Privacy policy

info@5pieces.de

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you visit it, Vercel processes technically necessary data such as your IP address, date and time, the page requested, and your browser and operating system (server log files). This keeps the site secure and reliably available.

The legal basis is our legitimate interest in reliable operation (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel; transfers to the USA are covered by the EU Standard Contractual Clauses.

We use no analytics or tracking services and no ads. Fonts are served from our own server, not by third parties. We pick the page language automatically from your browser’s language setting.

If you switch the language manually, we remember your choice in a cookie named “NEXT_LOCALE”. It holds only the language code (e.g. “de”) and is deleted after one year. It is technically necessary so the site respects your choice on your next visit (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). We set no other cookies.

Pluko needs no account. The details for your daily goal (e.g. weight, height, age, sex and goal), your entries and your history are stored only locally on your device. We have no access to them. If you delete the app, this data is gone.

The app uses photos only for recognition; they are not stored in the app. It asks for permission before accessing the camera or photo library.

When you take a photo or describe your meal, the app sends the photo or text to our server (hosted by Vercel, see above). The server passes the request on to the AI “Claude” by Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, and returns the estimated nutrition values to you. We store neither the photo nor the text.

Anthropic processes the data on our behalf and does not use it to train its models. Transfers to the USA are covered by the EU Standard Contractual Clauses. Please photograph only your food – no people or other personal items.

The legal basis is providing the feature you use (Art. 6(1)(b) GDPR).

So that the free trial applies only once per device and the recognition is not misused, the app uses a device ID. On iPhone, this is a random ID that the app creates on first launch and stores in your device’s keychain. It stays there even if you delete and reinstall the app – that is exactly its purpose. On Android, the app uses the Android ID assigned by the system, which only applies to Pluko on your device. The ID reveals nothing about you, and we do not link it to any other data.

The app sends the device ID with every recognition. Our server only stores a hashed, irreversible value of it with the database service Upstash, Inc. (USA): first, the start of your trial – this entry is deleted automatically 12 months after the trial started – and second, the number of your requests per day for the daily limit. These counters delete themselves automatically after 48 hours at the latest.

If errors occur, our server logs technical details such as the time and type of error – without photos or text.

The legal basis is our legitimate interest in protecting the trial from repeated use, running the service reliably and protecting it from misuse (Art. 6(1)(f) GDPR). Storing and reading the device ID on your device is strictly necessary for the service you use (Section 25(2) No. 2 TDDDG). Transfers to the USA are covered by the EU Standard Contractual Clauses.

After the free trial, AI recognition requires a subscription. It is purchased and paid for exclusively through Apple’s App Store or Google Play. We never see your payment details; Apple’s or Google’s privacy policy applies to them. The subscription is tied to your Apple ID or Google account and can be cancelled there at any time.

To check whether a subscription is active, we use the service RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. For this, the app transmits a random user identifier (without name or email address) and Apple’s or Google’s purchase receipts with details such as product, purchase date, price, currency and country. For technical reasons, RevenueCat also processes details such as IP address, device model, and operating system and app version. Our server only asks RevenueCat whether a subscription is active for your identifier.

RevenueCat processes this data on our behalf. Transfers to the USA are covered by the EU Standard Contractual Clauses. The legal basis is the performance of the subscription contract (Art. 6(1)(b) GDPR).

If you allow it, Pluko reads your burned active calories from Apple Health (iOS) or Health Connect (Android) to add them to your daily budget. This data stays on your device, is never transferred to us or third parties and is never used for advertising. You can revoke access at any time in your system settings.

You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR). Just send us an email. Since your entries only live on your device, we usually hold no data that we could link to you.

You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

We update this policy when the app or the website changes. The version published here applies.