text, avoid writing personal information in it: it would be sent along with the rest.

When you save a recipe of your own in your cookbook, Popotam estimates the price of its ingredients with its own price database. Only the ingredients it does not know are sent to Mistral AI, and only their name and quantity, to estimate their price and their store aisle. Neither the name of your recipe nor its steps are sent.

When Popotam puts your week together from its catalog (see section 2), it may ask Mistral AI to review the selected dishes against your preferences. In that case, the names of the selected dishes, their ingredients, and the same preferences as for a generation (listed two paragraphs above) are sent, nothing more.

Neither your email address, nor your space identifier, nor your IP address, nor any data that could identify you is sent: the call goes out from Popotam's server, not from your device. OpenAI and Mistral AI therefore receive a menu request without being able to know who it comes from. The processing they carry out on their own behalf is governed by their terms, published on openai.com and on mistral.ai.

Popotam has signed a data processing addendum with OpenAI Ireland Limited, OpenAI's European entity. Week composition requests may then be processed in the United States by companies in the OpenAI group: this transfer outside the European Union is governed by the European Commission's standard contractual clauses, which this addendum provides for. OpenAI does not use the data received through its API to train its models, and keeps it for 30 days at most, to fight abuse.

In both cases, Popotam keeps neither the instructions nor the menu received. The meal plan is sent back to your browser, and it is stored online only if you save your space (see the previous section).

One single exception, so that you can go elsewhere while your week is being prepared: if your device goes to sleep, loses the network or closes the app along the way, the prepared week stays in the RAM of Popotam's server, for fifteen minutes at most, until your device comes to fetch it. It is never written to the database, is linked only to a code drawn at random by your device, and disappears on its own after that delay or when the server restarts.

Popotam does, however, keep a technical log of these calls, to track its costs and spot outages: the date, the model used, the duration, the number of tokens, the cost and the status. This log contains no data about you, no space identifier and no menu content. It is deleted after 180 days.

4. Your email address (optional, and never commercial)

Popotam works without email and without an account. You can, however, save an address: it is used to find the link to your space from any device, and it is the only way to recover it if you lose it. It is never used to identify you or to log you in: the link remains the only way in.

Your address is used only to run the service. There is no newsletter, no marketing, no advertising, no profiling and no reselling: Popotam has nothing to sell you. It is not passed on to anyone for commercial purposes, not now, not later.

The list of messages you can receive is short, and it is complete: the confirmation of your address, a reminder of your link once that address is confirmed, the notice that your week is ready if you turned on automatic generation and asked to be told, and a single message if your automatic generation has been running for nothing for several weeks. Nothing else is sent to that address.

If you add a meal plan by scanning its QR code, Popotam asks for access to the camera. The image never leaves your device: it is not saved, not sent, and not analyzed anywhere other than in your browser, and the camera turns off as soon as you leave the scan screen. You can also paste the link by hand, without the camera.

The same address can be linked to several meal plans, up to five, if you keep more than one (for example one at home and one somewhere else). Each one must be confirmed separately from that mailbox. When you ask to recover your link, the message then lists them all, with the name you gave them. The unsubscribe link, on the other hand, only applies to the meal plan it was sent from.

Nothing is sent to that address until you have confirmed it by clicking the link you received. That first message does not contain the link to your space, precisely so that a mistyped address gives access to nothing. An address that is never confirmed is deleted automatically after seven days.

Every email contains an unsubscribe link that deletes your address in one click, with no confirmation and without touching your meal plan. You can also remove it from the app. Emails are delivered through Scaleway (France), which already hosts your space; only your address and the content of the message are passed to it.

5. Notifications (optional, and device by device)

If you accept, Popotam can show a notification on your phone or computer in two cases, and only these: when your automatically prepared week is ready, and when a week you just requested is ready but you have left the app in the meantime (that notification only goes to the device you requested it from). There are no commercial notifications.

This permission is requested by your browser, device by device, and it is never requested on its own: only after you click. You can withdraw it at any time, from Popotam (“Data” tab) or from your browser settings. Turning it off on one device does not affect the others.

For a notification to arrive when the app is closed, it goes through your browser's notification service: Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox. This service is not chosen by Popotam, it is the one of the device you use.

The content of the message is end-to-end encrypted, between Popotam's server and your device (RFC 8291 standard): the notification service carries a block it cannot read. It sees that a message is going to a subscription, never what it contains, and it receives neither your email address, nor the link to your space, nor your meal plan.

No notification is sent to anyone who has not explicitly accepted on the device concerned.

6. Your feedback and your donations

If you use the “Your feedback counts” form, we keep your message. Your email address is kept only if you provide it, and only to reply to you; it is not shared.

The link to your space is attached to your feedback only if you explicitly check the box provided for this (to help us reproduce a bug). By default, it is not sent.

If you answer “Done with your groceries?”, we keep Popotam's estimate, the amount on your receipt if you give it, how it felt to you (about right, more expensive, cheaper), what you bought in addition to the list, the number of items checked off, your number of people and the store listed in your preferences. Nothing more: not your space identifier, not your dishes, not your items. This feedback is anonymous, and it is used only to make the estimates more accurate.

If you make a donation, payment takes place on Stripe's page, not on Popotam: Stripe receives your card, your name, your email address and your country, and processes them according to its own privacy policy (stripe.com). Popotam keeps only the amount, the date and the technical reference of the payment, never your name, your address or your country, and never links a donation to a meal plan.

7. Audience measurement

We use Umami, a self-hosted audience measurement tool, with no cookies and no advertising trackers. The data is aggregated and anonymous (pages viewed, device type). The path of your secret link is masked before anything is sent: it never appears in the statistics.

