Privacy Notice

Who is responsible

piato decides what happens to your data and is responsible for it.

Write to privacy@piato.me with any question about this notice. You get an answer within 30 days.

piato runs in the European Union and your data stays there.

What piato stores

Your email address. It is how you sign in, and it is the only way to reach you.

What you told piato about your body: sex, date of birth, height, current weight, target weight, and how active you are. Every weight you enter is kept, so the app can show the trend.

The name you chose. It is optional, and it can be a nickname.

Optional, and only if you record it: the hours you slept, and the day a period started. Nothing else about a cycle is stored — no symptoms, and no prediction of a fertile window. The app uses the date to explain the water your body holds in that week, and to know when to ask again.

Your meals: the photographs, anything you typed about them, and the foods and nutrient numbers worked out from them.

Your settings: language and time zone.

The version of these documents you accepted, and the day you accepted it.

How you use the app: the minutes it was open on your screen, and which days you opened the sharing screen or the hunger check. It is counted so the app can be improved. Never what you answered, and never the moment — only the day.

This is health data

Your weight and your eating history say something about your health. European law calls this a special category of data and asks for your explicit permission before anyone may handle it.

That permission is what you give when you tick the box. It is the legal basis for everything described here.

You can withdraw it at any time. Because there is no part of piato left once the food and the weight are gone, withdrawing it closes your account and deletes your data.

Why piato uses it

To sign you in and keep you signed in.

To work out your daily calorie and nutrient targets from the formula, and to keep them honest against the weight you actually record.

To read your food photographs and turn them into a list of items with numbers.

To show your own history back to you.

To show you to the other members, on the Share tab and on your page, as described below.

Nothing is used for advertising. Nothing is sold. Nothing goes to a data broker. There is no profiling beyond the arithmetic that produces your own targets.

Who else touches it

Supabase stores the database, the accounts and the photographs, on servers in the European Union.

Vercel runs the application itself, from Dublin.

Anthropic reads your food photographs and your notes and returns the nutrition estimate. Anthropic does not use what is sent through its API to train its models.

OpenAI turns a spoken meal into words, when you use the microphone button. It receives the recording and nothing else. The recording is not stored, by piato or by anybody else, and it reaches OpenAI through Vercel.

Resend sends the sign-in email. It sees your email address and nothing else.

Each of these acts only on instruction and may not use your data for its own purposes.

What other members see

Other members who open your page see your name and picture, and a reading of how you used piato over your last 7 days. They also see whatever you post or reply there.

It never shows your email address, your weight, your target weight, a meal you logged, or a calorie figure.

Turning off the switch that shows you on the board hides that reading from the others. Your name, your picture and what you post stay visible.

How long it is kept

A full photograph is kept for 30 days, so that you can still correct an old meal. After that only a small thumbnail remains, for the journal.

Everything else is kept until you ask for it to go.

When your account is deleted, all of it is deleted with it, photographs included. This cannot be undone.

Your rights

Ask for a copy of everything piato holds about you.

Correct anything that is wrong. Most of it you can correct yourself in Settings.

Delete your account and everything in it.

Withdraw your permission, which has the same effect as deleting the account.

Object to what is done with your data, or ask for it to be restricted.

Complain to the data protection authority in your country. In Italy that is the Garante per la protezione dei dati personali.

For any of these, write to privacy@piato.me.

Cookies

piato puts two things in your browser: one that keeps you signed in, and one that remembers your language.

There is no analytics, no advertising, and no tracking of any kind. This is why piato never asks you to accept cookies.

Children

piato is not for anyone under 18. If an account turns out to belong to a child, it is deleted.

When this notice changes

New wording means a new version, and piato asks you to accept it before you carry on.

The version you accepted, and the day you accepted it, stay on record.