MyCellıer

Privacy policy

Last updated: October 22, 2026.

MyCellier is published by MINDSERSIT (SASU with €100 share capital, RCS Lyon 983 970 245, 155B rue Marcel Mérieux, 69007 Lyon, France). Processing of your personal data complies with the French Data Protection Act of January 6, 1978 (as amended) and the General Data Protection Regulation (GDPR) of April 27, 2016.

What we collect

To run the app, we collect:

  • Your email address (account creation and sign-in)
  • An Argon2-hashed password (never stored in plaintext)
  • The items you add to your pantry
  • Your preferences (zones, alerts, language, time zone)
  • If you create an emergency supply: the number of people to feed, meals per day and the target duration, and how your meals are made up, to work out what your supply covers. The last calculation is also kept with your supply on our servers, to show it to you if Premium ends; it is deleted with your account.
  • If you turn on push notifications: a technical identifier of your device (Web Push endpoint + associated VAPID keys)
  • If you subscribe to Premium: your Stripe customer and subscription identifiers, the plan, status and dates of your subscription, and when you asked for Premium right away. Your payment details (card, billing address) are collected and kept by Stripe, never by MyCellier.
  • If Premium is given to you: its end date and a short internal note saying why, which is not shown to you

Purposes

Your email is used to sign you in, deliver expiry alerts, and send transactional emails (verification, password reset). Your items make the app work. Subscription data is used to provide Premium, bill it and keep our accounts. No data is sold, traded, or used for advertising.

Hosting and retention

Data is hosted in Europe (OVHcloud, France) and kept for the life of your account. If you delete your account from your settings, all your data is erased within 30 days, in line with our backup policy.

One exception: if you subscribed to Premium, your invoices and your customer record at Stripe are kept for ten years, as the French Commercial Code requires (article L123-22), even after your account is deleted. They hold only what billing needs.

Your rights (GDPR)

Under the GDPR, you have the following rights over your data: access, rectification, erasure, processing restriction, portability, and objection. You can exercise them:

You may also file a complaint with the CNIL (the French data protection authority — www.cnil.fr).

Cookies and local storage

Nothing is written to or read from your device for tracking, analytics, or advertising. Everything below is either strictly necessary for the site to work or stores a display preference, so a consent banner is not required.

  • cellier_session — keeps you signed in. Lifetime: the session.
  • cellier_csrf — cross-site request forgery protection. Lifetime: the session.
  • cellier_locale — remembers your language. Lifetime: 1 year.
  • cellier-theme (localStorage) — remembers your light or dark theme. Lifetime: until you clear it.
  • During a payment, Stripe’s page (checkout.stripe.com) and its customer portal set their own cookies, on their domain, for payment security and fraud prevention. They fall under Stripe’s policy.
  • cellier_complimentary_reminder (localStorage) — the day the complimentary Premium reminder last showed, so it shows once a day at most. Only if you have complimentary Premium. Lifetime: until you clear it.
  • cellier_cache_* and cellier_offline_queue (localStorage) — the last copy of your pantry, the pantry on screen, the last calculation for your emergency supply and your meal split, and changes made offline, so the app opens and works without a network. Lifetime: until you sign out, which clears them.
  • Service worker cache — the application files, so it works offline. Lifetime: until your browser evicts it.

The audience measurements described below write nothing to and read nothing from your device.

Product analytics

To understand which pages work and where visitors drop off, MyCellier uses PostHog in cookieless mode, hosted in the European Union. Concretely:

  • PostHog stores nothing on your device: no cookie, no localStorage, no sessionStorage. Visits are counted using a hashed identifier computed on PostHog’s servers and renewed daily.
  • These browsing measurements cannot identify you: they are not tied to your account, and the identifier changes every day, which prevents following you from one day to the next.
  • A few account events — sign-up, email verification, adding an item — are recorded from our servers together with your account id. They tell us whether the product works; they store nothing on your device and are not linked to the browsing measurements above.
  • No screenshots, no session recordings, no browser fingerprinting.
  • Data stays hosted in the European Union.

These measurements rest on our legitimate interest in knowing whether the product works. You can object at any time by writing to contact@mycellier.app.

Legal basis

  • Performance of a contract (art. 6.1.b): your account, your pantry, and service emails (address verification, password reset); your Premium subscription, its payment and its emails.
  • Legal obligation (art. 6.1.c): keeping invoices.
  • Legitimate interest (art. 6.1.f): the cookieless audience measurements and the few product events described above.
  • Consent (art. 6.1.a): push notifications, which you grant from your browser and can revoke in the same place.

Processors

We use the following providers:

  • OVHcloud (France) — hosting for the application and the database, plus backups.
  • PostHog Cloud EU — cookieless audience measurement. Requests go to eu.i.posthog.com and eu-assets.i.posthog.com. If you take part in a test, your account identifier is on that feature’s tester list (today, early access to the Premium subscription, not to the emergency supply); the decision is made on our servers, with no request to PostHog while you use the app.
  • Resend (European region) — delivery of service emails. Your email address is passed to them for that purpose only.
  • Stripe Payments Europe, Ltd. (Ireland) — Premium payments, invoices and VAT calculation. Stripe may transfer some data to Stripe, Inc. in the United States; these transfers are covered by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

Every other provider, and its data, is located in the European Union.

Governing law

This policy is governed by French law.

This is a courtesy translation. In case of discrepancy, the French version prevails.