We also measure a few actions in the app, to learn what is useful and what gets in the way: a generation started and its result, the mode chosen, turning on automatic generation, a dish suggestion requested. These events carry fixed labels, chosen in advance from a closed list. They never contain the name of a dish, your email address, your space identifier, or any text you typed.

You can opt out of this measurement entirely, without asking us anything: open your browser's console on Popotam and run localStorage.setItem("umami.disabled", "1"). Nothing is sent from that device anymore, neither page views nor actions.

8. Cookies

Popotam uses no tracking or advertising cookies. Only your browser's local storage is used, for purely technical purposes, and it stays on your device.

9. Retention period

A space with no visit for more than 365 days is deleted automatically. Feedback is kept for as long as needed to handle it. The technical log of AI calls, which contains no data about you, is deleted after 180 days. An email address that is saved but never confirmed is deleted after seven days.

Well before that, if you turned on automatic generation and we stop seeing you for a few weeks, it is paused so that it does not prepare menus for nothing. Nothing is deleted at that point: your meal plan, your preferences, your history and your address stay intact, and one click is enough to restart it.

A notification permission is kept as long as you do not withdraw it. It disappears with your space if you delete it, and it is deleted on its own as soon as your browser tells us it is no longer valid, for example if you uninstalled the app or reset your browser.

10. Your rights

In accordance with the GDPR (RGPD in French), you have the right of access, rectification, erasure and objection.

For your meal plan: you can delete it yourself at any time with the “Delete this online space” button in the “Data” tab (or simply by no longer using your link). Deletion is permanent on the server side.

After this deletion, only the space identifier is kept, with no content at all, and only to prevent a device that stayed connected from recreating it. This identifier is in turn deleted after one year.

For your feedback or any other request: write to contact@youmax.fr.

11. Importing a recipe, and bringing over your Mealime data

When you paste a recipe link into “Import a recipe”, Popotam's server reads that web page, once, to extract the recipe published by the site (its title, its servings, its time, its ingredients, its steps, and the address of its photo). It only reads public https pages, refuses private or local addresses, and keeps nothing from the page: the recipe is sent back to your browser, and you decide whether to save it in your cookbook. The address you pasted is saved with the recipe, in your space, to show its source. The photo, if you see it in the preview, is displayed from the original site, which then sees your visit as it would for any image on a web page.

If the recipe is not in French, Popotam has it translated by its AI provider (Mistral AI, see section 3): only the title, the names of the ingredients and the steps are sent, never anything about you, and the quantities are converted by Popotam itself, not by the AI. These translations appear in the technical log described in section 3, without their content.

To bring over your Mealime account, the bookmark (or the extension) “Bring to Popotam” loads a small Popotam program into the my.mealime.com tab. It READS what the page already has in memory: the recipes in your current meal plan and the previous one, your favorites, your custom recipes, your recipe notes, your diet, your allergies, the foods you refuse and your number of people. It never reads or sends your login token, your email address, your first name, your subscription or your Mealime account identifier: it only keeps the fields named in its list. It does not query your account with Mealime: the only thing it reads is the page's public code (already loaded by your browser), to find the table of food names in it. This data passes from the Mealime tab to Popotam (the app that opened that tab, or the page popotam.fr/importer/mealime) through a direct message between the two tabs, never in a web address, and you check it before bringing it over. The photos of your recipes are displayed in this summary from mealime.com, without ever being copied or kept by Popotam.

To complete your favorites (Mealime only gives their number), Popotam's server reads the public recipe pages of mealime.com, one per second at most, and keeps these pages in memory for one day so it does not read them again. Nothing from your account is sent to mealime.com in the process.

From the app, you can also drop in the PDFs you printed from the Mealime app (a recipe, or your meal plan). Popotam's server reads them in memory, just long enough to extract the recipe text (title, servings, time, ingredients, steps), then forgets them: a PDF is never saved, neither on disk nor in the database, and its file name is only used to tell you on screen what each one produced. From a meal plan, Popotam keeps only the recipe titles, to find their public pages on mealime.com as it does for a favorite; the meal plan's grocery list is not read.

What you bring over enters your Popotam space exactly as if you had typed it: your recipes in your cookbook, your tastes in your preferences. These recipes are private copies: they never enter Popotam's public catalog (section 2), even if several people import the same one, and no public recipe is written from them. Popotam is not affiliated with Mealime.

12. Sharing and transfers

No data is sold or passed on to third parties for commercial purposes. Your space is hosted in the European Union. Only one thing that comes from your meal plan can leave it: week composition requests, which OpenAI may process in the United States, without any personal data (section 3).

The only third-party recipients are OpenAI and Mistral AI, if you use instant generation or import a recipe that needs translating (information listed in sections 3 and 11), Scaleway, which hosts the database and delivers the emails (section 4), if you accepted notifications, your own browser's notification service (section 5), which carries an encrypted message it cannot read, and, if you make a donation, Stripe, which processes the payment (section 6). Add to these Anthropic, a single time and without any space data, for the English translation of the public catalog (section 2). When you import a recipe from its link, that recipe's site sees Popotam's server reading its page, and your browser displaying its photo (section 11). No others.

None of these providers receives both your email address and your meal plan: neither OpenAI nor Mistral ever sees your address or your space identifier, Scaleway only delivers the message you agreed to receive, and the notification service receives neither one. No ad network, no data broker and no social network receives anything at all.

If you install the Android app from Google Play, Google handles its download and its updates under its own terms, as for any app. The app opens Popotam as is: it collects nothing more than the website.