Peanut

Privacy policy

Version of 28 September 2026

Peanut is an iPhone app, together with a website, that helps people with allergies find restaurants thanks to allergen information whose source is shown. This policy explains which personal data we process, why, for how long, who can access it, and how to exercise your rights. It describes how the service actually works on the date of its version.

1. Who is responsible for your data

Peanut is published by Yanis Rozier (Nay Studio), sole trader (entrepreneur individuel), 231 rue Saint-Honoré, 75001 Paris, France, SIREN 993 287 325 (RNE), who is the controller of your data.

For any question about your data: contact@naystudio.fr. No data protection officer (DPO) has been appointed so far. [TO BE VALIDATED : whether a DPO must be appointed given the processing of health data]

2. In short

The map and the restaurant search work without an account.
Your allergies and the health data in your reviews are only recorded with your explicit consent. You can withdraw it at any time in the app: Settings, My consents.
No advertising, no audience measurement, no tracking, no sale of data.
You can delete your account yourself, from the app.

3. The data we process

3.1 Your account

Data: E-mail address, password (only kept in an irreversibly encrypted form), display name (optional), role (user, restaurant owner or administrator), language, creation and update dates. The name entered at sign-up and the version of the terms of use you accepted are also kept in the technical sign-up data, and are not updated if you later change your name.
Why: To create and manage your account, and identify you.
Legal basis: Performance of the contract (terms of use).
How long: Until your account is deleted. An account with no activity at all for two years (no sign-in, and no opening of the app while signed in) may be deleted, and only after a warning sent by e-mail at least 30 days before.
Who can access it: You, and Peanut administrators for your profile (e-mail, name, role).

3.2 Sign-in and security

Data: For each open session: the IP address, the identification of the device or browser (user agent) and the dates. A log of authentication events (sign-up, sign-in, account deletion), which contains your e-mail address. The technical logs of our hosting provider (IP addresses, requests).
Why: To secure the service, prevent abuse and detect inactive accounts.
Legal basis: Our legitimate interest in securing the service.
How long: A session is deleted when you sign out (signing out of the app closes all your sessions) or with your account. Authentication log: 6 months at most. Technical logs of the hosting provider: 7 days.
Who can access it: Our hosting provider and the publisher, for the security of the service.

On your phone, your session is kept in the secure iOS keychain until you sign out. On the restaurant portal, it is kept in cookies that are strictly necessary for signing in (see section 10).

3.3 Your allergies (health data)

Data: The allergens you save in your profile.
Why: To pre-fill your search filters.
Legal basis: Your explicit consent (article 9.2.a of the GDPR), asked before the first entry. Without this consent, our database refuses to save them.
How long: Until you withdraw your consent, which deletes them immediately, or until your account is deleted. You can also delete them one by one.
Who can access it: Only you. No other user, restaurant owner or administrator can access them through the service.

3.4 Your reviews (published health data)

Data: The allergens concerned by your visit, any allergic reaction after the meal, your answers and ratings about the restaurant, your comments, your display name at the time of publication, and the date.
Why: To inform other people with allergies about how a restaurant handles allergies.
Legal basis: Your explicit consent to the publication of this health data, asked once per account, before your first review. Without this consent, our database refuses the publication.
Who can access it: Everyone: reviews are public, readable even without an account, under your display name. Your account identifier is never made public, nor shown to restaurant owners. Peanut administrators can verify or hide a review.
How long: See below: it depends on what you choose.

The name shown on a review is the one you had when you published it: changing your name later does not change it. You can delete any of your reviews at any time. When you withdraw your consent (Settings, My consents), you choose what happens to the reviews you have already published:

Detach them from your name: they stay published with no link to you. Your account, your name, your free-text comments and the technical data are erased, and the date is rounded to the month. The multiple-choice answers (allergens, reaction, ratings) remain, because they are useful to the safety of other people with allergies.
Delete them: all your reviews are erased, together with the restaurants’ responses and the reports about them.

