Privacy notice

1. Data controller

The data controller is Sebastiano Sannino, operator of Sunny Family, reachable at info@sunnyfamily.app for any request about personal data. This notice is given under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

2. What data we process

Account data: name, email, password (stored only in hashed form; there is none if you only sign in with Google or Apple), sign-up date and the accepted terms version. If you sign in with Google or Apple we receive from them an account identifier, the email and, when available, the name; with Apple the email may be an anonymous relay address. For sign-in, Google and Apple act as independent controllers under their own privacy notices.

Household data: members’ names, ages and kind (adult or child), meal attendance, portions, preferences, exclusions and allergies; menus, recipes, shopping list, meal history and ratings, learnings and imported documents (photos of menus or receipts).

Points, missions and badges, if the family keeps them on: actions taken in the app (for example a rating, a product used before it expires, a completed shopping trip) with the date and the member who took them, without quantities or kinds of food.

Community data, only if you take part: the family’s monthly contribution to the community challenge, the pseudonym and weekly scores in the league, published recipes with their reactions and reports.

Minimal technical data needed to run the service, for example session tokens stored securely on the device. The IP address a sign-in or password recovery request comes from is used only in memory to limit attempts and is not saved in our database.

Expiry reminders: if you turn them on, the app schedules the notifications directly on the phone, with the names of the products about to expire; reminders do not go through our servers.

Subscription data: active plan, status, period and purchase store. We do not process card or payment method details, which stay with Apple or Google.

Usage data: the usage statistics described in section 6.

Questions to Sunny: the text of the questions you write or dictate in “Ask Sunny” and the answers. They stay only on your phone while the conversation is open: our server keeps neither the questions nor the answers.

3. Allergies, conditions and health data

Allergies, intolerances, health conditions and health-related diets are data concerning health (special categories, Art. 9 GDPR). We process them only with your explicit consent, separate from accepting this notice: you give it by ticking the “Health data” box in onboarding or before adding the first allergy or condition. We record who gave the consent, when and on which version of this notice. Without consent the app saves no allergies or conditions and neither menus nor Sunny take them into account. With consent we use them only to adapt menus (personal or shared), exclude unsuitable foods and take them into account in Sunny’s answers.

The consent covers the whole household and is given by a member who can edit the family. If you enter data about other members, in particular minors, you confirm that you have their consent or hold parental responsibility. You can withdraw consent at any time in Family › Data: withdrawal immediately deletes the allergies and conditions of all members and does not affect processing already carried out. If the household had allergies or conditions saved before this update, they stay saved but we do not use them until you give consent or delete them.

4. Purposes and legal basis

To provide the requested service (account, households, menus, shopping, history, Sunny’s answers): performance of a contract (Art. 6(1)(b) GDPR).

To take allergies and health data into account: explicit consent (Art. 9(2)(a) GDPR).

For the security of the service and abuse prevention (for example limiting sign-in attempts): legitimate interest (Art. 6(1)(f) GDPR).

To manage the subscription and the plan’s usage limits: performance of the contract (Art. 6.1.b GDPR); to keep AI usage logs for cost control and abuse prevention: legitimate interest (Art. 6.1.f GDPR).

For usage statistics: legitimate interest (Art. 6.1.f GDPR) in measuring and improving the service with minimal, first-party data. You can object by turning off the “Usage statistics” switch for app statistics, or by writing to info@sunnyfamily.app.

For points, missions and badges, features internal to the family that can be turned off: performance of the contract (Art. 6.1.b GDPR).

To add the family’s contribution to the community challenge: legitimate interest (Art. 6.1.f GDPR) in offering a shared anti-waste goal, showing others only the total; you can object by turning points and badges off.

To take part in the league and to publish a recipe: consent (Art. 6.1.a GDPR), which you can withdraw by leaving the league or withdrawing the recipe; to moderate reported recipes: legitimate interest (Art. 6.1.f GDPR).

5. Artificial intelligence (OpenAI)

To generate personal menus and regenerate dishes, and to read imported menus and receipts, our server sends OpenAI only the strictly necessary family profile data (for example preferences, exclusions, allergies, conditions and meal participants) or the image or text of the document. We do not send the account name, email or other identifying data beyond the family profile.

Questions to Sunny. Questions about the menu, shopping and pantry are answered by our server, without AI. For other questions (“free questions”) we send OpenAI the text of the question, the app language and a summary of the household data needed to answer: members with name, age, diet, exclusions and preferences and, only with the health data consent, conditions and allergies; this week’s and next week’s approved menu; what is missing from the shopping; the pantry, if the plan includes it; the approved learnings. We do not send earlier questions or account data. What you write in the question reaches OpenAI as it is: avoid including data you do not want to share, especially other people’s health data.

OpenAI acts as a data processor under its data processing addendum (DPA); for customers based in the European Union the contracting party is OpenAI Ireland Ltd. Requests are sent with response storage turned off (store: false); OpenAI may keep them for a limited period, at most 30 days, only for abuse monitoring and security. Under the API service terms, the data is not used to train models. The shared menu of the Free plan is composed by our server without sending data to OpenAI.

