Privacy Notice

1. Who is responsible

The data controller is Eric K. — the operator of Où Déjeuner. To ask a question about this notice or to exercise your rights, use the request form at the end of this page.

2. What we process

The app does not ask for your name, email address, or any account details. It does process:

• A random browser ID. When you first use a write feature (voting, tagging, commenting), the app stores a random identifier (od_browser, a UUID) in a cookie on your device. It is not linked to your identity — it exists only so the app can show you your own past reactions and prevent duplicate votes.
• Your contributions. Votes and reactions, tags, restaurant submissions, issue reports, and any free-text comments you write. These are stored against the random browser ID only. Anything you type into a comment is stored as written — please do not put personal data about yourself or other individuals there.
• Technical connection data. Like any website, our servers and our network provider record IP addresses and basic request information in logs, for security and to keep the service running.
• Anything you send us. If you use the request form at the end of this page, we store what you write and any email address you choose to give, so we can answer you. If your browser already holds the random ID described above, the form records it too, so we can find the data your request is about.

3. Cookies

The app uses only strictly necessary cookies — there are no advertising or analytics trackers:

• od_gate — remembers that you entered the access password (up to 365 days).
• od_browser — the random browser ID described above (up to 365 days).
• od_admin — used only by administrators (up to 24 hours).
• Our network provider (Cloudflare) may set a security cookie to protect the site from abuse.

Because these cookies are strictly necessary for the service you asked for, no consent banner is shown. You can delete them at any time in your browser settings; doing so will sign you out and detach you from your past contributions.

4. Why we process it, and our legal basis

The purpose is to operate a shared lunch-picker. The legal basis is our legitimate interest (GDPR Art. 6(1)(f)) in providing a simple internal tool, weighed against the minimal data involved. Technical logs are processed on the basis of our legitimate interest in keeping the service secure.

5. Who can see it, and where it is stored

Contributions are visible to other users of the app. Data is hosted on Amazon Web Services in Paris, France (eu-west-3), with an encrypted backup in the same region. Traffic is routed through Cloudflare for security and delivery. Application errors are reported to Sentry (EU region) so we can detect and fix faults. These providers act as processors on our behalf; where any data is processed outside the EU, it is covered by Standard Contractual Clauses. We do not sell your data or share it for advertising.

6. How long we keep it

Cookies expire as listed in section 3. Contributions are kept while the app is in active use and removed when they are no longer relevant. Server logs are kept only for a short period for security purposes. Requests sent through the form below are kept only as long as needed to handle them.

7. Your rights

Under the GDPR you can request access to, correction of, or deletion of your data, and you can object to or ask us to restrict processing. Because data is tied only to a random browser ID, the request form below records that ID from your browser automatically, where one exists, so we can locate your records. To exercise any right, use the request form at the end of this page.

You also have the right to lodge a complaint with your data protection authority — in France, the CNIL.

8. Automated decisions

The app does not carry out automated decision-making or profiling that produces legal or similarly significant effects.

9. Changes to this notice

If this notice changes, the "last updated" date above will be revised.

10. Contact us or make a request

Use this form to ask a question about this notice or to exercise any of the rights in section 7. It goes directly to the administrator of Où Déjeuner. If you would like a reply, leave an email address — it is used only to answer your request, and for nothing else.