Exception: a review the restaurant has responded to is never detached. It is deleted together with the response, because we cannot guarantee that the response does not identify you. When you delete your account, your reviews are detached according to the same rule.

3.5 Your consents

Data: For each consent (profile allergies, publication of reviews, terms of use, terms for restaurant owners): the version of the accepted text, the date it was given and, where applicable, the date it was withdrawn.
Why: To be able to prove your consent, and its withdrawal.
Legal basis: Our legal obligation to demonstrate consent (article 7.1 of the GDPR).
How long: As long as your account exists, history included. Everything is deleted with your account.
Who can access it: You.

3.6 Your saved restaurants

Data: The restaurants you save as favourites.
Why: To find them easily.
Legal basis: Performance of the contract.
How long: Until you remove them, or until your account is deleted.
Who can access it: Only you.

3.7 Your photos of menus and allergen charts

Data: The photo, its title, its date and the link to your account. Before sending it, the app re-encodes the photo, which removes its metadata, including the GPS position. If this re-encoding fails, the upload is refused.
Why: To check, then publish, a restaurant’s allergen information.
Legal basis: Performance of the contract, which includes a licence on your contributions.
How long: Rejected photo: the file is deleted when it is rejected, and its record 30 days later. Approved photo: it stays published, including after your account is deleted; its title and the link to you are then erased.
Who can access it: Peanut administrators, who check it, and the owner of the restaurant. Once approved, everyone, without your identity.

3.8 Your restaurant suggestions

Data: The name, address, coordinates and Google Maps link of the suggested restaurant, your remarks, and the link to your account.
Why: To expand the list of restaurants.
Legal basis: Performance of the contract.
How long: Kept for the history of the database. When your account is deleted, the link to you and your remarks are erased.
Who can access it: You, and Peanut administrators.

3.9 Locating a suggested address

Data: When you ask to place the address of a suggested restaurant on the map, our server sends this address (street, district, city) to Mapbox to get its coordinates. We keep a log of the request: the address, the result and the link to your account.
Why: To place the restaurant on the map, limit the number of requests and monitor their cost.
Legal basis: Performance of the contract, and our legitimate interest in controlling the costs of the service.
How long: The link to your account is erased after 30 days, or earlier if you delete your account. The address and its result are kept, with no link to you, to avoid repeating the same requests and to monitor costs.
Who can access it: Peanut administrators. Mapbox only receives the address, never your identity.

3.10 Your location

Data: Your precise location, if you allow the app to access it while in use. It is read when the app starts, not tracked continuously.
Why: To centre the map on you, show nearby restaurants and compute distances.
Legal basis: Performance of the service you request. Access depends on the permission you give iOS, which you can withdraw in the iPhone settings: the map then works without your location.
How long: Your location is not recorded anywhere, neither on your phone nor on our servers.
Who can access it: Our server, for the time it takes to look up the restaurants in the displayed area and sort the results by distance. Mapbox, when you search for an address or a place: it receives the text you type and your location rounded to about 1 km, without your identity. The map background is provided by Apple (Maps), under its own privacy rules.

3.11 If you are a restaurant owner

Data: Your position in the restaurant, your business phone number, the justification of your request and the information about the restaurant; the status and dates of your access to the restaurant area, and any note from the team; your links to restaurants; the history of changes to restaurant pages (the page before and after); the documents you upload (menus, allergen charts); your responses to reviews; your reports of reviews.
Why: To check that you represent the restaurant and manage your restaurant area.
Legal basis: Performance of the contract (terms for restaurant owners).
How long: Until your account is deleted. Your requests, your access, your links to restaurants and your responses to reviews are then deleted. The page history and your reports are kept with no link to you and no free text, and your published documents stay online with no title and no link to you. A restaurant page left without any manager goes back to “to be checked again”.
Who can access it: You and Peanut administrators. Your responses to reviews are public, in the restaurant’s name. The restaurant’s phone number and website are public on its page.