OpenAI Ireland may transfer the data to other OpenAI group companies or to its providers outside the European Economic Area, for example in the United States. The transfer takes place on the basis of the standard contractual clauses approved by the European Commission (Art. 46 GDPR) or an adequacy decision (Art. 45 GDPR). You can ask about these safeguards by writing to info@sunnyfamily.app.

6. Usage statistics

To understand which features are useful and how to improve them we record first-party usage statistics: they stay on our servers, are not shared with third parties and are not used for advertising or profiling.

Service events. When an action succeeds our server records what kind of action it was (for example an approved menu, a pantry product used, a question to Sunny and how it ended), with the date, account, household, plan and a few closed values such as counts or the kind of meal. They are needed to measure and improve the service and stay on even with the “Usage statistics” switch off.

App statistics. If the “Usage statistics” switch is on, the app also records the screens opened and some features used (for example the welcome tour, the swipe review, recipes opened, the buttons in Sunny’s answers), together with a random installation identifier stored on the phone, the operating system, the app version and the language. The switch is on at first: you find it at the end of onboarding and in Family › Data; if you turn it off the app stops recording and deletes the events not yet sent.

Statistics never contain text you write (questions to Sunny, notes, instructions, recipes), names, ages, diets, allergies or other health data, the content of receipts and photos, emails, IP addresses or the phone model.

We keep them for 13 months, then delete them. If you delete the account they remain only as anonymous totals, no longer linked to you, the household or the phone.

7. Emails

We use your email to send you address verification and password recovery codes and, if someone invites you, the invitation to a household. Emails are sent through an email provider acting as a data processor. We do not send promotional messages.

8. Community

Sunny Family never shows other families your family’s names, ages, allergies, diets, menus, quantities, spending or contacts. Children do not take part in the community: only an owner who declares they are at least 18 can join the league, and only someone who declares they are at least 18 can publish a recipe.

Community challenge. If points and badges are on, the family’s actions counted by the month’s challenge (for example products used before they expire) are added to those of all other families. Other families and the administrators see only the total and the number of families taking part. Turning points and badges off under Family › Preferences stops your family from contributing.

Anti-waste league (optional, Premium). If the owner joins, the family appears under a generated pseudonym (for example “Sunflower Family”), which can be changed, in a weekly ranking of up to 20 families similar in number of members and presence of children. The other families in the group see only the pseudonym, the position and the share of products saved; the administrators see only how many families are in each tier. Leaving the league, turning points and badges off or deleting the account deletes the pseudonym and scores.

Shared recipes (optional). You can publish the recipe of a dish your family loved: only title, ingredients, steps and diet, time and season tags; the “kids love it” tag can be removed. Before publishing, the app blocks texts with members’ names, contacts or links. Other families do not know who published it and see only how many families tried it. You can withdraw it at any time. Reports record the reporting family (one per recipe) and the reason; after three reports the recipe is hidden until an administrator decides to restore or remove it.

9. Who sees the data

A household’s data is visible to the people who belong to it, according to the role assigned by the owner. We do not sell data or share it with third parties, except the technical providers listed (hosting, OpenAI, mail and, for subscriptions, Apple and Google) and where required by law.

Other families see only what is described in the Community section. The controller and the people it authorizes to administer Sunny Family can see, only when needed for support, subscriptions, security or abuse prevention: account data (name and email), the households you belong to with their name and number of members, the plan with its usage of the limits, and the AI usage log (kind of operation, cost and outcome, never the content). From the admin panel they do not see the family profile, menus or pantry. Every change made by an administrator is logged. Of the community they see the challenge totals, the number of families per league level and reported recipes, never which family they belong to.

10. Retention

We keep data while the account and the household are active. Password recovery codes expire after a few minutes, invitations at the stated expiry. When you delete the account we immediately delete the account, its sign-ins, the subscription recorded in Sunny Family and the households where you were the only member; the AI usage log keeps only the cost, no longer linked to you. Subscriptions bought on the App Store or Google Play are cancelled in the store. Any backup copies are removed within a reasonable technical time, unless the law requires otherwise.

To control costs and prevent abuse we keep an AI usage log (date, kind of operation, household, tokens used and estimated cost, without the content of requests or responses) for 13 months; for questions to Sunny we also record the kind of question (menu, shopping, pantry or free) and how it ended, never its text. Legal basis: legitimate interest (Art. 6.1.f GDPR).

Points, missions and badges stay in the family’s log for the last 400 days. For the community challenge we keep each family’s contribution for 13 months, then only the challenge total remains. In the league we keep the weekly results of the last 8 weeks, while the family stays in the league. Published recipes, with reactions and reports, are kept until they are withdrawn or until the account of the family’s only member is deleted; recipes removed by moderation are no longer visible to others.

11. Your rights

You can request access, rectification, erasure, restriction and portability of your data and object to processing based on legitimate interest by writing to info@sunnyfamily.app. You can delete your account at any time under Family › Account › Delete account.

From the app’s Data section you can export a full backup of the household (portability) and reset the data. You also have the right to lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali, www.garanteprivacy.it).

12. Changes

If we update this notice the version shown at the top changes and we ask you to review and accept it again at your next sign-in.