Privacy policy

Last updated: 28 October 2026.

Panna is a recipe app. This page says what it keeps about you, why, who sees it, and how to delete it.

Who is responsible

Jānis Seržants, a private individual, Latvia. Write to serzants.janis@gmail.com.

What we keep

• From Google or Apple, when you sign in: your e-mail, your name and the id they know you by. With Apple, also a token that lets us tell Apple when you delete your account. Never a password: the app has none.
• What you enter yourself: recipes and their photos, a profile photo, the shopping list, cooking history and notes, your language and unit choices, feedback.
• Sign-in keys, so you do not sign in every time.
• When the app reads a recipe for you: that it happened, when, whether it was a recipe, and what it cost. Not the text, the link, the picture or the answer.
• A server log: the address your phone connects from, the time and the request. It is there for security and is kept for 30 days.
• Usage statistics: what happens in the app, such as a recipe being created, shared or cooked, which screen was opened and how many steps a recipe had. They carry only a random device id, with no e-mail and no recipes. You can turn them off under You.

What we do not keep

Passwords. Photos you upload are re-encoded and everything embedded in them, location included, is removed. There is no advertising, and this site sets no cookies. The statistics never carry what you wrote: no recipes, no notes, no name or e-mail.

Why, and on what basis

Recipes, lists, history and sign-in: to run the app you asked for. The basis is Article 6(1)(b) of the GDPR, the contract between us, which is the terms of use. The log and the backups: to keep the service up and secure. The basis is Article 6(1)(f), our legitimate interest. Feedback: to answer you, again under Article 6(1)(b). Reading a recipe for you: because you asked, under Article 6(1)(b) as well. Usage statistics: to understand how the app is used and make it better. The basis is again Article 6(1)(f), our legitimate interest: the first screen tells you, and the switch under You turns them off at any time.

Who processes it for us

OVHcloud (OVH SAS, France) runs the server, in a data centre in the European Union, under the data processing agreement that is part of their terms. Every night a backup goes to Google Drive: Google LLC (USA) holds it for 14 days as a file encrypted before it leaves the server, so Google cannot read it. When you send feedback it is sent through Gmail and lands in a Gmail mailbox (Google LLC), with your name and e-mail, so you can get a reply. Google and Apple, when you sign in with them, are controllers in their own right under their own policies. Usage statistics are processed by PostHog Inc. in its EU cloud, in a data centre in Frankfurt, under their data processing agreement. When the app reads a recipe for you, your text, the page's text or the picture goes to Mistral AI (France), which processes it in the European Union under the data processing agreement that is part of their terms. Mistral keeps it for 30 days to spot abuse, then deletes it, and does not use it to train its models. The app asks before the first time it sends anything there. A picture has everything embedded in it, location included, removed first, and we do not keep it. If you give a link, our server fetches the page, so the site sees the server's address rather than yours. Transfers to the USA rest on the EU-US Data Privacy Framework where the recipient is certified under it, and on standard contractual clauses otherwise.

Shared recipes

A recipe is visible only to you until you create a link. Anyone who has the link sees the recipe, its photos and your name. They can save a copy: it is theirs, and it stays with them after you revoke the link or delete your account. Your notes and history never travel with a recipe.

How long

For as long as you have an account. The log for 30 days. Backups for 14 days, so a deleted account is fully gone within 14 days. Usage statistics for 12 months: once you turn them off, no new events are sent, and what was sent before stays until it ages out.

How to delete

In the app: You, then Delete account. The account with its recipes, photos, lists and history goes at once. Or write to serzants.janis@gmail.com from the e-mail you sign in with. What stays: copies other people saved from your links, the backup until it ages out, and, with nothing linking it to you, the record of what each recipe read cost.

Your rights

You can ask what we hold about you, have it corrected, deleted or restricted, or object to how it is used. Objecting to the statistics is simple: the switch under You turns them off at once. You can also ask for your data: we send it by e-mail as JSON. Write to serzants.janis@gmail.com and you get an answer within a month. If you think your data is handled wrongly, you can complain to the Latvian data protection authority, the Datu valsts inspekcija, at dvi.gov.lv.

Children

The app is not meant for people under 13.

Changes

When this page changes, the date at the top changes. Significant changes are announced in the app.