No online payment is processed today: access to the restaurant area is enabled by the team.

3.12 Your account deletion request

Data: The date and status of each deletion attempt.
Why: To limit abuse (three attempts per hour).
Legal basis: Our legitimate interest in protecting the service.
How long: 30 days. The link to your account disappears as soon as the deletion is done.
Who can access it: Nobody through the service: only the server uses it.

4. What we do not do

No advertising, no audience measurement tool, no error tracking tool.
No tracking across apps or websites, no advertising identifier.
No selling or renting of your data.
No automated decision-making or profiling about you.

5. Who receives your data

Supabase, our hosting provider: database, authentication, photo storage and server functions. Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Data hosted in the eu-central-1 region (Frankfurt, Germany).
Sending of e-mails related to your account, such as the sign-up confirmation: OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France.
Mapbox, for address search and locating suggested restaurants. Mapbox receives the searched text and a location rounded to about 1 km, or the suggested address, never your identity. Mapbox is a company established in the United States: Mapbox, Inc. is certified under the EU–U.S. Data Privacy Framework, recognised by the European Commission as providing an adequate level of protection (decision of 10 July 2023).
The website hosting provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States (contact: vercel.com/help). It receives the requests sent to the website and the restaurant area (IP address, browser, pages requested, portal session cookies) and keeps a technical log of them for one day. The portal functions run in Frankfurt (Germany); pages are served from the server of its network closest to the visitor. Vercel Inc., established in the United States, is certified under the EU–U.S. Data Privacy Framework.
Apple, which provides the map background (Maps) and distributes the app, under its own responsibility.
The public, for your reviews and your approved photos, under the conditions described above.
Public authorities, only on a request provided for by law.

6. Your rights

You have the following rights over your data:

access: know which data we hold about you, and get a copy;
rectification: correct inaccurate data;
erasure: have your data deleted;
restriction: have the use of data suspended, for example while its accuracy is checked;
objection: object to processing based on our legitimate interest;
portability: receive the data you provided to us in a structured, machine-readable format;
withdrawal of consent, at any time, without affecting what was done before the withdrawal;
set instructions on what happens to your data after your death.

Many of these rights can be exercised directly in the app, without writing to us:

change your display name: Settings;
withdraw a consent: Settings, My consents;
delete your allergies, a review or a saved restaurant: from the relevant screen;
delete your account: Settings, Delete my account.

Exercising your rights

Write to contact@naystudio.fr, preferably from your account’s e-mail address, stating which right you are exercising. If you write from another address, we will ask you to confirm your request from your account’s address, so that nobody else can obtain your data.

We reply within one month. This period can be extended by two months if the request is complex: we then let you know within the first month. It is free of charge. For an access or portability request, you receive a JSON file containing the data linked to your account.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the authority of your country of residence in the European Union.

7. Minimum age

You must be at least 15 years old to create a Peanut account. If we learn that an account was created by a younger person, we delete it.

8. Security

Exchanges between the app, the website and our servers are encrypted. Passwords are never stored in plain text. Rules enforced by the database itself restrict each person to their own data: for example, your allergies can only be read by you. Photos are stored in a private space and only made public once approved.

9. Where your data is

Our data is hosted by Supabase: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. Data hosted in the eu-central-1 region (Frankfurt, Germany). Mapbox and the website hosting provider, established in the United States, receive the data described in section 5. [TO BE VALIDATED : other transfers outside the European Union, depending on the region and hosting providers chosen]

10. Cookies

The public pages of the website, including this one, do not set any cookie. The restaurant portal only sets the cookies needed to keep you signed in, which do not require consent. The app does not use cookies: your session is kept in the secure iOS keychain.

11. Changes to this policy

Each version shows its date at the top of the page. If a change affects the use of your data, we will inform you before it applies, and ask for your consent again when it is required. See also the terms of use and the legal notice.